@snovon/solast 0.2.0

package/dist/detectors/vortex-protocol-reentrancy-guard.js

@@ -0,0 +1,408 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VortexProtocolReentrancyGuardDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'vortex-protocol-reentrancy-guard';
+const PATTERN = `${RULE_ID}/external-transfer-before-ledger-update`;
+const ASSIGN_OPS = new Set([
+    '=', '+=', '-=', '*=', '/=', '%=',
+    '&=', '|=', '^=', '<<=', '>>=', '>>>=',
+]);
+const UNARY_MUTATORS = new Set(['++', '--', 'delete']);
+const TRANSFER_CALL_MEMBERS = new Set([
+    'call', 'send', 'transfer', 'safetransfer', 'transferfrom', 'safetransferfrom'
+]);
+class VortexProtocolReentrancyGuardDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    currentFile = '';
+    scanAst(ast, file, _sourceText, ctxArg) {
+        this.currentFile = file;
+        const results = [];
+        if (!ast || ast.type !== 'SourceUnit')
+            return results;
+        const contractsByName = this.collectContractsByName(ast);
+        for (const child of ast.children || []) {
+            if (child?.type !== 'ContractDefinition')
+                continue;
+            if (child.kind === 'interface' || child.kind === 'library')
+                continue;
+            const stateVars = this.collectStateVariables(child, contractsByName);
+            for (const sub of child.subNodes || []) {
+                if (sub?.type !== 'FunctionDefinition')
+                    continue;
+                if (!sub.body)
+                    continue;
+                if (sub.isConstructor)
+                    continue;
+                const mutability = String(sub.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                const findings = this.analyzeFunction(child, sub, stateVars);
+                results.push(...findings);
+            }
+        }
+        return results;
+    }
+    analyzeFunction(contract, fn, stateVars) {
+        const localVars = this.collectLocals(fn);
+        const state = {
+            sawTransfer: false,
+            transferAccounts: new Set(),
+            sawUnknownTransferAccount: false,
+            effectAfterTransfer: null,
+        };
+        const ctx = { stateVars, localVars };
+        if (!fn.body || fn.body.type !== 'Block')
+            return [];
+        this.walk(fn.body, state, ctx);
+        const findings = [];
+        const fnName = fn.name || '<anonymous>';
+        if (state.effectAfterTransfer) {
+            findings.push(this.makeFinding(contract, fnName, state.effectAfterTransfer.loc, PATTERN, `Deferred ledger update: state mutation occurs after an external transfer in '${fnName}'.`));
+        }
+        return findings;
+    }
+    walk(node, state, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'EmitStatement')
+            return;
+        if (node.type === 'IfStatement') {
+            if (node.condition)
+                this.walk(node.condition, state, ctx);
+            const trueState = this.cloneState(state);
+            const falseState = this.cloneState(state);
+            if (node.trueBody)
+                this.walk(node.trueBody, trueState, ctx);
+            if (node.falseBody)
+                this.walk(node.falseBody, falseState, ctx);
+            state.sawTransfer = trueState.sawTransfer || falseState.sawTransfer || state.sawTransfer;
+            for (const account of trueState.transferAccounts)
+                state.transferAccounts.add(account);
+            for (const account of falseState.transferAccounts)
+                state.transferAccounts.add(account);
+            state.sawUnknownTransferAccount = state.sawUnknownTransferAccount
+                || trueState.sawUnknownTransferAccount
+                || falseState.sawUnknownTransferAccount;
+            if (trueState.effectAfterTransfer)
+                state.effectAfterTransfer = trueState.effectAfterTransfer;
+            if (falseState.effectAfterTransfer && !state.effectAfterTransfer)
+                state.effectAfterTransfer = falseState.effectAfterTransfer;
+            return;
+        }
+        if (node.type === 'TryStatement') {
+            if (node.expression)
+                this.walk(node.expression, state, ctx);
+            const bodyState = this.cloneState(state);
+            if (node.body)
+                this.walk(node.body, bodyState, ctx);
+            for (const clause of node.catchClauses || []) {
+                const catchState = this.cloneState(state);
+                this.walk(clause.body, catchState, ctx);
+                for (const account of catchState.transferAccounts)
+                    state.transferAccounts.add(account);
+                state.sawUnknownTransferAccount = state.sawUnknownTransferAccount || catchState.sawUnknownTransferAccount;
+                if (catchState.effectAfterTransfer && !state.effectAfterTransfer)
+                    state.effectAfterTransfer = catchState.effectAfterTransfer;
+            }
+            state.sawTransfer = state.sawTransfer || bodyState.sawTransfer;
+            for (const account of bodyState.transferAccounts)
+                state.transferAccounts.add(account);
+            state.sawUnknownTransferAccount = state.sawUnknownTransferAccount || bodyState.sawUnknownTransferAccount;
+            if (bodyState.effectAfterTransfer && !state.effectAfterTransfer)
+                state.effectAfterTransfer = bodyState.effectAfterTransfer;
+            return;
+        }
+        if (node.type === 'VariableDeclarationStatement') {
+            if (node.initialValue)
+                this.walk(node.initialValue, state, ctx);
+            return;
+        }
+        if (node.type === 'FunctionCall') {
+            if (this.isTransferOrCall(node, ctx)) {
+                for (const arg of node.arguments || []) {
+                    this.walk(arg, state, ctx);
+                }
+                state.sawTransfer = true;
+                const accounts = this.transferAccountKeys(node);
+                if (accounts.length === 0) {
+                    state.sawUnknownTransferAccount = true;
+                }
+                else {
+                    for (const account of accounts)
+                        state.transferAccounts.add(account);
+                }
+                return;
+            }
+            for (const child of this.childNodes(node)) {
+                this.walk(child, state, ctx);
+            }
+            return;
+        }
+        if (node.type === 'BinaryOperation' && ASSIGN_OPS.has(node.operator)) {
+            if (this.isLedgerMutation(node.left, ctx, state)) {
+                if (node.right)
+                    this.walk(node.right, state, ctx);
+                if (state.sawTransfer && !state.effectAfterTransfer) {
+                    state.effectAfterTransfer = { loc: this.locOf(node) };
+                }
+                if (node.left)
+                    this.walk(node.left, state, ctx);
+                return;
+            }
+        }
+        if (node.type === 'UnaryOperation' && UNARY_MUTATORS.has(node.operator)) {
+            if (this.isLedgerMutation(node.subExpression, ctx, state)) {
+                if (state.sawTransfer && !state.effectAfterTransfer) {
+                    state.effectAfterTransfer = { loc: this.locOf(node) };
+                }
+                return;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.walk(child, state, ctx);
+        }
+    }
+    isTransferOrCall(call, ctx) {
+        let callee = call?.expression;
+        if (callee?.type === 'NameValueExpression')
+            callee = callee.expression;
+        if (callee?.type === 'MemberAccess') {
+            const member = String(callee.memberName || '').toLowerCase();
+            if (TRANSFER_CALL_MEMBERS.has(member)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    isLedgerMutation(expr, ctx, state) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'IndexAccess') {
+            return this.refersToStateStorage(expr.base, ctx.stateVars, ctx.localVars)
+                && this.mutatesTransferredAccount(expr, state);
+        }
+        return false;
+    }
+    mutatesTransferredAccount(expr, state) {
+        if (state.sawUnknownTransferAccount)
+            return true;
+        if (state.transferAccounts.size === 0)
+            return false;
+        for (const indexExpr of this.indexExpressions(expr)) {
+            const key = this.exprKey(indexExpr);
+            if (key && state.transferAccounts.has(key))
+                return true;
+        }
+        return false;
+    }
+    indexExpressions(expr) {
+        const out = [];
+        let current = expr;
+        while (current?.type === 'IndexAccess') {
+            out.push(current.index ?? current.indexExpression);
+            current = current.base ?? current.baseExpression;
+        }
+        return out;
+    }
+    transferAccountKeys(call) {
+        let callee = call?.expression;
+        if (callee?.type === 'NameValueExpression')
+            callee = callee.expression;
+        if (callee?.type !== 'MemberAccess')
+            return [];
+        const member = String(callee.memberName || '').toLowerCase();
+        const accounts = [];
+        if (member === 'call' || member === 'send' || member === 'transfer') {
+            const nativeRecipient = this.exprKey(callee.expression);
+            if (nativeRecipient)
+                accounts.push(nativeRecipient);
+        }
+        const args = call.arguments || [];
+        if ((member === 'transfer' && args.length >= 2) || member === 'safetransfer') {
+            const recipient = this.exprKey(args[0]);
+            if (recipient)
+                accounts.push(recipient);
+        }
+        else if (member === 'transferfrom' || member === 'safetransferfrom') {
+            const from = this.exprKey(args[0]);
+            const to = this.exprKey(args[1]);
+            if (to === 'address(this)' || to === 'this') {
+                if (to)
+                    accounts.push(to);
+            }
+            else {
+                if (from)
+                    accounts.push(from);
+                if (to)
+                    accounts.push(to);
+            }
+        }
+        return [...new Set(accounts)];
+    }
+    exprKey(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        if (expr.type === 'Identifier')
+            return String(expr.name || '');
+        if (expr.type === 'MemberAccess') {
+            const base = this.exprKey(expr.expression);
+            const member = String(expr.memberName || '');
+            return base && member ? `${base}.${member}` : '';
+        }
+        if (expr.type === 'FunctionCall') {
+            const callee = this.exprKey(expr.expression);
+            if (callee === 'address' && this.exprKey((expr.arguments || [])[0]) === 'this')
+                return 'address(this)';
+        }
+        return '';
+    }
+    cloneState(state) {
+        return {
+            sawTransfer: state.sawTransfer,
+            transferAccounts: new Set(state.transferAccounts),
+            sawUnknownTransferAccount: state.sawUnknownTransferAccount,
+            effectAfterTransfer: state.effectAfterTransfer,
+        };
+    }
+    refersToStateStorage(expr, stateVars, localVars) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            if (localVars.has(name))
+                return false;
+            return stateVars.has(name);
+        }
+        if (expr.type === 'IndexAccess')
+            return this.refersToStateStorage(expr.base, stateVars, localVars);
+        if (expr.type === 'MemberAccess')
+            return this.refersToStateStorage(expr.expression, stateVars, localVars);
+        if (expr.type === 'TupleExpression') {
+            for (const c of expr.components || []) {
+                if (this.refersToStateStorage(c, stateVars, localVars))
+                    return true;
+            }
+        }
+        return false;
+    }
+    collectStateVariables(contract, contractsByName, visited = new Set()) {
+        const set = new Set();
+        const contractName = String(contract?.name || '');
+        if (contractName) {
+            if (visited.has(contractName))
+                return set;
+            visited.add(contractName);
+        }
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const v of sub.variables || []) {
+                if (v?.name)
+                    set.add(v.name);
+            }
+        }
+        for (const base of contract.baseContracts || []) {
+            const baseName = this.baseContractName(base);
+            if (!baseName)
+                continue;
+            const baseContract = contractsByName.get(baseName);
+            if (!baseContract)
+                continue;
+            for (const name of this.collectStateVariables(baseContract, contractsByName, visited)) {
+                set.add(name);
+            }
+        }
+        return set;
+    }
+    collectContractsByName(ast) {
+        const map = new Map();
+        for (const child of ast.children || []) {
+            if (child?.type === 'ContractDefinition' && child.name) {
+                map.set(child.name, child);
+            }
+        }
+        return map;
+    }
+    baseContractName(base) {
+        const namePath = base?.baseName?.namePath;
+        if (namePath)
+            return String(namePath).split('.').pop() || '';
+        const name = base?.baseName?.name;
+        if (name)
+            return String(name).split('.').pop() || '';
+        return '';
+    }
+    collectLocals(fn) {
+        const set = new Set();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                set.add(p.name);
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                set.add(p.name);
+        }
+        this.harvestLocalsRecursive(fn.body, set);
+        return set;
+    }
+    harvestLocalsRecursive(node, set) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    set.add(v.name);
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.harvestLocalsRecursive(child, set);
+        }
+    }
+    childNodes(node) {
+        const out = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'typeName')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        out.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                out.push(value);
+            }
+        }
+        return out;
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    makeFinding(contract, functionName, loc, pattern, message) {
+        const contractName = contract?.name || '';
+        return {
+            file: this.currentFile,
+            contract: contractName,
+            'function': functionName,
+            line: loc.line,
+            column: loc.column,
+            pattern,
+            confidence: 'high',
+            ruleId: RULE_ID,
+            severity: 'high',
+            message,
+            contractName,
+            functionName,
+            sourceLocation: { line: loc.line, column: loc.column },
+            trace: 'effect-after-transfer',
+            findingId: '',
+            contractHash: '',
+        };
+    }
+}
+exports.VortexProtocolReentrancyGuardDetector = VortexProtocolReentrancyGuardDetector;
+//# sourceMappingURL=vortex-protocol-reentrancy-guard.js.map

package/dist/detectors/vulnerable-price-dependency.d.ts

@@ -0,0 +1,41 @@
+import type { ScanResult } from '../index';
+export declare class VulnerablePriceDependencyDetector {
+    readonly id = "vulnerable-price-dependency";
+    readonly patternKey = "vulnerable-price-dependency";
+    readonly supportedAstKinds: "parser"[];
+    private findings;
+    private currentFile;
+    private currentContract;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(_node: any): void;
+    FunctionDefinition(node: any): void;
+    private walkBody;
+    private handleVariableDeclaration;
+    private handleBinaryOperation;
+    private handleFunctionCall;
+    private handleCondition;
+    private isPriceSourceExpression;
+    private isReferenceSourceCall;
+    private exprUsesTaint;
+    private exprUsesUnguardedTaint;
+    private taintGroupsIn;
+    private markGuardedTaintGroups;
+    private sanityOrDeviationGuardGroups;
+    private isCriticalSinkCall;
+    private collectComparisons;
+    private boundSide;
+    private containsHardcodedNumber;
+    private namesIn;
+    private walkExpression;
+    private markVariablesTainted;
+    private firstGroup;
+    private markAssignmentTarget;
+    private callOptionArguments;
+    private calleeName;
+    private isTypeCastCall;
+    private locOf;
+    private emitFinding;
+    private childNodes;
+}