hex-audit 0.7.0 → 0.8.0

package/dist/skills/fuzz/templates/utils/MockERC20.sol

@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.6.2 <0.9.0;
+
+/// @dev Interface of the ERC20 standard as defined in the EIP.
+/// @dev This includes the optional name, symbol, and decimals metadata.
+interface IERC20 {
+    /// @dev Emitted when `value` tokens are moved from one account (`from`) to another (`to`).
+    event Transfer(address indexed from, address indexed to, uint256 value);
+
+    /// @dev Emitted when the allowance of a `spender` for an `owner` is set, where `value`
+    /// is the new allowance.
+    event Approval(address indexed owner, address indexed spender, uint256 value);
+
+    /// @notice Returns the amount of tokens in existence.
+    function totalSupply() external view returns (uint256);
+
+    /// @notice Returns the amount of tokens owned by `account`.
+    function balanceOf(address account) external view returns (uint256);
+
+    /// @notice Moves `amount` tokens from the caller's account to `to`.
+    function transfer(address to, uint256 amount) external returns (bool);
+
+    /// @notice Returns the remaining number of tokens that `spender` is allowed
+    /// to spend on behalf of `owner`
+    function allowance(address owner, address spender) external view returns (uint256);
+
+    /// @notice Sets `amount` as the allowance of `spender` over the caller's tokens.
+    /// @dev Be aware of front-running risks: https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
+    function approve(address spender, uint256 amount) external returns (bool);
+
+    /// @notice Moves `amount` tokens from `from` to `to` using the allowance mechanism.
+    /// `amount` is then deducted from the caller's allowance.
+    function transferFrom(address from, address to, uint256 amount) external returns (bool);
+
+    /// @notice Returns the name of the token.
+    function name() external view returns (string memory);
+
+    /// @notice Returns the symbol of the token.
+    function symbol() external view returns (string memory);
+
+    /// @notice Returns the decimals places of the token.
+    function decimals() external view returns (uint8);
+}
+
+/// @notice This is a mock contract of the ERC20 standard for testing purposes only, it SHOULD NOT be used in production.
+/// @notice Includes open deal function to mint tokens to any address. 
+/// @dev Forked from: https://github.com/transmissions11/solmate/blob/0384dbaaa4fcb5715738a9254a7c0a4cb62cf458/src/tokens/ERC20.sol
+contract MockERC20 is IERC20 {
+    /*//////////////////////////////////////////////////////////////
+                            METADATA STORAGE
+    //////////////////////////////////////////////////////////////*/
+
+    string internal _name;
+
+    string internal _symbol;
+
+    uint8 internal _decimals;
+
+    function name() external view override returns (string memory) {
+        return _name;
+    }
+
+    function symbol() external view override returns (string memory) {
+        return _symbol;
+    }
+
+    function decimals() external view override returns (uint8) {
+        return _decimals;
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                              ERC20 STORAGE
+    //////////////////////////////////////////////////////////////*/
+
+    uint256 internal _totalSupply;
+
+    mapping(address => uint256) internal _balanceOf;
+
+    mapping(address => mapping(address => uint256)) internal _allowance;
+
+    function totalSupply() external view override returns (uint256) {
+        return _totalSupply;
+    }
+
+    function balanceOf(address owner) external view override returns (uint256) {
+        return _balanceOf[owner];
+    }
+
+    function allowance(address owner, address spender) external view override returns (uint256) {
+        return _allowance[owner][spender];
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                            EIP-2612 STORAGE
+    //////////////////////////////////////////////////////////////*/
+
+    uint256 internal INITIAL_CHAIN_ID;
+
+    bytes32 internal INITIAL_DOMAIN_SEPARATOR;
+
+    mapping(address => uint256) public nonces;
+
+    /*//////////////////////////////////////////////////////////////
+                               CONSTRUCTOR
+    //////////////////////////////////////////////////////////////*/
+
+    constructor(address recipient, uint256 mintAmount, string memory name, string memory symbol, uint8 decimals) {
+        _name = name;
+        _symbol = symbol;
+        _decimals = decimals;
+
+        INITIAL_CHAIN_ID = _pureChainId();
+        INITIAL_DOMAIN_SEPARATOR = computeDomainSeparator();
+        
+		_mint(recipient, mintAmount * 10 ** decimals);
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                               ERC20 LOGIC
+    //////////////////////////////////////////////////////////////*/
+
+    function approve(address spender, uint256 amount) public virtual override returns (bool) {
+        _allowance[msg.sender][spender] = amount;
+
+        emit Approval(msg.sender, spender, amount);
+
+        return true;
+    }
+
+    function transfer(address to, uint256 amount) public virtual override returns (bool) {
+        _balanceOf[msg.sender] = _sub(_balanceOf[msg.sender], amount);
+        _balanceOf[to] = _add(_balanceOf[to], amount);
+
+        emit Transfer(msg.sender, to, amount);
+
+        return true;
+    }
+
+    function transferFrom(address from, address to, uint256 amount) public virtual override returns (bool) {
+        uint256 allowed = _allowance[from][msg.sender]; // Saves gas for limited approvals.
+
+        if (allowed != ~uint256(0)) _allowance[from][msg.sender] = _sub(allowed, amount);
+
+        _balanceOf[from] = _sub(_balanceOf[from], amount);
+        _balanceOf[to] = _add(_balanceOf[to], amount);
+
+        emit Transfer(from, to, amount);
+
+        return true;
+    }
+
+    /*//////////////////////////////////////////////////////////////
+							 DEAL LOGIC
+    //////////////////////////////////////////////////////////////*/
+
+	function deal(uint256 amount) public virtual {
+        _mint(msg.sender, amount);
+    }
+
+    function deal(address to, uint256 amount) public virtual {
+        _mint(to, amount);
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                             EIP-2612 LOGIC
+    //////////////////////////////////////////////////////////////*/
+
+    function permit(address owner, address spender, uint256 value, uint256 deadline, uint8 v, bytes32 r, bytes32 s)
+        public
+        virtual
+    {
+        require(deadline >= block.timestamp, "PERMIT_DEADLINE_EXPIRED");
+
+        address recoveredAddress = ecrecover(
+            keccak256(
+                abi.encodePacked(
+                    "\x19\x01",
+                    DOMAIN_SEPARATOR(),
+                    keccak256(
+                        abi.encode(
+                            keccak256(
+                                "Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)"
+                            ),
+                            owner,
+                            spender,
+                            value,
+                            nonces[owner]++,
+                            deadline
+                        )
+                    )
+                )
+            ),
+            v,
+            r,
+            s
+        );
+
+        require(recoveredAddress != address(0) && recoveredAddress == owner, "INVALID_SIGNER");
+
+        _allowance[recoveredAddress][spender] = value;
+
+        emit Approval(owner, spender, value);
+    }
+
+    function DOMAIN_SEPARATOR() public view virtual returns (bytes32) {
+        return _pureChainId() == INITIAL_CHAIN_ID ? INITIAL_DOMAIN_SEPARATOR : computeDomainSeparator();
+    }
+
+    function computeDomainSeparator() internal view virtual returns (bytes32) {
+        return keccak256(
+            abi.encode(
+                keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
+                keccak256(bytes(_name)),
+                keccak256("1"),
+                _pureChainId(),
+                address(this)
+            )
+        );
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                        INTERNAL MINT/BURN LOGIC
+    //////////////////////////////////////////////////////////////*/
+
+    function _mint(address to, uint256 amount) internal virtual {
+        _totalSupply = _add(_totalSupply, amount);
+        _balanceOf[to] = _add(_balanceOf[to], amount);
+
+        emit Transfer(address(0), to, amount);
+    }
+
+    function _burn(address from, uint256 amount) internal virtual {
+        _balanceOf[from] = _sub(_balanceOf[from], amount);
+        _totalSupply = _sub(_totalSupply, amount);
+
+        emit Transfer(from, address(0), amount);
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                        INTERNAL SAFE MATH LOGIC
+    //////////////////////////////////////////////////////////////*/
+
+    function _add(uint256 a, uint256 b) internal pure returns (uint256) {
+        uint256 c = a + b;
+        require(c >= a, "ERC20: addition overflow");
+        return c;
+    }
+
+    function _sub(uint256 a, uint256 b) internal pure returns (uint256) {
+        require(a >= b, "ERC20: subtraction underflow");
+        return a - b;
+    }
+
+    /*//////////////////////////////////////////////////////////////
+                                HELPERS
+    //////////////////////////////////////////////////////////////*/
+
+    // We use this complex approach of `_viewChainId` and `_pureChainId` to ensure there are no
+    // compiler warnings when accessing chain ID in any solidity version supported by forge-std. We
+    // can't simply access the chain ID in a normal view or pure function because the solc View Pure
+    // Checker changed `chainid` from pure to view in 0.8.0.
+    function _viewChainId() private view returns (uint256 chainId) {
+        // Assembly required since `block.chainid` was introduced in 0.8.0.
+        assembly {
+            chainId := chainid()
+        }
+
+        address(this); // Silence warnings in older Solc versions.
+    }
+
+    function _pureChainId() private pure returns (uint256 chainId) {
+        function() internal view returns (uint256) fnIn = _viewChainId;
+        function() internal pure returns (uint256) pureChainId;
+        assembly {
+            pureChainId := fnIn
+        }
+        chainId = pureChainId();
+    }
+}

package/dist/skills/fuzz/templates/utils/PropertiesAsserts.sol

@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity >=0.6.2 <0.9.0;
+
+import {StringUtils} from "./StringUtils.sol";
+
+/// @author Modified from Crytic (https://github.com/crytic/properties/blob/main/contracts/util/PropertiesAsserts.sol)
+contract PropertiesAsserts is StringUtils {
+    event AssertFail(string);
+    event AssertEqFail(string);
+    event AssertNeqFail(string);
+    event AssertGteFail(string);
+    event AssertGtFail(string);
+    event AssertLteFail(string);
+    event AssertLtFail(string);
+
+    function t(bool b, string memory reason) internal {
+        if (!b) {
+            emit AssertFail(reason);
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is equal to b. Violations are logged using reason.
+    function eq(uint256 a, uint256 b, string memory reason) internal {
+        if (a != b) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "!=",
+                bStr,
+                ", reason: ",
+                reason
+            );
+            emit AssertEqFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of eq
+    function eq(int256 a, int256 b, string memory reason) internal {
+        if (a != b) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "!=",
+                bStr,
+                ", reason: ",
+                reason
+            );
+            emit AssertEqFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is not equal to b. Violations are logged using reason.
+    function neq(uint256 a, uint256 b, string memory reason) internal {
+        if (a == b) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "==",
+                bStr,
+                ", reason: ",
+                reason
+            );
+            emit AssertNeqFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of neq
+    function neq(int256 a, int256 b, string memory reason) internal {
+        if (a == b) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "==",
+                bStr,
+                ", reason: ",
+                reason
+            );
+            emit AssertNeqFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is greater than or equal to b. Violations are logged using reason.
+    function gte(uint256 a, uint256 b, string memory reason) internal {
+        if (!(a >= b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "<",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertGteFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of gte
+    function gte(int256 a, int256 b, string memory reason) internal {
+        if (!(a >= b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "<",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertGteFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is greater than b. Violations are logged using reason.
+    function gt(uint256 a, uint256 b, string memory reason) internal {
+        if (!(a > b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "<=",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertGtFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of gt
+    function gt(int256 a, int256 b, string memory reason) internal {
+        if (!(a > b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                "<=",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertGtFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is less than or equal to b. Violations are logged using reason.
+    function lte(uint256 a, uint256 b, string memory reason) internal {
+        if (!(a <= b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                ">",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertLteFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of lte
+    function lte(int256 a, int256 b, string memory reason) internal {
+        if (!(a <= b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                ">",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertLteFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice asserts that a is less than b. Violations are logged using reason.
+    function lt(uint256 a, uint256 b, string memory reason) internal {
+        if (!(a < b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                ">=",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertLtFail(string(assertMsg));
+            assert(false);
+        }
+    }
+
+    /// @notice int256 version of lt
+    function lt(int256 a, int256 b, string memory reason) internal {
+        if (!(a < b)) {
+            string memory aStr = toString(a);
+            string memory bStr = toString(b);
+            bytes memory assertMsg = abi.encodePacked(
+                "Invalid: ",
+                aStr,
+                ">=",
+                bStr,
+                " failed, reason: ",
+                reason
+            );
+            emit AssertLtFail(string(assertMsg));
+            assert(false);
+        }
+    }
+}

package/dist/skills/fuzz/templates/utils/StringUtils.sol

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity >=0.6.2 <0.9.0;
+
+/// @notice Efficient library for creating string representations of integers.
+/// @author Solmate (https://github.com/transmissions11/solmate/blob/main/src/utils/LibString.sol)
+/// @author Modified from Solady (https://github.com/Vectorized/solady/blob/main/src/utils/LibString.sol)
+/// @dev Name of the library is modified to prevent collisions with contract-under-test uses of LibString
+contract StringUtils {
+    function toString(int256 value) internal pure returns (string memory str) {
+        uint256 absValue = value >= 0 ? uint256(value) : uint256(-value);
+        str = toString(absValue);
+
+        if (value < 0) {
+            str = string(abi.encodePacked("-", str));
+        }
+    }
+
+    function toString(uint256 value) internal pure returns (string memory str) {
+        /// @solidity memory-safe-assembly
+        assembly {
+            // The maximum value of a uint256 contains 78 digits (1 byte per digit), but we allocate 160 bytes
+            // to keep the free memory pointer word aligned. We'll need 1 word for the length, 1 word for the
+            // trailing zeros padding, and 3 other words for a max of 78 digits. In total: 5 * 32 = 160 bytes.
+            let newFreeMemoryPointer := add(mload(0x40), 160)
+
+            // Update the free memory pointer to avoid overriding our string.
+            mstore(0x40, newFreeMemoryPointer)
+
+            // Assign str to the end of the zone of newly allocated memory.
+            str := sub(newFreeMemoryPointer, 32)
+
+            // Clean the last word of memory it may not be overwritten.
+            mstore(str, 0)
+
+            // Cache the end of the memory to calculate the length later.
+            let end := str
+
+            // We write the string from rightmost digit to leftmost digit.
+            // The following is essentially a do-while loop that also handles the zero case.
+            // prettier-ignore
+            for { let temp := value } 1 {} {
+                // Move the pointer 1 byte to the left.
+                str := sub(str, 1)
+
+                // Write the character to the pointer.
+                // The ASCII index of the '0' character is 48.
+                mstore8(str, add(48, mod(temp, 10)))
+
+                // Keep dividing temp until zero.
+                temp := div(temp, 10)
+
+                 // prettier-ignore
+                if iszero(temp) { break }
+            }
+
+            // Compute and cache the final total length of the string.
+            let length := sub(end, str)
+
+            // Move the pointer 32 bytes leftwards to make room for the length.
+            str := sub(str, 32)
+
+            // Store the string's length at the start of memory allocated for our string.
+            mstore(str, length)
+        }
+    }
+
+    function toString(address value) internal pure returns (string memory str) {
+        bytes memory s = new bytes(40);
+        for (uint i = 0; i < 20; i++) {
+            bytes1 b = bytes1(
+                uint8(uint(uint160(value)) / (2 ** (8 * (19 - i))))
+            );
+            bytes1 hi = bytes1(uint8(b) / 16);
+            bytes1 lo = bytes1(uint8(b) - 16 * uint8(hi));
+            s[2 * i] = char(hi);
+            s[2 * i + 1] = char(lo);
+        }
+        return string(s);
+    }
+
+    function char(bytes1 b) internal pure returns (bytes1 c) {
+        if (uint8(b) < 10) return bytes1(uint8(b) + 0x30);
+        else return bytes1(uint8(b) + 0x57);
+    }
+}