@snovon/solast 0.2.0

package/dist/detectors/cross-vm-reentrancy.js

@@ -0,0 +1,484 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CrossVmReentrancyDetector = void 0;
+const RULE_ID = 'cross-vm-reentrancy';
+const PATTERN = `${RULE_ID}/post-bridge-state-write`;
+const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=']);
+const UNARY_MUTATORS = new Set(['++', '--', 'delete']);
+const MOVE_BASE = /\b(?:aptos|sui|move)/i;
+const BRIDGE_BASE = /(?:bridge|router|gateway|wormhole|axelar|layerzero|endpoint|relayer|messenger|outbox|inbox)/i;
+const DIRECT_MOVE_SENDS = new Set(['sendmessage', 'dispatchmessage', 'callremote', 'sendtomove', 'sendtoaptos', 'sendtosui']);
+const GENERIC_BRIDGE_SENDS = new Set(['publishmessage', 'sendmessage', 'dispatchmessage', 'callremote']);
+const TARGETED_ROUTER_SENDS = new Set(['callcontract', 'send', 'sendfrom', 'sendmessage', 'dispatchmessage']);
+const TERMINATING_KINDS = new Set([
+    'ReturnStatement', 'Return',
+    'ThrowStatement', 'Throw',
+    'RevertStatement', 'Revert',
+    'BreakStatement', 'Break',
+    'ContinueStatement', 'Continue',
+]);
+class CrossVmReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const stateVars = collectStateVariables(contract);
+            const internalSummaries = summarizeInternalFunctions(contract);
+            const contractName = getName(contract);
+            for (const fn of contractMembers(contract)) {
+                if (!isNode(fn, 'FunctionDefinition') || !getBody(fn) || isConstructor(fn))
+                    continue;
+                const mutability = String(fn.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                const finding = analyzeFunction(file, contractName, fn, stateVars, internalSummaries, lineOffsets);
+                if (finding)
+                    findings.push(finding);
+            }
+        }
+        return findings;
+    }
+}
+exports.CrossVmReentrancyDetector = CrossVmReentrancyDetector;
+function analyzeFunction(file, contractName, fn, stateVars, internalSummaries, lineOffsets) {
+    const functionName = getName(fn) || '<anonymous>';
+    const memoryLocals = collectFunctionLocals(fn);
+    const acc = { postBridgeWrite: null };
+    walkFlow(getBody(fn), { sawBridgeInteraction: false }, { stateVars, memoryLocals, storageAliases: new Map(), internalSummaries, lineOffsets }, acc);
+    if (!acc.postBridgeWrite)
+        return null;
+    return makeFinding(file, contractName, functionName, acc.postBridgeWrite);
+}
+function walkFlow(node, inState, ctx, acc) {
+    if (!node || typeof node !== 'object')
+        return { state: inState, terminates: false };
+    if (acc.postBridgeWrite)
+        return { state: inState, terminates: false };
+    if (isNode(node, 'EmitStatement'))
+        return { state: inState, terminates: false };
+    if (isTerminator(node)) {
+        let state = inState;
+        for (const child of childNodes(node)) {
+            state = walkFlow(child, state, ctx, acc).state;
+        }
+        return { state, terminates: true };
+    }
+    if (isNode(node, 'IfStatement'))
+        return walkIf(node, inState, ctx, acc);
+    if (isNode(node, 'ForStatement') || isNode(node, 'WhileStatement') || isNode(node, 'DoWhileStatement')) {
+        return walkLoop(node, inState, ctx, acc);
+    }
+    if (isNode(node, 'Block') || isNode(node, 'UncheckedStatement')) {
+        return walkBlock(node, inState, ctx, acc);
+    }
+    if (isNode(node, 'VariableDeclarationStatement')) {
+        const init = node.initialValue || node.initialValueExpression;
+        const state = init ? walkFlow(init, inState, ctx, acc).state : inState;
+        recordLocalDeclarations(node, init, ctx);
+        return { state, terminates: false };
+    }
+    if (isNode(node, 'ExpressionStatement')) {
+        const expr = node.expression;
+        return expr ? walkFlow(expr, inState, ctx, acc) : { state: inState, terminates: false };
+    }
+    if (isFunctionCall(node)) {
+        if (isBridgeInteraction(node)) {
+            let state = inState;
+            for (const arg of node.arguments || []) {
+                state = walkFlow(arg, state, ctx, acc).state;
+            }
+            return { state: { sawBridgeInteraction: true }, terminates: false };
+        }
+        const directName = directCallName(callExpression(node));
+        if (directName && ctx.internalSummaries.get(directName)?.performsBridgeInteraction) {
+            let state = inState;
+            for (const arg of node.arguments || []) {
+                state = walkFlow(arg, state, ctx, acc).state;
+            }
+            return { state: { sawBridgeInteraction: true }, terminates: false };
+        }
+    }
+    if (isAssignment(node)) {
+        const left = assignmentLeft(node);
+        if (refersToStateStorage(left, ctx)) {
+            const rightRes = walkFlow(assignmentRight(node), inState, ctx, acc);
+            if (rightRes.state.sawBridgeInteraction && !acc.postBridgeWrite) {
+                acc.postBridgeWrite = locOf(node, ctx.lineOffsets);
+            }
+            return { state: rightRes.state, terminates: false };
+        }
+    }
+    if (isNode(node, 'UnaryOperation') && UNARY_MUTATORS.has(String(node.operator || ''))) {
+        if (refersToStateStorage(node.subExpression, ctx)) {
+            if (inState.sawBridgeInteraction && !acc.postBridgeWrite) {
+                acc.postBridgeWrite = locOf(node, ctx.lineOffsets);
+            }
+            return { state: inState, terminates: false };
+        }
+    }
+    let state = inState;
+    for (const child of childNodes(node)) {
+        state = walkFlow(child, state, ctx, acc).state;
+    }
+    return { state, terminates: false };
+}
+function walkBlock(node, inState, ctx, acc) {
+    const stmts = Array.isArray(node.statements) ? node.statements : [];
+    let state = inState;
+    for (const stmt of stmts) {
+        const r = walkFlow(stmt, state, ctx, acc);
+        state = r.state;
+        if (r.terminates)
+            return { state, terminates: true };
+    }
+    return { state, terminates: false };
+}
+function walkIf(node, inState, ctx, acc) {
+    const condition = node.condition;
+    const condState = condition ? walkFlow(condition, inState, ctx, acc).state : inState;
+    const trueRes = node.trueBody
+        ? walkFlow(node.trueBody, condState, ctx, acc)
+        : { state: condState, terminates: false };
+    const hasFalse = !!node.falseBody;
+    const falseRes = hasFalse
+        ? walkFlow(node.falseBody, condState, ctx, acc)
+        : { state: condState, terminates: false };
+    let outSaw = condState.sawBridgeInteraction;
+    if (!trueRes.terminates)
+        outSaw = outSaw || trueRes.state.sawBridgeInteraction;
+    if (hasFalse && !falseRes.terminates)
+        outSaw = outSaw || falseRes.state.sawBridgeInteraction;
+    const terminates = hasFalse && trueRes.terminates && falseRes.terminates;
+    return { state: { sawBridgeInteraction: outSaw }, terminates };
+}
+function walkLoop(node, inState, ctx, acc) {
+    const parts = [
+        node.initExpression,
+        node.conditionExpression,
+        node.condition,
+        node.body,
+        node.loopExpression,
+    ];
+    let state = inState;
+    for (const part of parts) {
+        if (!part)
+            continue;
+        const r = walkFlow(part, state, ctx, acc);
+        state = { sawBridgeInteraction: state.sawBridgeInteraction || r.state.sawBridgeInteraction };
+    }
+    return { state, terminates: false };
+}
+function isTerminator(node) {
+    for (const kind of TERMINATING_KINDS) {
+        if (isNode(node, kind))
+            return true;
+    }
+    return false;
+}
+function summarizeInternalFunctions(contract) {
+    const summaries = new Map();
+    for (const fn of contractMembers(contract)) {
+        if (!isNode(fn, 'FunctionDefinition') || !getBody(fn) || isConstructor(fn))
+            continue;
+        const name = getName(fn);
+        if (!name)
+            continue;
+        summaries.set(name, {
+            performsBridgeInteraction: bodyContainsBridgeInteraction(getBody(fn)),
+        });
+    }
+    return summaries;
+}
+function bodyContainsBridgeInteraction(body) {
+    let found = false;
+    walk(body, node => {
+        if (!found && isFunctionCall(node) && isBridgeInteraction(node))
+            found = true;
+    });
+    return found;
+}
+function isBridgeInteraction(call) {
+    const callee = unwrapCallOptions(callExpression(call));
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const member = String(callee.memberName || '').toLowerCase();
+    const baseText = expressionText(callee.expression);
+    const fullText = `${baseText}.${member}`;
+    if (MOVE_BASE.test(baseText) && DIRECT_MOVE_SENDS.has(member))
+        return true;
+    if (BRIDGE_BASE.test(baseText) && MOVE_BASE.test(fullText) && TARGETED_ROUTER_SENDS.has(member))
+        return true;
+    if (/(?:wormhole)/i.test(baseText) && member === 'publishmessage' && hasMoveContext(call))
+        return true;
+    if (/(?:axelar|gateway)/i.test(baseText) && member === 'callcontract' && callTargetsMove(call))
+        return true;
+    if (BRIDGE_BASE.test(baseText) && GENERIC_BRIDGE_SENDS.has(member) && MOVE_BASE.test(expressionText(call)))
+        return true;
+    return false;
+}
+function callTargetsMove(call) {
+    return (call.arguments || []).some((arg) => MOVE_BASE.test(expressionText(arg)));
+}
+function hasMoveContext(call) {
+    const callee = unwrapCallOptions(callExpression(call));
+    const callText = expressionText(call);
+    const calleeText = expressionText(callee);
+    return MOVE_BASE.test(calleeText) || MOVE_BASE.test(callText) || callTargetsMove(call);
+}
+function collectContracts(ast) {
+    const roots = Array.isArray(ast.children) ? ast.children : Array.isArray(ast.nodes) ? ast.nodes : [];
+    return roots.filter((node) => isNode(node, 'ContractDefinition'));
+}
+function contractMembers(contract) {
+    return Array.isArray(contract.subNodes) ? contract.subNodes : Array.isArray(contract.nodes) ? contract.nodes : [];
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract.kind || contract.contractKind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function isConstructor(fn) {
+    return !!fn.isConstructor || String(fn.kind || '').toLowerCase() === 'constructor';
+}
+function collectStateVariables(contract) {
+    const names = new Set();
+    for (const member of contractMembers(contract)) {
+        if (isNode(member, 'StateVariableDeclaration')) {
+            for (const variable of member.variables || []) {
+                const name = getName(variable);
+                if (name)
+                    names.add(name);
+            }
+        }
+        else if (isNode(member, 'VariableDeclaration') && member.stateVariable) {
+            const name = getName(member);
+            if (name)
+                names.add(name);
+        }
+    }
+    return names;
+}
+function collectFunctionLocals(fn) {
+    const names = new Set();
+    for (const param of [...getParameters(fn), ...getReturnParameters(fn)]) {
+        const name = getName(param);
+        if (name)
+            names.add(name);
+    }
+    walk(getBody(fn), node => {
+        if (isNode(node, 'VariableDeclarationStatement')) {
+            for (const variable of node.variables || node.declarations || []) {
+                const name = getName(variable);
+                if (name)
+                    names.add(name);
+            }
+        }
+    });
+    return names;
+}
+function recordLocalDeclarations(node, init, ctx) {
+    const variables = node.variables || node.declarations || [];
+    for (const variable of variables) {
+        const name = getName(variable);
+        if (!name)
+            continue;
+        if (isStorageLocal(variable) && init && refersToStateStorage(init, ctx)) {
+            ctx.memoryLocals.delete(name);
+            ctx.storageAliases.set(name, storageRootName(init, ctx) || name);
+            continue;
+        }
+        ctx.storageAliases.delete(name);
+        ctx.memoryLocals.add(name);
+    }
+}
+function isStorageLocal(variable) {
+    return String(variable?.storageLocation || variable?.typeName?.storageLocation || '').toLowerCase() === 'storage';
+}
+function getParameters(fn) {
+    if (Array.isArray(fn?.parameters))
+        return fn.parameters;
+    return fn?.parameters?.parameters || [];
+}
+function getReturnParameters(fn) {
+    if (Array.isArray(fn?.returnParameters))
+        return fn.returnParameters;
+    return fn?.returnParameters?.parameters || [];
+}
+function getBody(fn) {
+    return fn?.body || null;
+}
+function isAssignment(node) {
+    if (isNode(node, 'Assignment'))
+        return true;
+    return isNode(node, 'BinaryOperation') && ASSIGN_OPS.has(String(node.operator || ''));
+}
+function assignmentLeft(node) {
+    return node.left || node.leftHandSide;
+}
+function assignmentRight(node) {
+    return node.right || node.rightHandSide;
+}
+function refersToStateStorage(expr, ctx) {
+    if (!expr || typeof expr !== 'object')
+        return false;
+    if (isNode(expr, 'Identifier')) {
+        const name = getName(expr);
+        if (ctx.storageAliases.has(name))
+            return true;
+        return !ctx.memoryLocals.has(name) && ctx.stateVars.has(name);
+    }
+    if (isNode(expr, 'IndexAccess'))
+        return refersToStateStorage(expr.base || expr.baseExpression, ctx);
+    if (isNode(expr, 'MemberAccess'))
+        return refersToStateStorage(expr.expression, ctx);
+    if (isNode(expr, 'TupleExpression')) {
+        return (expr.components || []).some((component) => refersToStateStorage(component, ctx));
+    }
+    return false;
+}
+function storageRootName(expr, ctx) {
+    if (!expr || typeof expr !== 'object')
+        return '';
+    if (isNode(expr, 'Identifier')) {
+        const name = getName(expr);
+        return ctx.storageAliases.get(name) || name;
+    }
+    if (isNode(expr, 'IndexAccess'))
+        return storageRootName(expr.base || expr.baseExpression, ctx);
+    if (isNode(expr, 'MemberAccess'))
+        return storageRootName(expr.expression, ctx);
+    return '';
+}
+function isFunctionCall(node) {
+    return isNode(node, 'FunctionCall');
+}
+function callExpression(call) {
+    return call?.expression;
+}
+function unwrapCallOptions(node) {
+    let current = node;
+    while (isNode(current, 'NameValueExpression') || isNode(current, 'FunctionCallOptions')) {
+        current = current.expression;
+    }
+    return current;
+}
+function directCallName(expr) {
+    return isNode(expr, 'Identifier') ? getName(expr) : '';
+}
+function expressionText(node) {
+    if (!node || typeof node !== 'object')
+        return '';
+    if (isNode(node, 'Identifier'))
+        return getName(node);
+    if (isNode(node, 'MemberAccess'))
+        return `${expressionText(node.expression)}.${node.memberName || ''}`;
+    if (isNode(node, 'IndexAccess'))
+        return `${expressionText(node.base || node.baseExpression)}[${expressionText(node.index || node.indexExpression)}]`;
+    if (isNode(node, 'FunctionCall'))
+        return `${expressionText(unwrapCallOptions(callExpression(node)))}(${(node.arguments || []).map(expressionText).join(',')})`;
+    if (isNode(node, 'FunctionCallOptions'))
+        return expressionText(node.expression);
+    if (isNode(node, 'NameValueExpression'))
+        return expressionText(node.expression);
+    if (isNode(node, 'UnaryOperation'))
+        return `${node.operator || ''}${expressionText(node.subExpression)}`;
+    if (isNode(node, 'BinaryOperation'))
+        return `${expressionText(node.left || node.leftExpression)}${node.operator || ''}${expressionText(node.right || node.rightExpression)}`;
+    if (isNode(node, 'Literal'))
+        return String(node.value ?? node.hexValue ?? '');
+    if (isNode(node, 'NumberLiteral') || isNode(node, 'StringLiteral') || isNode(node, 'BooleanLiteral'))
+        return String(node.value ?? node.number ?? '');
+    return childNodes(node).map(expressionText).join(' ');
+}
+function getName(node) {
+    return String(node?.name || node?.namePath || '');
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function walk(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childNodes(node))
+        walk(child, visit);
+}
+function childNodes(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const out = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'documentation')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    out.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function locOf(node, lineOffsets) {
+    if (node?.loc?.start)
+        return { line: node.loc.start.line || 0, column: node.loc.start.column || 0 };
+    return getLocFromSrc(node, lineOffsets) || { line: 0, column: 0 };
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const lineOffsets = [0];
+    let byteOffset = 0;
+    for (const char of sourceText) {
+        byteOffset += Buffer.byteLength(char, 'utf8');
+        if (char === '\n')
+            lineOffsets.push(byteOffset);
+    }
+    return lineOffsets;
+}
+function getLocFromSrc(node, lineOffsets) {
+    if (!node?.src || !lineOffsets)
+        return undefined;
+    const offset = Number(String(node.src).split(':')[0]);
+    if (!Number.isFinite(offset) || offset < 0)
+        return undefined;
+    let lineIndex = 0;
+    for (let i = 0; i < lineOffsets.length; i++) {
+        if (lineOffsets[i] <= offset)
+            lineIndex = i;
+        else
+            break;
+    }
+    return { line: lineIndex + 1, column: offset - lineOffsets[lineIndex] };
+}
+function makeFinding(file, contractName, functionName, loc) {
+    return {
+        file,
+        contract: contractName,
+        'function': functionName,
+        line: loc.line,
+        column: loc.column,
+        pattern: PATTERN,
+        confidence: 'low',
+        ruleId: RULE_ID,
+        severity: 'medium',
+        message: `Cross-VM bridge path '${contractName}.${functionName}' mutates Solidity state after a Move-VM or bridge message interaction; finalize replay/accounting state before the outbound interaction.`,
+        contractName,
+        functionName,
+        sourceLocation: { line: loc.line, column: loc.column },
+        trace: 'bridge-interaction-before-state-write',
+        suggestedFix: 'Move replay, nonce, processed, credit, and outbox accounting updates before the bridge/message-router call, and keep callback/message handlers separately guarded.',
+        findingId: '',
+        contractHash: '',
+    };
+}
+//# sourceMappingURL=cross-vm-reentrancy.js.map

package/dist/detectors/decimals-mismatch.d.ts

@@ -0,0 +1,89 @@
+import type { ScanResult } from '../api';
+export declare class DecimalsMismatchDetector {
+    readonly id = "decimals-mismatch";
+    readonly patternKey = "decimals-mismatch";
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "high";
+    };
+    private currentFile;
+    private findings;
+    private currentContractName;
+    private currentContractNode;
+    private currentFunctionName;
+    private currentFunctionNode;
+    private stateVars;
+    private tokenDecimals;
+    private localAmounts;
+    private constructorParams;
+    private paramToStateVars;
+    private decimalsCacheToParam;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    'ContractDefinition:exit'(): void;
+    FunctionDefinition(node: any): void;
+    'FunctionDefinition:exit'(_node: any): void;
+    FunctionCall(node: any): void;
+    VariableDeclarationStatement(node: any): void;
+    BinaryOperation(node: any): void;
+    private resetContract;
+    /**
+     * Track `stateVar = param` bindings in constructors, and
+     * `decimalsCache = param.decimals()` patterns.
+     */
+    private trackConstructorBinding;
+    /**
+     * Detect `require(tokenVar.decimals() == N)` (directly on token) and
+     * `require(decimalsCache == N)` (cached decimals state var). Also
+     * detect `require(N == ...)` ordering.
+     */
+    private tryLearnDecimals;
+    private tryLearnDecimalsFromCall;
+    private tryLearnDecimalsFromCache;
+    /**
+     * Record decimals for a token name (state var or constructor param),
+     * and propagate to bound state variables.
+     */
+    private setDecimals;
+    /**
+     * Parse `tokenVar.decimals()` call — returns the identifier name (state var or param).
+     */
+    private parseDecimalsCall;
+    /**
+     * Parse a NumberLiteral and return its integer value, or null.
+     */
+    private parseNumberLiteral;
+    /**
+     * Detect `uint256 x = token.balanceOf(...)` and record that x is an amount
+     * from the given token with its known decimals.
+     */
+    private tryTrackLocalAmount;
+    /**
+     * Extract the token variable and its decimals from a balanceOf-like call.
+     */
+    private extractTokenAmountCall;
+    /**
+     * Parse a MemberAccess expression for balanceOf/allowance on a token.
+     */
+    private parseErc20AmountCall;
+    /**
+     * Resolve the effective decimals of an expression node.
+     * Handles: Identifier (localAmounts), FunctionCall (balanceOf/allowance),
+     * BinaryOperation (* or / by power-of-10 → scale normalization).
+     */
+    private resolveAmountDecimals;
+    /**
+     * Check if a node represents a scale normalization (multiply or divide by power-of-10).
+     */
+    private isScaleNormalized;
+    /**
+     * Extract the power of 10 from a node if it represents 10**N or 1eN.
+     * Returns the exponent N, or null if not a power-of-10.
+     */
+    private extractPowerOfTen;
+    private directCallName;
+}