@snovon/solast 0.2.0

package/dist/detectors/staked-rate-as-oracle.js

@@ -0,0 +1,497 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StakedRateAsOracleDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'staked-rate-as-oracle';
+const RATE_METHODS = new Set([
+    'getRate',
+    'exchangeRate',
+    'exchangeRateStored',
+    'exchangeRateCurrent',
+    'convertToAssets',
+    'convertToShares',
+    'pricePerShare',
+    'getPooledEthByShares',
+]);
+const PRICE_CONTEXT_RE = /price|rate|collateral|borrow|debt|liquidat|ltv|valuation/i;
+const LENDING_FUNCTION_RE = /price|assetprice|latestanswer|latestRoundData|peek|borrow|collateral|liquidat|ltv|valuation/i;
+const INDEPENDENT_PRICE_RE = /price|answer|oracle|feed|twap|median|reference|ref/i;
+const MIN_RE = /\bmin|minrate|floor/i;
+const MAX_RE = /\bmax|maxrate|cap|ceiling/i;
+class StakedRateAsOracleDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            if (contract.kind === 'interface' || contract.kind === 'library')
+                continue;
+            for (const sub of contract.subNodes || []) {
+                if (sub?.type !== 'FunctionDefinition')
+                    continue;
+                if (!sub.body)
+                    continue;
+                findings.push(...this.analyzeFunction(file, contract, sub));
+            }
+        }
+        return findings;
+    }
+    analyzeFunction(file, contract, fn) {
+        const body = fn.body;
+        const reads = this.collectRateReads(body);
+        if (reads.length === 0)
+            return [];
+        const independentNames = this.collectIndependentOracleNames(body);
+        const freshnessChecked = this.hasFreshnessCheck(body);
+        const functionName = fn.name || '<anonymous>';
+        const findings = [];
+        for (const read of reads) {
+            if (this.isBalancerWeightedPoolRateRead(read, body))
+                continue;
+            const tainted = this.propagateTaint(body, read.assignedNames);
+            if (!this.hasContextualSink(read, tainted, body, functionName))
+                continue;
+            if (this.hasLocalSafeguard(tainted, body, independentNames, freshnessChecked, read))
+                continue;
+            findings.push(this.buildFinding(file, contract, functionName, read));
+        }
+        return findings;
+    }
+    propagateTaint(body, seeds) {
+        const tainted = new Set(seeds);
+        let changed = true;
+        while (changed) {
+            changed = false;
+            this.walk(body, node => {
+                if (!node || typeof node !== 'object')
+                    return;
+                if (node.type === 'VariableDeclarationStatement' && node.initialValue) {
+                    const initNames = this.collectIdentifiers(node.initialValue);
+                    if (initNames.some(n => tainted.has(n))) {
+                        for (const v of node.variables || []) {
+                            if (v?.name && !tainted.has(v.name)) {
+                                tainted.add(v.name);
+                                changed = true;
+                            }
+                        }
+                    }
+                }
+                if (node.type === 'BinaryOperation' && this.isAssignmentOperator(node.operator)) {
+                    const rightNames = this.collectIdentifiers(node.right);
+                    if (rightNames.some(n => tainted.has(n))) {
+                        for (const name of this.collectIdentifiers(node.left)) {
+                            if (!tainted.has(name)) {
+                                tainted.add(name);
+                                changed = true;
+                            }
+                        }
+                    }
+                }
+            });
+        }
+        return tainted;
+    }
+    hasContextualSink(read, tainted, body, functionName) {
+        for (const name of tainted) {
+            if (PRICE_CONTEXT_RE.test(name))
+                return true;
+            if (this.hasPricingArithmetic(body, name))
+                return true;
+            if (LENDING_FUNCTION_RE.test(functionName) && this.returnUsesName(body, name))
+                return true;
+            if (this.taintedInGuardSink(name, body))
+                return true;
+        }
+        if (LENDING_FUNCTION_RE.test(functionName) && this.isReturned(body, read.node))
+            return true;
+        if (this.hasInlinePricingArithmetic(body, read.node))
+            return true;
+        return false;
+    }
+    taintedInGuardSink(name, body) {
+        let found = false;
+        this.walk(body, node => {
+            if (found || !node || typeof node !== 'object')
+                return;
+            const condition = this.guardCondition(node);
+            if (!condition)
+                return;
+            const condNames = this.collectIdentifiers(condition);
+            if (condNames.includes(name)) {
+                found = condNames.some(other => other !== name && PRICE_CONTEXT_RE.test(other));
+            }
+        });
+        return found;
+    }
+    hasLocalSafeguard(tainted, body, independentNames, freshnessChecked, read) {
+        const names = [...tainted];
+        if (names.some(name => this.hasTwoSidedClamp(body, name)))
+            return true;
+        if (freshnessChecked && names.some(name => this.hasDeviationBound(body, name, independentNames)))
+            return true;
+        if (freshnessChecked && this.hasDeviationBoundForCall(body, read.node, independentNames))
+            return true;
+        return false;
+    }
+    buildFinding(file, contract, functionName, read) {
+        const { line, column, endLine } = (0, ast_1.assertLoc)(read.node);
+        return {
+            file,
+            contract: contract?.name || '<anonymous>',
+            'function': functionName,
+            line,
+            endLine,
+            column,
+            pattern: RULE_ID,
+            confidence: 'medium',
+            ruleId: RULE_ID,
+            severity: 'high',
+            message: `LRT/yield-bearing rate '${read.receiver}.${read.method}()' influences collateral, borrow, liquidation, or price-feed logic without a local freshness, bounds, clamp, or independent sanity check.`,
+            contractName: contract?.name || '<anonymous>',
+            functionName,
+            sourceLocation: { line, column },
+            trace: 'unchecked-rate-provider-price-input',
+            findingId: '',
+            contractHash: '',
+        };
+    }
+    collectRateReads(body) {
+        const reads = [];
+        this.walkWithParent(body, (node, parent) => {
+            if (!this.isRateCall(node))
+                return;
+            reads.push({
+                node,
+                method: node.expression.memberName,
+                receiver: this.receiverText(node.expression.expression),
+                assignedNames: this.assignedNamesForCall(node, parent),
+            });
+        });
+        return reads;
+    }
+    isBalancerWeightedPoolRateRead(read, body) {
+        if (read.method !== 'getRate')
+            return false;
+        let hasWeightedPoolContext = false;
+        this.walk(body, node => {
+            if (hasWeightedPoolContext || !node || node.type !== 'FunctionCall')
+                return;
+            const expr = this.unwrapCallOptions(node.expression);
+            if (!expr || expr.type !== 'MemberAccess')
+                return;
+            const method = expr.memberName || '';
+            hasWeightedPoolContext = (method === 'getNormalizedWeights' || method === 'getInvariant') &&
+                this.receiverText(expr.expression) === read.receiver;
+        });
+        return hasWeightedPoolContext;
+    }
+    isRateCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return false;
+        const expr = this.unwrapCallOptions(node.expression);
+        if (!expr || expr.type !== 'MemberAccess')
+            return false;
+        return RATE_METHODS.has(expr.memberName || '');
+    }
+    assignedNamesForCall(call, parent) {
+        const names = new Set();
+        if (!parent || typeof parent !== 'object')
+            return names;
+        if (parent.type === 'VariableDeclarationStatement' && parent.initialValue === call) {
+            for (const variable of parent.variables || []) {
+                if (variable?.name)
+                    names.add(variable.name);
+            }
+        }
+        if (parent.type === 'BinaryOperation' && parent.operator === '=' && parent.right === call) {
+            this.collectIdentifiers(parent.left).forEach(name => names.add(name));
+        }
+        return names;
+    }
+    collectIndependentOracleNames(body) {
+        const names = new Set();
+        this.walk(body, node => {
+            if (!node || node.type !== 'VariableDeclarationStatement')
+                return;
+            const init = node.initialValue;
+            if (!init || init.type !== 'FunctionCall')
+                return;
+            const method = this.memberName(init.expression);
+            if (method === 'latestRoundData') {
+                const vars = node.variables || [];
+                for (const index of [1, 3]) {
+                    const variable = vars[index];
+                    if (variable?.name)
+                        names.add(variable.name);
+                }
+            }
+            else if (method === 'latestAnswer' || method === 'getPrice' || method === 'getAssetPrice' || method === 'peek') {
+                for (const variable of node.variables || []) {
+                    if (variable?.name)
+                        names.add(variable.name);
+                }
+            }
+        });
+        return names;
+    }
+    hasFreshnessCheck(body) {
+        let hasFreshness = false;
+        this.walk(body, node => {
+            if (hasFreshness || !node || typeof node !== 'object')
+                return;
+            const condition = this.guardCondition(node);
+            if (!condition)
+                return;
+            const names = this.collectIdentifiers(condition).join(' ');
+            hasFreshness = /updatedAt|updated_at|timestamp|publishTime|publish_time/i.test(names) &&
+                this.containsBlockTimestamp(condition) &&
+                this.containsComparison(condition);
+        });
+        return hasFreshness;
+    }
+    hasDeviationBound(body, rateName, independentNames) {
+        if (independentNames.size === 0)
+            return false;
+        let bounded = false;
+        this.walk(body, node => {
+            if (bounded || !node || typeof node !== 'object')
+                return;
+            const condition = this.guardCondition(node);
+            if (!condition)
+                return;
+            bounded = this.conditionHasDeviationBound(condition, rateName, independentNames);
+        });
+        return bounded;
+    }
+    hasDeviationBoundForCall(body, call, independentNames) {
+        if (independentNames.size === 0)
+            return false;
+        let bounded = false;
+        this.walk(body, node => {
+            if (bounded || !node || typeof node !== 'object')
+                return;
+            const condition = this.guardCondition(node);
+            if (!condition)
+                return;
+            this.walk(condition, child => {
+                if (bounded || !this.isComparison(child))
+                    return;
+                const names = this.collectIdentifiers(child);
+                bounded = this.containsNode(child, call) && names.some(name => independentNames.has(name) || INDEPENDENT_PRICE_RE.test(name));
+            });
+        });
+        return bounded;
+    }
+    conditionHasDeviationBound(condition, rateName, independentNames) {
+        let found = false;
+        this.walk(condition, node => {
+            if (found || !this.isComparison(node))
+                return;
+            const names = this.collectIdentifiers(node);
+            found = names.includes(rateName) &&
+                names.some(name => independentNames.has(name) || INDEPENDENT_PRICE_RE.test(name)) &&
+                !this.isZeroOnlyComparison(node, rateName);
+        });
+        return found;
+    }
+    hasTwoSidedClamp(body, rateName) {
+        let lower = false;
+        let upper = false;
+        this.walk(body, node => {
+            if (!node || node.type !== 'IfStatement')
+                return;
+            const conditionNames = this.collectIdentifiers(node.condition);
+            if (!conditionNames.includes(rateName))
+                return;
+            const assigned = this.assignmentToName(node.trueBody, rateName);
+            if (!assigned)
+                return;
+            const assignedNames = this.collectIdentifiers(assigned);
+            const conditionText = conditionNames.join(' ');
+            const assignedText = assignedNames.join(' ');
+            if (MAX_RE.test(`${conditionText} ${assignedText}`))
+                upper = true;
+            if (MIN_RE.test(`${conditionText} ${assignedText}`))
+                lower = true;
+        });
+        return lower && upper;
+    }
+    assignmentToName(node, name) {
+        let assigned = null;
+        this.walk(node, child => {
+            if (assigned || !child || child.type !== 'BinaryOperation' || child.operator !== '=')
+                return;
+            const leftNames = this.collectIdentifiers(child.left);
+            if (leftNames.length === 1 && leftNames[0] === name)
+                assigned = child.right;
+        });
+        return assigned;
+    }
+    hasPricingArithmetic(body, rateName) {
+        let found = false;
+        this.walk(body, node => {
+            if (found || !this.isMultiplicative(node))
+                return;
+            const names = this.collectIdentifiers(node);
+            found = names.includes(rateName) && names.some(name => name !== rateName && PRICE_CONTEXT_RE.test(name));
+        });
+        return found;
+    }
+    hasInlinePricingArithmetic(body, call) {
+        let found = false;
+        this.walk(body, node => {
+            if (found || !this.isMultiplicative(node))
+                return;
+            const names = this.collectIdentifiers(node);
+            found = this.containsNode(node, call) && names.some(name => PRICE_CONTEXT_RE.test(name));
+        });
+        return found;
+    }
+    returnUsesName(body, name) {
+        let used = false;
+        this.walk(body, node => {
+            if (used || node?.type !== 'ReturnStatement')
+                return;
+            used = this.collectIdentifiers(node.expression).includes(name);
+        });
+        return used;
+    }
+    isReturned(body, target) {
+        let returned = false;
+        this.walk(body, node => {
+            if (returned || node?.type !== 'ReturnStatement')
+                return;
+            returned = this.containsNode(node.expression, target);
+        });
+        return returned;
+    }
+    guardCondition(node) {
+        if (node.type === 'FunctionCall') {
+            const name = this.memberName(node.expression);
+            if (name === 'require' || name === 'assert')
+                return (node.arguments || [])[0] || null;
+        }
+        if (node.type === 'IfStatement')
+            return node.condition || null;
+        return null;
+    }
+    isComparison(node) {
+        return node?.type === 'BinaryOperation' && ['<', '<=', '>', '>='].includes(node.operator);
+    }
+    containsComparison(node) {
+        if (this.isComparison(node))
+            return true;
+        return this.children(node).some(child => this.containsComparison(child));
+    }
+    isMultiplicative(node) {
+        return node?.type === 'BinaryOperation' && (node.operator === '*' || node.operator === '/');
+    }
+    isAssignmentOperator(operator) {
+        return ['=', '+=', '-=', '*=', '/=', '%='].includes(operator);
+    }
+    isZeroOnlyComparison(node, rateName) {
+        if (!this.isComparison(node))
+            return false;
+        const names = this.collectIdentifiers(node);
+        return names.length === 1 && names[0] === rateName && this.containsZeroLiteral(node);
+    }
+    containsZeroLiteral(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'NumberLiteral' && String(node.number || '') === '0')
+            return true;
+        return this.children(node).some(child => this.containsZeroLiteral(child));
+    }
+    containsBlockTimestamp(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess' &&
+            node.memberName === 'timestamp' &&
+            node.expression?.type === 'Identifier' &&
+            node.expression.name === 'block') {
+            return true;
+        }
+        return this.children(node).some(child => this.containsBlockTimestamp(child));
+    }
+    memberName(expr) {
+        const unwrapped = this.unwrapCallOptions(expr);
+        if (!unwrapped || typeof unwrapped !== 'object')
+            return '';
+        if (unwrapped.type === 'MemberAccess')
+            return unwrapped.memberName || '';
+        if (unwrapped.type === 'Identifier')
+            return unwrapped.name || '';
+        return '';
+    }
+    unwrapCallOptions(expr) {
+        return expr?.type === 'FunctionCallOptions' ? expr.expression : expr;
+    }
+    receiverText(node) {
+        if (!node || typeof node !== 'object')
+            return '<unknown>';
+        if (node.type === 'Identifier')
+            return node.name || '<unknown>';
+        if (node.type === 'MemberAccess')
+            return `${this.receiverText(node.expression)}.${node.memberName || '<member>'}`;
+        return '<expression>';
+    }
+    collectIdentifiers(node) {
+        const names = [];
+        this.walk(node, child => {
+            if (child?.type === 'Identifier' && child.name)
+                names.push(child.name);
+            if (child?.type === 'MemberAccess' && child.memberName)
+                names.push(child.memberName);
+        });
+        return names;
+    }
+    containsNode(root, target) {
+        if (!root || !target)
+            return false;
+        if (root === target)
+            return true;
+        return this.children(root).some(child => this.containsNode(child, target));
+    }
+    walk(node, visit) {
+        if (!node || typeof node !== 'object')
+            return;
+        visit(node);
+        for (const child of this.children(node)) {
+            this.walk(child, visit);
+        }
+    }
+    walkWithParent(node, visit, parent = null) {
+        if (!node || typeof node !== 'object')
+            return;
+        visit(node, parent);
+        for (const child of this.children(node)) {
+            this.walkWithParent(child, visit, node);
+        }
+    }
+    children(node) {
+        if (!node || typeof node !== 'object')
+            return [];
+        const out = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'type')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        out.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                out.push(value);
+            }
+        }
+        return out;
+    }
+}
+exports.StakedRateAsOracleDetector = StakedRateAsOracleDetector;
+//# sourceMappingURL=staked-rate-as-oracle.js.map

package/dist/detectors/stale-oracle.d.ts

@@ -0,0 +1,63 @@
+import type { ScanResult } from '../index';
+export declare class StaleOracleDetector {
+    readonly id = "oracle-staleness";
+    readonly patternKey = "oracle-staleness";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    private findings;
+    private currentFile;
+    private currentContract;
+    private currentFunction;
+    private functionStack;
+    private seen;
+    private contractConstants;
+    private structMembers;
+    private currentAst;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    SourceUnit(node: any): void;
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(_node: any): void;
+    StateVariableDeclaration(node: any): void;
+    StructDefinition(node: any): void;
+    private recordConstantDeclaration;
+    FunctionDefinition(node: any): void;
+    FunctionDefinition_post(_node: any): void;
+    private recordFinding;
+    private collectOracleReads;
+    private bodyFreshnessStatusForName;
+    private freshnessExpressionStatus;
+    private staleRevertExpressionStatus;
+    private boundedAgePredicateStatus;
+    private isComparisonOperator;
+    private unwrapParens;
+    private isRequireOrAssert;
+    private isTimestampRef;
+    private isBlockTimestampRef;
+    private getTimestampMinusThreshold;
+    private getTimestampPlusThreshold;
+    private isBlockTimestampMinusName;
+    private thresholdStatus;
+    private thresholdSeconds;
+    private thresholdSecondsFromLiteral;
+    private getCalleeMemberName;
+    private isLatestRoundDataCall;
+    private isSequencerUptimeRead;
+    private isCustomTupleOracleCall;
+    private timestampedStructOracleRead;
+    private getBindingFromVariables;
+    private getPriceBindingFromVariables;
+    private getTimestampBindingFromVariables;
+    private getPriceBindingFromReturnNames;
+    private getTimestampBindingFromReturnNames;
+    private getBindingByReturnName;
+    private typeNameToStructName;
+    private isPriceLikeField;
+    private isTimestampLikeField;
+    private getBindingFromTuple;
+    private bodyUsesIdentifier;
+    private statementContainsRevert;
+    private displayTimestampName;
+    private expressionToText;
+    private walk;
+    private childNodes;
+}