established scope in tower contracts

aderyn_core/src/audit/auditor.rs

@@ -6,12 +6,14 @@ use crate::{
     audit::{
         attack_surface::AttackSurfaceDetector,
         public_functions_no_sender::PublicFunctionsNoSenderChecksDetector,
+        send_ether_no_checks::SendEtherWithoutMsgSenderChecksDetector,
     },
     context::workspace_context::WorkspaceContext,
 };
 
 pub fn get_auditor_detectors() -> Vec<Box<dyn AuditorDetector>> {
     vec![
+        Box::<SendEtherWithoutMsgSenderChecksDetector>::default(),
         Box::<AttackSurfaceDetector>::default(),
         Box::<PublicFunctionsNoSenderChecksDetector>::default(),
     ]

aderyn_core/src/audit/mod.rs

@@ -1,3 +1,4 @@
 pub mod attack_surface;
 pub mod auditor;
 pub mod public_functions_no_sender;
+pub mod send_ether_no_checks;

aderyn_core/src/audit/send_ether_no_checks.rs

@@ -0,0 +1,57 @@
+use prettytable::{row, Row};
+
+use super::auditor::AuditorDetector;
+use crate::context::workspace_context::WorkspaceContext;
+use std::error::Error;
+
+struct SendEtherNoChecksInstance {
+    ether_sending_call: String,
+}
+
+#[derive(Default)]
+pub struct SendEtherWithoutMsgSenderChecksDetector {
+    found_instances: Vec<SendEtherNoChecksInstance>,
+}
+
+impl AuditorDetector for SendEtherWithoutMsgSenderChecksDetector {
+    fn detect(&mut self, context: &WorkspaceContext) -> Result<bool, Box<dyn Error>> {
+        Ok(!self.found_instances.is_empty())
+    }
+
+    fn title(&self) -> String {
+        String::from("Sending native Eth is not protected")
+    }
+
+    fn table_titles(&self) -> Row {
+        row!["Code"]
+    }
+
+    fn table_rows(&self) -> Vec<Row> {
+        self.found_instances
+            .iter()
+            .map(|instance| row![instance.ether_sending_call])
+            .collect()
+    }
+
+    fn skeletal_clone(&self) -> Box<dyn AuditorDetector> {
+        Box::<SendEtherWithoutMsgSenderChecksDetector>::default()
+    }
+}
+
+#[cfg(test)]
+mod send_ether_no_checks_detector {
+    use crate::audit::{
+        auditor::AuditorDetector, send_ether_no_checks::SendEtherWithoutMsgSenderChecksDetector,
+    };
+
+    #[test]
+    fn test_attack_surface_detector() {
+        let context = crate::detect::test_utils::load_solidity_source_unit(
+            "../tests/contract-playground/src/auditor_mode/ExternalCalls.sol",
+        );
+
+        let mut detector = SendEtherWithoutMsgSenderChecksDetector::default();
+        let found = detector.detect(&context).unwrap();
+        assert!(found);
+    }
+}

tests/contract-playground/src/auditor_mode/send_ether_no_checks/Tower.sol

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.19;
+
+// Goal of this contract is to test if we can establish a link between 
+// the public function `enterTenthFloor` and the fact that `require(msg.sender == 0x011)` 
+// could potentially be called as a result
+contract Tower1 {
+
+    function visitEighthFloor() internal {
+        require(msg.sender == address(0x11));
+    }
+
+    modifier passThroughNinthFloor() {
+        visitEighthFloor();
+        _;
+    }
+
+    // Start Here
+    function enterTenthFloor() public passThroughNinthFloor() {
+
+    }
+
+}
+
+// Goal of this contract is to test if we can establish a link between 
+// the public function `enterTenthFloor` and the fact that `x.call{value: 10}("calldata");` 
+// could potentially be called as a result.
+// Here, the call to send native eth is not safe
+contract Tower2 {
+
+    function visitEighthFloor(address x) internal {
+        (bool success,) = x.call{value: 10}("calldata");
+        if (!success) {
+            revert();
+        }
+    }
+
+    modifier passThroughNinthFloor(address x) {
+        visitEighthFloor(x);
+        _;
+    }
+
+    // Start Here
+    function enterTenthFloor(address x) public passThroughNinthFloor(x) {
+
+    }
+
+}
+
+
+
+// Goal of this contract is to test if we can establish a link between 
+// the public function `enterTenthFloor` <-> `x.call{value: 10}("calldata");` 
+// and public function `enterTenthFloor` <-> `require(msg.sender == 0x11);` 
+// As a result the call to send native eth is safe
+contract Tower3 {
+
+    function visitEighthFloor(address x) internal {
+        (bool success,) = x.call{value: 10}("calldata");
+        if (!success) {
+            revert();
+        }
+    }
+
+    modifier passThroughNinthFloor(address x) {
+        visitEighthFloor(x);
+        _;
+    }
+
+    // Start Here
+    function enterTenthFloor(address x) public passThroughNinthFloor(x) {
+        visitSeventhFloor();
+    }
+
+    function visitSeventhFloor() internal {
+        require(msg.sender == address(0x11));
+    }
+
+}
+
+