vulnplanet/l3x

AI-driven Static Analyzer. Supports Rust and Smart contracts: Solana based on Rust, Ethereum based on Solidity.

l3x's Issues

Failed to get a valid response from OpenAI

Use apikey can request success :

  -H "Authorization: Bearer $OPENAI_KEY" \
  -H "OpenAI-Organization: org-jzbvMiPRhVKpZWrIQ1JkhvOr"

But run error:
Error: Custom { kind: Other, error: "Failed to get a valid response from OpenAI" }

This is a public hazard

The program sends the entire source file for each regex match to GPT, which easily becomes extremely expensive. For example, a 1000 line Rust file can easily have 100 matches with normal usage, which'd lead to 100 000 lines of code sent, which can easily be a million tokens. GPT4 costs $10 / million tokens, so that's $10 to scan a fairly average file.

All of the integer overflow patterns can be particularly egregious and will make any mathy code rack up an extravagant bill.

Running this against rustc will produce 4600 matches just for the keyword unsafe. I don't even know how high the number of tokens sent goes here. Billions?

That's all without accounting for the fix suggestions GPT sends back. Those also cost a lot.

Don't run this, it will bankrupt you.

---

This rule is particularly fun, matching every &mut.

l3x/l3x/src/vulnerability_checks.rs

Lines 57 to 66 in 3887ee5

	VulnerabilityCheck {
	id: "RUST005".to_string(),
	language: "Rust".to_string(),
	title: "[Rust-General] Aliasing Rules Violation".to_string(),
	severity: "Medium".to_string(),
	pattern: r"&mut\s+\w+".to_string(),
	safe_pattern: None,
	description: "Mutable aliasing that could lead to data races or undefined behavior.".to_string(),
	suggested_fix: "Ensure that mutable references do not alias by using exclusive access patterns.".to_string(),
	},