@snovon/solast 0.2.0

package/dist/detectors/unchecked-external-call.d.ts

@@ -0,0 +1,66 @@
+import type { ScanResult } from '../index';
+export interface Candidate {
+    stmtNode?: any;
+    callName: string;
+    loc: {
+        line: number;
+        column: number;
+    };
+    checkedVar: string | null;
+    dataVars: Set<string>;
+    insideLoop: boolean;
+}
+export declare class UncheckedExternalCallDetector {
+    readonly id: string;
+    readonly patternKey: string;
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "medium";
+        help: string;
+    };
+    private currentFile;
+    private currentAst;
+    private currentContract;
+    private findings;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    SourceUnit(node: any): void;
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(_node: any): void;
+    ['ContractDefinition:exit'](node: any): void;
+    FunctionDefinition(node: any): void;
+    protected analyzeFunction(file: string, ast: any, contract: any, fn: any): ScanResult[];
+    protected collectCandidates(node: any, ast: any, candidates: Candidate[], insideLoop: boolean): void;
+    protected collectReturnInfo(node: any, returnedVars: Set<string>, markReturn: () => void): void;
+    protected isForwardingWrapperCandidate(candidate: Candidate, returnedVars: Set<string>, hasReturnExpression: boolean): boolean;
+    protected collectValidatedVariables(node: any, validations: Set<string>): void;
+    protected revertingFailureCheck(node: any): string | null;
+    protected containsRevert(node: any): boolean;
+    protected checkedIdentifier(expr: any): string | null;
+    protected collectCheckedIdentifiers(expr: any, validations: Set<string>): void;
+    protected collectReturnedSuccessIdentifiers(expr: any, validations: Set<string>, inConjunction: boolean): void;
+    protected assignedSuccessName(left: any, callNode: any, callName: string, ast: any): string | null;
+    protected firstVariableName(variables: any[]): string | null;
+    protected dataVariableNames(callNode: any, variables: any[], ast: any): Set<string>;
+    protected assignedDataNames(left: any, callNode: any, ast: any): Set<string>;
+    protected successVariableName(callNode: any, variables: any[], callName: string, fallback: string | null, ast: any): string | null;
+    protected tupleComponentByReturnName(left: any, callNode: any, ast: any, slotNames: string[], fallbackIndex: number): any;
+    protected asLowLevelCall(node: any): {
+        node: any;
+        callName: string;
+    } | null;
+    protected lowLevelMemberName(expr: any): string | null;
+    protected directCallName(expr: any): string | null;
+    protected identifierName(expr: any): string | null;
+    protected collectIdentifiers(node: any, out: Set<string>): void;
+    protected hasAny(haystack: Set<string>, needles: Set<string>): boolean;
+    protected locOf(node: any): {
+        line: number;
+        column: number;
+    };
+    protected isLoop(node: any): boolean;
+    protected childNodes(node: any): any[];
+}

package/dist/detectors/unchecked-external-call.js

@@ -0,0 +1,389 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UncheckedExternalCallDetector = void 0;
+const resolve_return_names_1 = require("../ast/resolve-return-names");
+const ast_1 = require("./_common/ast");
+const loop_call_stack_1 = require("./_common/loop-call-stack");
+const RULE_ID = 'unchecked-external-call';
+const PATTERN = `${RULE_ID}/unchecked-return-value`;
+const LOW_LEVEL_CALLS = new Set(['call', 'delegatecall', 'staticcall', 'send']);
+class UncheckedExternalCallDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'Low-level external calls should validate the boolean success return value.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'medium',
+        help: 'Capture and check the success result from call, delegatecall, staticcall, or send before continuing, or explicitly return the success value to the caller.',
+    };
+    currentFile = '';
+    currentAst = null;
+    currentContract = null;
+    findings = [];
+    setFile(file) {
+        this.currentFile = file;
+        this.currentAst = null;
+        this.currentContract = null;
+        this.findings = [];
+    }
+    getFindings() {
+        return this.findings;
+    }
+    SourceUnit(node) {
+        this.currentAst = node;
+    }
+    ContractDefinition(node) {
+        this.currentContract = node?.kind === 'interface' ? null : node;
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = null;
+    }
+    ['ContractDefinition:exit'](node) {
+        this.ContractDefinition_post(node);
+    }
+    FunctionDefinition(node) {
+        if (!this.currentAst || !this.currentContract || !node?.body)
+            return;
+        this.findings.push(...this.analyzeFunction(this.currentFile, this.currentAst, this.currentContract, node));
+    }
+    analyzeFunction(file, ast, contract, fn) {
+        const validations = new Set();
+        this.collectValidatedVariables(fn.body, validations);
+        const returnedVars = new Set();
+        let hasReturnExpression = false;
+        this.collectReturnInfo(fn.body, returnedVars, () => { hasReturnExpression = true; });
+        const candidates = [];
+        this.collectCandidates(fn.body, ast, candidates, false);
+        return candidates
+            .filter((candidate) => !this.isForwardingWrapperCandidate(candidate, returnedVars, hasReturnExpression))
+            .filter((candidate) => !candidate.checkedVar || !validations.has(candidate.checkedVar))
+            .map((candidate) => {
+            const finding = {
+                file,
+                contract: contract.name || '<anonymous>',
+                'function': fn.name || (fn.isConstructor ? '<constructor>' : '<anonymous>'),
+                line: candidate.loc.line,
+                column: candidate.loc.column,
+                ruleId: RULE_ID,
+                pattern: PATTERN,
+                severity: 'medium',
+                confidence: 'high',
+                category: 'vulnerability',
+                message: `Unchecked external ${candidate.callName} return value: validate the boolean success result before continuing.`,
+                findingId: '',
+                contractHash: '',
+            };
+            if (candidate.insideLoop) {
+                (0, loop_call_stack_1.enrichLoopCallStack)(finding, (0, loop_call_stack_1.loopCallPathForFunction)(contract, fn));
+            }
+            return finding;
+        });
+    }
+    collectCandidates(node, ast, candidates, insideLoop) {
+        if (!node || typeof node !== 'object')
+            return;
+        const nestedInsideLoop = insideLoop || this.isLoop(node);
+        if (node.type === 'VariableDeclarationStatement') {
+            const call = this.asLowLevelCall(node.initialValue);
+            if (call) {
+                const checkedVar = this.firstVariableName(node.variables);
+                candidates.push({
+                    callName: call.callName,
+                    loc: this.locOf(call.node),
+                    checkedVar: this.successVariableName(call.node, node.variables, call.callName, checkedVar, ast),
+                    dataVars: this.dataVariableNames(call.node, node.variables, ast),
+                    insideLoop: nestedInsideLoop,
+                    stmtNode: node,
+                });
+            }
+            return;
+        }
+        if (node.type === 'ExpressionStatement') {
+            const expr = node.expression;
+            const directCall = this.asLowLevelCall(expr);
+            if (directCall) {
+                candidates.push({
+                    callName: directCall.callName,
+                    loc: this.locOf(directCall.node),
+                    checkedVar: null,
+                    dataVars: new Set(),
+                    insideLoop: nestedInsideLoop,
+                    stmtNode: node,
+                });
+                return;
+            }
+            if (expr?.type === 'BinaryOperation' && expr.operator === '=') {
+                const call = this.asLowLevelCall(expr.right);
+                if (call) {
+                    candidates.push({
+                        callName: call.callName,
+                        loc: this.locOf(call.node),
+                        checkedVar: this.assignedSuccessName(expr.left, call.node, call.callName, ast),
+                        dataVars: this.assignedDataNames(expr.left, call.node, ast),
+                        insideLoop: nestedInsideLoop,
+                        stmtNode: node,
+                    });
+                    return;
+                }
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectCandidates(child, ast, candidates, nestedInsideLoop);
+        }
+    }
+    collectReturnInfo(node, returnedVars, markReturn) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'ReturnStatement' && node.expression) {
+            markReturn();
+            this.collectIdentifiers(node.expression, returnedVars);
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectReturnInfo(child, returnedVars, markReturn);
+        }
+    }
+    isForwardingWrapperCandidate(candidate, returnedVars, hasReturnExpression) {
+        if (candidate.callName === 'send') {
+            if (!candidate.checkedVar)
+                return false;
+            return hasReturnExpression;
+        }
+        return this.hasAny(returnedVars, candidate.dataVars);
+    }
+    collectValidatedVariables(node, validations) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'FunctionCall') {
+            const directName = this.directCallName(node.expression);
+            if (directName === 'require' || directName === 'assert') {
+                this.collectCheckedIdentifiers(node.arguments?.[0], validations);
+            }
+            if (directName === 'verifyCallResult' && node.arguments?.[0]) {
+                const checked = this.checkedIdentifier(node.arguments[0]);
+                if (checked)
+                    validations.add(checked);
+            }
+            else if ((directName === 'verify' ||
+                directName === 'verifyCallResultFromTarget' ||
+                directName === '_revert') &&
+                node.arguments?.[1]) {
+                const checked = this.checkedIdentifier(node.arguments[1]);
+                if (checked)
+                    validations.add(checked);
+            }
+        }
+        if (node.type === 'IfStatement') {
+            const checked = this.revertingFailureCheck(node);
+            if (checked)
+                validations.add(checked);
+        }
+        if (node.type === 'ReturnStatement') {
+            this.collectReturnedSuccessIdentifiers(node.expression, validations, false);
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectValidatedVariables(child, validations);
+        }
+    }
+    revertingFailureCheck(node) {
+        const condition = node.condition;
+        if (condition?.type !== 'UnaryOperation' || condition.operator !== '!')
+            return null;
+        const checked = this.identifierName(condition.subExpression);
+        if (!checked)
+            return null;
+        return this.containsRevert(node.trueBody) ? checked : null;
+    }
+    containsRevert(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'RevertStatement')
+            return true;
+        if (node.type === 'FunctionCall' && this.directCallName(node.expression) === 'revert')
+            return true;
+        return this.childNodes(node).some((child) => this.containsRevert(child));
+    }
+    checkedIdentifier(expr) {
+        const direct = this.identifierName(expr);
+        if (direct)
+            return direct;
+        if (expr?.type === 'UnaryOperation' && expr.operator === '!') {
+            return this.identifierName(expr.subExpression);
+        }
+        if (expr?.type === 'BinaryOperation' && (expr.operator === '==' || expr.operator === '!=')) {
+            return this.identifierName(expr.left) || this.identifierName(expr.right);
+        }
+        return null;
+    }
+    collectCheckedIdentifiers(expr, validations) {
+        const direct = this.checkedIdentifier(expr);
+        if (direct) {
+            validations.add(direct);
+            return;
+        }
+        if (expr?.type === 'BinaryOperation' && expr.operator === '&&') {
+            this.collectCheckedIdentifiers(expr.left, validations);
+            this.collectCheckedIdentifiers(expr.right, validations);
+        }
+    }
+    collectReturnedSuccessIdentifiers(expr, validations, inConjunction) {
+        const direct = this.identifierName(expr);
+        if (direct) {
+            validations.add(direct);
+            return;
+        }
+        if (expr?.type === 'BinaryOperation' && expr.operator === '&&') {
+            this.collectReturnedSuccessIdentifiers(expr.left, validations, true);
+            this.collectReturnedSuccessIdentifiers(expr.right, validations, true);
+        }
+    }
+    assignedSuccessName(left, callNode, callName, ast) {
+        if (left?.type === 'TupleExpression') {
+            return this.identifierName(this.tupleComponentByReturnName(left, callNode, ast, ['success', 'ok'], 0));
+        }
+        if (callName === 'send') {
+            return this.identifierName(left);
+        }
+        return null;
+    }
+    firstVariableName(variables) {
+        if (!Array.isArray(variables) || variables.length === 0)
+            return null;
+        const first = variables[0];
+        return first?.name || first?.identifier?.name || null;
+    }
+    dataVariableNames(callNode, variables, ast) {
+        const names = new Set();
+        if (!Array.isArray(variables))
+            return names;
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (returnNames) {
+            for (let i = 0; i < returnNames.length; i++) {
+                const slot = returnNames[i]?.toLowerCase();
+                if (slot !== 'data' && slot !== 'returndata')
+                    continue;
+                const name = variables[i]?.name || variables[i]?.identifier?.name || null;
+                if (name)
+                    names.add(name);
+            }
+            if (names.size > 0)
+                return names;
+        }
+        for (let i = 1; i < variables.length; i++) {
+            const name = variables[i]?.name || variables[i]?.identifier?.name || null;
+            if (name)
+                names.add(name);
+        }
+        return names;
+    }
+    assignedDataNames(left, callNode, ast) {
+        const names = new Set();
+        if (left?.type !== 'TupleExpression')
+            return names;
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (returnNames) {
+            for (let i = 0; i < returnNames.length; i++) {
+                const slot = returnNames[i]?.toLowerCase();
+                if (slot !== 'data' && slot !== 'returndata')
+                    continue;
+                const name = this.identifierName(left.components?.[i]);
+                if (name)
+                    names.add(name);
+            }
+            if (names.size > 0)
+                return names;
+        }
+        for (let i = 1; i < (left.components || []).length; i++) {
+            const name = this.identifierName(left.components[i]);
+            if (name)
+                names.add(name);
+        }
+        return names;
+    }
+    successVariableName(callNode, variables, callName, fallback, ast) {
+        if (callName === 'send')
+            return fallback;
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (!returnNames)
+            return fallback;
+        const index = returnNames.findIndex(name => name === 'success' || name === 'ok');
+        if (index < 0)
+            return fallback;
+        return variables[index]?.name || variables[index]?.identifier?.name || fallback;
+    }
+    tupleComponentByReturnName(left, callNode, ast, slotNames, fallbackIndex) {
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (returnNames) {
+            const index = returnNames.findIndex(name => !!name && slotNames.includes(name.toLowerCase()));
+            if (index >= 0)
+                return left.components?.[index];
+        }
+        return left.components?.[fallbackIndex];
+    }
+    asLowLevelCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return null;
+        const callName = this.lowLevelMemberName(node.expression);
+        return callName ? { node, callName } : null;
+    }
+    lowLevelMemberName(expr) {
+        if (!expr)
+            return null;
+        if (expr.type === 'MemberAccess' && LOW_LEVEL_CALLS.has(expr.memberName)) {
+            return expr.memberName;
+        }
+        if (expr.type === 'NameValueExpression' || expr.type === 'FunctionCallOptions') {
+            return this.lowLevelMemberName(expr.expression);
+        }
+        return null;
+    }
+    directCallName(expr) {
+        return expr?.type === 'Identifier' ? expr.name : null;
+    }
+    identifierName(expr) {
+        return expr?.type === 'Identifier' ? expr.name : null;
+    }
+    collectIdentifiers(node, out) {
+        if (!node || typeof node !== 'object')
+            return;
+        const name = this.identifierName(node);
+        if (name)
+            out.add(name);
+        for (const child of this.childNodes(node))
+            this.collectIdentifiers(child, out);
+    }
+    hasAny(haystack, needles) {
+        for (const needle of needles) {
+            if (haystack.has(needle))
+                return true;
+        }
+        return false;
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    isLoop(node) {
+        return node?.type === 'ForStatement' || node?.type === 'WhileStatement' || node?.type === 'DoWhileStatement';
+    }
+    childNodes(node) {
+        const children = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        children.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                children.push(value);
+            }
+        }
+        return children;
+    }
+}
+exports.UncheckedExternalCallDetector = UncheckedExternalCallDetector;
+//# sourceMappingURL=unchecked-external-call.js.map

package/dist/detectors/unchecked-oft-return.d.ts

@@ -0,0 +1,13 @@
+import type { ScanResult } from '../index';
+export declare class UncheckedOftReturnDetector {
+    readonly id = "unchecked-oft-return";
+    readonly patternKey = "unchecked-oft-return";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string): ScanResult[];
+    private collectDiscardedCalls;
+    private asOftSendFamilyCall;
+    private callName;
+    private makeFinding;
+    private locOf;
+    private childNodes;
+}

package/dist/detectors/unchecked-oft-return.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UncheckedOftReturnDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'unchecked-oft-return';
+const PATTERN = `${RULE_ID}/discarded-return-value`;
+const SEND_FAMILY = new Set(['send', 'sendFrom', '_lzSend', '_lzSendDeep']);
+const MIN_ARGS = {
+    send: 3,
+    sendFrom: 4,
+    _lzSend: 4,
+    _lzSendDeep: 4,
+};
+class UncheckedOftReturnDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            if (contract.kind === 'interface' || contract.kind === 'library')
+                continue;
+            for (const subNode of contract.subNodes || []) {
+                if (subNode?.type !== 'FunctionDefinition' || !subNode.body)
+                    continue;
+                this.collectDiscardedCalls(subNode.body, file, contract, subNode, findings);
+            }
+        }
+        return findings;
+    }
+    collectDiscardedCalls(node, file, contract, fn, findings) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'ExpressionStatement') {
+            const match = this.asOftSendFamilyCall(node.expression);
+            if (match) {
+                findings.push(this.makeFinding(file, contract, fn, match));
+                return;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectDiscardedCalls(child, file, contract, fn, findings);
+        }
+    }
+    asOftSendFamilyCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return null;
+        const name = this.callName(node.expression);
+        if (!name || !SEND_FAMILY.has(name))
+            return null;
+        const argCount = Array.isArray(node.arguments) ? node.arguments.length : 0;
+        const minArgs = MIN_ARGS[name] ?? 4;
+        if (argCount < minArgs)
+            return null;
+        return { name, node };
+    }
+    callName(expr) {
+        if (!expr)
+            return null;
+        if (expr.type === 'Identifier')
+            return expr.name || null;
+        if (expr.type === 'MemberAccess')
+            return expr.memberName || null;
+        if (expr.type === 'NameValueExpression')
+            return this.callName(expr.expression);
+        return null;
+    }
+    makeFinding(file, contract, fn, match) {
+        const loc = this.locOf(match.node);
+        const contractName = contract.name || '<anonymous>';
+        const functionName = fn.name || (fn.isConstructor ? '<constructor>' : '<anonymous>');
+        return {
+            file,
+            contract: contractName,
+            'function': functionName,
+            line: loc.line,
+            column: loc.column,
+            ruleId: RULE_ID,
+            pattern: PATTERN,
+            severity: 'medium',
+            confidence: 'medium',
+            category: 'unchecked-return-value',
+            message: `Unchecked ${match.name} return value: assign, validate, assert, or propagate the OFT/LayerZero send result.`,
+            contractName,
+            functionName,
+            sourceLocation: loc,
+            findingId: '',
+            contractHash: '',
+        };
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    childNodes(node) {
+        const children = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        children.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                children.push(value);
+            }
+        }
+        return children;
+    }
+}
+exports.UncheckedOftReturnDetector = UncheckedOftReturnDetector;
+//# sourceMappingURL=unchecked-oft-return.js.map

package/dist/detectors/unguarded-governance-execution.d.ts

@@ -0,0 +1,35 @@
+import type { ScanResult } from '../index';
+export declare class UnguardedGovernanceExecutionDetector {
+    readonly id = "unguarded-governance-execution";
+    readonly patternKey = "unguarded-governance-execution";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string): ScanResult[];
+    private isCandidateFunction;
+    private collectProposalParams;
+    private collectModifiers;
+    private applyPreBodyModifiers;
+    private walkStatementWithParamMap;
+    private walkStatement;
+    private walkExpression;
+    private recordProposalAlias;
+    private recordGuard;
+    private isPrivilegedSink;
+    private proposalKeyForSink;
+    private proposalKeyForExpression;
+    private hasCompleteGuard;
+    private ensureGuard;
+    private isExecutedWrite;
+    private containsExecutorDelegation;
+    private hasGovernanceGuardSurface;
+    private containsGovernanceGuard;
+    private makeFinding;
+    private callMemberName;
+    private callObject;
+    private identifierName;
+    private mapParam;
+    private rootIdentifier;
+    private locOf;
+    private isStatementLike;
+    private childNodes;
+    private expressionToString;
+}