README.md

Rust-based Solidity AST analyzer and context builder.

Note: These goals/priorities will change over time.

Short-term goals - Working Examples:

• Traverse the AST and create a public "Context" symbol table
• Create a detector architecture
• Recreate 4nalyzer detectors
  • High: delegatecall in loop
  • Medium: centralization risk
  • Medium: solmate SafeTransferLib does not check existence
  • Low: Avoid encodePacked
  • Low: Deprecated functions
  • Low: Empty function body
  • Low: Front-runnable initializer
  • Low: Unsafe ERC20 Operations
  • Low: Unspecific Pragma
  • Low: Use of ecrecover
  • NC: Address(0) check
  • NC: Non-reentrant before modifiers
  • NC: Require with string
  • NC: Return value from approve
  • NC: Todo in code
  • NC: Unindexed events
  • NC: Use constants
  • NC: Useless public function
  • GAS: All

Medium-term goals - Auditor Aid:

• Support Multiple Abstract Syntax Trees representing multiple Solidity files
• Support Foundry/Hardhat/Truffle/Solc output formats for ingesting AST
  • Foundry
  • Hardhat
• Support functionality from:
  • Consensys Solidity Analyzer
    • Complexity
    • nSLOC
    • Percentage YUL code 👀
  • Slither

Long-term goals - Product:

Create tools that utilize the context library to:

• Provide automated gas optimizations
• Custom subscribable detectors
• Control/data flow analyses
• Symbolic execution lite, with invariant analysis
• Vyper support

Attribution

• AST Visitor code from solc-ast-rs.
• Current detectors based on 4nalyzer detectors.