diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 24f04ee87b..b90d490df9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -44,11 +44,10 @@ jobs: path: dist/ - name: publish - uses: pypa/gh-action-pypi-publish@v1.8.8 + uses: pypa/gh-action-pypi-publish@v1.8.10 - name: sign - uses: sigstore/gh-action-sigstore-python@v1.2.3 + uses: sigstore/gh-action-sigstore-python@v2.0.1 with: inputs: ./dist/*.tar.gz ./dist/*.whl release-signing-artifacts: true - bundle-only: true diff --git a/CITATION.cff b/CITATION.cff new file mode 100644 index 0000000000..605bd60e5f --- /dev/null +++ b/CITATION.cff @@ -0,0 +1,64 @@ +cff-version: 1.2.0 +title: Slither Analyzer +message: >- + If you use this software, please cite it using the + metadata from this file. +type: software +authors: + - given-names: Josselin + family-names: Feist + - given-names: Gustavo + family-names: Grieco + - given-names: Alex + family-names: Groce +identifiers: + - type: doi + value: 10.48550/arXiv.1908.09878 + description: arXiv.1908.09878 + - type: url + value: 'https://arxiv.org/abs/1908.09878' + description: arxiv + - type: doi + value: 10.1109/wetseb.2019.00008 +repository-code: 'https://github.com/crytic/slither' +url: 'https://www.trailofbits.com/' +repository-artifact: 'https://github.com/crytic/slither/releases' +abstract: >- + Slither is a static analysis framework designed to provide + rich information about Ethereum smart contracts. + + It works by converting Solidity smart contracts into an + intermediate representation called SlithIR. + + SlithIR uses Static Single Assignment (SSA) form and a + reduced instruction set to ease implementation of analyses + while preserving semantic information that would be lost + in transforming Solidity to bytecode. + + Slither allows for the application of commonly used + program analysis techniques like dataflow and taint + tracking. + + + Our framework has four main use cases: + + (1) automated detection of vulnerabilities, + + (2) automated detection of code optimization + opportunities, + + (3) improvement of the user's understanding of the + contracts, and + + (4) assistance with code review. +keywords: + - Ethereum + - Static Analysis + - Smart contracts + - EVM + - bug detection + - Software Engineering +license: AGPL-3.0-only +commit: 3d4f934d3228f072b7df2c5e7252c64df4601bc8 +version: 0.9.5 +date-released: '2023-06-28' diff --git a/README.md b/README.md index cb815561e8..1a0d203c7d 100644 --- a/README.md +++ b/README.md @@ -1,42 +1,57 @@ -# Slither, the Solidity source analyzer +# [Slither, the Solidity source analyzer](https://crytic.github.io/slither/slither.html) -Logo +Slither Static Analysis Framework Logo [![Build Status](https://img.shields.io/github/actions/workflow/status/crytic/slither/ci.yml?branch=master)](https://github.com/crytic/slither/actions?query=workflow%3ACI) -[![Slack Status](https://empireslacking.herokuapp.com/badge.svg)](https://empireslacking.herokuapp.com) -[![PyPI version](https://badge.fury.io/py/slither-analyzer.svg)](https://badge.fury.io/py/slither-analyzer) - -Slither is a Solidity static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses. - -- [Features](#features) -- [Usage](#usage) -- [How to Install](#how-to-install) -- [Detectors](#detectors) -- [Printers](#printers) -- [Tools](#tools) -- [API Documentation](#api-documentation) -- [Getting Help](#getting-help) -- [FAQ](#faq) -- [Publications](#publications) +![PyPI](https://img.shields.io/pypi/v/slither-analyzer?logo=python&logoColor=white&label=slither-analyzer) +[![Slither - Read the Docs](https://img.shields.io/badge/Slither-Read_the_Docs-2ea44f)](https://crytic.github.io/slither/slither.html) +[![Slither - Wiki](https://img.shields.io/badge/Slither-Wiki-2ea44f)](https://github.com/crytic/slither/wiki/SlithIR) + +> Join the Empire Hacking Slack +> +> [![Slack Status](https://slack.empirehacking.nyc/badge.svg)](https://slack.empirehacking.nyc/) +> > - Discussions and Support + +**Slither** is a Solidity static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses. + +* [Features](#features) +* [Usage](#usage) +* [How to install](#how-to-install) + * [Using Pip](#using-pip) + * [Using Git](#using-git) + * [Using Docker](#using-docker) + * [Integration](#integration) +* [Detectors](#detectors) +* [Printers](#printers) + * [Quick Review Printers](#quick-review-printers) + * [In-Depth Review Printers](#in-depth-review-printers) +* [Tools](#tools) +* [API Documentation](#api-documentation) +* [Getting Help](#getting-help) +* [FAQ](#faq) +* [License](#license) +* [Publications](#publications) + * [Trail of Bits publication](#trail-of-bits-publication) + * [External publications](#external-publications) ## Features -- Detects vulnerable Solidity code with low false positives (see the list of [trophies](./trophies.md)) -- Identifies where the error condition occurs in the source code -- Easily integrates into continuous integration and Hardhat/Foundry builds -- Built-in 'printers' quickly report crucial contract information -- Detector API to write custom analyses in Python -- Ability to analyze contracts written with Solidity >= 0.4 -- Intermediate representation ([SlithIR](https://github.com/trailofbits/slither/wiki/SlithIR)) enables simple, high-precision analyses -- Correctly parses 99.9% of all public Solidity code -- Average execution time of less than 1 second per contract -- Integrates with Github's code scanning in [CI](https://github.com/marketplace/actions/slither-action) +* Detects vulnerable Solidity code with low false positives (see the list of [trophies](./trophies.md)) +* Identifies where the error condition occurs in the source code +* Easily integrates into continuous integration and Hardhat/Foundry builds +* Built-in 'printers' quickly report crucial contract information +* Detector API to write custom analyses in Python +* Ability to analyze contracts written with Solidity >= 0.4 +* Intermediate representation ([SlithIR](https://github.com/trailofbits/slither/wiki/SlithIR)) enables simple, high-precision analyses +* Correctly parses 99.9% of all public Solidity code +* Average execution time of less than 1 second per contract +* Integrates with Github's code scanning in [CI](https://github.com/marketplace/actions/slither-action) ## Usage Run Slither on a Hardhat/Foundry/Dapp/Brownie application: -```bash +```console slither . ``` @@ -44,18 +59,19 @@ This is the preferred option if your project has dependencies as Slither relies However, you can run Slither on a single file that does not import dependencies: -```bash +```console slither tests/uninitialized.sol ``` ## How to install -Slither requires Python 3.8+. +> **Note**
+> Slither requires Python 3.8+. If you're **not** going to use one of the [supported compilation frameworks](https://github.com/crytic/crytic-compile), you need [solc](https://github.com/ethereum/solidity/), the Solidity compiler; we recommend using [solc-select](https://github.com/crytic/solc-select) to conveniently switch between solc versions. ### Using Pip -```bash +```console pip3 install slither-analyzer ``` @@ -84,9 +100,9 @@ docker run -it -v /home/share:/share trailofbits/eth-security-toolbox ### Integration -- For GitHub action integration, use [slither-action](https://github.com/marketplace/actions/slither-action). -- To generate a Markdown report, use `slither [target] --checklist`. -- To generate a Markdown with GitHub source code highlighting, use `slither [target] --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/` (replace `ORG`, `REPO`, `COMMIT`) +* For GitHub action integration, use [slither-action](https://github.com/marketplace/actions/slither-action). +* To generate a Markdown report, use `slither [target] --checklist`. +* To generate a Markdown with GitHub source code highlighting, use `slither [target] --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/` (replace `ORG`, `REPO`, `COMMIT`) ## Detectors @@ -182,23 +198,24 @@ Num | Detector | What it Detects | Impact | Confidence For more information, see -- The [Detector Documentation](https://github.com/crytic/slither/wiki/Detector-Documentation) for details on each detector -- The [Detection Selection](https://github.com/crytic/slither/wiki/Usage#detector-selection) to run only selected detectors. By default, all the detectors are run. -- The [Triage Mode](https://github.com/crytic/slither/wiki/Usage#triage-mode) to filter individual results +* The [Detector Documentation](https://github.com/crytic/slither/wiki/Detector-Documentation) for details on each detector +* The [Detection Selection](https://github.com/crytic/slither/wiki/Usage#detector-selection) to run only selected detectors. By default, all the detectors are run. +* The [Triage Mode](https://github.com/crytic/slither/wiki/Usage#triage-mode) to filter individual results ## Printers + ### Quick Review Printers -- `human-summary`: [Print a human-readable summary of the contracts](https://github.com/trailofbits/slither/wiki/Printer-documentation#human-summary) -- `inheritance-graph`: [Export the inheritance graph of each contract to a dot file](https://github.com/trailofbits/slither/wiki/Printer-documentation#inheritance-graph) -- `contract-summary`: [Print a summary of the contracts](https://github.com/trailofbits/slither/wiki/Printer-documentation#contract-summary) -- `loc`: [Count the total number lines of code (LOC), source lines of code (SLOC), and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), and test files (TEST).](https://github.com/trailofbits/slither/wiki/Printer-documentation#loc) +* `human-summary`: [Print a human-readable summary of the contracts](https://github.com/trailofbits/slither/wiki/Printer-documentation#human-summary) +* `inheritance-graph`: [Export the inheritance graph of each contract to a dot file](https://github.com/trailofbits/slither/wiki/Printer-documentation#inheritance-graph) +* `contract-summary`: [Print a summary of the contracts](https://github.com/trailofbits/slither/wiki/Printer-documentation#contract-summary) +* `loc`: [Count the total number lines of code (LOC), source lines of code (SLOC), and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), and test files (TEST).](https://github.com/trailofbits/slither/wiki/Printer-documentation#loc) ### In-Depth Review Printers -- `call-graph`: [Export the call-graph of the contracts to a dot file](https://github.com/trailofbits/slither/wiki/Printer-documentation#call-graph) -- `cfg`: [Export the CFG of each functions](https://github.com/trailofbits/slither/wiki/Printer-documentation#cfg) -- `function-summary`: [Print a summary of the functions](https://github.com/trailofbits/slither/wiki/Printer-documentation#function-summary) -- `vars-and-auth`: [Print the state variables written and the authorization of the functions](https://github.com/crytic/slither/wiki/Printer-documentation#variables-written-and-authorization) -- `not-pausable`: [Print functions that do not use `whenNotPaused` modifier](https://github.com/trailofbits/slither/wiki/Printer-documentation#when-not-paused). +* `call-graph`: [Export the call-graph of the contracts to a dot file](https://github.com/trailofbits/slither/wiki/Printer-documentation#call-graph) +* `cfg`: [Export the CFG of each functions](https://github.com/trailofbits/slither/wiki/Printer-documentation#cfg) +* `function-summary`: [Print a summary of the functions](https://github.com/trailofbits/slither/wiki/Printer-documentation#function-summary) +* `vars-and-auth`: [Print the state variables written and the authorization of the functions](https://github.com/crytic/slither/wiki/Printer-documentation#variables-written-and-authorization) +* `not-pausable`: [Print functions that do not use `whenNotPaused` modifier](https://github.com/trailofbits/slither/wiki/Printer-documentation#when-not-paused). To run a printer, use `--print` and a comma-separated list of printers. @@ -206,13 +223,13 @@ See the [Printer documentation](https://github.com/crytic/slither/wiki/Printer-d ## Tools -- `slither-check-upgradeability`: [Review `delegatecall`-based upgradeability](https://github.com/crytic/slither/wiki/Upgradeability-Checks) -- `slither-prop`: [Automatic unit test and property generation](https://github.com/crytic/slither/wiki/Property-generation) -- `slither-flat`: [Flatten a codebase](https://github.com/crytic/slither/wiki/Contract-Flattening) -- `slither-check-erc`: [Check the ERC's conformance](https://github.com/crytic/slither/wiki/ERC-Conformance) -- `slither-format`: [Automatic patch generation](https://github.com/crytic/slither/wiki/Slither-format) -- `slither-read-storage`: [Read storage values from contracts](./slither/tools/read_storage/README.md) -- `slither-interface`: [Generate an interface for a contract](./slither/tools/interface/README.md) +* `slither-check-upgradeability`: [Review `delegatecall`-based upgradeability](https://github.com/crytic/slither/wiki/Upgradeability-Checks) +* `slither-prop`: [Automatic unit test and property generation](https://github.com/crytic/slither/wiki/Property-generation) +* `slither-flat`: [Flatten a codebase](https://github.com/crytic/slither/wiki/Contract-Flattening) +* `slither-check-erc`: [Check the ERC's conformance](https://github.com/crytic/slither/wiki/ERC-Conformance) +* `slither-format`: [Automatic patch generation](https://github.com/crytic/slither/wiki/Slither-format) +* `slither-read-storage`: [Read storage values from contracts](./slither/tools/read_storage/README.md) +* `slither-interface`: [Generate an interface for a contract](./slither/tools/interface/README.md) See the [Tool documentation](https://github.com/crytic/slither/wiki/Tool-Documentation) for additional tools. @@ -226,23 +243,23 @@ Documentation on Slither's internals is available [here](https://crytic.github.i Feel free to stop by our [Slack channel](https://empireslacking.herokuapp.com) (#ethereum) for help using or extending Slither. -- The [Printer documentation](https://github.com/trailofbits/slither/wiki/Printer-documentation) describes the information Slither is capable of visualizing for each contract. +* The [Printer documentation](https://github.com/trailofbits/slither/wiki/Printer-documentation) describes the information Slither is capable of visualizing for each contract. -- The [Detector documentation](https://github.com/trailofbits/slither/wiki/Adding-a-new-detector) describes how to write a new vulnerability analyses. +* The [Detector documentation](https://github.com/trailofbits/slither/wiki/Adding-a-new-detector) describes how to write a new vulnerability analyses. -- The [API documentation](https://github.com/crytic/slither/wiki/Python-API) describes the methods and objects available for custom analyses. +* The [API documentation](https://github.com/crytic/slither/wiki/Python-API) describes the methods and objects available for custom analyses. -- The [SlithIR documentation](https://github.com/trailofbits/slither/wiki/SlithIR) describes the SlithIR intermediate representation. +* The [SlithIR documentation](https://github.com/trailofbits/slither/wiki/SlithIR) describes the SlithIR intermediate representation. ## FAQ How do I exclude mocks or tests? -- View our documentation on [path filtering](https://github.com/crytic/slither/wiki/Usage#path-filtering). +* View our documentation on [path filtering](https://github.com/crytic/slither/wiki/Usage#path-filtering). How do I fix "unknown file" or compilation issues? -- Because slither requires the solc AST, it must have all dependencies available. +* Because slither requires the solc AST, it must have all dependencies available. If a contract has dependencies, `slither contract.sol` will fail. Instead, use `slither .` in the parent directory of `contracts/` (you should see `contracts/` when you run `ls`). If you have a `node_modules/` folder, it must be in the same directory as `contracts/`. To verify that this issue is related to slither, @@ -257,7 +274,7 @@ Slither is licensed and distributed under the AGPLv3 license. [Contact us](mailt ### Trail of Bits publication -- [Slither: A Static Analysis Framework For Smart Contracts](https://arxiv.org/abs/1908.09878), Josselin Feist, Gustavo Grieco, Alex Groce - WETSEB '19 +* [Slither: A Static Analysis Framework For Smart Contracts](https://arxiv.org/abs/1908.09878), Josselin Feist, Gustavo Grieco, Alex Groce - WETSEB '19 ### External publications diff --git a/setup.py b/setup.py index 70d4f71fd4..182b91d35b 100644 --- a/setup.py +++ b/setup.py @@ -8,15 +8,15 @@ description="Slither is a Solidity static analysis framework written in Python 3.", url="https://github.com/crytic/slither", author="Trail of Bits", - version="0.9.3", + version="0.9.6", packages=find_packages(), python_requires=">=3.8", install_requires=[ "packaging", "prettytable>=3.3.0", "pycryptodome>=3.4.6", - # "crytic-compile>=0.3.1,<0.4.0", - "crytic-compile@git+https://github.com/crytic/crytic-compile.git@dev#egg=crytic-compile", + "crytic-compile>=0.3.3,<0.4.0", + # "crytic-compile@git+https://github.com/crytic/crytic-compile.git@dev#egg=crytic-compile", "web3>=6.0.0", "eth-abi>=4.0.0", "eth-typing>=3.0.0", @@ -36,7 +36,6 @@ "coverage[toml]", "filelock", "pytest-insta", - "solc-select@git+https://github.com/crytic/solc-select.git@query-artifact-path#egg=solc-select", ], "doc": [ "pdoc", diff --git a/slither/core/declarations/__init__.py b/slither/core/declarations/__init__.py index 92e0b9eca3..f341187518 100644 --- a/slither/core/declarations/__init__.py +++ b/slither/core/declarations/__init__.py @@ -18,3 +18,5 @@ from .function_contract import FunctionContract from .function_top_level import FunctionTopLevel from .custom_error_contract import CustomErrorContract +from .custom_error_top_level import CustomErrorTopLevel +from .custom_error import CustomError diff --git a/slither/core/declarations/contract.py b/slither/core/declarations/contract.py index fd2cdd4684..9b1488db31 100644 --- a/slither/core/declarations/contract.py +++ b/slither/core/declarations/contract.py @@ -861,7 +861,7 @@ def get_state_variable_from_canonical_name( Returns: StateVariable """ - return next((v for v in self.state_variables if v.name == canonical_name), None) + return next((v for v in self.state_variables if v.canonical_name == canonical_name), None) def get_structure_from_name(self, structure_name: str) -> Optional["StructureContract"]: """ diff --git a/slither/core/declarations/custom_error_contract.py b/slither/core/declarations/custom_error_contract.py index cd279a3a62..2c8bec9efa 100644 --- a/slither/core/declarations/custom_error_contract.py +++ b/slither/core/declarations/custom_error_contract.py @@ -16,3 +16,7 @@ def is_declared_by(self, contract: "Contract") -> bool: :return: """ return self.contract == contract + + @property + def canonical_name(self) -> str: + return self.contract.name + "." + self.full_name diff --git a/slither/core/declarations/custom_error_top_level.py b/slither/core/declarations/custom_error_top_level.py index 64a6a85353..b80356b245 100644 --- a/slither/core/declarations/custom_error_top_level.py +++ b/slither/core/declarations/custom_error_top_level.py @@ -12,3 +12,7 @@ class CustomErrorTopLevel(CustomError, TopLevel): def __init__(self, compilation_unit: "SlitherCompilationUnit", scope: "FileScope") -> None: super().__init__(compilation_unit) self.file_scope: "FileScope" = scope + + @property + def canonical_name(self) -> str: + return self.full_name diff --git a/slither/core/expressions/unary_operation.py b/slither/core/expressions/unary_operation.py index 6572249278..4051326131 100644 --- a/slither/core/expressions/unary_operation.py +++ b/slither/core/expressions/unary_operation.py @@ -106,8 +106,6 @@ def __init__( UnaryOperationType.MINUSMINUS_PRE, UnaryOperationType.PLUSPLUS_POST, UnaryOperationType.MINUSMINUS_POST, - UnaryOperationType.PLUS_PRE, - UnaryOperationType.MINUS_PRE, ]: expression.set_lvalue() diff --git a/slither/detectors/naming_convention/naming_convention.py b/slither/detectors/naming_convention/naming_convention.py index 02deb719e7..0633799e56 100644 --- a/slither/detectors/naming_convention/naming_convention.py +++ b/slither/detectors/naming_convention/naming_convention.py @@ -167,7 +167,7 @@ def _detect(self) -> List[Output]: results.append(res) else: - if var.visibility == "private": + if var.visibility in ["private", "internal"]: correct_naming = self.is_mixed_case_with_underscore(var.name) else: correct_naming = self.is_mixed_case(var.name) diff --git a/slither/detectors/statements/divide_before_multiply.py b/slither/detectors/statements/divide_before_multiply.py index 6f199db414..334da592c0 100644 --- a/slither/detectors/statements/divide_before_multiply.py +++ b/slither/detectors/statements/divide_before_multiply.py @@ -2,7 +2,7 @@ Module detecting possible loss of precision due to divide before multiple """ from collections import defaultdict -from typing import DefaultDict, List, Set, Tuple +from typing import DefaultDict, List, Tuple from slither.core.cfg.node import Node from slither.core.declarations.contract import Contract @@ -63,7 +63,7 @@ def is_assert(node: Node) -> bool: # pylint: disable=too-many-branches def _explore( - to_explore: Set[Node], f_results: List[List[Node]], divisions: DefaultDict[LVALUE, List[Node]] + to_explore: List[Node], f_results: List[List[Node]], divisions: DefaultDict[LVALUE, List[Node]] ) -> None: explored = set() while to_explore: # pylint: disable=too-many-nested-blocks @@ -114,7 +114,7 @@ def _explore( f_results.append(node_results) for son in node.sons: - to_explore.add(son) + to_explore.append(son) def detect_divide_before_multiply( @@ -145,7 +145,7 @@ def detect_divide_before_multiply( # track all the division results (and the assignment of the division results) divisions: DefaultDict[LVALUE, List[Node]] = defaultdict(list) - _explore({function.entry_point}, f_results, divisions) + _explore([function.entry_point], f_results, divisions) for f_result in f_results: results.append((function, f_result)) diff --git a/slither/utils/output.py b/slither/utils/output.py index 84c9ac65a1..4a91ca9b9b 100644 --- a/slither/utils/output.py +++ b/slither/utils/output.py @@ -18,6 +18,7 @@ Structure, Pragma, FunctionContract, + CustomError, ) from slither.core.source_mapping.source_mapping import SourceMapping from slither.core.variables.local_variable import LocalVariable @@ -438,6 +439,8 @@ def add(self, add: SupportedOutput, additional_fields: Optional[Dict] = None) -> self.add_event(add, additional_fields=additional_fields) elif isinstance(add, Structure): self.add_struct(add, additional_fields=additional_fields) + elif isinstance(add, CustomError): + self.add_custom_error(add, additional_fields=additional_fields) elif isinstance(add, Pragma): self.add_pragma(add, additional_fields=additional_fields) elif isinstance(add, Node): @@ -585,6 +588,32 @@ def add_event(self, event: Event, additional_fields: Optional[Dict] = None) -> N self._data["elements"].append(element) + # endregion + ################################################################################### + ################################################################################### + # region CustomError + ################################################################################### + ################################################################################### + + def add_custom_error( + self, custom_error: CustomError, additional_fields: Optional[Dict] = None + ) -> None: + if additional_fields is None: + additional_fields = {} + type_specific_fields = { + "parent": _create_parent_element(custom_error), + "signature": custom_error.full_name, + } + element = _create_base_element( + "custom_error", + custom_error.name, + custom_error.source_mapping.to_json(), + type_specific_fields, + additional_fields, + ) + + self._data["elements"].append(element) + # endregion ################################################################################### ################################################################################### diff --git a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_4_25_naming_convention_sol__0.txt b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_4_25_naming_convention_sol__0.txt index ed4177ca17..e4a643678d 100644 --- a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_4_25_naming_convention_sol__0.txt +++ b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_4_25_naming_convention_sol__0.txt @@ -1,10 +1,10 @@ Struct naming.test (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#14-16) is not in CapWords -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#69) is not in mixedCase +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#70) is not in mixedCase -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#69) is single letter l, O, or I, which should not be used +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#70) is single letter l, O, or I, which should not be used -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#68) is not in mixedCase +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#69) is not in mixedCase Variable naming.Var_One (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#11) is not in mixedCase @@ -14,11 +14,11 @@ Contract naming (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_c Enum naming.numbers (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#6) is not in CapWords -Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#59) is not in mixedCase +Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#60) is not in mixedCase -Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#56) is not in mixedCase +Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#57) is not in mixedCase -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#68) is single letter l, O, or I, which should not be used +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#69) is single letter l, O, or I, which should not be used Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#23) is not in CapWords @@ -26,7 +26,7 @@ Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.4.25 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#30-33) is not in mixedCase -Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#67) is single letter l, O, or I, which should not be used +Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#68) is single letter l, O, or I, which should not be used Parameter naming.setInt(uint256,uint256).Number2 (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#35) is not in mixedCase diff --git a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_5_16_naming_convention_sol__0.txt b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_5_16_naming_convention_sol__0.txt index 35c11193f5..96f6aab3c6 100644 --- a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_5_16_naming_convention_sol__0.txt +++ b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_5_16_naming_convention_sol__0.txt @@ -1,10 +1,10 @@ Struct naming.test (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#14-16) is not in CapWords -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#69) is not in mixedCase +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#70) is not in mixedCase -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#69) is single letter l, O, or I, which should not be used +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#70) is single letter l, O, or I, which should not be used -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#68) is not in mixedCase +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#69) is not in mixedCase Variable naming.Var_One (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#11) is not in mixedCase @@ -14,11 +14,11 @@ Contract naming (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_c Enum naming.numbers (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#6) is not in CapWords -Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#59) is not in mixedCase +Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#60) is not in mixedCase -Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#56) is not in mixedCase +Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#57) is not in mixedCase -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#68) is single letter l, O, or I, which should not be used +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#69) is single letter l, O, or I, which should not be used Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#23) is not in CapWords @@ -26,7 +26,7 @@ Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.5.16 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#30-33) is not in mixedCase -Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#67) is single letter l, O, or I, which should not be used +Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#68) is single letter l, O, or I, which should not be used Parameter naming.setInt(uint256,uint256).Number2 (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#35) is not in mixedCase diff --git a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_6_11_naming_convention_sol__0.txt b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_6_11_naming_convention_sol__0.txt index f692e211b8..f1986fb781 100644 --- a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_6_11_naming_convention_sol__0.txt +++ b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_6_11_naming_convention_sol__0.txt @@ -1,10 +1,10 @@ Struct naming.test (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#14-16) is not in CapWords -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#69) is not in mixedCase +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#70) is not in mixedCase -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#69) is single letter l, O, or I, which should not be used +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#70) is single letter l, O, or I, which should not be used -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#68) is not in mixedCase +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#69) is not in mixedCase Variable naming.Var_One (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#11) is not in mixedCase @@ -14,11 +14,11 @@ Contract naming (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_c Enum naming.numbers (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#6) is not in CapWords -Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#59) is not in mixedCase +Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#60) is not in mixedCase -Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#56) is not in mixedCase +Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#57) is not in mixedCase -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#68) is single letter l, O, or I, which should not be used +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#69) is single letter l, O, or I, which should not be used Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#23) is not in CapWords @@ -26,7 +26,7 @@ Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.6.11 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#30-33) is not in mixedCase -Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#67) is single letter l, O, or I, which should not be used +Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#68) is single letter l, O, or I, which should not be used Parameter naming.setInt(uint256,uint256).Number2 (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#35) is not in mixedCase diff --git a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_7_6_naming_convention_sol__0.txt b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_7_6_naming_convention_sol__0.txt index af17cabe8f..b471cbfa2f 100644 --- a/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_7_6_naming_convention_sol__0.txt +++ b/tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_7_6_naming_convention_sol__0.txt @@ -1,10 +1,10 @@ Struct naming.test (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#14-16) is not in CapWords -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#69) is not in mixedCase +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#70) is not in mixedCase -Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#69) is single letter l, O, or I, which should not be used +Variable T.I (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#70) is single letter l, O, or I, which should not be used -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#68) is not in mixedCase +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#69) is not in mixedCase Variable naming.Var_One (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#11) is not in mixedCase @@ -14,11 +14,11 @@ Contract naming (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_co Enum naming.numbers (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#6) is not in CapWords -Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#59) is not in mixedCase +Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#60) is not in mixedCase -Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#56) is not in mixedCase +Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#57) is not in mixedCase -Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#68) is single letter l, O, or I, which should not be used +Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#69) is single letter l, O, or I, which should not be used Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#23) is not in CapWords @@ -26,7 +26,7 @@ Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.7.6/ Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#30-33) is not in mixedCase -Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#67) is single letter l, O, or I, which should not be used +Variable T.l (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#68) is single letter l, O, or I, which should not be used Parameter naming.setInt(uint256,uint256).Number2 (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#35) is not in mixedCase diff --git a/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol b/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol index 7181ca9110..add7867e07 100644 --- a/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol +++ b/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol @@ -53,7 +53,8 @@ contract Test { contract T { uint private _myPrivateVar; - uint _myPublicVar; + uint internal _myInternalVar; + uint public _myPublicVar; function test(uint _unused, uint _used) public returns(uint){ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol-0.4.25.zip b/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol-0.4.25.zip index c7aaae071d..fe35f0c006 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol-0.4.25.zip and b/tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol-0.4.25.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.4.25/no_warning_for_public_constants.sol-0.4.25.zip b/tests/e2e/detectors/test_data/naming-convention/0.4.25/no_warning_for_public_constants.sol-0.4.25.zip index 2726a771d1..b8c6c58c1d 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.4.25/no_warning_for_public_constants.sol-0.4.25.zip and b/tests/e2e/detectors/test_data/naming-convention/0.4.25/no_warning_for_public_constants.sol-0.4.25.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol b/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol index 7181ca9110..add7867e07 100644 --- a/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol +++ b/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol @@ -53,7 +53,8 @@ contract Test { contract T { uint private _myPrivateVar; - uint _myPublicVar; + uint internal _myInternalVar; + uint public _myPublicVar; function test(uint _unused, uint _used) public returns(uint){ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol-0.5.16.zip b/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol-0.5.16.zip index da900f1f69..6c732f786e 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol-0.5.16.zip and b/tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol-0.5.16.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.5.16/no_warning_for_public_constants.sol-0.5.16.zip b/tests/e2e/detectors/test_data/naming-convention/0.5.16/no_warning_for_public_constants.sol-0.5.16.zip index 160fee3a22..600f68386b 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.5.16/no_warning_for_public_constants.sol-0.5.16.zip and b/tests/e2e/detectors/test_data/naming-convention/0.5.16/no_warning_for_public_constants.sol-0.5.16.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol b/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol index 7181ca9110..add7867e07 100644 --- a/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol +++ b/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol @@ -53,7 +53,8 @@ contract Test { contract T { uint private _myPrivateVar; - uint _myPublicVar; + uint internal _myInternalVar; + uint public _myPublicVar; function test(uint _unused, uint _used) public returns(uint){ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol-0.6.11.zip b/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol-0.6.11.zip index 3e6277ac1b..b916970874 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol-0.6.11.zip and b/tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol-0.6.11.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.6.11/no_warning_for_public_constants.sol-0.6.11.zip b/tests/e2e/detectors/test_data/naming-convention/0.6.11/no_warning_for_public_constants.sol-0.6.11.zip index 67f8eff7ee..ed813d07b9 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.6.11/no_warning_for_public_constants.sol-0.6.11.zip and b/tests/e2e/detectors/test_data/naming-convention/0.6.11/no_warning_for_public_constants.sol-0.6.11.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol b/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol index 7181ca9110..add7867e07 100644 --- a/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol +++ b/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol @@ -53,7 +53,8 @@ contract Test { contract T { uint private _myPrivateVar; - uint _myPublicVar; + uint internal _myInternalVar; + uint public _myPublicVar; function test(uint _unused, uint _used) public returns(uint){ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol-0.7.6.zip b/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol-0.7.6.zip index cc9d43c582..f1e3a8ad55 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol-0.7.6.zip and b/tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol-0.7.6.zip differ diff --git a/tests/e2e/detectors/test_data/naming-convention/0.7.6/no_warning_for_public_constants.sol-0.7.6.zip b/tests/e2e/detectors/test_data/naming-convention/0.7.6/no_warning_for_public_constants.sol-0.7.6.zip index 7b304b5c0c..9f2c1a1a7d 100644 Binary files a/tests/e2e/detectors/test_data/naming-convention/0.7.6/no_warning_for_public_constants.sol-0.7.6.zip and b/tests/e2e/detectors/test_data/naming-convention/0.7.6/no_warning_for_public_constants.sol-0.7.6.zip differ diff --git a/tests/unit/slithir/test_ternary_expressions.py b/tests/unit/slithir/test_ternary_expressions.py index 0acd9345d7..712c9582b0 100644 --- a/tests/unit/slithir/test_ternary_expressions.py +++ b/tests/unit/slithir/test_ternary_expressions.py @@ -1,8 +1,13 @@ from pathlib import Path from slither import Slither from slither.core.cfg.node import NodeType -from slither.slithir.operations import Assignment -from slither.core.expressions import AssignmentOperation, TupleExpression +from slither.slithir.operations import Assignment, Unpack +from slither.core.expressions import ( + AssignmentOperation, + TupleExpression, + NewElementaryType, + CallExpression, +) TEST_DATA_DIR = Path(__file__).resolve().parent / "test_data" @@ -12,27 +17,29 @@ def test_ternary_conversions(solc_binary_path) -> None: solc_path = solc_binary_path("0.8.0") slither = Slither(Path(TEST_DATA_DIR, "ternary_expressions.sol").as_posix(), solc=solc_path) for contract in slither.contracts: - for function in contract.functions: - vars_declared = 0 - vars_assigned = 0 - for node in function.nodes: - if node.type in [NodeType.IF, NodeType.IFLOOP]: + if not contract.is_signature_only: + for function in contract.functions: + vars_declared = 0 + vars_assigned = 0 + for node in function.nodes: + if node.type in [NodeType.IF, NodeType.IFLOOP]: - # Iterate over true and false son - for inner_node in node.sons: - # Count all variables declared - expression = inner_node.expression - if isinstance(expression, AssignmentOperation): - var_expr = expression.expression_left - # Only tuples declare more than one var - if isinstance(var_expr, TupleExpression): - vars_declared += len(var_expr.expressions) - else: - vars_declared += 1 + # Iterate over true and false son + for inner_node in node.sons: + # Count all variables declared + expression = inner_node.expression + if isinstance( + expression, (AssignmentOperation, NewElementaryType, CallExpression) + ): + var_expr = expression.expression_left + # Only tuples declare more than one var + if isinstance(var_expr, TupleExpression): + vars_declared += len(var_expr.expressions) + else: + vars_declared += 1 - for ir in inner_node.irs: - # Count all variables defined - if isinstance(ir, Assignment): - vars_assigned += 1 - - assert vars_declared == vars_assigned + for ir in inner_node.irs: + # Count all variables defined + if isinstance(ir, (Assignment, Unpack)): + vars_assigned += 1 + assert vars_declared == vars_assigned and vars_assigned != 0