chainlink-audit 0.1.0

package/dist/scanner.js

@@ -0,0 +1,133 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { defaultConfig, loadConfig, severityRank } from "./config.js";
+import { rules } from "./rules/index.js";
+const ignoredDirectories = new Set([
+    ".git",
+    "node_modules",
+    "out",
+    "cache",
+    "broadcast",
+    "artifacts",
+    "dist",
+    "build",
+]);
+function normalizePath(value) {
+    return value.split(path.sep).join("/");
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globToRegExp(pattern) {
+    const normalized = normalizePath(pattern);
+    let source = "";
+    for (let index = 0; index < normalized.length; index++) {
+        const char = normalized[index];
+        const next = normalized[index + 1];
+        if (char === "*" && next === "*") {
+            source += ".*";
+            index++;
+        }
+        else if (char === "*") {
+            source += "[^/]*";
+        }
+        else {
+            source += escapeRegExp(char);
+        }
+    }
+    return new RegExp(`(^|/)${source}($|/)`);
+}
+function matchesExclude(relativePath, pattern) {
+    const normalizedPath = normalizePath(relativePath).replace(/^\/+/, "");
+    const normalizedPattern = normalizePath(pattern).replace(/^\/+/, "");
+    if (normalizedPattern.length === 0)
+        return false;
+    if (normalizedPattern.includes("*")) {
+        return globToRegExp(normalizedPattern).test(normalizedPath);
+    }
+    const directoryPattern = normalizedPattern.endsWith("/")
+        ? normalizedPattern.slice(0, -1)
+        : normalizedPattern;
+    return (normalizedPath === directoryPattern ||
+        normalizedPath.startsWith(`${directoryPattern}/`) ||
+        normalizedPath.includes(`/${directoryPattern}/`));
+}
+function isExcluded(fileOrDirectory, scanRoot, config) {
+    const relativePath = path.relative(scanRoot, fileOrDirectory);
+    const normalized = normalizePath(relativePath || path.basename(fileOrDirectory));
+    return config.exclude.some((pattern) => matchesExclude(normalized, pattern));
+}
+async function collectSolidityFiles(targetPath, scanRoot, config) {
+    if (isExcluded(targetPath, scanRoot, config))
+        return [];
+    const stat = await fs.stat(targetPath);
+    if (stat.isFile()) {
+        if (!targetPath.endsWith(".sol"))
+            return [];
+        return [targetPath];
+    }
+    const entries = await fs.readdir(targetPath, { withFileTypes: true });
+    const nested = await Promise.all(entries
+        .filter((entry) => !(entry.isDirectory() && ignoredDirectories.has(entry.name)))
+        .filter((entry) => !entry.name.startsWith(".") || entry.name === ".")
+        .map((entry) => collectSolidityFiles(path.join(targetPath, entry.name), scanRoot, config)));
+    return nested.flat();
+}
+function detectProducts(files) {
+    const products = new Set();
+    const allContent = files.map((file) => file.content).join("\n");
+    if (/(AggregatorV3Interface|latestRoundData|IChainlinkAggregator)/.test(allContent))
+        products.add("data-feeds");
+    if (/(CCIPReceiver|Any2EVMMessage|IRouterClient|_ccipReceive|ccipReceive|sourceChainSelector)/.test(allContent))
+        products.add("ccip");
+    if (/(VRFConsumerBase|VRFCoordinator|fulfillRandomWords|requestRandomWords)/.test(allContent))
+        products.add("vrf");
+    if (/(AutomationCompatibleInterface|KeeperCompatibleInterface|checkUpkeep|performUpkeep)/.test(allContent))
+        products.add("automation");
+    if (/(FunctionsClient|FunctionsRequest|DONHostedSecrets|sendRequest|fulfillRequest)/i.test(allContent))
+        products.add("functions-cre");
+    if (/(DataStreams|StreamsLookup|ILogAutomation|VerifierProxy|reportContext|ReportV3|BasicReport|websocket)/i.test(allContent))
+        products.add("data-streams");
+    return products;
+}
+function detectL2Target(files) {
+    const combined = files.map((file) => `${file.file}\n${file.content}`).join("\n");
+    return /(\barbitrum\b|\boptimism\b|\bbase\b|\bpolygon\b|\bzksync\b|\bscroll\b|\blinea\b|\bmantle\b|\bblast\b|sepolia.*\bbase\b|\bl2\b)/i.test(combined);
+}
+export async function scanPath(targetPath, options = {}) {
+    const absoluteTarget = path.resolve(targetPath);
+    const config = options.config ?? await loadConfig(absoluteTarget);
+    const scanRoot = (await fs.stat(absoluteTarget)).isFile() ? path.dirname(absoluteTarget) : absoluteTarget;
+    const solidityFiles = await collectSolidityFiles(absoluteTarget, scanRoot, config);
+    const files = await Promise.all(solidityFiles.map(async (file) => ({
+        file: path.relative(process.cwd(), file) || file,
+        content: await fs.readFile(file, "utf8"),
+    })));
+    const repoSignals = {
+        products: detectProducts(files),
+        targetsL2: detectL2Target(files),
+        files,
+    };
+    const findings = [];
+    for (const file of files) {
+        const lines = file.content.split(/\r?\n/);
+        for (const rule of rules) {
+            findings.push(...rule.scan({ file: file.file, content: file.content, lines, repoSignals }));
+        }
+    }
+    const minSeverityRank = severityRank(config.minSeverity ?? defaultConfig.minSeverity);
+    const filteredFindings = findings.filter((finding) => severityRank(finding.severity) >= minSeverityRank);
+    filteredFindings.sort((a, b) => {
+        const fileCompare = a.file.localeCompare(b.file);
+        if (fileCompare !== 0)
+            return fileCompare;
+        return a.line - b.line || a.ruleId.localeCompare(b.ruleId);
+    });
+    return {
+        targetPath,
+        scannedFiles: files.length,
+        products: [...repoSignals.products].sort(),
+        findings: filteredFindings,
+        config,
+    };
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "chainlink-audit",
+  "version": "0.1.0",
+  "description": "Security CLI for detecting potential Chainlink integration risks in Solidity repositories.",
+  "license": "MIT",
+  "type": "module",
+  "keywords": [
+    "chainlink",
+    "solidity",
+    "security",
+    "audit",
+    "web3",
+    "cli",
+    "foundry",
+    "ccip",
+    "vrf",
+    "automation",
+    "oracle"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alva-p/chainlink-integration-audit-kit.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/alva-p/chainlink-integration-audit-kit/issues"
+  },
+  "homepage": "https://github.com/alva-p/chainlink-integration-audit-kit#readme",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "chainlink-audit": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "dev": "tsx src/index.ts",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}