decurity/semgrep-smart-contracts

Semgrep rules for smart contracts based on DeFi exploits

semgrep-smart-contracts's Issues

Could you make a release?

Hi,

We are using your rules for scientific work and need to perhaps refer to release version of the rules. Could you please create a release so that we can refer to?

Additional references for potential inclusion

here is a catalog of contracts and their exploits with corresponding SWC entries: https://github.com/manifoldfinance/defi-threat/tree/2020/10/catalog

please let me know how to best contribute and also how to best cite your work.

cheers

inefficient-state-variable-increment / inefficient-state-variable-decrement

Why is there no inefficient-state-variable-decrement to detect the decrement case, similar to the inefficient-state-variable-increment case?

Fix: arbitrary-low-level-call matching workarounds

Great repo. I've been learning semgrep with your examples and believe I've found a workaround to incorporate arbitrary-low-level-calls without waiting for beta improvements to solidity semgrep.

The fixes include:

• Defining types for metavariables inside function declarations
• Adding pattern-either patterns to include curly braces for call

rules:
 -
    id: arbitrary-low-level-call
    message: An attacker may perform call() to an arbitrary address with controlled calldata
    metadata:
        references:
        - https://twitter.com/CertiKAlert/status/1512198846343954445
        - https://twitter.com/SlowMist_Team/status/1508787862791069700
        - https://twitter.com/Beosin_com/status/1509099103401127942
        - https://blocksecteam.medium.com/li-fi-attack-a-cross-chain-bridge-vulnerability-no-its-due-to-unchecked-external-call-c31e7dadf60f
        - https://etherscan.io/address/0xe7597f774fd0a15a617894dc39d45a28b97afa4f # Auctus Options
        - https://etherscan.io/address/0x73a499e043b03fc047189ab1ba72eb595ff1fc8e # Li.Fi
        category: controlled-call
        tags:
        - auctus-options
        - starstream-finance
        - basket-dao
        - li-finance
    patterns:
    - pattern-either:
        - pattern-inside: |
            function $F(..., address $ADDR, ..., bytes calldata $DATA, ...) external { ... }
        - pattern-inside: |
            function $F(..., address $ADDR, ..., bytes calldata $DATA, ...) public { ... }
    - pattern-either:
        - pattern: $ADDR.call($DATA);
        - pattern: $ADDR.call{$VALUE:...}($DATA);
        - pattern: $ADDR.call{$VALUE:..., $GAS:...}($DATA);
    languages: 
    - solidity
    severity: ERROR

Four matching cases:

contract wxBTRFLY is FrozenToken {
    function execute(
        address to,
        uint256 value,
        bytes calldata data
    ) external returns (bool, bytes memory) {

        // ruleid: arbitrary-low-level-call
        (bool success, bytes memory result) = to.call{value: value}(data);

        // ruleid: arbitrary-low-level-call
        (bool success, bytes memory result) = to.call{gas: value}(data);

        // ruleid: arbitrary-low-level-call
        (bool success, bytes memory result) = to.call(data);

        // ruleid: arbitrary-low-level-call
        (bool success, bytes memory result) = to.call{value: value, gas: 0}(data);

        return (success, result);
    }
}