@snovon/solast 0.2.0

package/dist/detectors/beneficiary-validation.js

@@ -0,0 +1,696 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BeneficiaryValidationDetector = void 0;
+const RULE_ID = 'beneficiary-validation';
+const BORROW_BEHALF_NAMES = new Set(['borrowbehalf', 'borrowonbehalf']);
+const MAX_HELPER_DEPTH = 4;
+class BeneficiaryValidationDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const helpers = collectFunctionsByName(contract);
+            const modifiers = collectModifiersByName(contract);
+            const contractName = getName(contract) || '<anonymous>';
+            for (const fn of getContractFunctions(contract)) {
+                if (!getFunctionBody(fn))
+                    continue;
+                if (isBorrowBehalfImplementation(fn)) {
+                    const beneficiary = getFunctionParameters(fn).find(isAddressParameter);
+                    const paramName = beneficiary ? String(beneficiary.name || '') : '';
+                    if (paramName) {
+                        const sinkPath = firstBeneficiarySinkPath(fn, paramName, helpers, new Set(), 0);
+                        if (sinkPath) {
+                            const guards = guardsAlongSinkPath(sinkPath, helpers, modifiers);
+                            if (!guards.zero || !guards.self) {
+                                const fnName = functionDisplayName(fn);
+                                const loc = getLoc(fn, lineOffsets) || { line: 0, column: 0 };
+                                findings.push(makeFinding({
+                                    file,
+                                    contractName,
+                                    fnName,
+                                    paramName,
+                                    loc,
+                                    missing: { zero: !guards.zero, self: !guards.self },
+                                    isCallSite: false,
+                                }));
+                            }
+                        }
+                    }
+                }
+                for (const callSite of findBorrowBehalfCallSites(getFunctionBody(fn))) {
+                    const arg0 = getCallArguments(callSite)[0];
+                    if (!arg0 || !isNode(arg0, 'Identifier'))
+                        continue;
+                    const argName = String(arg0.name || '');
+                    const param = getFunctionParameters(fn).find(p => String(p.name || '') === argName && isAddressParameter(p));
+                    if (!param)
+                        continue;
+                    const guards = guardsBeforeCall(fn, argName, callSite, helpers, modifiers);
+                    if (!guards.zero || !guards.self) {
+                        const fnName = functionDisplayName(fn);
+                        const loc = getLoc(callSite, lineOffsets) || getLoc(fn, lineOffsets) || { line: 0, column: 0 };
+                        findings.push(makeFinding({
+                            file,
+                            contractName,
+                            fnName,
+                            paramName: argName,
+                            loc,
+                            missing: { zero: !guards.zero, self: !guards.self },
+                            isCallSite: true,
+                        }));
+                    }
+                }
+            }
+        }
+        return findings;
+    }
+}
+exports.BeneficiaryValidationDetector = BeneficiaryValidationDetector;
+function makeFinding(args) {
+    const missingParts = [];
+    if (args.missing.zero)
+        missingParts.push('address(0)');
+    if (args.missing.self)
+        missingParts.push('address(this)');
+    const missingText = missingParts.join(' and ');
+    const subject = args.isCallSite
+        ? `delegated borrowBehalf call in '${args.contractName}.${args.fnName}'`
+        : `'${args.contractName}.${args.fnName}'`;
+    const guard = `require(${args.paramName} != address(0) && ${args.paramName} != address(this), "invalid beneficiary")`;
+    const message = `Missing beneficiary validation in ${subject}: beneficiary parameter '${args.paramName}' is not rejected against ${missingText}, enabling Venus-style donation/accounting attacks. Add ${guard} before the borrow sink.`;
+    return {
+        file: args.file,
+        contract: args.contractName,
+        'function': args.fnName,
+        line: args.loc.line,
+        endLine: args.loc.line,
+        column: args.loc.column,
+        pattern: RULE_ID,
+        confidence: 'high',
+        ruleId: RULE_ID,
+        severity: 'error',
+        message,
+        rationale: 'Venus Protocol borrowBehalf donation-attack pattern: passing address(0) or address(this) as the beneficiary either silently destroys the loan accounting (zero-address) or credits debt to the protocol itself (self-address), creating donation/accounting side effects exploitable by any caller.',
+        suggestedFix: `Reject invalid beneficiaries before the borrow sink, e.g. \`${guard}\`, an \`if (...) revert InvalidBeneficiary();\` guard, a shared internal helper, or a modifier that performs both checks on the same parameter.`,
+        beneficiaryParameter: args.paramName,
+        contractName: args.contractName,
+        functionName: args.fnName,
+        sourceLocation: args.loc,
+        findingId: '',
+        contractHash: '',
+        source: 'x-issue-674-venus-borrowbehalf-donation',
+    };
+}
+function isBorrowBehalfImplementation(fn) {
+    if (!isExternallyCallable(fn))
+        return false;
+    return BORROW_BEHALF_NAMES.has(getName(fn).toLowerCase());
+}
+function guardsAlongSinkPath(path, helpers, modifiers) {
+    let guards = emptyGuards();
+    for (const segment of path) {
+        guards = unionGuards(guards, guardsFromModifiers(segment.fn, segment.paramName, helpers, modifiers, new Set()));
+        if (guards.zero && guards.self)
+            return guards;
+        guards = unionGuards(guards, guardsFromBody(segment.body, segment.paramName, helpers, modifiers, segment.sinkStatement, new Set()));
+        if (guards.zero && guards.self)
+            return guards;
+    }
+    return guards;
+}
+function guardsBeforeCall(fn, paramName, callSite, helpers, modifiers) {
+    let guards = guardsFromModifiers(fn, paramName, helpers, modifiers, new Set());
+    guards = unionGuards(guards, guardsFromBody(getFunctionBody(fn), paramName, helpers, modifiers, callSite, new Set()));
+    return guards;
+}
+function guardsFromModifiers(fn, paramName, helpers, modifiers, visited) {
+    let guards = emptyGuards();
+    for (const inv of fn?.modifiers || []) {
+        const modName = getModifierName(inv);
+        const mod = modifiers.get(modName);
+        if (!mod || visited.has(mod))
+            continue;
+        const args = getCallArguments(inv);
+        const modParams = getFunctionParameters(mod);
+        let mappedName = null;
+        for (let i = 0; i < args.length; i++) {
+            if (isIdentifierNamed(args[i], paramName) && modParams[i]?.name) {
+                mappedName = String(modParams[i].name);
+                break;
+            }
+        }
+        if (!mappedName)
+            continue;
+        visited.add(mod);
+        const sub = guardsFromBody(getFunctionBody(mod), mappedName, helpers, modifiers, null, visited);
+        visited.delete(mod);
+        guards = unionGuards(guards, sub);
+        if (guards.zero && guards.self)
+            return guards;
+    }
+    return guards;
+}
+function guardsFromBody(body, paramName, helpers, modifiers, stopAt, visited) {
+    let guards = emptyGuards();
+    if (!body)
+        return guards;
+    for (const stmt of getBlockStatements(body)) {
+        if (stopAt && containsNode(stmt, stopAt))
+            break;
+        guards = unionGuards(guards, guardsFromStatement(stmt, paramName, helpers, modifiers, visited));
+        if (guards.zero && guards.self)
+            return guards;
+    }
+    return guards;
+}
+function guardsFromStatement(stmt, paramName, helpers, modifiers, visited) {
+    if (!stmt || typeof stmt !== 'object')
+        return emptyGuards();
+    if (isNode(stmt, 'ExpressionStatement')) {
+        const expr = stmt.expression;
+        if (isNode(expr, 'FunctionCall')) {
+            const callee = getCalleeName(expr).toLowerCase();
+            if (callee === 'require' || callee === 'assert') {
+                return positiveGuards(getCallArguments(expr)[0], paramName);
+            }
+            if (isNode(expr.expression, 'Identifier')) {
+                const helperName = String(expr.expression.name || '');
+                const helper = helpers.get(helperName);
+                if (helper && !visited.has(helper)) {
+                    const helperParams = getFunctionParameters(helper);
+                    const args = getCallArguments(expr);
+                    let mappedName = null;
+                    for (let i = 0; i < args.length; i++) {
+                        if (isIdentifierNamed(args[i], paramName) && helperParams[i]?.name) {
+                            mappedName = String(helperParams[i].name);
+                            break;
+                        }
+                    }
+                    if (mappedName) {
+                        visited.add(helper);
+                        const sub = guardsFromBody(getFunctionBody(helper), mappedName, helpers, modifiers, null, visited);
+                        visited.delete(helper);
+                        return sub;
+                    }
+                }
+            }
+        }
+    }
+    if (isNode(stmt, 'IfStatement')) {
+        const trueBody = stmt.trueBody || stmt.body;
+        if (bodyUnconditionallyExits(trueBody)) {
+            return negativeGuards(stmt.condition, paramName);
+        }
+    }
+    return emptyGuards();
+}
+function positiveGuards(cond, paramName) {
+    if (!cond || typeof cond !== 'object')
+        return emptyGuards();
+    const c = unwrapTuple(cond);
+    if (isNode(c, 'BinaryOperation')) {
+        const op = String(c.operator || '');
+        const left = getLeft(c);
+        const right = getRight(c);
+        if (op === '&&') {
+            return unionGuards(positiveGuards(left, paramName), positiveGuards(right, paramName));
+        }
+        if (op === '||') {
+            const l = positiveGuards(left, paramName);
+            const r = positiveGuards(right, paramName);
+            return { zero: l.zero && r.zero, self: l.self && r.self };
+        }
+        if (op === '!=' || op === '!==') {
+            return guardsFromInequality(left, right, paramName);
+        }
+        return emptyGuards();
+    }
+    if (isNode(c, 'UnaryOperation') && String(c.operator || '') === '!') {
+        return negativeGuards(c.subExpression, paramName);
+    }
+    return emptyGuards();
+}
+function negativeGuards(cond, paramName) {
+    if (!cond || typeof cond !== 'object')
+        return emptyGuards();
+    const c = unwrapTuple(cond);
+    if (isNode(c, 'BinaryOperation')) {
+        const op = String(c.operator || '');
+        const left = getLeft(c);
+        const right = getRight(c);
+        if (op === '||') {
+            return unionGuards(negativeGuards(left, paramName), negativeGuards(right, paramName));
+        }
+        if (op === '&&') {
+            const l = negativeGuards(left, paramName);
+            const r = negativeGuards(right, paramName);
+            return { zero: l.zero && r.zero, self: l.self && r.self };
+        }
+        if (op === '==' || op === '===') {
+            return guardsFromInequality(left, right, paramName);
+        }
+        return emptyGuards();
+    }
+    if (isNode(c, 'UnaryOperation') && String(c.operator || '') === '!') {
+        return positiveGuards(c.subExpression, paramName);
+    }
+    return emptyGuards();
+}
+function guardsFromInequality(left, right, paramName) {
+    const out = emptyGuards();
+    if (isIdentifierNamed(left, paramName) && isAddressZero(right))
+        out.zero = true;
+    if (isIdentifierNamed(right, paramName) && isAddressZero(left))
+        out.zero = true;
+    if (isIdentifierNamed(left, paramName) && isAddressThis(right))
+        out.self = true;
+    if (isIdentifierNamed(right, paramName) && isAddressThis(left))
+        out.self = true;
+    return out;
+}
+function bodyUnconditionallyExits(body) {
+    if (!body || typeof body !== 'object')
+        return false;
+    if (isNode(body, 'Block')) {
+        return getBlockStatements(body).some(statementGuaranteesExit);
+    }
+    return statementGuaranteesExit(body);
+}
+function statementGuaranteesExit(stmt) {
+    if (!stmt || typeof stmt !== 'object')
+        return false;
+    if (isNode(stmt, 'ThrowStatement') || isNode(stmt, 'RevertStatement'))
+        return true;
+    if (isNode(stmt, 'ExpressionStatement')) {
+        const expr = stmt.expression;
+        return isNode(expr, 'FunctionCall') && getCalleeName(expr).toLowerCase() === 'revert';
+    }
+    if (isNode(stmt, 'Block'))
+        return bodyUnconditionallyExits(stmt);
+    return false;
+}
+function firstBeneficiarySinkPath(fn, paramName, helpers, visited, depth) {
+    const body = getFunctionBody(fn);
+    if (!body || depth > MAX_HELPER_DEPTH)
+        return null;
+    for (const stmt of getBlockStatements(body)) {
+        if (statementHasDirectSink(stmt, paramName)) {
+            return [{ fn, body, paramName, sinkStatement: stmt }];
+        }
+        const tail = sinkPathThroughHelpers(stmt, paramName, helpers, visited, depth);
+        if (tail) {
+            return [{ fn, body, paramName, sinkStatement: stmt }, ...tail];
+        }
+    }
+    return null;
+}
+function statementHasDirectSink(stmt, paramName) {
+    let found = false;
+    walkAll(stmt, node => {
+        if (found)
+            return;
+        if (isAccountingMutation(node, paramName) || isTransferReceiverFlow(node, paramName)) {
+            found = true;
+        }
+    });
+    return found;
+}
+function sinkPathThroughHelpers(stmt, paramName, helpers, visited, depth) {
+    let result = null;
+    walkAll(stmt, node => {
+        if (result)
+            return;
+        if (!isNode(node, 'FunctionCall') || !isNode(node.expression, 'Identifier'))
+            return;
+        const helperName = String(node.expression.name || '');
+        const helper = helpers.get(helperName);
+        if (!helper || visited.has(helper))
+            return;
+        const helperParams = getFunctionParameters(helper);
+        const args = getCallArguments(node);
+        for (let i = 0; i < args.length; i++) {
+            if (!isIdentifierNamed(args[i], paramName) || !helperParams[i]?.name)
+                continue;
+            const mappedName = String(helperParams[i].name);
+            visited.add(helper);
+            const sub = firstBeneficiarySinkPath(helper, mappedName, helpers, visited, depth + 1);
+            visited.delete(helper);
+            if (sub) {
+                result = sub;
+                return;
+            }
+        }
+    });
+    return result;
+}
+function isAccountingMutation(node, paramName) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (isNode(node, 'BinaryOperation')) {
+        const op = String(node.operator || '');
+        if (!['=', '+=', '-=', '*=', '/=', '%='].includes(op))
+            return false;
+        return containsIndexAccessWithParam(getLeft(node), paramName);
+    }
+    if (isNode(node, 'Assignment')) {
+        return containsIndexAccessWithParam(getLeft(node), paramName);
+    }
+    if (isNode(node, 'UnaryOperation')) {
+        const op = String(node.operator || '');
+        if (op !== '++' && op !== '--')
+            return false;
+        return containsIndexAccessWithParam(node.subExpression, paramName);
+    }
+    return false;
+}
+function containsIndexAccessWithParam(node, paramName) {
+    let found = false;
+    walkAll(node, child => {
+        if (found || !isNode(child, 'IndexAccess'))
+            return;
+        const index = child.indexExpression || child.index;
+        if (containsIdentifier(index, paramName))
+            found = true;
+    });
+    return found;
+}
+function isTransferReceiverFlow(node, paramName) {
+    if (!isNode(node, 'FunctionCall'))
+        return false;
+    const callee = node.expression;
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const memberName = String(callee.memberName || '').toLowerCase();
+    const args = getCallArguments(node);
+    if (memberName === 'transfer' || memberName === 'send') {
+        return containsIdentifier(args[0], paramName);
+    }
+    if (memberName === 'transferfrom') {
+        return containsIdentifier(args[1], paramName);
+    }
+    return false;
+}
+function containsIdentifier(node, name) {
+    let found = false;
+    walkAll(node, child => {
+        if (!found && isIdentifierNamed(child, name))
+            found = true;
+    });
+    return found;
+}
+function findBorrowBehalfCallSites(body) {
+    const sites = [];
+    walkAll(body, node => {
+        if (!isNode(node, 'FunctionCall'))
+            return;
+        const callee = node.expression;
+        if (!isNode(callee, 'MemberAccess'))
+            return;
+        const memberName = String(callee.memberName || '').toLowerCase();
+        if (BORROW_BEHALF_NAMES.has(memberName))
+            sites.push(node);
+    });
+    return sites;
+}
+function containsNode(haystack, needle) {
+    if (!haystack || typeof haystack !== 'object')
+        return false;
+    if (haystack === needle)
+        return true;
+    for (const child of childrenOf(haystack)) {
+        if (containsNode(child, needle))
+            return true;
+    }
+    return false;
+}
+function walkAll(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childrenOf(node))
+        walkAll(child, visit);
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const children = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'id')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    children.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            children.push(value);
+        }
+    }
+    return children;
+}
+function collectContracts(ast) {
+    const out = [];
+    walkContracts(ast, node => out.push(node));
+    return out;
+}
+function walkContracts(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (isNode(node, 'ContractDefinition')) {
+        visit(node);
+        return;
+    }
+    for (const child of childrenOf(node))
+        walkContracts(child, visit);
+}
+function collectFunctionsByName(contract) {
+    const out = new Map();
+    for (const member of getContractMembers(contract)) {
+        if (isNode(member, 'FunctionDefinition')) {
+            const name = getName(member);
+            if (name)
+                out.set(name, member);
+        }
+    }
+    return out;
+}
+function collectModifiersByName(contract) {
+    const out = new Map();
+    for (const member of getContractMembers(contract)) {
+        if (isNode(member, 'ModifierDefinition')) {
+            const name = getName(member);
+            if (name)
+                out.set(name, member);
+        }
+    }
+    return out;
+}
+function getContractFunctions(contract) {
+    return getContractMembers(contract).filter(child => isNode(child, 'FunctionDefinition'));
+}
+function getContractMembers(contract) {
+    if (!contract || typeof contract !== 'object')
+        return [];
+    if (Array.isArray(contract.subNodes))
+        return contract.subNodes;
+    if (Array.isArray(contract.nodes))
+        return contract.nodes;
+    return [];
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract?.kind || contract?.contractKind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function isConstructor(fn) {
+    if (!fn)
+        return false;
+    if (fn.isConstructor === true)
+        return true;
+    return String(fn.kind || '').toLowerCase() === 'constructor';
+}
+function isExternallyCallable(fn) {
+    if (!fn || isConstructor(fn))
+        return false;
+    const visibility = String(fn.visibility || '').toLowerCase();
+    return visibility === 'public' || visibility === 'external';
+}
+function getFunctionParameters(fn) {
+    const params = fn?.parameters;
+    if (Array.isArray(params))
+        return params;
+    if (Array.isArray(params?.parameters))
+        return params.parameters;
+    return [];
+}
+function getFunctionBody(node) {
+    return node?.body || null;
+}
+function getBlockStatements(body) {
+    if (!body || typeof body !== 'object')
+        return [];
+    if (Array.isArray(body.statements))
+        return body.statements;
+    return [];
+}
+function isAddressParameter(param) {
+    const typeName = param?.typeName;
+    const typeString = String(param?.typeDescriptions?.typeString || param?.type || '');
+    if (/\baddress\b/.test(typeString))
+        return true;
+    if (typeof typeName === 'string')
+        return typeName === 'address';
+    if (typeName?.name === 'address')
+        return true;
+    if (typeName?.type === 'ElementaryTypeName' && typeName?.name === 'address')
+        return true;
+    if (typeName?.nodeType === 'ElementaryTypeName' && typeName?.name === 'address')
+        return true;
+    return false;
+}
+function isAddressZero(node) {
+    if (!isNode(node, 'FunctionCall'))
+        return false;
+    if (getElementaryTypeName(node.expression) !== 'address')
+        return false;
+    const args = getCallArguments(node);
+    return args.length === 1 && isLiteralZero(args[0]);
+}
+function isAddressThis(node) {
+    if (!isNode(node, 'FunctionCall'))
+        return false;
+    if (getElementaryTypeName(node.expression) !== 'address')
+        return false;
+    const args = getCallArguments(node);
+    return args.length === 1 && isThisExpression(args[0]);
+}
+function getElementaryTypeName(expr) {
+    if (!expr || typeof expr !== 'object')
+        return '';
+    if (isNode(expr, 'ElementaryTypeName'))
+        return String(expr.name || '');
+    if (isNode(expr, 'ElementaryTypeNameExpression'))
+        return String(expr.typeName?.name || expr.typeName || '');
+    if (isNode(expr, 'Identifier'))
+        return String(expr.name || '');
+    return '';
+}
+function isThisExpression(node) {
+    return isNode(node, 'Identifier') && String(node.name || '') === 'this';
+}
+function isLiteralZero(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (isNode(node, 'NumberLiteral')) {
+        const raw = String(node.number ?? node.value ?? '').replace(/_/g, '').toLowerCase();
+        return /^0x?0*$/.test(raw);
+    }
+    if (isNode(node, 'Literal')) {
+        if (String(node.kind || '') !== 'number')
+            return false;
+        const raw = String(node.value ?? '').replace(/_/g, '').toLowerCase();
+        return /^0x?0*$/.test(raw);
+    }
+    return false;
+}
+function unwrapTuple(node) {
+    if (isNode(node, 'TupleExpression')) {
+        const components = Array.isArray(node.components) ? node.components.filter(Boolean) : [];
+        if (components.length === 1)
+            return unwrapTuple(components[0]);
+    }
+    return node;
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function isIdentifierNamed(node, name) {
+    return isNode(node, 'Identifier') && String(node?.name || '') === name;
+}
+function getName(node) {
+    return typeof node?.name === 'string' ? node.name : '';
+}
+function functionDisplayName(fn) {
+    return getName(fn) || '<anonymous>';
+}
+function getCallArguments(node) {
+    return Array.isArray(node?.arguments) ? node.arguments : [];
+}
+function getCalleeName(node) {
+    const expr = node?.expression;
+    if (isNode(expr, 'Identifier'))
+        return String(expr.name || '');
+    if (isNode(expr, 'MemberAccess'))
+        return String(expr.memberName || '');
+    return '';
+}
+function getModifierName(modifier) {
+    if (!modifier)
+        return '';
+    if (typeof modifier === 'string')
+        return modifier;
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    if (modifier.name && typeof modifier.name === 'object') {
+        if (typeof modifier.name.name === 'string')
+            return modifier.name.name;
+        if (typeof modifier.name.namePath === 'string')
+            return modifier.name.namePath;
+    }
+    if (modifier.modifierName) {
+        const inner = modifier.modifierName;
+        if (typeof inner === 'string')
+            return inner;
+        if (typeof inner.name === 'string')
+            return inner.name;
+    }
+    return '';
+}
+function getLeft(node) {
+    return node?.left ?? node?.leftExpression ?? node?.leftHandSide;
+}
+function getRight(node) {
+    return node?.right ?? node?.rightExpression ?? node?.rightHandSide;
+}
+function emptyGuards() { return { zero: false, self: false }; }
+function unionGuards(a, b) {
+    return { zero: a.zero || b.zero, self: a.self || b.self };
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const lineOffsets = [0];
+    let byteOffset = 0;
+    for (const char of sourceText) {
+        byteOffset += Buffer.byteLength(char, 'utf8');
+        if (char === '\n')
+            lineOffsets.push(byteOffset);
+    }
+    return lineOffsets;
+}
+function getLoc(node, lineOffsets) {
+    if (node?.loc?.start)
+        return node.loc.start;
+    if (!node?.src || !lineOffsets)
+        return undefined;
+    const offset = Number(String(node.src).split(':')[0]);
+    if (!Number.isFinite(offset) || offset < 0)
+        return undefined;
+    let lineIndex = 0;
+    for (let i = 0; i < lineOffsets.length; i++) {
+        if (lineOffsets[i] <= offset)
+            lineIndex = i;
+        else
+            break;
+    }
+    return { line: lineIndex + 1, column: offset - lineOffsets[lineIndex] };
+}
+//# sourceMappingURL=beneficiary-validation.js.map

package/dist/detectors/borrow-behalf-consent.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class BorrowBehalfConsentDetector {
+    readonly id = "borrow-behalf-consent";
+    readonly patternKey = "borrow-behalf-consent";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}