edith-skep3 2.4.3

package/dist/parser.js

@@ -0,0 +1,229 @@
+import { createPublicClient, http, formatEther, formatUnits } from 'viem';
+import { mainnet } from 'viem/chains';
+const LOCAL_ANVIL_RPC = 'http://127.0.0.1:8545';
+// Known ERC-20 event signatures
+const KNOWN_TOPICS = {
+    '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef': 'Transfer(address,address,uint256)',
+    '0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925': 'Approval(address,address,uint256)',
+    '0xe1fffcc4923d04b559f4d29a8bfc6cda04eb5b0d3c460751c2402c5c5cc9109c': 'Deposit(address,uint256)',
+    '0x7fcf532c15f0a6db0bd6d0e038bea71d30d808c7d98cb3bf7268a95bf5081b65': 'Withdrawal(address,uint256)',
+};
+// Suspicious patterns in traces
+const SUSPICIOUS_OPCODES = ['DELEGATECALL', 'SELFDESTRUCT', 'CREATE2'];
+import axios from 'axios';
+export class TransactionParser {
+    client;
+    signatureCache = {};
+    constructor(rpcUrl = LOCAL_ANVIL_RPC) {
+        this.client = createPublicClient({
+            chain: mainnet,
+            transport: http(rpcUrl),
+        });
+    }
+    async parseReceipt(txHash) {
+        const receipt = await this.client.getTransactionReceipt({ hash: txHash });
+        const tx = await this.client.getTransaction({ hash: txHash });
+        const tokenLosses = [];
+        const logs = receipt.logs.map((log) => {
+            const topic0 = log.topics[0];
+            const eventName = topic0 ? (KNOWN_TOPICS[topic0] || `Unknown(${topic0.slice(0, 10)}...)`) : 'Unknown';
+            // Try to decode Transfer/Approval
+            let decoded;
+            if (topic0 === '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef') {
+                const from = '0x' + (log.topics[1] || '').slice(26);
+                const to = '0x' + (log.topics[2] || '').slice(26);
+                const amount = BigInt(log.data || '0x0');
+                decoded = { from, to, amount: amount.toString() };
+                // Track if the sender is losing ERC20 tokens
+                if (from.toLowerCase() === tx.from.toLowerCase()) {
+                    let decimals = 18; // fallback
+                    // A quick heuristic for USDC/USDT which have 6 decimals
+                    if (log.address.toLowerCase() === '0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48' ||
+                        log.address.toLowerCase() === '0xdac17f958d2ee523a2206206994597c13d831ec7') {
+                        decimals = 6;
+                    }
+                    tokenLosses.push({
+                        tokenAddress: log.address,
+                        amount: amount.toString(),
+                        formatted: formatUnits(amount, decimals)
+                    });
+                }
+            }
+            else if (topic0 === '0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925') {
+                const owner = '0x' + (log.topics[1] || '').slice(26);
+                const spender = '0x' + (log.topics[2] || '').slice(26);
+                const amount = BigInt(log.data || '0x0');
+                const isInfinite = amount > BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
+                decoded = { owner, spender, amount: isInfinite ? 'INFINITE (Max Uint256)' : amount.toString() };
+            }
+            return {
+                address: log.address,
+                eventName,
+                raw: log.data,
+                decoded,
+            };
+        });
+        const warnings = this.detectWarningsFromLogs(logs, tx.from);
+        return {
+            hash: txHash,
+            to: receipt.to || 'Contract Creation',
+            from: receipt.from,
+            value: formatEther(tx.value) + ' ETH',
+            status: receipt.status === 'success' ? 'success' : 'reverted',
+            gasUsed: receipt.gasUsed.toString(),
+            gasFee: receipt.gasUsed * (receipt.effectiveGasPrice || BigInt(0)),
+            logs,
+            tokenLosses,
+            warnings,
+        };
+    }
+    async parseTrace(rawTrace) {
+        if (!rawTrace)
+            return null;
+        const suspiciousOps = [];
+        const extractSuspicious = async (traceNode) => {
+            const childPromises = (traceNode.calls || []).map((node) => extractSuspicious(node));
+            const calls = await Promise.all(childPromises);
+            // Check for suspicious opcodes
+            if (traceNode.type && SUSPICIOUS_OPCODES.includes(traceNode.type.toUpperCase())) {
+                suspiciousOps.push(`${traceNode.type} to ${traceNode.to}`);
+            }
+            let decodedInput = `Raw: ${(traceNode.input || '0x').slice(0, 512)}...`;
+            // Auto decoding using 4byte directory
+            if (traceNode.input && traceNode.input.length >= 10 && traceNode.input !== '0x') {
+                const selector = traceNode.input.slice(0, 10);
+                if (!this.signatureCache[selector]) {
+                    try {
+                        const res = await axios.get(`https://www.4byte.directory/api/v1/signatures/?hex_signature=${selector}`);
+                        if (res.data && res.data.results && res.data.results.length > 0) {
+                            this.signatureCache[selector] = res.data.results[0].text_signature;
+                        }
+                        else {
+                            this.signatureCache[selector] = `Unknown(${selector})`;
+                        }
+                    }
+                    catch (e) {
+                        this.signatureCache[selector] = `Unknown(${selector})`;
+                    }
+                }
+                decodedInput = `${this.signatureCache[selector]} | ${decodedInput}`;
+            }
+            return {
+                type: traceNode.type || 'CALL',
+                to: traceNode.to || 'unknown',
+                from: traceNode.from || 'unknown',
+                input: decodedInput,
+                output: (traceNode.output || '0x').slice(0, 512),
+                calls: calls.length > 0 ? calls : undefined,
+                suspiciousOps,
+            };
+        };
+        return await extractSuspicious(rawTrace);
+    }
+    parseStateDiff(rawDiff, impersonatedAddress) {
+        if (!rawDiff)
+            return { stateChanges: [] };
+        const changes = [];
+        let balanceLoss;
+        const pre = rawDiff.pre || {};
+        const post = rawDiff.post || {};
+        const allAddresses = new Set([...Object.keys(pre), ...Object.keys(post)]);
+        allAddresses.forEach(address => {
+            const preState = pre[address] || { balance: '0x0', nonce: 0, storage: {} };
+            const postState = post[address] || { balance: '0x0', nonce: 0, storage: {} };
+            let balanceChange = undefined;
+            const preBal = BigInt(preState.balance || '0x0');
+            const postBal = BigInt(postState.balance || '0x0');
+            if (preBal !== postBal) {
+                const diff = postBal - preBal;
+                const sign = diff > 0n ? '+' : '-';
+                const absDiff = diff > 0n ? diff : -diff;
+                balanceChange = `${sign}${formatEther(absDiff)} ETH`;
+                if (address.toLowerCase() === impersonatedAddress.toLowerCase() && diff < 0n) {
+                    balanceLoss = { amount: -diff, formatted: formatEther(-diff) };
+                }
+            }
+            const storageModified = JSON.stringify(preState.storage || {}) !== JSON.stringify(postState.storage || {});
+            const nonceChange = preState.nonce !== postState.nonce;
+            if (balanceChange || storageModified || nonceChange) {
+                changes.push({
+                    address,
+                    balanceChange,
+                    nonceChange,
+                    storageModified
+                });
+            }
+        });
+        return { stateChanges: changes, balanceLoss };
+    }
+    detectWarningsFromLogs(logs, senderAddress) {
+        const warnings = [];
+        for (const log of logs) {
+            // Infinite approval detection
+            if (log.eventName.startsWith('Approval') && log.decoded?.amount === 'INFINITE (Max Uint256)') {
+                warnings.push(`⚠️  INFINITE APPROVAL granted to ${log.decoded.spender} for token ${log.address}`);
+            }
+            // Transfer to unknown address (not sender)
+            if (log.eventName.startsWith('Transfer') && log.decoded) {
+                if (log.decoded.from.toLowerCase() === senderAddress.toLowerCase()) {
+                    warnings.push(`⚠️  Token transfer FROM your wallet at ${log.address}`);
+                }
+            }
+        }
+        return warnings;
+    }
+    formatForAI(parsed, trace, contractCode) {
+        const logSummary = (parsed.logs || []).map(l => {
+            let str = `  - Event: ${l.eventName} on ${l.address}`;
+            if (l.decoded) {
+                str += `\n    Decoded: ${JSON.stringify(l.decoded)}`;
+            }
+            return str;
+        }).join('\n');
+        const traceSummary = trace ? JSON.stringify({
+            type: trace.type,
+            to: trace.to,
+            suspiciousOps: trace.suspiciousOps,
+            numSubCalls: (trace.calls || []).length,
+        }, null, 2) : 'No trace available.';
+        let codeSection = '';
+        if (contractCode) {
+            // Include a safe snippet of the code (AI has token limits)
+            const cleanCode = contractCode.slice(0, 25000);
+            codeSection = `\n=== TARGET CONTRACT CODE (Logic) ===\n${cleanCode}\n`;
+        }
+        const stateDiffSummary = (parsed.stateChanges || []).map(sc => {
+            let s = `  - Account: ${sc.address}`;
+            if (sc.balanceChange)
+                s += ` | Balance: ${sc.balanceChange}`;
+            if (sc.nonceChange)
+                s += ` | Nonce changed`;
+            if (sc.storageModified)
+                s += ` | Storage modified`;
+            return s;
+        }).join('\n');
+        return `
+=== TRANSACTION SIMULATION REPORT ===
+Hash: ${parsed.hash}
+From: ${parsed.from}
+To:   ${parsed.to}
+Value: ${parsed.value}
+Status: ${parsed.status?.toUpperCase()}
+Gas Used: ${parsed.gasUsed}
+Native Value Lost: ${parsed.balanceLoss ? parsed.balanceLoss.formatted + ' ETH' : '0 ETH'}
+ERC20 Tokens Lost: ${(parsed.tokenLosses && parsed.tokenLosses.length > 0) ? parsed.tokenLosses.map(t => `${t.formatted} unit(s) of ${t.tokenAddress}`).join(', ') : 'None detected'}
+${codeSection}
+=== EMITTED EVENTS (Logs) ===
+${logSummary || 'No events emitted.'}
+
+=== STATE DIFFERENCES (Pre/Post) ===
+${stateDiffSummary || 'No state changes.'}
+
+=== CALL TRACE (Local Anvil) ===
+${traceSummary}
+
+=== PRE-DETECTED WARNINGS ===
+${(parsed.warnings || []).join('\n') || 'None detected by parser.'}
+    `.trim();
+    }
+}

package/dist/simulator.js

@@ -0,0 +1,229 @@
+import { spawn } from 'child_process';
+import { createPublicClient, http } from 'viem';
+import { mainnet } from 'viem/chains';
+// Public free RPC - no API key required, works for forking
+export const DEFAULT_FORK_RPC = 'https://ethereum.publicnode.com';
+const LOCAL_ANVIL_RPC = 'http://127.0.0.1:8545';
+export class AnvilSimulator {
+    anvilProcess = null;
+    remoteRpcUrl;
+    ready = false;
+    constructor(remoteRpcUrl = DEFAULT_FORK_RPC) {
+        this.remoteRpcUrl = remoteRpcUrl;
+    }
+    async startFork(blockNumber) {
+        const args = [
+            '--fork-url', this.remoteRpcUrl,
+            '--port', '8545',
+        ];
+        if (blockNumber) {
+            args.push('--fork-block-number', blockNumber.toString());
+        }
+        const anvilBin = `${process.env.HOME}/.foundry/bin/anvil`;
+        return new Promise((resolve, reject) => {
+            try {
+                this.anvilProcess = spawn(anvilBin, args, {
+                    stdio: 'ignore', // suppress all anvil output
+                    detached: false,
+                });
+                this.anvilProcess.on('error', (err) => {
+                    reject(new Error(`Failed to start Anvil: ${err.message}. Run: curl -L https://foundry.paradigm.xyz | bash && foundryup`));
+                });
+                this.anvilProcess.on('exit', (code) => {
+                    if (!this.ready && code !== null && code !== 0) {
+                        reject(new Error(`Anvil crashed on startup (Exit ${code}). The target RPC might be rate-limiting or down.`));
+                    }
+                });
+                // Poll HTTP until Anvil is actually ready to accept connections
+                const poll = async () => {
+                    const maxMs = 20_000;
+                    const interval = 300;
+                    let elapsed = 0;
+                    while (elapsed < maxMs) {
+                        if (this.ready)
+                            return; // connected or rejected by exit
+                        try {
+                            const res = await fetch('http://127.0.0.1:8545', {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'eth_blockNumber', params: [] }),
+                                signal: AbortSignal.timeout(500),
+                            });
+                            if (res.ok) {
+                                this.ready = true;
+                                resolve();
+                                return;
+                            }
+                        }
+                        catch { /* not ready yet */ }
+                        await new Promise(r => setTimeout(r, interval));
+                        elapsed += interval;
+                    }
+                    if (!this.ready)
+                        reject(new Error('Anvil startup timed out after 20s. Check that port 8545 is free.'));
+                };
+                poll();
+            }
+            catch (e) {
+                reject(new Error(`Anvil not found. Install Foundry: curl -L https://foundry.paradigm.xyz | bash`));
+            }
+        });
+    }
+    // Returns a viem client connected to the LOCAL Anvil node
+    getClient() {
+        return createPublicClient({
+            chain: mainnet,
+            transport: http(LOCAL_ANVIL_RPC),
+        });
+    }
+    // Impersonate any address on the local fork (no private key needed)
+    async impersonateAccount(address) {
+        await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 1,
+                method: 'anvil_impersonateAccount',
+                params: [address],
+            }),
+        });
+    }
+    async stopImpersonating(address) {
+        await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 1,
+                method: 'anvil_stopImpersonatingAccount',
+                params: [address],
+            }),
+        });
+    }
+    // Fund an account on local fork (for gas)
+    async setBalance(address, ethAmount = 10n ** 18n) {
+        await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 1,
+                method: 'anvil_setBalance',
+                params: [address, '0x' + ethAmount.toString(16)],
+            }),
+        });
+    }
+    // Send a raw transaction to local Anvil and mine it
+    async simulateTransaction(params) {
+        const txParams = {
+            from: params.from,
+            data: params.data || '0x',
+            value: params.value ? '0x' + params.value.toString(16) : '0x0',
+            gas: '0x' + (3_000_000).toString(16),
+        };
+        if (params.to)
+            txParams.to = params.to;
+        const sendRes = await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 2,
+                method: 'eth_sendTransaction',
+                params: [txParams],
+            }),
+        });
+        const sendData = await sendRes.json();
+        if (sendData.error)
+            throw new Error(`Simulation failed: ${sendData.error.message}`);
+        // Explicitly mine a block to include the tx
+        await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 3,
+                method: 'evm_mine',
+                params: [],
+            }),
+        });
+        const txHash = sendData.result;
+        // Poll until the receipt is available (Anvil indexes asynchronously)
+        for (let i = 0; i < 20; i++) {
+            const r = await fetch(LOCAL_ANVIL_RPC, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    jsonrpc: '2.0', id: 10,
+                    method: 'eth_getTransactionReceipt',
+                    params: [txHash],
+                }),
+            });
+            const rj = await r.json();
+            if (rj.result !== null)
+                break;
+            await new Promise(res => setTimeout(res, 200));
+        }
+        return txHash;
+    }
+    async getBalance(address) {
+        const res = await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 7,
+                method: 'eth_getBalance',
+                params: [address, 'latest'],
+            }),
+        });
+        const data = await res.json();
+        return BigInt(data.result || '0x0');
+    }
+    async traceStateDiff(txHash) {
+        const res = await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 6,
+                method: 'debug_traceTransaction',
+                params: [txHash, { tracer: 'prestateTracer', tracerConfig: { diffMode: true } }],
+            }),
+        });
+        const data = await res.json();
+        return data.result;
+    }
+    // Get the full EVM trace from LOCAL Anvil (this is free — it's your own node)
+    async traceTransaction(txHash) {
+        const res = await fetch(LOCAL_ANVIL_RPC, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0', id: 4,
+                method: 'debug_traceTransaction',
+                params: [txHash, { tracer: 'callTracer' }],
+            }),
+        });
+        const data = await res.json();
+        if (data.error) {
+            // Fallback to structLogs tracer
+            const res2 = await fetch(LOCAL_ANVIL_RPC, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    jsonrpc: '2.0', id: 5,
+                    method: 'debug_traceTransaction',
+                    params: [txHash, {}],
+                }),
+            });
+            const data2 = await res2.json();
+            return data2.result;
+        }
+        return data.result;
+    }
+    async stop() {
+        if (this.anvilProcess) {
+            this.anvilProcess.kill('SIGTERM');
+            this.anvilProcess = null;
+            this.ready = false;
+        }
+    }
+    get isReady() {
+        return this.ready;
+    }
+}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "edith-skep3",
+  "version": "2.4.3",
+  "description": "Local-first Web3 wallet security CLI. Intercepts transactions, forks the EVM with Foundry Anvil, simulates execution, and runs on-device AI threat analysis via Ollama — all without sending a single byte to the cloud.",
+  "main": "dist/index.js",
+  "bin": {
+    "edith": "./dist/index.js"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "assets",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc && chmod +x dist/index.js",
+    "start": "node dist/index.js",
+    "dev": "npm run build && node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "web3",
+    "ethereum",
+    "blockchain",
+    "security",
+    "wallet",
+    "transaction",
+    "simulation",
+    "evm",
+    "anvil",
+    "foundry",
+    "ollama",
+    "ai",
+    "drainer",
+    "honeypot",
+    "cli",
+    "proxy",
+    "skep3",
+    "edith"
+  ],
+  "author": "Anubhav Singh <anubhav@anufied.me> (https://anufied.me)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anu-sin-theta/edith-skep3.git"
+  },
+  "publishConfig": {
+    "provenance": true
+  },
+  "homepage": "https://skep3.anufied.pro",
+  "bugs": {
+    "url": "https://github.com/anu-sin-theta/edith-skep3/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "axios": "^1.13.5",
+    "chalk": "^5.6.2",
+    "commander": "^14.0.3",
+    "inquirer": "^13.2.2",
+    "ollama": "^0.6.3",
+    "openai": "^6.22.0",
+    "ora": "^9.3.0",
+    "viem": "^2.45.3"
+  },
+  "devDependencies": {
+    "@types/inquirer": "^9.0.9",
+    "@types/node": "^25.2.3",
+    "@types/ora": "^3.1.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3"
+  }
+}