slither.utils.upgradeability

  1from typing import Optional, Tuple, List
  2
  3from slither.analyses.data_dependency.data_dependency import get_dependencies
  4from slither.core.cfg.node import Node, NodeType
  5from slither.core.declarations import (
  6    Contract,
  7    Function,
  8)
  9from slither.core.expressions import (
 10    Literal,
 11    Identifier,
 12    CallExpression,
 13    AssignmentOperation,
 14)
 15from slither.core.solidity_types import (
 16    ElementaryType,
 17)
 18from slither.core.variables.local_variable import LocalVariable
 19from slither.core.variables.state_variable import StateVariable
 20from slither.core.variables.variable import Variable
 21from slither.slithir.operations import (
 22    LowLevelCall,
 23)
 24from slither.tools.read_storage.read_storage import SlotInfo, SlitherReadStorage
 25from slither.utils.encoding import encode_ir_for_upgradeability_compare
 26
 27
 28class TaintedExternalContract:
 29    def __init__(self, contract: "Contract") -> None:
 30        self._contract: Contract = contract
 31        self._tainted_functions: List[Function] = []
 32        self._tainted_variables: List[Variable] = []
 33
 34    @property
 35    def contract(self) -> Contract:
 36        return self._contract
 37
 38    @property
 39    def tainted_functions(self) -> List[Function]:
 40        return self._tainted_functions
 41
 42    def add_tainted_function(self, f: Function):
 43        self._tainted_functions.append(f)
 44
 45    @property
 46    def tainted_variables(self) -> List[Variable]:
 47        return self._tainted_variables
 48
 49    def add_tainted_variable(self, v: Variable):
 50        self._tainted_variables.append(v)
 51
 52
 53# pylint: disable=too-many-locals
 54def compare(
 55    v1: Contract, v2: Contract, include_external: bool = False
 56) -> Tuple[
 57    List[Variable],
 58    List[Variable],
 59    List[Variable],
 60    List[Function],
 61    List[Function],
 62    List[Function],
 63]:
 64    """
 65    Compares two versions of a contract. Most useful for upgradeable (logic) contracts,
 66    but does not require that Contract.is_upgradeable returns true for either contract.
 67
 68    Args:
 69        v1: Original version of (upgradeable) contract
 70        v2: Updated version of (upgradeable) contract
 71        include_external: Optional flag to enable cross-contract external taint analysis
 72
 73    Returns:
 74        missing-vars-in-v2: list[Variable],
 75        new-variables: list[Variable],
 76        tainted-variables: list[Variable],
 77        new-functions: list[Function],
 78        modified-functions: list[Function],
 79        tainted-functions: list[Function]
 80        tainted-contracts: list[TaintedExternalContract]
 81    """
 82
 83    order_vars1 = v1.stored_state_variables_ordered
 84    order_vars2 = v2.stored_state_variables_ordered
 85    func_sigs1 = [function.solidity_signature for function in v1.functions]
 86    func_sigs2 = [function.solidity_signature for function in v2.functions]
 87
 88    missing_vars_in_v2 = []
 89    new_variables = []
 90    tainted_variables = []
 91    new_functions = []
 92    modified_functions = []
 93    tainted_functions = []
 94
 95    # Since this is not a detector, include any missing variables in the v2 contract
 96    if len(order_vars2) < len(order_vars1):
 97        missing_vars_in_v2.extend(get_missing_vars(v1, v2))
 98
 99    # Find all new and modified functions in the v2 contract
100    new_modified_functions = []
101    new_modified_function_vars = []
102    for sig in func_sigs2:
103        function = v2.get_function_from_signature(sig)
104        orig_function = v1.get_function_from_signature(sig)
105        if sig not in func_sigs1:
106            new_modified_functions.append(function)
107            new_functions.append(function)
108            new_modified_function_vars += function.all_state_variables_written()
109        elif not function.is_constructor_variables and is_function_modified(
110            orig_function, function
111        ):
112            new_modified_functions.append(function)
113            modified_functions.append(function)
114            new_modified_function_vars += function.all_state_variables_written()
115
116    # Find all unmodified functions that call a modified function or read/write the
117    # same state variable(s) as a new/modified function, i.e., tainted functions
118    for function in v2.functions:
119        if (
120            function in new_modified_functions
121            or function.is_constructor
122            or function.name.startswith("slither")
123        ):
124            continue
125        modified_calls = [
126            func for func in new_modified_functions if func in function.internal_calls
127        ]
128        tainted_vars = [
129            var
130            for var in set(new_modified_function_vars)
131            if var in function.all_state_variables_read() + function.all_state_variables_written()
132            and not var.is_constant
133            and not var.is_immutable
134        ]
135        if len(modified_calls) > 0 or len(tainted_vars) > 0:
136            tainted_functions.append(function)
137
138    # Find all new or tainted variables, i.e., variables that are written by a new/modified/tainted function
139    for var in order_vars2:
140        written_by = v2.get_functions_writing_to_variable(var)
141        if next((v for v in v1.state_variables_ordered if v.name == var.name), None) is None:
142            new_variables.append(var)
143        elif any(func in written_by for func in new_modified_functions + tainted_functions):
144            tainted_variables.append(var)
145
146    tainted_contracts = []
147    if include_external:
148        # Find all external contracts and functions called by new/modified/tainted functions
149        tainted_contracts = tainted_external_contracts(
150            new_functions + modified_functions + tainted_functions
151        )
152
153    return (
154        missing_vars_in_v2,
155        new_variables,
156        tainted_variables,
157        new_functions,
158        modified_functions,
159        tainted_functions,
160        tainted_contracts,
161    )
162
163
164def tainted_external_contracts(funcs: List[Function]) -> List[TaintedExternalContract]:
165    """
166    Takes a list of functions from one contract, finds any calls in these to functions in external contracts,
167    and determines which variables and functions in the external contracts are tainted by these external calls.
168    Args:
169        funcs: a list of Function objects to search for external calls.
170
171    Returns:
172        TaintedExternalContract() (
173            contract: Contract,
174            tainted_functions: List[TaintedFunction],
175            tainted_variables: List[TaintedVariable]
176        )
177    """
178    tainted_contracts: dict[str, TaintedExternalContract] = {}
179    tainted_list: list[TaintedExternalContract] = []
180
181    for func in funcs:
182        for contract, target in func.all_high_level_calls():
183            if contract.is_library:
184                # Not interested in library calls
185                continue
186            if contract.name not in tainted_contracts:
187                # A contract may be tainted by multiple function calls - only make one TaintedExternalContract object
188                tainted_contracts[contract.name] = TaintedExternalContract(contract)
189            if (
190                isinstance(target, Function)
191                and target not in funcs
192                and target not in (f for f in tainted_contracts[contract.name].tainted_functions)
193                and not (target.is_constructor or target.is_fallback or target.is_receive)
194            ):
195                # Found a high-level call to a new tainted function
196                tainted_contracts[contract.name].add_tainted_function(target)
197                for var in target.all_state_variables_written():
198                    # Consider as tainted all variables written by the tainted function
199                    if var not in (v for v in tainted_contracts[contract.name].tainted_variables):
200                        tainted_contracts[contract.name].add_tainted_variable(var)
201            elif (
202                isinstance(target, StateVariable)
203                and target not in (v for v in tainted_contracts[contract.name].tainted_variables)
204                and target.is_stored
205            ):
206                # Found a new high-level call to a public state variable getter
207                tainted_contracts[contract.name].add_tainted_variable(target)
208    for c in tainted_contracts.values():
209        tainted_list.append(c)
210        contract = c.contract
211        variables = c.tainted_variables
212        for var in variables:
213            # For each tainted variable, consider as tainted any function that reads or writes to it
214            read_write = set(
215                contract.get_functions_reading_from_variable(var)
216                + contract.get_functions_writing_to_variable(var)
217            )
218            for f in read_write:
219                if f not in tainted_contracts[contract.name].tainted_functions and not (
220                    f.is_constructor or f.is_fallback or f.is_receive
221                ):
222                    c.add_tainted_function(f)
223    return tainted_list
224
225
226def tainted_inheriting_contracts(
227    tainted_contracts: List[TaintedExternalContract], contracts: List[Contract] = None
228) -> List[TaintedExternalContract]:
229    """
230    Takes a list of TaintedExternalContract obtained from tainted_external_contracts, and finds any contracts which
231    inherit a tainted contract, as well as any functions that call tainted functions or read tainted variables in
232    the inherited contract.
233    Args:
234        tainted_contracts: the list obtained from `tainted_external_contracts` or `compare`.
235        contracts: (optional) the list of contracts to check for inheritance. If not provided, defaults to
236                    `contract.compilation_unit.contracts` for each contract in tainted_contracts.
237
238    Returns:
239        An updated list of TaintedExternalContract, including all from the input list.
240    """
241    for tainted in tainted_contracts:
242        contract = tainted.contract
243        check_contracts = contracts
244        if contracts is None:
245            check_contracts = contract.compilation_unit.contracts
246        # We are only interested in checking contracts that inherit a tainted contract
247        check_contracts = [
248            c
249            for c in check_contracts
250            if c.name not in [t.contract.name for t in tainted_contracts]
251            and contract.name in [i.name for i in c.inheritance]
252        ]
253        for c in check_contracts:
254            new_taint = TaintedExternalContract(c)
255            for f in c.functions_declared:
256                # Search for functions that call an inherited tainted function or access an inherited tainted variable
257                internal_calls = [c for c in f.all_internal_calls() if isinstance(c, Function)]
258                if any(
259                    call.canonical_name == t.canonical_name
260                    for t in tainted.tainted_functions
261                    for call in internal_calls
262                ) or any(
263                    var.canonical_name == t.canonical_name
264                    for t in tainted.tainted_variables
265                    for var in f.all_state_variables_read() + f.all_state_variables_written()
266                ):
267                    new_taint.add_tainted_function(f)
268            for f in new_taint.tainted_functions:
269                # For each newly found tainted function, consider as tainted any variable it writes to
270                for var in f.all_state_variables_written():
271                    if var not in (
272                        v for v in tainted.tainted_variables + new_taint.tainted_variables
273                    ):
274                        new_taint.add_tainted_variable(var)
275            for var in new_taint.tainted_variables:
276                # For each newly found tainted variable, consider as tainted any function that reads or writes to it
277                read_write = set(
278                    contract.get_functions_reading_from_variable(var)
279                    + contract.get_functions_writing_to_variable(var)
280                )
281                for f in read_write:
282                    if f not in (
283                        t for t in tainted.tainted_functions + new_taint.tainted_functions
284                    ) and not (f.is_constructor or f.is_fallback or f.is_receive):
285                        new_taint.add_tainted_function(f)
286            if len(new_taint.tainted_functions) > 0:
287                tainted_contracts.append(new_taint)
288    return tainted_contracts
289
290
291def get_missing_vars(v1: Contract, v2: Contract) -> List[StateVariable]:
292    """
293    Gets all non-constant/immutable StateVariables that appear in v1 but not v2
294    Args:
295        v1: Contract version 1
296        v2: Contract version 2
297
298    Returns:
299        List of StateVariables from v1 missing in v2
300    """
301    results = []
302    order_vars1 = v1.stored_state_variables_ordered
303    order_vars2 = v2.stored_state_variables_ordered
304    if len(order_vars2) < len(order_vars1):
305        for variable in order_vars1:
306            if variable.name not in [v.name for v in order_vars2]:
307                results.append(variable)
308    return results
309
310
311def is_function_modified(f1: Function, f2: Function) -> bool:
312    """
313    Compares two versions of a function, and returns True if the function has been modified.
314    First checks whether the functions' content hashes are equal to quickly rule out identical functions.
315    Walks the CFGs and compares IR operations if hashes differ to rule out false positives, i.e., from changed comments.
316
317    Args:
318        f1: Original version of the function
319        f2: New version of the function
320
321    Returns:
322        True if the functions differ, otherwise False
323    """
324    # If the function content hashes are the same, no need to investigate the function further
325    if f1.source_mapping.content_hash == f2.source_mapping.content_hash:
326        return False
327    # If the hashes differ, it is possible a change in a name or in a comment could be the only difference
328    # So we need to resort to walking through the CFG and comparing the IR operations
329    queue_f1 = [f1.entry_point]
330    queue_f2 = [f2.entry_point]
331    visited = []
332    while len(queue_f1) > 0 and len(queue_f2) > 0:
333        node_f1 = queue_f1.pop(0)
334        node_f2 = queue_f2.pop(0)
335        visited.extend([node_f1, node_f2])
336        queue_f1.extend(son for son in node_f1.sons if son not in visited)
337        queue_f2.extend(son for son in node_f2.sons if son not in visited)
338        if len(node_f1.irs) != len(node_f2.irs):
339            return True
340        for i, ir in enumerate(node_f1.irs):
341            if encode_ir_for_upgradeability_compare(ir) != encode_ir_for_upgradeability_compare(
342                node_f2.irs[i]
343            ):
344                return True
345    return False
346
347
348def get_proxy_implementation_slot(proxy: Contract) -> Optional[SlotInfo]:
349    """
350    Gets information about the storage slot where a proxy's implementation address is stored.
351    Args:
352        proxy: A Contract object (proxy.is_upgradeable_proxy should be true).
353
354    Returns:
355        (`SlotInfo`) | None : A dictionary of the slot information.
356    """
357
358    delegate = get_proxy_implementation_var(proxy)
359    if isinstance(delegate, StateVariable):
360        if delegate.is_stored:
361            srs = SlitherReadStorage([proxy], 20)
362            return srs.get_storage_slot(delegate, proxy)
363        if delegate.is_constant and delegate.type.name == "bytes32":
364            return SlotInfo(
365                name=delegate.name,
366                type_string="address",
367                slot=int(delegate.expression.value, 16),
368                size=160,
369                offset=0,
370            )
371    return None
372
373
374def get_proxy_implementation_var(proxy: Contract) -> Optional[Variable]:
375    """
376    Gets the Variable that stores a proxy's implementation address. Uses data dependency to trace any LocalVariable
377    that is passed into a delegatecall as the target address back to its data source, ideally a StateVariable.
378    Can return a newly created StateVariable if an `sload` from a hardcoded storage slot is found in assembly.
379    Args:
380        proxy: A Contract object (proxy.is_upgradeable_proxy should be true).
381
382    Returns:
383        (`Variable`) | None : The variable, ideally a StateVariable, which stores the proxy's implementation address.
384    """
385    if not proxy.is_upgradeable_proxy or not proxy.fallback_function:
386        return None
387
388    delegate = find_delegate_in_fallback(proxy)
389    if isinstance(delegate, LocalVariable):
390        dependencies = get_dependencies(delegate, proxy)
391        try:
392            delegate = next(var for var in dependencies if isinstance(var, StateVariable))
393        except StopIteration:
394            # TODO: Handle case where get_dependencies does not return any state variables.
395            return delegate
396    return delegate
397
398
399def find_delegate_in_fallback(proxy: Contract) -> Optional[Variable]:
400    """
401    Searches a proxy's fallback function for a delegatecall, then extracts the Variable being passed in as the target.
402    Can return a newly created StateVariable if an `sload` from a hardcoded storage slot is found in assembly.
403    Should typically be called by get_proxy_implementation_var(proxy).
404    Args:
405        proxy: A Contract object (should have a fallback function).
406
407    Returns:
408        (`Variable`) | None : The variable being passed as the destination argument in a delegatecall in the fallback.
409    """
410    delegate: Optional[Variable] = None
411    fallback = proxy.fallback_function
412    for node in fallback.all_nodes():
413        for ir in node.irs:
414            if isinstance(ir, LowLevelCall) and ir.function_name == "delegatecall":
415                delegate = ir.destination
416        if delegate is not None:
417            break
418        if (
419            node.type == NodeType.ASSEMBLY
420            and isinstance(node.inline_asm, str)
421            and "delegatecall" in node.inline_asm
422        ):
423            delegate = extract_delegate_from_asm(proxy, node)
424        elif node.type == NodeType.EXPRESSION:
425            expression = node.expression
426            if isinstance(expression, AssignmentOperation):
427                expression = expression.expression_right
428            if (
429                isinstance(expression, CallExpression)
430                and "delegatecall" in str(expression.called)
431                and len(expression.arguments) > 1
432            ):
433                dest = expression.arguments[1]
434                if isinstance(dest, CallExpression) and "sload" in str(dest.called):
435                    dest = dest.arguments[0]
436                if isinstance(dest, Identifier):
437                    delegate = dest.value
438                    break
439                if (
440                    isinstance(dest, Literal) and len(dest.value) == 66
441                ):  # 32 bytes = 64 chars + "0x" = 66 chars
442                    # Storage slot is not declared as a constant, but rather is hardcoded in the assembly,
443                    # so create a new StateVariable to represent it.
444                    delegate = create_state_variable_from_slot(dest.value)
445                    break
446    return delegate
447
448
449def extract_delegate_from_asm(contract: Contract, node: Node) -> Optional[Variable]:
450    """
451    Finds a Variable with a name matching the argument passed into a delegatecall, when all we have is an Assembly node
452    with a block of code as one long string. Usually only the case for solc versions < 0.6.0.
453    Can return a newly created StateVariable if an `sload` from a hardcoded storage slot is found in assembly.
454    Should typically be called by find_delegate_in_fallback(proxy).
455    Args:
456        contract: The parent Contract.
457        node: The Assembly Node (i.e., node.type == NodeType.ASSEMBLY)
458
459    Returns:
460        (`Variable`) | None : The variable being passed as the destination argument in a delegatecall in the fallback.
461    """
462    asm_split = str(node.inline_asm).split("\n")
463    asm = next(line for line in asm_split if "delegatecall" in line)
464    params = asm.split("call(")[1].split(", ")
465    dest = params[1]
466    if dest.endswith(")") and not dest.startswith("sload("):
467        dest = params[2]
468    if dest.startswith("sload("):
469        dest = dest.replace(")", "(").split("(")[1]
470        if dest.startswith("0x"):
471            return create_state_variable_from_slot(dest)
472        if dest.isnumeric():
473            slot_idx = int(dest)
474            return next(
475                (
476                    v
477                    for v in contract.state_variables_ordered
478                    if SlitherReadStorage.get_variable_info(contract, v)[0] == slot_idx
479                ),
480                None,
481            )
482        for v in node.function.variables_read_or_written:
483            if v.name == dest:
484                if isinstance(v, LocalVariable) and v.expression is not None:
485                    e = v.expression
486                    if isinstance(e, Identifier) and isinstance(e.value, StateVariable):
487                        v = e.value
488                        # Fall through, return constant storage slot
489                if isinstance(v, StateVariable) and v.is_constant:
490                    return v
491    if "_fallback_asm" in dest or "_slot" in dest:
492        dest = dest.split("_")[0]
493    return find_delegate_from_name(contract, dest, node.function)
494
495
496def find_delegate_from_name(
497    contract: Contract, dest: str, parent_func: Function
498) -> Optional[Variable]:
499    """
500    Searches for a variable with a given name, starting with StateVariables declared in the contract, followed by
501    LocalVariables in the parent function, either declared in the function body or as parameters in the signature.
502    Can return a newly created StateVariable if an `sload` from a hardcoded storage slot is found in assembly.
503    Args:
504        contract: The Contract object to search.
505        dest: The variable name to search for.
506        parent_func: The Function object to search.
507
508    Returns:
509        (`Variable`) | None : The variable with the matching name, if found
510    """
511    for sv in contract.state_variables:
512        if sv.name == dest:
513            return sv
514    for lv in parent_func.local_variables:
515        if lv.name == dest:
516            return lv
517    for pv in parent_func.parameters + parent_func.returns:
518        if pv.name == dest:
519            return pv
520    if parent_func.contains_assembly:
521        for node in parent_func.all_nodes():
522            if node.type == NodeType.ASSEMBLY and isinstance(node.inline_asm, str):
523                asm = next(
524                    (
525                        s
526                        for s in node.inline_asm.split("\n")
527                        if f"{dest}:=sload(" in s.replace(" ", "")
528                    ),
529                    None,
530                )
531                if asm:
532                    slot = asm.split("sload(")[1].split(")")[0]
533                    if slot.startswith("0x"):
534                        return create_state_variable_from_slot(slot, name=dest)
535                    try:
536                        slot_idx = int(slot)
537                        return next(
538                            (
539                                v
540                                for v in contract.state_variables_ordered
541                                if SlitherReadStorage.get_variable_info(contract, v)[0] == slot_idx
542                            ),
543                            None,
544                        )
545                    except TypeError:
546                        continue
547    return None
548
549
550def create_state_variable_from_slot(slot: str, name: str = None) -> Optional[StateVariable]:
551    """
552    Creates a new StateVariable object to wrap a hardcoded storage slot found in assembly.
553    Args:
554        slot: The storage slot hex string.
555        name: Optional name for the variable. The slot string is used if name is not provided.
556
557    Returns:
558        A newly created constant StateVariable of type bytes32, with the slot as the variable's expression and name,
559        if slot matches the length and prefix of a bytes32. Otherwise, returns None.
560    """
561    if len(slot) == 66 and slot.startswith("0x"):  # 32 bytes = 64 chars + "0x" = 66 chars
562        # Storage slot is not declared as a constant, but rather is hardcoded in the assembly,
563        # so create a new StateVariable to represent it.
564        v = StateVariable()
565        v.is_constant = True
566        v.expression = Literal(slot, ElementaryType("bytes32"))
567        if name is not None:
568            v.name = name
569        else:
570            v.name = slot
571        v.type = ElementaryType("bytes32")
572        return v
573    # This should probably also handle hashed strings, but for now return None
574    return None