@snovon/solast 0.2.0

package/dist/detectors/steth-transfer-reentrancy.js

@@ -0,0 +1,317 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StethTransferReentrancyDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'steth-transfer-reentrancy';
+const TRANSFER_MEMBERS = new Set(['transfer', 'transferFrom', 'safeTransfer', 'safeTransferFrom']);
+const ASSIGNMENT_OPERATORS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=']);
+const UNARY_MUTATORS = new Set(['++', '--', 'delete']);
+const REENTRANCY_GUARD_RE = /^(nonreentrant|nonreentrantview|noreentrant|reentrancyguard|noreentry|nonreentrantcall)$/i;
+const ACCOUNTING_NAME_RE = /(share|shares|balance|balances|balanceof|supply|pooled|asset|assets|account|debt|borrow|deposit|reserve|cash|collateral|liabilit|accounting)/i;
+const STALE_READ_MEMBER_RE = /^(balanceOf|totalSupply|getPooledEthByShares|getSharesByPooledEth|sharesOf|totalShares)$/i;
+class StethTransferReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        for (const contract of getContracts(ast)) {
+            const kind = String(contract.kind || contract.contractKind || '').toLowerCase();
+            if (kind === 'interface' || kind === 'library')
+                continue;
+            const contractCtx = {
+                contractName: getName(contract) || '<anonymous>',
+                stateVars: collectStateVars(contract),
+            };
+            for (const fn of getFunctions(contract)) {
+                if (!getFunctionBody(fn) || isGuarded(fn))
+                    continue;
+                const mutability = String(fn.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                const ctx = {
+                    ...contractCtx,
+                    functionName: getName(fn) || (fn.isConstructor ? '<constructor>' : '<anonymous>'),
+                    locals: collectLocals(fn),
+                    sawTransfer: false,
+                    staleRead: '',
+                    findingNode: null,
+                };
+                walkInSourceOrder(getFunctionBody(fn), node => this.observeNode(node, ctx));
+                if (ctx.findingNode) {
+                    findings.push(buildFinding(file, ctx, ctx.findingNode));
+                }
+            }
+        }
+        return findings;
+    }
+    observeNode(node, ctx) {
+        if (ctx.findingNode)
+            return 'skip-children';
+        if (isNode(node, 'EmitStatement'))
+            return 'skip-children';
+        if (isVariableDeclarationStatement(node)) {
+            const initialValue = getInitialValue(node);
+            if (ctx.sawTransfer && initialValue && !ctx.staleRead) {
+                ctx.staleRead = describeStaleRead(initialValue, ctx);
+            }
+            for (const name of getVariableDeclarationNames(node)) {
+                if (name)
+                    ctx.locals.add(name);
+            }
+            if (initialValue)
+                this.observeNode(initialValue, ctx);
+            return 'skip-children';
+        }
+        if (isAssignment(node)) {
+            const left = getAssignmentLeft(node);
+            const right = getAssignmentRight(node);
+            if (ctx.sawTransfer && right && !ctx.staleRead) {
+                ctx.staleRead = describeStaleRead(right, ctx);
+            }
+            if (isAccountingStateWrite(left, ctx)) {
+                if (ctx.sawTransfer)
+                    ctx.findingNode = node;
+                return 'skip-children';
+            }
+        }
+        if (isNode(node, 'UnaryOperation') && UNARY_MUTATORS.has(String(node.operator || ''))) {
+            if (isAccountingStateWrite(node.subExpression, ctx)) {
+                if (ctx.sawTransfer)
+                    ctx.findingNode = node;
+                return 'skip-children';
+            }
+        }
+        if (isFunctionCall(node)) {
+            if (ctx.sawTransfer && !ctx.staleRead) {
+                ctx.staleRead = describeStaleRead(node, ctx);
+            }
+            if (isTransferCall(node)) {
+                ctx.sawTransfer = true;
+                return 'skip-children';
+            }
+        }
+    }
+}
+exports.StethTransferReentrancyDetector = StethTransferReentrancyDetector;
+function isTransferCall(call) {
+    const callee = unwrapCallOptions(getCallExpression(call));
+    return isNode(callee, 'MemberAccess') && TRANSFER_MEMBERS.has(getMemberName(callee));
+}
+function isAccountingStateWrite(node, ctx) {
+    const root = getStateRoot(node, ctx.stateVars, ctx.locals);
+    return !!root && ACCOUNTING_NAME_RE.test(root);
+}
+function describeStaleRead(node, ctx) {
+    let read = '';
+    walkInSourceOrder(node, child => {
+        if (read)
+            return 'skip-children';
+        if (isFunctionCall(child)) {
+            const callee = unwrapCallOptions(getCallExpression(child));
+            if (isNode(callee, 'MemberAccess') && STALE_READ_MEMBER_RE.test(getMemberName(callee))) {
+                read = `${getMemberName(callee)}()`;
+                return 'skip-children';
+            }
+        }
+        if (isNode(child, 'Identifier')) {
+            const name = getName(child);
+            if (ctx.stateVars.has(name) && !ctx.locals.has(name) && ACCOUNTING_NAME_RE.test(name)) {
+                read = name;
+                return 'skip-children';
+            }
+        }
+    });
+    return read;
+}
+function collectStateVars(contract) {
+    const vars = new Set();
+    for (const child of childrenOf(contract)) {
+        if (!isStateVariableDeclaration(child))
+            continue;
+        for (const decl of getDeclarationVariables(child)) {
+            const name = getName(decl);
+            if (name)
+                vars.add(name);
+        }
+    }
+    return vars;
+}
+function collectLocals(fn) {
+    const locals = new Set();
+    for (const param of getParameters(fn)) {
+        const name = getName(param);
+        if (name)
+            locals.add(name);
+    }
+    for (const param of getReturnParameters(fn)) {
+        const name = getName(param);
+        if (name)
+            locals.add(name);
+    }
+    return locals;
+}
+function getStateRoot(node, stateVars, locals) {
+    if (!node || typeof node !== 'object')
+        return '';
+    if (isNode(node, 'Identifier')) {
+        const name = getName(node);
+        return stateVars.has(name) && !locals.has(name) ? name : '';
+    }
+    if (isNode(node, 'IndexAccess'))
+        return getStateRoot(node.base ?? node.baseExpression, stateVars, locals);
+    if (isNode(node, 'MemberAccess'))
+        return getStateRoot(node.expression, stateVars, locals);
+    return '';
+}
+function isGuarded(fn) {
+    for (const modifier of fn.modifiers || fn.modifierList || []) {
+        const name = getModifierName(modifier);
+        if (REENTRANCY_GUARD_RE.test(name))
+            return true;
+    }
+    return false;
+}
+function buildFinding(file, ctx, node) {
+    const loc = getLoc(node);
+    const staleReadNote = ctx.staleRead ? ` Stale read observed in the transfer window: ${ctx.staleRead}.` : '';
+    return {
+        file,
+        contract: ctx.contractName,
+        'function': ctx.functionName,
+        line: loc.line,
+        endLine: loc.line,
+        column: loc.column,
+        pattern: RULE_ID,
+        confidence: 'high',
+        ruleId: RULE_ID,
+        severity: 'high',
+        message: `stETH-style transfer reentrancy in '${ctx.contractName}.${ctx.functionName}': token transfer occurs before share/balance accounting is finalized.${staleReadNote}`,
+        contractName: ctx.contractName,
+        functionName: ctx.functionName,
+        sourceLocation: loc,
+        trace: 'token-transfer-before-accounting-write',
+        rationale: 'A callback-capable token transfer can expose stale share, balance, pooled-ether, or supply accounting before the function updates storage.',
+        suggestedFix: 'Apply checks-effects-interactions: update share/balance accounting before transfer or protect the entrypoint with a reentrancy guard.',
+        findingId: '',
+        contractHash: '',
+    };
+}
+function getContracts(ast) {
+    return childrenOf(ast).filter(child => isNode(child, 'ContractDefinition'));
+}
+function getFunctions(contract) {
+    return childrenOf(contract).filter(child => isNode(child, 'FunctionDefinition'));
+}
+function getFunctionBody(fn) {
+    return fn.body || null;
+}
+function isStateVariableDeclaration(node) {
+    return isNode(node, 'StateVariableDeclaration') || (isNode(node, 'VariableDeclaration') && node.stateVariable === true);
+}
+function getDeclarationVariables(node) {
+    if (Array.isArray(node.variables))
+        return node.variables;
+    if (isNode(node, 'VariableDeclaration'))
+        return [node];
+    return [];
+}
+function getParameters(fn) {
+    return fn.parameters?.parameters || fn.parameters || [];
+}
+function getReturnParameters(fn) {
+    return fn.returnParameters?.parameters || fn.returnParameters || [];
+}
+function isVariableDeclarationStatement(node) {
+    return isNode(node, 'VariableDeclarationStatement');
+}
+function getInitialValue(node) {
+    return node.initialValue ?? null;
+}
+function getVariableDeclarationNames(node) {
+    const declarations = node.variables || node.declarations || [];
+    return declarations.map((decl) => getName(decl)).filter(Boolean);
+}
+function isAssignment(node) {
+    return (isNode(node, 'BinaryOperation') || isNode(node, 'Assignment')) && ASSIGNMENT_OPERATORS.has(String(node.operator || ''));
+}
+function getAssignmentLeft(node) {
+    return node.left ?? node.leftHandSide;
+}
+function getAssignmentRight(node) {
+    return node.right ?? node.rightHandSide;
+}
+function isFunctionCall(node) {
+    return isNode(node, 'FunctionCall');
+}
+function getCallExpression(node) {
+    return node.expression;
+}
+function unwrapCallOptions(expr) {
+    if (isNode(expr, 'NameValueExpression') || isNode(expr, 'FunctionCallOptions'))
+        return expr.expression;
+    return expr;
+}
+function getMemberName(node) {
+    return String(node?.memberName || '');
+}
+function getModifierName(modifier) {
+    if (!modifier)
+        return '';
+    if (typeof modifier === 'string')
+        return modifier;
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    if (modifier.name)
+        return getName(modifier.name);
+    if (modifier.modifierName)
+        return getName(modifier.modifierName);
+    return '';
+}
+function getLoc(node) {
+    const { line, column } = (0, ast_1.assertLoc)(node);
+    return { line, column };
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function getName(node) {
+    return String(node?.name || node?.namePath || '');
+}
+function walkInSourceOrder(node, visitor) {
+    if (!node || typeof node !== 'object')
+        return;
+    const result = visitor(node);
+    if (result === 'skip-children')
+        return;
+    for (const child of childrenOf(node))
+        walkInSourceOrder(child, visitor);
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const children = [];
+    for (const key of childKeys(node)) {
+        const value = node[key];
+        if (Array.isArray(value)) {
+            children.push(...value.filter(item => item && typeof item === 'object'));
+        }
+        else if (value && typeof value === 'object') {
+            children.push(value);
+        }
+    }
+    return children;
+}
+function childKeys(node) {
+    const preferred = [
+        'children', 'nodes', 'subNodes', 'statements', 'expression', 'initialValue',
+        'left', 'right', 'leftHandSide', 'rightHandSide', 'base', 'baseExpression',
+        'index', 'indexExpression', 'arguments', 'declarations', 'variables',
+        'components', 'subExpression', 'condition', 'trueBody', 'falseBody',
+        'body', 'block', 'catchClauses', 'returnParameters',
+    ];
+    return preferred.filter(key => Object.prototype.hasOwnProperty.call(node, key));
+}
+//# sourceMappingURL=steth-transfer-reentrancy.js.map

package/dist/detectors/storage-collision-malicious-proposal.d.ts

@@ -0,0 +1,27 @@
+import type { ScanResult } from '../index';
+export declare class StorageCollisionMaliciousProposalDetector {
+    readonly id = "storage-collision-malicious-proposal";
+    readonly patternKey = "storage-collision-malicious-proposal";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+    private firstCollisionFinding;
+    private collectContracts;
+    private computeLayout;
+    private typeSize;
+    private collectWritableSlots;
+    private writtenRoot;
+    private collectDelegatecallPaths;
+    private isExternallyCallable;
+    private isProposalControlledDelegatecall;
+    private collectStorageAliases;
+    private delegatecall;
+    private isProposalMember;
+    private isProposalLikeStorageRead;
+    private containsParam;
+    private rootIdentifier;
+    private expressionToString;
+    private callToString;
+    private sourceSnippet;
+    private walk;
+    private locOf;
+}