@snovon/solast 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (738) hide show
  1. package/LICENSE +201 -0
  2. package/README.md +190 -0
  3. package/dist/api.d.ts +89 -0
  4. package/dist/api.js +33 -0
  5. package/dist/ast/resolve-return-names.d.ts +2 -0
  6. package/dist/ast/resolve-return-names.js +199 -0
  7. package/dist/ast/solc-walker.d.ts +17 -0
  8. package/dist/ast/solc-walker.js +497 -0
  9. package/dist/ast/storage-layout.d.ts +21 -0
  10. package/dist/ast/storage-layout.js +64 -0
  11. package/dist/cli.d.ts +65 -0
  12. package/dist/cli.js +755 -0
  13. package/dist/config.d.ts +9 -0
  14. package/dist/config.js +284 -0
  15. package/dist/dedup/files.d.ts +1 -0
  16. package/dist/dedup/files.js +74 -0
  17. package/dist/dedup/findings.d.ts +41 -0
  18. package/dist/dedup/findings.js +211 -0
  19. package/dist/detectors/_common/access-control.d.ts +204 -0
  20. package/dist/detectors/_common/access-control.js +377 -0
  21. package/dist/detectors/_common/ast.d.ts +139 -0
  22. package/dist/detectors/_common/ast.js +239 -0
  23. package/dist/detectors/_common/compiler-profile.d.ts +14 -0
  24. package/dist/detectors/_common/compiler-profile.js +66 -0
  25. package/dist/detectors/_common/dataflow.d.ts +75 -0
  26. package/dist/detectors/_common/dataflow.js +57 -0
  27. package/dist/detectors/_common/fhe.d.ts +7 -0
  28. package/dist/detectors/_common/fhe.js +40 -0
  29. package/dist/detectors/_common/integer-overflow-helpers.d.ts +58 -0
  30. package/dist/detectors/_common/integer-overflow-helpers.js +422 -0
  31. package/dist/detectors/_common/loop-call-stack.d.ts +9 -0
  32. package/dist/detectors/_common/loop-call-stack.js +132 -0
  33. package/dist/detectors/_common/oracle.d.ts +5 -0
  34. package/dist/detectors/_common/oracle.js +64 -0
  35. package/dist/detectors/_common/price-rate.d.ts +116 -0
  36. package/dist/detectors/_common/price-rate.js +446 -0
  37. package/dist/detectors/_common/source-text.d.ts +11 -0
  38. package/dist/detectors/_common/source-text.js +82 -0
  39. package/dist/detectors/_common/weighted-pool-invariant.d.ts +21 -0
  40. package/dist/detectors/_common/weighted-pool-invariant.js +105 -0
  41. package/dist/detectors/aave-v2-reentrancy.d.ts +7 -0
  42. package/dist/detectors/aave-v2-reentrancy.js +286 -0
  43. package/dist/detectors/access-control.d.ts +103 -0
  44. package/dist/detectors/access-control.js +983 -0
  45. package/dist/detectors/add-reentrancy-on-weth-contract.d.ts +7 -0
  46. package/dist/detectors/add-reentrancy-on-weth-contract.js +536 -0
  47. package/dist/detectors/ai-generated-randomness.d.ts +32 -0
  48. package/dist/detectors/ai-generated-randomness.js +239 -0
  49. package/dist/detectors/amm-spot-oracle-manipulation.d.ts +52 -0
  50. package/dist/detectors/amm-spot-oracle-manipulation.js +420 -0
  51. package/dist/detectors/analyzing-the-uniswap-v3-exploit.d.ts +26 -0
  52. package/dist/detectors/analyzing-the-uniswap-v3-exploit.js +279 -0
  53. package/dist/detectors/any-token-is-destroyed.d.ts +34 -0
  54. package/dist/detectors/any-token-is-destroyed.js +527 -0
  55. package/dist/detectors/anyswap-anytoken-permit-allowance-drain.d.ts +7 -0
  56. package/dist/detectors/anyswap-anytoken-permit-allowance-drain.js +524 -0
  57. package/dist/detectors/anyswap-insufficient-token-validation.d.ts +24 -0
  58. package/dist/detectors/anyswap-insufficient-token-validation.js +342 -0
  59. package/dist/detectors/approval-based-drain.d.ts +7 -0
  60. package/dist/detectors/approval-based-drain.js +772 -0
  61. package/dist/detectors/arbitrary-account-balance-transfer.d.ts +7 -0
  62. package/dist/detectors/arbitrary-account-balance-transfer.js +485 -0
  63. package/dist/detectors/arbitrary-address-spoofing-attack.d.ts +7 -0
  64. package/dist/detectors/arbitrary-address-spoofing-attack.js +444 -0
  65. package/dist/detectors/arbitrary-address-spoofing.d.ts +9 -0
  66. package/dist/detectors/arbitrary-address-spoofing.js +657 -0
  67. package/dist/detectors/arbitrary-call-error.d.ts +127 -0
  68. package/dist/detectors/arbitrary-call-error.js +1163 -0
  69. package/dist/detectors/arbitrary-call.d.ts +4 -0
  70. package/dist/detectors/arbitrary-call.js +11 -0
  71. package/dist/detectors/arbitrary-delegatecall-target.d.ts +35 -0
  72. package/dist/detectors/arbitrary-delegatecall-target.js +554 -0
  73. package/dist/detectors/arbitrary-recipient-no-access-control.d.ts +7 -0
  74. package/dist/detectors/arbitrary-recipient-no-access-control.js +638 -0
  75. package/dist/detectors/arbitrary-storage-proof-forgery.d.ts +35 -0
  76. package/dist/detectors/arbitrary-storage-proof-forgery.js +340 -0
  77. package/dist/detectors/arbitrary-transfer-from.d.ts +38 -0
  78. package/dist/detectors/arbitrary-transfer-from.js +339 -0
  79. package/dist/detectors/arbitrum-cross-chain-message-replay.d.ts +22 -0
  80. package/dist/detectors/arbitrum-cross-chain-message-replay.js +477 -0
  81. package/dist/detectors/avs-slashing-without-quorum-check.d.ts +50 -0
  82. package/dist/detectors/avs-slashing-without-quorum-check.js +386 -0
  83. package/dist/detectors/bad-debt-propagation.d.ts +13 -0
  84. package/dist/detectors/bad-debt-propagation.js +480 -0
  85. package/dist/detectors/bad-k-value-verification.d.ts +7 -0
  86. package/dist/detectors/bad-k-value-verification.js +512 -0
  87. package/dist/detectors/bad-randomness-zero-blockhash.d.ts +29 -0
  88. package/dist/detectors/bad-randomness-zero-blockhash.js +115 -0
  89. package/dist/detectors/balancer-flash-loan-manipulation.d.ts +33 -0
  90. package/dist/detectors/balancer-flash-loan-manipulation.js +178 -0
  91. package/dist/detectors/balancer-pause-guard.d.ts +33 -0
  92. package/dist/detectors/balancer-pause-guard.js +307 -0
  93. package/dist/detectors/balancer-weighted-pool-flash-loan.d.ts +42 -0
  94. package/dist/detectors/balancer-weighted-pool-flash-loan.js +275 -0
  95. package/dist/detectors/batch-transfer-overflow.d.ts +7 -0
  96. package/dist/detectors/batch-transfer-overflow.js +465 -0
  97. package/dist/detectors/beneficiary-validation.d.ts +7 -0
  98. package/dist/detectors/beneficiary-validation.js +696 -0
  99. package/dist/detectors/borrow-behalf-consent.d.ts +7 -0
  100. package/dist/detectors/borrow-behalf-consent.js +400 -0
  101. package/dist/detectors/break-continue-scope.d.ts +7 -0
  102. package/dist/detectors/break-continue-scope.js +194 -0
  103. package/dist/detectors/bridge-accounting-bypass.d.ts +65 -0
  104. package/dist/detectors/bridge-accounting-bypass.js +449 -0
  105. package/dist/detectors/bridge-business-logic-flaw-incorrect-acc.d.ts +43 -0
  106. package/dist/detectors/bridge-business-logic-flaw-incorrect-acc.js +394 -0
  107. package/dist/detectors/bridge-collateral-drain.d.ts +7 -0
  108. package/dist/detectors/bridge-collateral-drain.js +630 -0
  109. package/dist/detectors/bridge-forged-proof.d.ts +7 -0
  110. package/dist/detectors/bridge-forged-proof.js +754 -0
  111. package/dist/detectors/bridge-missing-message-nonce.d.ts +57 -0
  112. package/dist/detectors/bridge-missing-message-nonce.js +638 -0
  113. package/dist/detectors/bridge-swap-metapool-attack.d.ts +20 -0
  114. package/dist/detectors/bridge-swap-metapool-attack.js +230 -0
  115. package/dist/detectors/business-logic-flaw-flashloan-price-mani.d.ts +7 -0
  116. package/dist/detectors/business-logic-flaw-flashloan-price-mani.js +353 -0
  117. package/dist/detectors/business-logic-flaw-incorrect-recipient-balance.d.ts +7 -0
  118. package/dist/detectors/business-logic-flaw-incorrect-recipient-balance.js +403 -0
  119. package/dist/detectors/business-logic-flaw.d.ts +21 -0
  120. package/dist/detectors/business-logic-flaw.js +339 -0
  121. package/dist/detectors/business-logic.d.ts +17 -0
  122. package/dist/detectors/business-logic.js +22 -0
  123. package/dist/detectors/bypassed-insolvency-check.d.ts +30 -0
  124. package/dist/detectors/bypassed-insolvency-check.js +232 -0
  125. package/dist/detectors/bytecode-divergence-risk.d.ts +32 -0
  126. package/dist/detectors/bytecode-divergence-risk.js +150 -0
  127. package/dist/detectors/cache-array-length.d.ts +30 -0
  128. package/dist/detectors/cache-array-length.js +177 -0
  129. package/dist/detectors/cache-storage-reads.d.ts +46 -0
  130. package/dist/detectors/cache-storage-reads.js +323 -0
  131. package/dist/detectors/calldata-secret-access-control.d.ts +36 -0
  132. package/dist/detectors/calldata-secret-access-control.js +446 -0
  133. package/dist/detectors/capital-cross-contract-reentrancy.d.ts +34 -0
  134. package/dist/detectors/capital-cross-contract-reentrancy.js +481 -0
  135. package/dist/detectors/cartel-custom-approval-logic.d.ts +7 -0
  136. package/dist/detectors/cartel-custom-approval-logic.js +407 -0
  137. package/dist/detectors/ccip-receiver-missing-replay-guard.d.ts +22 -0
  138. package/dist/detectors/ccip-receiver-missing-replay-guard.js +413 -0
  139. package/dist/detectors/chain-coupling-risk.d.ts +8 -0
  140. package/dist/detectors/chain-coupling-risk.js +203 -0
  141. package/dist/detectors/chainlink-deprecated-function.d.ts +7 -0
  142. package/dist/detectors/chainlink-deprecated-function.js +205 -0
  143. package/dist/detectors/chainlink-tx-origin.d.ts +7 -0
  144. package/dist/detectors/chainlink-tx-origin.js +363 -0
  145. package/dist/detectors/check-effects-interactions.d.ts +39 -0
  146. package/dist/detectors/check-effects-interactions.js +783 -0
  147. package/dist/detectors/check-permit-missing-chainid.d.ts +27 -0
  148. package/dist/detectors/check-permit-missing-chainid.js +456 -0
  149. package/dist/detectors/classic-reentrancy.d.ts +93 -0
  150. package/dist/detectors/classic-reentrancy.js +645 -0
  151. package/dist/detectors/coinbase-morpho-wethloan-policy.d.ts +29 -0
  152. package/dist/detectors/coinbase-morpho-wethloan-policy.js +368 -0
  153. package/dist/detectors/compoundv2-inflation-attack.d.ts +7 -0
  154. package/dist/detectors/compoundv2-inflation-attack.js +675 -0
  155. package/dist/detectors/constructor-address-validation.d.ts +24 -0
  156. package/dist/detectors/constructor-address-validation.js +335 -0
  157. package/dist/detectors/constructor-interface-no-address-validation.d.ts +32 -0
  158. package/dist/detectors/constructor-interface-no-address-validation.js +283 -0
  159. package/dist/detectors/cross-chain-arbitrary-call.d.ts +7 -0
  160. package/dist/detectors/cross-chain-arbitrary-call.js +601 -0
  161. package/dist/detectors/cross-chain-input-validation.d.ts +31 -0
  162. package/dist/detectors/cross-chain-input-validation.js +347 -0
  163. package/dist/detectors/cross-chain-intent-replay.d.ts +38 -0
  164. package/dist/detectors/cross-chain-intent-replay.js +453 -0
  165. package/dist/detectors/cross-chain-intent-stale-resolution.d.ts +7 -0
  166. package/dist/detectors/cross-chain-intent-stale-resolution.js +463 -0
  167. package/dist/detectors/cross-chain-message-order-dependency.d.ts +8 -0
  168. package/dist/detectors/cross-chain-message-order-dependency.js +472 -0
  169. package/dist/detectors/cross-chain-message-replay.d.ts +8 -0
  170. package/dist/detectors/cross-chain-message-replay.js +568 -0
  171. package/dist/detectors/cross-chain-messaging.d.ts +7 -0
  172. package/dist/detectors/cross-chain-messaging.js +663 -0
  173. package/dist/detectors/cross-chain-msg-truncation.d.ts +7 -0
  174. package/dist/detectors/cross-chain-msg-truncation.js +453 -0
  175. package/dist/detectors/cross-chain-truncation.d.ts +7 -0
  176. package/dist/detectors/cross-chain-truncation.js +422 -0
  177. package/dist/detectors/cross-contract-integer-overflow.d.ts +76 -0
  178. package/dist/detectors/cross-contract-integer-overflow.js +554 -0
  179. package/dist/detectors/cross-contract-reentrancy-trusted-callee.d.ts +39 -0
  180. package/dist/detectors/cross-contract-reentrancy-trusted-callee.js +385 -0
  181. package/dist/detectors/cross-contract-reentrancy.d.ts +63 -0
  182. package/dist/detectors/cross-contract-reentrancy.js +631 -0
  183. package/dist/detectors/cross-function-reentrancy.d.ts +37 -0
  184. package/dist/detectors/cross-function-reentrancy.js +648 -0
  185. package/dist/detectors/cross-protocol-contagion.d.ts +20 -0
  186. package/dist/detectors/cross-protocol-contagion.js +445 -0
  187. package/dist/detectors/cross-protocol-oracle-collateral.d.ts +38 -0
  188. package/dist/detectors/cross-protocol-oracle-collateral.js +487 -0
  189. package/dist/detectors/cross-vm-reentrancy.d.ts +7 -0
  190. package/dist/detectors/cross-vm-reentrancy.js +484 -0
  191. package/dist/detectors/decimals-mismatch.d.ts +89 -0
  192. package/dist/detectors/decimals-mismatch.js +451 -0
  193. package/dist/detectors/deferred-state-update.d.ts +16 -0
  194. package/dist/detectors/deferred-state-update.js +35 -0
  195. package/dist/detectors/deflationary-token.d.ts +27 -0
  196. package/dist/detectors/deflationary-token.js +751 -0
  197. package/dist/detectors/delegate-transfer-unrestricted-caller.d.ts +44 -0
  198. package/dist/detectors/delegate-transfer-unrestricted-caller.js +410 -0
  199. package/dist/detectors/delegatecall-fallback-reentrancy-bypass.d.ts +14 -0
  200. package/dist/detectors/delegatecall-fallback-reentrancy-bypass.js +241 -0
  201. package/dist/detectors/delegatecall-in-loops.d.ts +7 -0
  202. package/dist/detectors/delegatecall-in-loops.js +129 -0
  203. package/dist/detectors/delegatecall-init-owner-mutator.d.ts +8 -0
  204. package/dist/detectors/delegatecall-init-owner-mutator.js +655 -0
  205. package/dist/detectors/delegatecall-init.d.ts +7 -0
  206. package/dist/detectors/delegatecall-init.js +769 -0
  207. package/dist/detectors/delegatecall-untrusted-implementation.d.ts +41 -0
  208. package/dist/detectors/delegatecall-untrusted-implementation.js +888 -0
  209. package/dist/detectors/delegated-authorization-bypass.d.ts +7 -0
  210. package/dist/detectors/delegated-authorization-bypass.js +370 -0
  211. package/dist/detectors/denial-of-service.d.ts +117 -0
  212. package/dist/detectors/denial-of-service.js +947 -0
  213. package/dist/detectors/division-before-multiplication.d.ts +7 -0
  214. package/dist/detectors/division-before-multiplication.js +303 -0
  215. package/dist/detectors/dn404-mirror-access-control.d.ts +26 -0
  216. package/dist/detectors/dn404-mirror-access-control.js +315 -0
  217. package/dist/detectors/doge-flashloan.d.ts +29 -0
  218. package/dist/detectors/doge-flashloan.js +329 -0
  219. package/dist/detectors/donate-inflation-exchangerate-roundin.d.ts +7 -0
  220. package/dist/detectors/donate-inflation-exchangerate-roundin.js +621 -0
  221. package/dist/detectors/donation-share-inflation.d.ts +24 -0
  222. package/dist/detectors/donation-share-inflation.js +466 -0
  223. package/dist/detectors/dont-let-eth-get-rekt.d.ts +84 -0
  224. package/dist/detectors/dont-let-eth-get-rekt.js +1151 -0
  225. package/dist/detectors/dos-unbounded-loop-external-call-revert.d.ts +37 -0
  226. package/dist/detectors/dos-unbounded-loop-external-call-revert.js +541 -0
  227. package/dist/detectors/eip1167-proxy-reentrancy.d.ts +7 -0
  228. package/dist/detectors/eip1167-proxy-reentrancy.js +508 -0
  229. package/dist/detectors/eip4626-vault-reentrancy.d.ts +32 -0
  230. package/dist/detectors/eip4626-vault-reentrancy.js +312 -0
  231. package/dist/detectors/eip5792-auth-replay.d.ts +45 -0
  232. package/dist/detectors/eip5792-auth-replay.js +519 -0
  233. package/dist/detectors/eip712-domain-separator.d.ts +42 -0
  234. package/dist/detectors/eip712-domain-separator.js +524 -0
  235. package/dist/detectors/eip712-signature-verification.d.ts +49 -0
  236. package/dist/detectors/eip712-signature-verification.js +689 -0
  237. package/dist/detectors/eip7702-auth-replay.d.ts +7 -0
  238. package/dist/detectors/eip7702-auth-replay.js +768 -0
  239. package/dist/detectors/eip7702-cross-chain-replay.d.ts +27 -0
  240. package/dist/detectors/eip7702-cross-chain-replay.js +307 -0
  241. package/dist/detectors/eip7702-delegated-eoa-approval-race.d.ts +39 -0
  242. package/dist/detectors/eip7702-delegated-eoa-approval-race.js +413 -0
  243. package/dist/detectors/eip7702-delegation-reentrancy.d.ts +21 -0
  244. package/dist/detectors/eip7702-delegation-reentrancy.js +705 -0
  245. package/dist/detectors/eip7702-delegation-risk.d.ts +7 -0
  246. package/dist/detectors/eip7702-delegation-risk.js +745 -0
  247. package/dist/detectors/eip7702-eoa-assumption.d.ts +57 -0
  248. package/dist/detectors/eip7702-eoa-assumption.js +461 -0
  249. package/dist/detectors/erc1155-batch-missing-per-id-approval.d.ts +23 -0
  250. package/dist/detectors/erc1155-batch-missing-per-id-approval.js +343 -0
  251. package/dist/detectors/erc1155-reentrancy.d.ts +31 -0
  252. package/dist/detectors/erc1155-reentrancy.js +217 -0
  253. package/dist/detectors/erc1271-stub-implementation.d.ts +21 -0
  254. package/dist/detectors/erc1271-stub-implementation.js +268 -0
  255. package/dist/detectors/erc20-safe-wrapper-return-unchecked.d.ts +43 -0
  256. package/dist/detectors/erc20-safe-wrapper-return-unchecked.js +368 -0
  257. package/dist/detectors/erc20-unchecked-non-standard-return.d.ts +55 -0
  258. package/dist/detectors/erc20-unchecked-non-standard-return.js +454 -0
  259. package/dist/detectors/erc2612-permit-frontrunning.d.ts +23 -0
  260. package/dist/detectors/erc2612-permit-frontrunning.js +246 -0
  261. package/dist/detectors/erc2771-context-spoofing.d.ts +41 -0
  262. package/dist/detectors/erc2771-context-spoofing.js +510 -0
  263. package/dist/detectors/erc4337-validation-storage-access.d.ts +35 -0
  264. package/dist/detectors/erc4337-validation-storage-access.js +232 -0
  265. package/dist/detectors/erc4626-totalassets-stub.d.ts +17 -0
  266. package/dist/detectors/erc4626-totalassets-stub.js +216 -0
  267. package/dist/detectors/erc6909-balance-overflow.d.ts +7 -0
  268. package/dist/detectors/erc6909-balance-overflow.js +688 -0
  269. package/dist/detectors/erc6909-operator-scope.d.ts +49 -0
  270. package/dist/detectors/erc6909-operator-scope.js +494 -0
  271. package/dist/detectors/erc721-unchecked-transfer.d.ts +38 -0
  272. package/dist/detectors/erc721-unchecked-transfer.js +364 -0
  273. package/dist/detectors/erc7579-module-install-without-threshold.d.ts +40 -0
  274. package/dist/detectors/erc7579-module-install-without-threshold.js +338 -0
  275. package/dist/detectors/erc7683-fill-validation.d.ts +53 -0
  276. package/dist/detectors/erc7683-fill-validation.js +758 -0
  277. package/dist/detectors/erc7683-intent-resolution.d.ts +7 -0
  278. package/dist/detectors/erc7683-intent-resolution.js +457 -0
  279. package/dist/detectors/erc777-callback-reentrancy.d.ts +8 -0
  280. package/dist/detectors/erc777-callback-reentrancy.js +439 -0
  281. package/dist/detectors/erc777-reentrancy.d.ts +7 -0
  282. package/dist/detectors/erc777-reentrancy.js +488 -0
  283. package/dist/detectors/erc777-tokens-to-send-reentrancy.d.ts +47 -0
  284. package/dist/detectors/erc777-tokens-to-send-reentrancy.js +674 -0
  285. package/dist/detectors/estuary-token-flaw.d.ts +16 -0
  286. package/dist/detectors/estuary-token-flaw.js +547 -0
  287. package/dist/detectors/euler-debt-token-manipulation.d.ts +32 -0
  288. package/dist/detectors/euler-debt-token-manipulation.js +347 -0
  289. package/dist/detectors/exploiting-a-vulnerability-in-curve-fina.d.ts +29 -0
  290. package/dist/detectors/exploiting-a-vulnerability-in-curve-fina.js +210 -0
  291. package/dist/detectors/fallback-delegatecall-reentrancy.d.ts +14 -0
  292. package/dist/detectors/fallback-delegatecall-reentrancy.js +236 -0
  293. package/dist/detectors/farm-business-logic-flaw-lack-of-access.d.ts +7 -0
  294. package/dist/detectors/farm-business-logic-flaw-lack-of-access.js +665 -0
  295. package/dist/detectors/fee-mechanism-exploitation.d.ts +20 -0
  296. package/dist/detectors/fee-mechanism-exploitation.js +400 -0
  297. package/dist/detectors/fee-on-transfer-balance-mismatch.d.ts +49 -0
  298. package/dist/detectors/fee-on-transfer-balance-mismatch.js +394 -0
  299. package/dist/detectors/fhe-encrypted-input-validation.d.ts +29 -0
  300. package/dist/detectors/fhe-encrypted-input-validation.js +210 -0
  301. package/dist/detectors/fhe-handle-leakage.d.ts +44 -0
  302. package/dist/detectors/fhe-handle-leakage.js +315 -0
  303. package/dist/detectors/fhe-oz-pattern-misuse.d.ts +26 -0
  304. package/dist/detectors/fhe-oz-pattern-misuse.js +311 -0
  305. package/dist/detectors/fhe-state-leakage.d.ts +8 -0
  306. package/dist/detectors/fhe-state-leakage.js +400 -0
  307. package/dist/detectors/fi-bridges.d.ts +33 -0
  308. package/dist/detectors/fi-bridges.js +428 -0
  309. package/dist/detectors/finance-access-control-price-oracle-man.d.ts +9 -0
  310. package/dist/detectors/finance-access-control-price-oracle-man.js +640 -0
  311. package/dist/detectors/finance-bridge-address0safetransferfrom.d.ts +8 -0
  312. package/dist/detectors/finance-bridge-address0safetransferfrom.js +574 -0
  313. package/dist/detectors/finance-business-logic-in-mint.d.ts +54 -0
  314. package/dist/detectors/finance-business-logic-in-mint.js +687 -0
  315. package/dist/detectors/finance-erc667-reentrancy.d.ts +7 -0
  316. package/dist/detectors/finance-erc667-reentrancy.js +509 -0
  317. package/dist/detectors/finance-flashloan-price-oracle-manipul.d.ts +7 -0
  318. package/dist/detectors/finance-flashloan-price-oracle-manipul.js +546 -0
  319. package/dist/detectors/finance-flashloan-reentrancy.d.ts +7 -0
  320. package/dist/detectors/finance-flashloan-reentrancy.js +547 -0
  321. package/dist/detectors/finance-swap-metapool-attack.d.ts +19 -0
  322. package/dist/detectors/finance-swap-metapool-attack.js +321 -0
  323. package/dist/detectors/flashloan-price-manipulation.d.ts +7 -0
  324. package/dist/detectors/flashloan-price-manipulation.js +950 -0
  325. package/dist/detectors/flashloan-reentrancy-rari.d.ts +28 -0
  326. package/dist/detectors/flashloan-reentrancy-rari.js +577 -0
  327. package/dist/detectors/flashloan-reentrancy.d.ts +7 -0
  328. package/dist/detectors/flashloan-reentrancy.js +383 -0
  329. package/dist/detectors/flashloan-token-migrate.d.ts +7 -0
  330. package/dist/detectors/flashloan-token-migrate.js +274 -0
  331. package/dist/detectors/force-fed-eth-state-corruption.d.ts +32 -0
  332. package/dist/detectors/force-fed-eth-state-corruption.js +293 -0
  333. package/dist/detectors/free-mint-bug.d.ts +41 -0
  334. package/dist/detectors/free-mint-bug.js +483 -0
  335. package/dist/detectors/front-running-orderbook-state-update.d.ts +37 -0
  336. package/dist/detectors/front-running-orderbook-state-update.js +471 -0
  337. package/dist/detectors/front-running-shared-collateral-write.d.ts +41 -0
  338. package/dist/detectors/front-running-shared-collateral-write.js +508 -0
  339. package/dist/detectors/fusion-v1-settlement-arbitrary-yul-calld.d.ts +30 -0
  340. package/dist/detectors/fusion-v1-settlement-arbitrary-yul-calld.js +354 -0
  341. package/dist/detectors/generalized-frontrunning.d.ts +7 -0
  342. package/dist/detectors/generalized-frontrunning.js +836 -0
  343. package/dist/detectors/governance-flash-loan.d.ts +62 -0
  344. package/dist/detectors/governance-flash-loan.js +452 -0
  345. package/dist/detectors/governance-flashloan-vote.d.ts +41 -0
  346. package/dist/detectors/governance-flashloan-vote.js +272 -0
  347. package/dist/detectors/halborn-security-report-aave-v3.d.ts +6 -0
  348. package/dist/detectors/halborn-security-report-aave-v3.js +357 -0
  349. package/dist/detectors/incorrect-access-control.d.ts +26 -0
  350. package/dist/detectors/incorrect-access-control.js +328 -0
  351. package/dist/detectors/incorrect-burn-accounting.d.ts +10 -0
  352. package/dist/detectors/incorrect-burn-accounting.js +387 -0
  353. package/dist/detectors/incorrect-dividends-calculation.d.ts +27 -0
  354. package/dist/detectors/incorrect-dividends-calculation.js +524 -0
  355. package/dist/detectors/incorrect-dividends.d.ts +27 -0
  356. package/dist/detectors/incorrect-dividends.js +485 -0
  357. package/dist/detectors/incorrect-input-validation.d.ts +23 -0
  358. package/dist/detectors/incorrect-input-validation.js +312 -0
  359. package/dist/detectors/incorrect-signature-verification.d.ts +26 -0
  360. package/dist/detectors/incorrect-signature-verification.js +530 -0
  361. package/dist/detectors/infinite-loop.d.ts +7 -0
  362. package/dist/detectors/infinite-loop.js +440 -0
  363. package/dist/detectors/infinite-number-of-loans.d.ts +13 -0
  364. package/dist/detectors/infinite-number-of-loans.js +565 -0
  365. package/dist/detectors/inheritance-override.d.ts +26 -0
  366. package/dist/detectors/inheritance-override.js +320 -0
  367. package/dist/detectors/initialization-access-control.d.ts +8 -0
  368. package/dist/detectors/initialization-access-control.js +659 -0
  369. package/dist/detectors/insecure-randomness.d.ts +73 -0
  370. package/dist/detectors/insecure-randomness.js +610 -0
  371. package/dist/detectors/insufficient-access-control-trusted-param.d.ts +39 -0
  372. package/dist/detectors/insufficient-access-control-trusted-param.js +356 -0
  373. package/dist/detectors/insufficient-dvn-threshold.d.ts +32 -0
  374. package/dist/detectors/insufficient-dvn-threshold.js +585 -0
  375. package/dist/detectors/integer-overflow-detector.d.ts +45 -0
  376. package/dist/detectors/integer-overflow-detector.js +284 -0
  377. package/dist/detectors/integer-overflow.d.ts +95 -0
  378. package/dist/detectors/integer-overflow.js +344 -0
  379. package/dist/detectors/integer-underflow.d.ts +7 -0
  380. package/dist/detectors/integer-underflow.js +422 -0
  381. package/dist/detectors/intent-settlement-balance-manipulation.d.ts +22 -0
  382. package/dist/detectors/intent-settlement-balance-manipulation.js +548 -0
  383. package/dist/detectors/l1-to-l2-message-reentrancy.d.ts +7 -0
  384. package/dist/detectors/l1-to-l2-message-reentrancy.js +545 -0
  385. package/dist/detectors/l2-withdrawal-validation.d.ts +8 -0
  386. package/dist/detectors/l2-withdrawal-validation.js +303 -0
  387. package/dist/detectors/lack-of-access-control.d.ts +7 -0
  388. package/dist/detectors/lack-of-access-control.js +425 -0
  389. package/dist/detectors/lack-of-calldata-validation.d.ts +16 -0
  390. package/dist/detectors/lack-of-calldata-validation.js +914 -0
  391. package/dist/detectors/lack-of-input-validation-reentrancy.d.ts +7 -0
  392. package/dist/detectors/lack-of-input-validation-reentrancy.js +637 -0
  393. package/dist/detectors/lack-of-slippage-control.d.ts +7 -0
  394. package/dist/detectors/lack-of-slippage-control.js +513 -0
  395. package/dist/detectors/lack-of-slippage-protection.d.ts +7 -0
  396. package/dist/detectors/lack-of-slippage-protection.js +474 -0
  397. package/dist/detectors/lack-of-validation-data.d.ts +23 -0
  398. package/dist/detectors/lack-of-validation-data.js +391 -0
  399. package/dist/detectors/lack-of-validation-pool.d.ts +7 -0
  400. package/dist/detectors/lack-of-validation-pool.js +492 -0
  401. package/dist/detectors/lack-of-validation-userdata.d.ts +7 -0
  402. package/dist/detectors/lack-of-validation-userdata.js +583 -0
  403. package/dist/detectors/lack-of-validation.d.ts +27 -0
  404. package/dist/detectors/lack-of-validation.js +609 -0
  405. package/dist/detectors/layerzero-dvn-quorum-missing.d.ts +22 -0
  406. package/dist/detectors/layerzero-dvn-quorum-missing.js +464 -0
  407. package/dist/detectors/layerzero-v2-unverified-origin.d.ts +40 -0
  408. package/dist/detectors/layerzero-v2-unverified-origin.js +368 -0
  409. package/dist/detectors/liquidation-accounting-desync.d.ts +14 -0
  410. package/dist/detectors/liquidation-accounting-desync.js +145 -0
  411. package/dist/detectors/liquidation-gain-manipulation.d.ts +42 -0
  412. package/dist/detectors/liquidation-gain-manipulation.js +606 -0
  413. package/dist/detectors/liquidation-price-rounding-advantage.d.ts +26 -0
  414. package/dist/detectors/liquidation-price-rounding-advantage.js +283 -0
  415. package/dist/detectors/liquidity-poisoning.d.ts +25 -0
  416. package/dist/detectors/liquidity-poisoning.js +339 -0
  417. package/dist/detectors/loans-malicious-proposal-price-oracle.d.ts +44 -0
  418. package/dist/detectors/loans-malicious-proposal-price-oracle.js +813 -0
  419. package/dist/detectors/logic-flaw.d.ts +186 -0
  420. package/dist/detectors/logic-flaw.js +3356 -0
  421. package/dist/detectors/manipulation-of-funds.d.ts +31 -0
  422. package/dist/detectors/manipulation-of-funds.js +304 -0
  423. package/dist/detectors/merkl-unsafe-claim-callback.d.ts +22 -0
  424. package/dist/detectors/merkl-unsafe-claim-callback.js +94 -0
  425. package/dist/detectors/mev-boost-timestamp.d.ts +7 -0
  426. package/dist/detectors/mev-boost-timestamp.js +318 -0
  427. package/dist/detectors/mev-merge-exploit.d.ts +29 -0
  428. package/dist/detectors/mev-merge-exploit.js +397 -0
  429. package/dist/detectors/mev-sandwich-vulnerability.d.ts +24 -0
  430. package/dist/detectors/mev-sandwich-vulnerability.js +648 -0
  431. package/dist/detectors/mev-slot-manipulation.d.ts +36 -0
  432. package/dist/detectors/mev-slot-manipulation.js +691 -0
  433. package/dist/detectors/mevbot-insufficient-validation.d.ts +48 -0
  434. package/dist/detectors/mevbot-insufficient-validation.js +574 -0
  435. package/dist/detectors/migration-rebalance-without-bound.d.ts +7 -0
  436. package/dist/detectors/migration-rebalance-without-bound.js +514 -0
  437. package/dist/detectors/mint-hardcoded-asset-parity.d.ts +31 -0
  438. package/dist/detectors/mint-hardcoded-asset-parity.js +356 -0
  439. package/dist/detectors/miscalculation-on-spendallowance.d.ts +7 -0
  440. package/dist/detectors/miscalculation-on-spendallowance.js +188 -0
  441. package/dist/detectors/misconfiguration.d.ts +27 -0
  442. package/dist/detectors/misconfiguration.js +410 -0
  443. package/dist/detectors/missing-access-control-caller-supplied-auth.d.ts +7 -0
  444. package/dist/detectors/missing-access-control-caller-supplied-auth.js +550 -0
  445. package/dist/detectors/missing-access-control-receiver-payout.d.ts +7 -0
  446. package/dist/detectors/missing-access-control-receiver-payout.js +460 -0
  447. package/dist/detectors/missing-access-control-role-or-transferfrom.d.ts +7 -0
  448. package/dist/detectors/missing-access-control-role-or-transferfrom.js +663 -0
  449. package/dist/detectors/missing-access-control.d.ts +19 -0
  450. package/dist/detectors/missing-access-control.js +781 -0
  451. package/dist/detectors/missing-sequencer-uptime-check.d.ts +30 -0
  452. package/dist/detectors/missing-sequencer-uptime-check.js +348 -0
  453. package/dist/detectors/missing-storage-gap.d.ts +19 -0
  454. package/dist/detectors/missing-storage-gap.js +193 -0
  455. package/dist/detectors/missing-swap-deadline-slippage.d.ts +31 -0
  456. package/dist/detectors/missing-swap-deadline-slippage.js +231 -0
  457. package/dist/detectors/missing-zk-proof-verification.d.ts +60 -0
  458. package/dist/detectors/missing-zk-proof-verification.js +547 -0
  459. package/dist/detectors/my-experience-with-yearn-finance.d.ts +7 -0
  460. package/dist/detectors/my-experience-with-yearn-finance.js +552 -0
  461. package/dist/detectors/network-bridge-ronin.d.ts +7 -0
  462. package/dist/detectors/network-bridge-ronin.js +408 -0
  463. package/dist/detectors/network-bridge.d.ts +7 -0
  464. package/dist/detectors/network-bridge.js +444 -0
  465. package/dist/detectors/network-underflow.d.ts +7 -0
  466. package/dist/detectors/network-underflow.js +517 -0
  467. package/dist/detectors/nft-denial-of-service.d.ts +7 -0
  468. package/dist/detectors/nft-denial-of-service.js +223 -0
  469. package/dist/detectors/nft-marketplace-order-reentrancy.d.ts +7 -0
  470. package/dist/detectors/nft-marketplace-order-reentrancy.js +427 -0
  471. package/dist/detectors/nft-token-standard-access-control.d.ts +7 -0
  472. package/dist/detectors/nft-token-standard-access-control.js +455 -0
  473. package/dist/detectors/oracle-manipulation-amm-spot-price.d.ts +42 -0
  474. package/dist/detectors/oracle-manipulation-amm-spot-price.js +321 -0
  475. package/dist/detectors/oracle-manipulation-liquidity-withdrawal.d.ts +27 -0
  476. package/dist/detectors/oracle-manipulation-liquidity-withdrawal.js +192 -0
  477. package/dist/detectors/oracle-manipulation.d.ts +90 -0
  478. package/dist/detectors/oracle-manipulation.js +1023 -0
  479. package/dist/detectors/oracle-vortex-manipulation.d.ts +30 -0
  480. package/dist/detectors/oracle-vortex-manipulation.js +473 -0
  481. package/dist/detectors/overpriced-asset-in-oracle.d.ts +41 -0
  482. package/dist/detectors/overpriced-asset-in-oracle.js +420 -0
  483. package/dist/detectors/oz-access-control-roles.d.ts +33 -0
  484. package/dist/detectors/oz-access-control-roles.js +359 -0
  485. package/dist/detectors/pair-manipulation-transfer-hook.d.ts +38 -0
  486. package/dist/detectors/pair-manipulation-transfer-hook.js +366 -0
  487. package/dist/detectors/parameter-access-control.d.ts +47 -0
  488. package/dist/detectors/parameter-access-control.js +511 -0
  489. package/dist/detectors/parameter-manipulation.d.ts +7 -0
  490. package/dist/detectors/parameter-manipulation.js +505 -0
  491. package/dist/detectors/parity-multisig-delegatecall.d.ts +7 -0
  492. package/dist/detectors/parity-multisig-delegatecall.js +707 -0
  493. package/dist/detectors/permissionless-claim-amm-spot-pricing.d.ts +7 -0
  494. package/dist/detectors/permissionless-claim-amm-spot-pricing.js +351 -0
  495. package/dist/detectors/permit-future-dated-deadline.d.ts +31 -0
  496. package/dist/detectors/permit-future-dated-deadline.js +339 -0
  497. package/dist/detectors/phishing-attack-bybit.d.ts +37 -0
  498. package/dist/detectors/phishing-attack-bybit.js +513 -0
  499. package/dist/detectors/post-insolvency-check.d.ts +7 -0
  500. package/dist/detectors/post-insolvency-check.js +277 -0
  501. package/dist/detectors/precision-loss-vulnerability.d.ts +7 -0
  502. package/dist/detectors/precision-loss-vulnerability.js +472 -0
  503. package/dist/detectors/precision-truncation.d.ts +8 -0
  504. package/dist/detectors/precision-truncation.js +425 -0
  505. package/dist/detectors/price-dependency-veth.d.ts +41 -0
  506. package/dist/detectors/price-dependency-veth.js +588 -0
  507. package/dist/detectors/price-feed-verification.d.ts +7 -0
  508. package/dist/detectors/price-feed-verification.js +557 -0
  509. package/dist/detectors/price-manipulation-reentrancy.d.ts +32 -0
  510. package/dist/detectors/price-manipulation-reentrancy.js +445 -0
  511. package/dist/detectors/price-manipulation-via-reentranc.d.ts +7 -0
  512. package/dist/detectors/price-manipulation-via-reentranc.js +569 -0
  513. package/dist/detectors/price-oracle-manipulation.d.ts +25 -0
  514. package/dist/detectors/price-oracle-manipulation.js +530 -0
  515. package/dist/detectors/project-instant-rewards-unlocked.d.ts +6 -0
  516. package/dist/detectors/project-instant-rewards-unlocked.js +462 -0
  517. package/dist/detectors/protocol-reentrancy.d.ts +7 -0
  518. package/dist/detectors/protocol-reentrancy.js +457 -0
  519. package/dist/detectors/proxy-init-race.d.ts +11 -0
  520. package/dist/detectors/proxy-init-race.js +634 -0
  521. package/dist/detectors/proxy-storage-slot-collision.d.ts +7 -0
  522. package/dist/detectors/proxy-storage-slot-collision.js +135 -0
  523. package/dist/detectors/public-internal-function.d.ts +39 -0
  524. package/dist/detectors/public-internal-function.js +233 -0
  525. package/dist/detectors/quote-silent-zero.d.ts +25 -0
  526. package/dist/detectors/quote-silent-zero.js +156 -0
  527. package/dist/detectors/readonly-reentrancy.d.ts +9 -0
  528. package/dist/detectors/readonly-reentrancy.js +108 -0
  529. package/dist/detectors/receipt-redemption-missing-validation.d.ts +31 -0
  530. package/dist/detectors/receipt-redemption-missing-validation.js +453 -0
  531. package/dist/detectors/reentrancy-balance.d.ts +36 -0
  532. package/dist/detectors/reentrancy-balance.js +577 -0
  533. package/dist/detectors/reentrancy-business-logic-game.d.ts +36 -0
  534. package/dist/detectors/reentrancy-business-logic-game.js +616 -0
  535. package/dist/detectors/reentrancy-on-sell-nft.d.ts +23 -0
  536. package/dist/detectors/reentrancy-on-sell-nft.js +510 -0
  537. package/dist/detectors/reflection-token-balance-desync.d.ts +28 -0
  538. package/dist/detectors/reflection-token-balance-desync.js +246 -0
  539. package/dist/detectors/registry-engine.d.ts +34 -0
  540. package/dist/detectors/registry-engine.js +388 -0
  541. package/dist/detectors/rollup-unvalidated-state-update.d.ts +35 -0
  542. package/dist/detectors/rollup-unvalidated-state-update.js +286 -0
  543. package/dist/detectors/s-horizon-bridge-private-key-compromis.d.ts +8 -0
  544. package/dist/detectors/s-horizon-bridge-private-key-compromis.js +615 -0
  545. package/dist/detectors/share-price-manipulation.d.ts +7 -0
  546. package/dist/detectors/share-price-manipulation.js +653 -0
  547. package/dist/detectors/signature-replay.d.ts +30 -0
  548. package/dist/detectors/signature-replay.js +367 -0
  549. package/dist/detectors/simpleswap-unverified-approval.d.ts +27 -0
  550. package/dist/detectors/simpleswap-unverified-approval.js +198 -0
  551. package/dist/detectors/single-spot-oracle-collateral-valuation.d.ts +22 -0
  552. package/dist/detectors/single-spot-oracle-collateral-valuation.js +419 -0
  553. package/dist/detectors/skim-token-balance.d.ts +7 -0
  554. package/dist/detectors/skim-token-balance.js +788 -0
  555. package/dist/detectors/sky-oft-governance-payload.d.ts +7 -0
  556. package/dist/detectors/sky-oft-governance-payload.js +515 -0
  557. package/dist/detectors/sky-oft-governance-truncation.d.ts +32 -0
  558. package/dist/detectors/sky-oft-governance-truncation.js +377 -0
  559. package/dist/detectors/solana-evm-bridge-truncation.d.ts +7 -0
  560. package/dist/detectors/solana-evm-bridge-truncation.js +638 -0
  561. package/dist/detectors/solhint-unchecked-low-level-call.d.ts +74 -0
  562. package/dist/detectors/solhint-unchecked-low-level-call.js +463 -0
  563. package/dist/detectors/stablecoin-pair-spot-oracle.d.ts +7 -0
  564. package/dist/detectors/stablecoin-pair-spot-oracle.js +364 -0
  565. package/dist/detectors/staked-rate-as-oracle.d.ts +44 -0
  566. package/dist/detectors/staked-rate-as-oracle.js +497 -0
  567. package/dist/detectors/stale-oracle.d.ts +63 -0
  568. package/dist/detectors/stale-oracle.js +649 -0
  569. package/dist/detectors/starkware-proof-validation-gap.d.ts +18 -0
  570. package/dist/detectors/starkware-proof-validation-gap.js +629 -0
  571. package/dist/detectors/steth-transfer-reentrancy.d.ts +8 -0
  572. package/dist/detectors/steth-transfer-reentrancy.js +317 -0
  573. package/dist/detectors/storage-collision-malicious-proposal.d.ts +27 -0
  574. package/dist/detectors/storage-collision-malicious-proposal.js +386 -0
  575. package/dist/detectors/timestamp-manipulation.d.ts +49 -0
  576. package/dist/detectors/timestamp-manipulation.js +383 -0
  577. package/dist/detectors/token-access-control.d.ts +7 -0
  578. package/dist/detectors/token-access-control.js +544 -0
  579. package/dist/detectors/token-incorrect-signature-verification.d.ts +23 -0
  580. package/dist/detectors/token-incorrect-signature-verification.js +434 -0
  581. package/dist/detectors/token-transfer-logic-flaw.d.ts +33 -0
  582. package/dist/detectors/token-transfer-logic-flaw.js +267 -0
  583. package/dist/detectors/transfer-double-debit-pool-recipient.d.ts +7 -0
  584. package/dist/detectors/transfer-double-debit-pool-recipient.js +542 -0
  585. package/dist/detectors/treasury-reentrancy.d.ts +7 -0
  586. package/dist/detectors/treasury-reentrancy.js +442 -0
  587. package/dist/detectors/tstore-poison.d.ts +32 -0
  588. package/dist/detectors/tstore-poison.js +417 -0
  589. package/dist/detectors/tstore-race-condition.d.ts +7 -0
  590. package/dist/detectors/tstore-race-condition.js +632 -0
  591. package/dist/detectors/types.d.ts +85 -0
  592. package/dist/detectors/types.js +20 -0
  593. package/dist/detectors/unauthorized-payer-transferfrom.d.ts +66 -0
  594. package/dist/detectors/unauthorized-payer-transferfrom.js +339 -0
  595. package/dist/detectors/unauthorized-transferfrom-shell.d.ts +7 -0
  596. package/dist/detectors/unauthorized-transferfrom-shell.js +504 -0
  597. package/dist/detectors/unauthorized-transferfrom.d.ts +16 -0
  598. package/dist/detectors/unauthorized-transferfrom.js +838 -0
  599. package/dist/detectors/unbound-zk-verifier-input.d.ts +7 -0
  600. package/dist/detectors/unbound-zk-verifier-input.js +445 -0
  601. package/dist/detectors/unbounded-share-price-collateral-oracle.d.ts +48 -0
  602. package/dist/detectors/unbounded-share-price-collateral-oracle.js +566 -0
  603. package/dist/detectors/uncapped-reward-emission.d.ts +7 -0
  604. package/dist/detectors/uncapped-reward-emission.js +493 -0
  605. package/dist/detectors/unchecked-call-forwarding.d.ts +31 -0
  606. package/dist/detectors/unchecked-call-forwarding.js +330 -0
  607. package/dist/detectors/unchecked-external-call-unconditional-state-mutation.d.ts +18 -0
  608. package/dist/detectors/unchecked-external-call-unconditional-state-mutation.js +311 -0
  609. package/dist/detectors/unchecked-external-call.d.ts +66 -0
  610. package/dist/detectors/unchecked-external-call.js +389 -0
  611. package/dist/detectors/unchecked-oft-return.d.ts +13 -0
  612. package/dist/detectors/unchecked-oft-return.js +118 -0
  613. package/dist/detectors/unguarded-governance-execution.d.ts +35 -0
  614. package/dist/detectors/unguarded-governance-execution.js +422 -0
  615. package/dist/detectors/unguarded-governance-executor.d.ts +35 -0
  616. package/dist/detectors/unguarded-governance-executor.js +349 -0
  617. package/dist/detectors/unindexed-event-address.d.ts +7 -0
  618. package/dist/detectors/unindexed-event-address.js +268 -0
  619. package/dist/detectors/uninitialized-implementation.d.ts +27 -0
  620. package/dist/detectors/uninitialized-implementation.js +333 -0
  621. package/dist/detectors/uninitialized-storage-pointer.d.ts +7 -0
  622. package/dist/detectors/uninitialized-storage-pointer.js +110 -0
  623. package/dist/detectors/uniswap-skim-token-balance-attack.d.ts +8 -0
  624. package/dist/detectors/uniswap-skim-token-balance-attack.js +331 -0
  625. package/dist/detectors/uniswap-v4-hook-state-manipulation.d.ts +7 -0
  626. package/dist/detectors/uniswap-v4-hook-state-manipulation.js +296 -0
  627. package/dist/detectors/unprotected-admin-or-fund-sink.d.ts +7 -0
  628. package/dist/detectors/unprotected-admin-or-fund-sink.js +643 -0
  629. package/dist/detectors/unprotected-dex-swap.d.ts +43 -0
  630. package/dist/detectors/unprotected-dex-swap.js +334 -0
  631. package/dist/detectors/unprotected-initializer.d.ts +7 -0
  632. package/dist/detectors/unprotected-initializer.js +707 -0
  633. package/dist/detectors/unprotected-pair-initializer.d.ts +22 -0
  634. package/dist/detectors/unprotected-pair-initializer.js +359 -0
  635. package/dist/detectors/unprotected-upgrade-function.d.ts +7 -0
  636. package/dist/detectors/unprotected-upgrade-function.js +180 -0
  637. package/dist/detectors/unreachable-code-0.8.28.d.ts +19 -0
  638. package/dist/detectors/unreachable-code-0.8.28.js +206 -0
  639. package/dist/detectors/unsafe-proxy-storage.d.ts +7 -0
  640. package/dist/detectors/unsafe-proxy-storage.js +436 -0
  641. package/dist/detectors/unsafe-transient-storage.d.ts +7 -0
  642. package/dist/detectors/unsafe-transient-storage.js +1052 -0
  643. package/dist/detectors/unsafe-tx-origin.d.ts +9 -0
  644. package/dist/detectors/unsafe-tx-origin.js +179 -0
  645. package/dist/detectors/unsigned-validity-window.d.ts +20 -0
  646. package/dist/detectors/unsigned-validity-window.js +220 -0
  647. package/dist/detectors/unvalidated-interface-address.d.ts +25 -0
  648. package/dist/detectors/unvalidated-interface-address.js +377 -0
  649. package/dist/detectors/uups-uninitialized-storage.d.ts +9 -0
  650. package/dist/detectors/uups-uninitialized-storage.js +366 -0
  651. package/dist/detectors/v2-error-k-value-attack.d.ts +33 -0
  652. package/dist/detectors/v2-error-k-value-attack.js +276 -0
  653. package/dist/detectors/v2-k-invariant-bypass.d.ts +33 -0
  654. package/dist/detectors/v2-k-invariant-bypass.js +283 -0
  655. package/dist/detectors/v4-hook-reentrancy.d.ts +9 -0
  656. package/dist/detectors/v4-hook-reentrancy.js +488 -0
  657. package/dist/detectors/vault-inflation-rounding.d.ts +23 -0
  658. package/dist/detectors/vault-inflation-rounding.js +477 -0
  659. package/dist/detectors/vault-share-price-manipulation.d.ts +7 -0
  660. package/dist/detectors/vault-share-price-manipulation.js +332 -0
  661. package/dist/detectors/vortex-interaction-guard.d.ts +45 -0
  662. package/dist/detectors/vortex-interaction-guard.js +275 -0
  663. package/dist/detectors/vortex-protocol-reentrancy-guard.d.ts +27 -0
  664. package/dist/detectors/vortex-protocol-reentrancy-guard.js +408 -0
  665. package/dist/detectors/vulnerable-price-dependency.d.ts +41 -0
  666. package/dist/detectors/vulnerable-price-dependency.js +473 -0
  667. package/dist/detectors/weak-random-mint.d.ts +37 -0
  668. package/dist/detectors/weak-random-mint.js +271 -0
  669. package/dist/detectors/withdraw-be-to-withdraw.d.ts +26 -0
  670. package/dist/detectors/withdraw-be-to-withdraw.js +329 -0
  671. package/dist/detectors/wrong-function-visibility.d.ts +29 -0
  672. package/dist/detectors/wrong-function-visibility.js +147 -0
  673. package/dist/detectors/wrong-price-calculation.d.ts +42 -0
  674. package/dist/detectors/wrong-price-calculation.js +387 -0
  675. package/dist/detectors/yearn-vault-v2-share-price-manipulation.d.ts +32 -0
  676. package/dist/detectors/yearn-vault-v2-share-price-manipulation.js +248 -0
  677. package/dist/detectors/zero-fee.d.ts +7 -0
  678. package/dist/detectors/zero-fee.js +596 -0
  679. package/dist/detectors/zetachain-gateway-hack-analysis.d.ts +7 -0
  680. package/dist/detectors/zetachain-gateway-hack-analysis.js +629 -0
  681. package/dist/detectors/zk-rollup-da-gap.d.ts +8 -0
  682. package/dist/detectors/zk-rollup-da-gap.js +322 -0
  683. package/dist/detectors/zksync-batch-validation.d.ts +8 -0
  684. package/dist/detectors/zksync-batch-validation.js +461 -0
  685. package/dist/detectors/zksync-era-rollup-state-update.d.ts +60 -0
  686. package/dist/detectors/zksync-era-rollup-state-update.js +360 -0
  687. package/dist/detectors/zksync-simulation-drift.d.ts +35 -0
  688. package/dist/detectors/zksync-simulation-drift.js +309 -0
  689. package/dist/exit-codes.d.ts +15 -0
  690. package/dist/exit-codes.js +18 -0
  691. package/dist/formatters/github-actions.d.ts +2 -0
  692. package/dist/formatters/github-actions.js +61 -0
  693. package/dist/formatters/sarif.d.ts +24 -0
  694. package/dist/formatters/sarif.js +670 -0
  695. package/dist/formatters/text.d.ts +14 -0
  696. package/dist/formatters/text.js +152 -0
  697. package/dist/fp-rates.json +70 -0
  698. package/dist/identity/diff-baseline.d.ts +16 -0
  699. package/dist/identity/diff-baseline.js +152 -0
  700. package/dist/identity/hashing.d.ts +39 -0
  701. package/dist/identity/hashing.js +96 -0
  702. package/dist/index.d.ts +174 -0
  703. package/dist/index.js +358 -0
  704. package/dist/parallel-scan.d.ts +66 -0
  705. package/dist/parallel-scan.js +227 -0
  706. package/dist/registry.d.ts +17 -0
  707. package/dist/registry.js +118 -0
  708. package/dist/rules/glob.d.ts +5 -0
  709. package/dist/rules/glob.js +76 -0
  710. package/dist/rules/suppressions.d.ts +23 -0
  711. package/dist/rules/suppressions.js +136 -0
  712. package/dist/rules/tiers.d.ts +23 -0
  713. package/dist/rules/tiers.js +341 -0
  714. package/dist/scan-worker.d.ts +1 -0
  715. package/dist/scan-worker.js +61 -0
  716. package/dist/scan.d.ts +24 -0
  717. package/dist/scan.js +558 -0
  718. package/dist/semantic/contracts.d.ts +10 -0
  719. package/dist/semantic/contracts.js +141 -0
  720. package/dist/semantic/diagnostics.d.ts +29 -0
  721. package/dist/semantic/diagnostics.js +25 -0
  722. package/dist/semantic/eog.d.ts +56 -0
  723. package/dist/semantic/eog.js +545 -0
  724. package/dist/semantic/imports.d.ts +88 -0
  725. package/dist/semantic/imports.js +246 -0
  726. package/dist/semantic/index.d.ts +2 -0
  727. package/dist/semantic/index.js +8 -0
  728. package/dist/semantic/inheritance.d.ts +33 -0
  729. package/dist/semantic/inheritance.js +137 -0
  730. package/dist/semantic/model.d.ts +95 -0
  731. package/dist/semantic/model.js +232 -0
  732. package/dist/semantic/taint-tracker.d.ts +49 -0
  733. package/dist/semantic/taint-tracker.js +410 -0
  734. package/dist/semantic/types.d.ts +119 -0
  735. package/dist/semantic/types.js +18 -0
  736. package/dist/severity.d.ts +10 -0
  737. package/dist/severity.js +78 -0
  738. package/package.json +52 -0
@@ -0,0 +1,769 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.DelegatecallInitDetector = void 0;
4
+ const RULE_ID = 'delegatecall-init';
5
+ const SOURCE = 'x-20170719-parity-multisig';
6
+ const INIT_FUNCTION_NAMES = new Set(['init', 'initialize', 'setup']);
7
+ const OWNER_STORAGE_NAMES = /^(isOwner|owner|owners|ownerCount|admin|admins|authority|governance|governor)$/i;
8
+ const ACCESS_CONTROL_MODIFIERS = new Set([
9
+ 'onlyowner',
10
+ 'onlyrole',
11
+ 'onlyadmin',
12
+ 'onlyauthorized',
13
+ 'onlyoperator',
14
+ 'onlygovernance',
15
+ 'onlygovernor',
16
+ 'onlyguardian',
17
+ 'onlymanager',
18
+ ]);
19
+ const ONE_TIME_GUARD_MODIFIERS = new Set([
20
+ 'initializer',
21
+ 'reinitializer',
22
+ 'onlyonce',
23
+ 'oncedonly',
24
+ 'noninitialized',
25
+ 'whennotinitialized',
26
+ ]);
27
+ class DelegatecallInitDetector {
28
+ id = RULE_ID;
29
+ patternKey = RULE_ID;
30
+ supportedAstKinds = ['parser', 'solc'];
31
+ scanAst(ast, file, sourceText) {
32
+ if (!ast || typeof ast !== 'object')
33
+ return [];
34
+ const findings = [];
35
+ const lineOffsets = buildLineOffsets(sourceText);
36
+ const contracts = collectContracts(ast)
37
+ .filter(contractNode => !isInterfaceLike(contractNode))
38
+ .map(contractNode => buildContractInfo(contractNode));
39
+ const contractsByName = new Map(contracts.map(contract => [contract.name, contract]));
40
+ const initCandidates = collectInitCandidates(contracts);
41
+ const delegatecalls = collectDelegatecallPaths(contracts);
42
+ const emitted = new Set();
43
+ for (const call of delegatecalls) {
44
+ for (const candidate of matchingInitCandidates(call, initCandidates, contractsByName)) {
45
+ const key = `${call.callerContract.name}.${call.caller.name}:${call.target}:${candidate.contract.name}.${candidate.fn.name}`;
46
+ if (emitted.has(key))
47
+ continue;
48
+ emitted.add(key);
49
+ const loc = getLoc(call.node, lineOffsets) || getLoc(call.caller.node, lineOffsets) || { line: 0, column: 0 };
50
+ const callerName = `${call.callerContract.name}.${call.caller.name}`;
51
+ const initializerPath = candidate.path.map(name => `${candidate.contract.name}.${name}`).join(' -> ');
52
+ findings.push({
53
+ file,
54
+ contract: call.callerContract.name,
55
+ 'function': call.caller.name,
56
+ line: loc.line,
57
+ endLine: loc.line,
58
+ column: loc.column,
59
+ pattern: RULE_ID,
60
+ confidence: 'high',
61
+ ruleId: RULE_ID,
62
+ severity: 'critical',
63
+ message: `Externally reachable delegatecall in '${callerName}' can invoke unprotected initializer path '${initializerPath}' through target '${call.target}'.`,
64
+ rationale: 'Mirrors the 2017-07-19 Parity multisig hack: a proxy-style caller forwards data by delegatecall to initialization logic that overwrites privileged ownership storage without an effective one-time initialization guard.',
65
+ suggestedFix: 'Guard the initializer with an OpenZeppelin `initializer`/`reinitializer` modifier or an explicit initialized-state check that is set during initialization, and restrict public delegatecall forwarding to trusted callers/selectors.',
66
+ contractName: call.callerContract.name,
67
+ functionName: call.caller.name,
68
+ sourceLocation: { line: loc.line, column: loc.column },
69
+ caller: callerName,
70
+ delegateTarget: call.target,
71
+ initializerPath,
72
+ trace: `caller: ${callerName}; delegate target: ${call.target}; initializer path: ${initializerPath}`,
73
+ operationType: 'delegatecall',
74
+ externalCallNode: call.node,
75
+ findingId: '',
76
+ contractHash: '',
77
+ source: SOURCE,
78
+ });
79
+ }
80
+ }
81
+ return findings;
82
+ }
83
+ }
84
+ exports.DelegatecallInitDetector = DelegatecallInitDetector;
85
+ function isCanonicalInitName(name) {
86
+ if (!name)
87
+ return false;
88
+ const normalized = name.toLowerCase();
89
+ return INIT_FUNCTION_NAMES.has(normalized) || normalized.startsWith('init');
90
+ }
91
+ function buildContractInfo(contractNode) {
92
+ const ownerNames = collectOwnerStateNames(contractNode);
93
+ const functions = new Map();
94
+ for (const fn of getContractFunctions(contractNode)) {
95
+ const name = functionDisplayName(fn);
96
+ const body = getFunctionBody(fn);
97
+ functions.set(name, {
98
+ node: fn,
99
+ name,
100
+ directMutation: !!body && bodyMutatesOwnerStorage(body, ownerNames),
101
+ calls: body ? collectSameContractCalls(body) : new Set(),
102
+ });
103
+ }
104
+ return {
105
+ node: contractNode,
106
+ name: getName(contractNode) || '<anonymous>',
107
+ ownerNames,
108
+ stateTypes: collectStateVariableTypes(contractNode),
109
+ functions,
110
+ };
111
+ }
112
+ function collectInitCandidates(contracts) {
113
+ const candidates = [];
114
+ for (const contract of contracts) {
115
+ if (contract.ownerNames.size === 0)
116
+ continue;
117
+ for (const fn of contract.functions.values()) {
118
+ if (!isCanonicalInitName(fn.name))
119
+ continue;
120
+ if (isConstructor(fn.node))
121
+ continue;
122
+ if (!isExternallyCallable(fn.node))
123
+ continue;
124
+ const body = getFunctionBody(fn.node);
125
+ if (!body)
126
+ continue;
127
+ if (hasEffectiveOneTimeGuard(fn.node, body))
128
+ continue;
129
+ if (hasCallerAccessControl(fn.node, body))
130
+ continue;
131
+ const path = ownerMutationPath(fn, contract.functions, new Set());
132
+ if (!path)
133
+ continue;
134
+ candidates.push({ contract, fn, path });
135
+ }
136
+ }
137
+ return candidates;
138
+ }
139
+ function collectDelegatecallPaths(contracts) {
140
+ const paths = [];
141
+ for (const contract of contracts) {
142
+ for (const fn of contract.functions.values()) {
143
+ if (!isExternallyReachableCaller(fn.node))
144
+ continue;
145
+ if (hasCallerAccessControl(fn.node, getFunctionBody(fn.node)))
146
+ continue;
147
+ collectDelegatecallsFromFunction(contract, fn, contract.functions, new Set(), paths);
148
+ }
149
+ }
150
+ return paths;
151
+ }
152
+ function collectDelegatecallsFromFunction(contract, caller, functions, seen, out) {
153
+ collectDelegatecallsFromCurrentFunction(contract, caller, caller, functions, seen, out);
154
+ }
155
+ function collectDelegatecallsFromCurrentFunction(contract, externalCaller, current, functions, seen, out) {
156
+ if (seen.has(current.name))
157
+ return;
158
+ seen.add(current.name);
159
+ const body = getFunctionBody(current.node);
160
+ if (!body)
161
+ return;
162
+ walkAny(body, node => {
163
+ const delegatecall = delegatecallDetails(node, contract);
164
+ if (delegatecall) {
165
+ out.push({ callerContract: contract, caller: externalCaller, node, ...delegatecall });
166
+ }
167
+ return false;
168
+ });
169
+ for (const calledName of current.calls) {
170
+ const called = functions.get(calledName);
171
+ if (called && !isExternallyReachableCaller(called.node)) {
172
+ collectDelegatecallsFromCurrentFunction(contract, externalCaller, called, functions, seen, out);
173
+ }
174
+ }
175
+ }
176
+ function delegatecallDetails(node, contract) {
177
+ if (!isNode(node, 'FunctionCall'))
178
+ return undefined;
179
+ const callee = node.expression;
180
+ if (!isNode(callee, 'MemberAccess') || String(callee.memberName || '') !== 'delegatecall')
181
+ return undefined;
182
+ const targetExpr = callee.expression;
183
+ const target = expressionToString(targetExpr);
184
+ return {
185
+ target,
186
+ targetType: delegateTargetType(targetExpr, contract),
187
+ selector: selectorFromDelegatecallArgs(node.arguments || []),
188
+ };
189
+ }
190
+ function matchingInitCandidates(call, candidates, contractsByName) {
191
+ const targetResolved = !!(call.targetType && contractsByName.has(call.targetType));
192
+ if (!targetResolved && !call.selector)
193
+ return [];
194
+ let scoped = candidates.filter(candidate => candidate.contract.name !== call.callerContract.name);
195
+ if (targetResolved) {
196
+ scoped = scoped.filter(candidate => candidate.contract.name === call.targetType);
197
+ }
198
+ if (call.selector) {
199
+ scoped = scoped.filter(candidate => candidate.fn.name === call.selector);
200
+ }
201
+ return scoped;
202
+ }
203
+ function ownerMutationPath(info, functions, seen) {
204
+ if (info.directMutation)
205
+ return [info.name];
206
+ if (seen.has(info.name))
207
+ return undefined;
208
+ seen.add(info.name);
209
+ for (const calledName of info.calls) {
210
+ const called = functions.get(calledName);
211
+ if (!called)
212
+ continue;
213
+ const tail = ownerMutationPath(called, functions, seen);
214
+ if (tail)
215
+ return [info.name, ...tail];
216
+ }
217
+ return undefined;
218
+ }
219
+ function collectOwnerStateNames(contractNode) {
220
+ const result = new Set();
221
+ for (const child of getContractMembers(contractNode)) {
222
+ if (isNode(child, 'StateVariableDeclaration')) {
223
+ for (const v of child.variables || []) {
224
+ if (v?.name && isPrivilegedStorageName(String(v.name)))
225
+ result.add(String(v.name));
226
+ }
227
+ }
228
+ else if (isNode(child, 'VariableDeclaration') && child.stateVariable) {
229
+ if (child.name && isPrivilegedStorageName(String(child.name)))
230
+ result.add(String(child.name));
231
+ }
232
+ }
233
+ return result;
234
+ }
235
+ function collectStateVariableTypes(contractNode) {
236
+ const result = new Map();
237
+ for (const child of getContractMembers(contractNode)) {
238
+ if (isNode(child, 'StateVariableDeclaration')) {
239
+ for (const v of child.variables || []) {
240
+ if (v?.name) {
241
+ const typeName = variableTypeName(v);
242
+ if (typeName)
243
+ result.set(String(v.name), typeName);
244
+ }
245
+ }
246
+ }
247
+ else if (isNode(child, 'VariableDeclaration') && child.stateVariable) {
248
+ const typeName = variableTypeName(child);
249
+ if (child.name && typeName)
250
+ result.set(String(child.name), typeName);
251
+ }
252
+ }
253
+ return result;
254
+ }
255
+ function variableTypeName(variable) {
256
+ const typeName = variable?.typeName;
257
+ if (!typeName || typeof typeName !== 'object')
258
+ return '';
259
+ if (typeof typeName.name === 'string')
260
+ return typeName.name;
261
+ if (typeof typeName.namePath === 'string')
262
+ return typeName.namePath.split('.').pop() || '';
263
+ if (typeName.pathNode)
264
+ return variableTypeName({ typeName: typeName.pathNode });
265
+ if (typeof typeName.typeString === 'string')
266
+ return typeName.typeString.split(' ').pop() || '';
267
+ return '';
268
+ }
269
+ function isPrivilegedStorageName(name) {
270
+ if (!name)
271
+ return false;
272
+ const normalized = name.length > 1 && name.startsWith('_') ? name.slice(1) : name;
273
+ return OWNER_STORAGE_NAMES.test(normalized);
274
+ }
275
+ function bodyMutatesOwnerStorage(body, ownerNames) {
276
+ return walkAny(body, node => isOwnerAssignment(node, ownerNames) || isOwnerArrayPush(node, ownerNames));
277
+ }
278
+ function isOwnerAssignment(node, ownerNames) {
279
+ if (!node || typeof node !== 'object')
280
+ return false;
281
+ let left = null;
282
+ if (isNode(node, 'BinaryOperation')) {
283
+ const operator = String(node.operator || '');
284
+ if (!operator.includes('=') || ['==', '===', '!=', '!==', '<=', '>='].includes(operator))
285
+ return false;
286
+ left = node.left || node.leftExpression;
287
+ }
288
+ else if (isNode(node, 'Assignment')) {
289
+ if (!String(node.operator || '').includes('='))
290
+ return false;
291
+ left = node.leftHandSide;
292
+ }
293
+ else {
294
+ return false;
295
+ }
296
+ return expressionTargetsOwnerStorage(left, ownerNames);
297
+ }
298
+ function isOwnerArrayPush(node, ownerNames) {
299
+ if (!isNode(node, 'FunctionCall'))
300
+ return false;
301
+ const callee = node.expression;
302
+ if (!isNode(callee, 'MemberAccess'))
303
+ return false;
304
+ if (String(callee.memberName || '') !== 'push')
305
+ return false;
306
+ return expressionTargetsOwnerStorage(callee.expression, ownerNames);
307
+ }
308
+ function expressionTargetsOwnerStorage(expr, ownerNames) {
309
+ if (!expr || typeof expr !== 'object')
310
+ return false;
311
+ if (isNode(expr, 'Identifier'))
312
+ return ownerNames.has(String(expr.name || ''));
313
+ if (isNode(expr, 'IndexAccess')) {
314
+ return expressionTargetsOwnerStorage(expr.base || expr.baseExpression, ownerNames);
315
+ }
316
+ if (isNode(expr, 'MemberAccess')) {
317
+ if (ownerNames.has(String(expr.memberName || '')))
318
+ return true;
319
+ return expressionTargetsOwnerStorage(expr.expression, ownerNames);
320
+ }
321
+ if (isNode(expr, 'TupleExpression')) {
322
+ return (expr.components || []).some((component) => expressionTargetsOwnerStorage(component, ownerNames));
323
+ }
324
+ return false;
325
+ }
326
+ function collectSameContractCalls(body) {
327
+ const calls = new Set();
328
+ walkAny(body, node => {
329
+ if (!isNode(node, 'FunctionCall'))
330
+ return false;
331
+ const name = getCallName(node.expression);
332
+ if (name)
333
+ calls.add(name);
334
+ return false;
335
+ });
336
+ return calls;
337
+ }
338
+ function getCallName(expr) {
339
+ if (!expr || typeof expr !== 'object')
340
+ return '';
341
+ if (isNode(expr, 'Identifier'))
342
+ return String(expr.name || '');
343
+ if (isNode(expr, 'MemberAccess')) {
344
+ if (isNode(expr.expression, 'Identifier') && String(expr.expression.name || '') === 'this') {
345
+ return String(expr.memberName || '');
346
+ }
347
+ }
348
+ return '';
349
+ }
350
+ function containsCallerAuthorizationGuard(body) {
351
+ for (const stmt of getBlockStatements(body)) {
352
+ if (isRequireOrAssertWith(stmt, conditionGuardsCaller))
353
+ return true;
354
+ if (isNode(stmt, 'IfStatement') && conditionDeniesCaller(stmt.condition) && bodyUnconditionallyExits(stmt.trueBody))
355
+ return true;
356
+ }
357
+ return false;
358
+ }
359
+ function isRequireOrAssertWith(stmt, predicate) {
360
+ if (!isNode(stmt, 'ExpressionStatement'))
361
+ return false;
362
+ const expr = stmt.expression;
363
+ if (!isRequireOrAssertCall(expr))
364
+ return false;
365
+ return predicate(expr.arguments?.[0]);
366
+ }
367
+ function isRequireOrAssertCall(expr) {
368
+ if (!isNode(expr, 'FunctionCall'))
369
+ return false;
370
+ const name = getCallName(expr.expression).toLowerCase();
371
+ return name === 'require' || name === 'assert';
372
+ }
373
+ function conditionGuardsCaller(node) {
374
+ if (!node || typeof node !== 'object')
375
+ return false;
376
+ if (isCallerEqualityCheck(node))
377
+ return true;
378
+ if (isOwnerMembershipCheck(node))
379
+ return true;
380
+ for (const child of childrenOf(node)) {
381
+ if (conditionGuardsCaller(child))
382
+ return true;
383
+ }
384
+ return false;
385
+ }
386
+ function hasEffectiveOneTimeGuard(fn, body) {
387
+ if (hasOneTimeGuardModifier(fn))
388
+ return true;
389
+ const checked = new Set();
390
+ const written = new Set();
391
+ walkAny(body, node => {
392
+ collectInitializedChecks(node, checked);
393
+ collectInitializedWrites(node, written);
394
+ return false;
395
+ });
396
+ for (const name of checked) {
397
+ if (written.has(name))
398
+ return true;
399
+ }
400
+ return false;
401
+ }
402
+ function hasOneTimeGuardModifier(fn) {
403
+ for (const modifier of fn.modifiers || []) {
404
+ const name = getModifierName(modifier).toLowerCase();
405
+ if (ONE_TIME_GUARD_MODIFIERS.has(name))
406
+ return true;
407
+ }
408
+ return false;
409
+ }
410
+ function hasCallerAccessControl(fn, body) {
411
+ for (const modifier of fn.modifiers || []) {
412
+ const name = getModifierName(modifier).toLowerCase();
413
+ if (ACCESS_CONTROL_MODIFIERS.has(name))
414
+ return true;
415
+ }
416
+ return !!body && containsCallerAuthorizationGuard(body);
417
+ }
418
+ function collectInitializedChecks(node, out) {
419
+ if (!isRequireOrAssertCall(node))
420
+ return;
421
+ collectInitializedFalseChecks(node.arguments?.[0], out);
422
+ }
423
+ function collectInitializedFalseChecks(node, out) {
424
+ if (!node || typeof node !== 'object')
425
+ return;
426
+ if (isNode(node, 'UnaryOperation') && String(node.operator || '') === '!') {
427
+ const name = initializedIdentifierName(node.subExpression);
428
+ if (name)
429
+ out.add(name);
430
+ }
431
+ if (isNode(node, 'BinaryOperation')) {
432
+ const op = String(node.operator || '');
433
+ const left = node.left || node.leftExpression;
434
+ const right = node.right || node.rightExpression;
435
+ if ((op === '==' || op === '===') && isBooleanLiteral(right, false)) {
436
+ const name = initializedIdentifierName(left);
437
+ if (name)
438
+ out.add(name);
439
+ }
440
+ if ((op === '==' || op === '===') && isBooleanLiteral(left, false)) {
441
+ const name = initializedIdentifierName(right);
442
+ if (name)
443
+ out.add(name);
444
+ }
445
+ }
446
+ if (isNode(node, 'BinaryOperation') && String(node.operator || '') === '&&') {
447
+ collectInitializedFalseChecks(node.left || node.leftExpression, out);
448
+ collectInitializedFalseChecks(node.right || node.rightExpression, out);
449
+ }
450
+ }
451
+ function collectInitializedWrites(node, out) {
452
+ let left = null;
453
+ let right = null;
454
+ if (isNode(node, 'BinaryOperation') && String(node.operator || '') === '=') {
455
+ left = node.left || node.leftExpression;
456
+ right = node.right || node.rightExpression;
457
+ }
458
+ else if (isNode(node, 'Assignment') && String(node.operator || '') === '=') {
459
+ left = node.leftHandSide;
460
+ right = node.rightHandSide;
461
+ }
462
+ if (!isBooleanLiteral(right, true))
463
+ return;
464
+ const name = initializedIdentifierName(left);
465
+ if (name)
466
+ out.add(name);
467
+ }
468
+ function initializedIdentifierName(node) {
469
+ if (isNode(node, 'Identifier') && /initialized/i.test(String(node.name || '')))
470
+ return String(node.name);
471
+ if (isNode(node, 'MemberAccess') && /initialized/i.test(String(node.memberName || '')))
472
+ return String(node.memberName);
473
+ return '';
474
+ }
475
+ function isBooleanLiteral(node, value) {
476
+ if (!node || typeof node !== 'object')
477
+ return false;
478
+ if (isNode(node, 'BooleanLiteral'))
479
+ return node.value === value || String(node.value) === String(value);
480
+ if (isNode(node, 'Literal') && String(node.kind || '').toLowerCase() === 'bool')
481
+ return node.value === value || String(node.value) === String(value);
482
+ return false;
483
+ }
484
+ function conditionDeniesCaller(node) {
485
+ if (!node || typeof node !== 'object')
486
+ return false;
487
+ if (isNode(node, 'UnaryOperation') && String(node.operator || '') === '!') {
488
+ return conditionGuardsCaller(node.subExpression);
489
+ }
490
+ if (isNode(node, 'BinaryOperation')) {
491
+ const op = String(node.operator || '');
492
+ const left = node.left || node.leftExpression;
493
+ const right = node.right || node.rightExpression;
494
+ if ((op === '!=' || op === '!==') && ((isMsgSender(left) && isAuthSubject(right)) || (isMsgSender(right) && isAuthSubject(left))))
495
+ return true;
496
+ }
497
+ return false;
498
+ }
499
+ function isCallerEqualityCheck(node) {
500
+ if (!isNode(node, 'BinaryOperation'))
501
+ return false;
502
+ const op = String(node.operator || '');
503
+ if (op !== '==' && op !== '===')
504
+ return false;
505
+ const left = node.left || node.leftExpression;
506
+ const right = node.right || node.rightExpression;
507
+ return (isMsgSender(left) && isAuthSubject(right)) || (isMsgSender(right) && isAuthSubject(left));
508
+ }
509
+ function isOwnerMembershipCheck(node) {
510
+ if (isNode(node, 'IndexAccess')) {
511
+ const base = node.base || node.baseExpression;
512
+ const index = node.index || node.indexExpression;
513
+ return isOwnerLikeIdentifier(base) && isMsgSender(index);
514
+ }
515
+ return false;
516
+ }
517
+ function isOwnerLikeIdentifier(node) {
518
+ return isNode(node, 'Identifier') && /^(isOwner|owners)$/i.test(String(node.name || ''));
519
+ }
520
+ function isAuthSubject(node) {
521
+ if (!node || typeof node !== 'object')
522
+ return false;
523
+ if (isNode(node, 'Identifier'))
524
+ return /^(owner|admin|governance|governor|guardian|authority|operator|manager)$/i.test(String(node.name || ''));
525
+ if (isNode(node, 'MemberAccess'))
526
+ return /^(owner|admin|governance|governor|guardian|authority|operator|manager)$/i.test(String(node.memberName || ''));
527
+ return false;
528
+ }
529
+ function isMsgSender(node) {
530
+ return isNode(node, 'MemberAccess') &&
531
+ String(node.memberName || '') === 'sender' &&
532
+ isNode(node.expression, 'Identifier') &&
533
+ String(node.expression.name || '') === 'msg';
534
+ }
535
+ function bodyUnconditionallyExits(body) {
536
+ if (!body || typeof body !== 'object')
537
+ return false;
538
+ if (isNode(body, 'Block'))
539
+ return getBlockStatements(body).some(statementGuaranteesExit);
540
+ return statementGuaranteesExit(body);
541
+ }
542
+ function statementGuaranteesExit(stmt) {
543
+ if (!stmt || typeof stmt !== 'object')
544
+ return false;
545
+ if (isNode(stmt, 'ThrowStatement') || isNode(stmt, 'RevertStatement'))
546
+ return true;
547
+ if (isNode(stmt, 'ExpressionStatement') && isNode(stmt.expression, 'FunctionCall')) {
548
+ return getCallName(stmt.expression.expression).toLowerCase() === 'revert';
549
+ }
550
+ if (isNode(stmt, 'Block'))
551
+ return bodyUnconditionallyExits(stmt);
552
+ return false;
553
+ }
554
+ function isInterfaceLike(contractNode) {
555
+ const kind = String(contractNode?.kind || contractNode?.contractKind || '').toLowerCase();
556
+ return kind === 'interface' || kind === 'library';
557
+ }
558
+ function isConstructor(fn) {
559
+ if (!fn)
560
+ return false;
561
+ if (fn.isConstructor === true)
562
+ return true;
563
+ return String(fn.kind || '').toLowerCase() === 'constructor';
564
+ }
565
+ function isExternallyCallable(fn) {
566
+ if (!fn || isConstructor(fn))
567
+ return false;
568
+ const kind = String(fn.kind || '').toLowerCase();
569
+ if (kind === 'fallback' || kind === 'receive' || fn.isFallback === true || fn.isReceiveEther === true)
570
+ return false;
571
+ const visibility = String(fn.visibility || '').toLowerCase();
572
+ return visibility === 'public' || visibility === 'external';
573
+ }
574
+ function isExternallyReachableCaller(fn) {
575
+ if (!fn || isConstructor(fn))
576
+ return false;
577
+ const kind = String(fn.kind || '').toLowerCase();
578
+ if (kind === 'fallback' || kind === 'receive' || fn.isFallback === true || fn.isReceiveEther === true)
579
+ return true;
580
+ const visibility = String(fn.visibility || '').toLowerCase();
581
+ return visibility === 'public' || visibility === 'external';
582
+ }
583
+ function expressionToString(expr) {
584
+ if (!expr || typeof expr !== 'object')
585
+ return '<unknown>';
586
+ if (isNode(expr, 'Identifier'))
587
+ return String(expr.name || '<unknown>');
588
+ if (isNode(expr, 'MemberAccess'))
589
+ return `${expressionToString(expr.expression)}.${String(expr.memberName || '')}`;
590
+ if (isNode(expr, 'FunctionCall')) {
591
+ return `${expressionToString(expr.expression)}(${(expr.arguments || []).map(expressionToString).join(', ')})`;
592
+ }
593
+ if (isNode(expr, 'ElementaryTypeNameExpression'))
594
+ return String(expr.typeName?.name || expr.typeName || '<type>');
595
+ if (isNode(expr, 'ElementaryTypeName'))
596
+ return String(expr.name || '<type>');
597
+ if (isNode(expr, 'Literal') || isNode(expr, 'StringLiteral'))
598
+ return JSON.stringify(expr.value ?? '');
599
+ return '<unknown>';
600
+ }
601
+ function delegateTargetType(expr, contract) {
602
+ if (!expr || typeof expr !== 'object')
603
+ return undefined;
604
+ if (isNode(expr, 'FunctionCall') && expressionToString(expr.expression) === 'address') {
605
+ return delegateTargetType((expr.arguments || [])[0], contract);
606
+ }
607
+ if (isNode(expr, 'Identifier')) {
608
+ return contract.stateTypes.get(String(expr.name || ''));
609
+ }
610
+ return undefined;
611
+ }
612
+ function selectorFromDelegatecallArgs(args) {
613
+ const first = args[0];
614
+ if (!isNode(first, 'FunctionCall'))
615
+ return undefined;
616
+ const callee = expressionToString(first.expression);
617
+ if (!callee.endsWith('abi.encodeWithSignature'))
618
+ return undefined;
619
+ const signature = stringLiteralValue(first.arguments?.[0]);
620
+ if (!signature)
621
+ return undefined;
622
+ return signature.split('(')[0];
623
+ }
624
+ function stringLiteralValue(node) {
625
+ if (!node || typeof node !== 'object')
626
+ return '';
627
+ if (isNode(node, 'StringLiteral') || isNode(node, 'Literal')) {
628
+ return typeof node.value === 'string' ? node.value : '';
629
+ }
630
+ return '';
631
+ }
632
+ function getModifierName(modifier) {
633
+ if (!modifier)
634
+ return '';
635
+ if (typeof modifier === 'string')
636
+ return modifier;
637
+ if (typeof modifier.name === 'string')
638
+ return modifier.name;
639
+ if (modifier.name && typeof modifier.name === 'object') {
640
+ if (typeof modifier.name.name === 'string')
641
+ return modifier.name.name;
642
+ if (typeof modifier.name.namePath === 'string')
643
+ return modifier.name.namePath;
644
+ }
645
+ if (modifier.modifierName) {
646
+ const inner = modifier.modifierName;
647
+ if (typeof inner === 'string')
648
+ return inner;
649
+ if (inner && typeof inner.name === 'string')
650
+ return inner.name;
651
+ }
652
+ return '';
653
+ }
654
+ function functionDisplayName(fn) {
655
+ if (fn.isFallback === true)
656
+ return '<fallback>';
657
+ if (fn.isReceiveEther === true)
658
+ return '<receive>';
659
+ const kind = String(fn.kind || '').toLowerCase();
660
+ if (kind === 'fallback')
661
+ return '<fallback>';
662
+ if (kind === 'receive')
663
+ return '<receive>';
664
+ const name = fn.name;
665
+ if (typeof name === 'string' && name.length > 0)
666
+ return name;
667
+ return '<anonymous>';
668
+ }
669
+ function getName(node) {
670
+ return typeof node?.name === 'string' ? node.name : '';
671
+ }
672
+ function getFunctionBody(node) {
673
+ return node?.body || null;
674
+ }
675
+ function getContractFunctions(contractNode) {
676
+ return getContractMembers(contractNode).filter(child => isNode(child, 'FunctionDefinition'));
677
+ }
678
+ function getContractMembers(contractNode) {
679
+ if (!contractNode || typeof contractNode !== 'object')
680
+ return [];
681
+ if (Array.isArray(contractNode.subNodes))
682
+ return contractNode.subNodes;
683
+ if (Array.isArray(contractNode.nodes))
684
+ return contractNode.nodes;
685
+ return [];
686
+ }
687
+ function getBlockStatements(body) {
688
+ if (!body || typeof body !== 'object')
689
+ return [];
690
+ return Array.isArray(body.statements) ? body.statements : [];
691
+ }
692
+ function collectContracts(ast) {
693
+ const out = [];
694
+ walkContracts(ast, node => out.push(node));
695
+ return out;
696
+ }
697
+ function walkContracts(node, visit) {
698
+ if (!node || typeof node !== 'object')
699
+ return;
700
+ if (isNode(node, 'ContractDefinition')) {
701
+ visit(node);
702
+ return;
703
+ }
704
+ for (const child of childrenOf(node))
705
+ walkContracts(child, visit);
706
+ }
707
+ function isNode(node, kind) {
708
+ return node?.type === kind || node?.nodeType === kind;
709
+ }
710
+ function walkAny(node, predicate) {
711
+ if (!node || typeof node !== 'object')
712
+ return false;
713
+ if (predicate(node))
714
+ return true;
715
+ for (const child of childrenOf(node)) {
716
+ if (walkAny(child, predicate))
717
+ return true;
718
+ }
719
+ return false;
720
+ }
721
+ function childrenOf(node) {
722
+ if (!node || typeof node !== 'object')
723
+ return [];
724
+ const children = [];
725
+ for (const [key, value] of Object.entries(node)) {
726
+ if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'id' || key === 'typeName')
727
+ continue;
728
+ if (Array.isArray(value)) {
729
+ for (const item of value) {
730
+ if (item && typeof item === 'object')
731
+ children.push(item);
732
+ }
733
+ }
734
+ else if (value && typeof value === 'object') {
735
+ children.push(value);
736
+ }
737
+ }
738
+ return children;
739
+ }
740
+ function buildLineOffsets(sourceText) {
741
+ if (sourceText === undefined)
742
+ return undefined;
743
+ const lineOffsets = [0];
744
+ let byteOffset = 0;
745
+ for (const char of sourceText) {
746
+ byteOffset += Buffer.byteLength(char, 'utf8');
747
+ if (char === '\n')
748
+ lineOffsets.push(byteOffset);
749
+ }
750
+ return lineOffsets;
751
+ }
752
+ function getLoc(node, lineOffsets) {
753
+ if (node?.loc?.start)
754
+ return node.loc.start;
755
+ if (!node?.src || !lineOffsets)
756
+ return undefined;
757
+ const offset = Number(String(node.src).split(':')[0]);
758
+ if (!Number.isFinite(offset) || offset < 0)
759
+ return undefined;
760
+ let lineIndex = 0;
761
+ for (let i = 0; i < lineOffsets.length; i++) {
762
+ if (lineOffsets[i] <= offset)
763
+ lineIndex = i;
764
+ else
765
+ break;
766
+ }
767
+ return { line: lineIndex + 1, column: offset - lineOffsets[lineIndex] };
768
+ }
769
+ //# sourceMappingURL=delegatecall-init.js.map