Skip to content

Commit 18b449a

Browse files
Elexy101Elexy101
authored
Add files via upload
1 parent 0ca34fe commit 18b449a

File tree

4 files changed

+313
-2
lines changed

4 files changed

+313
-2
lines changed

‎README.md

+80-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,80 @@
1-
# solscan
2-
Solscan is a static Solidity vulnerabilities scanner written in Python 3.7+
1+
# solscan attack - smart contracts vulnerability scanner
2+
3+
<img src="/logo.png" width="300"/>
4+
Solscan is a static Solidity vulnerabilities scanner written in Python. It works based on regular expressions and contextual analyse of your code. Solscan is able to scan contracts regardless of their version or ability to compile (you can even scan a single function without a need to have a whole smart contract ready).
5+
6+
7+
## Features
8+
* Support of 28 vulnerabilities
9+
* Static scan of your code meaning no need to have compiler
10+
* Works on all Solidity versions
11+
12+
## Installation
13+
### Prerequisites
14+
First of all, you will need to have Python 3.7+ installed on your machine.
15+
Tool also uses `click`, `termcolor` and `pyfiglet` python packages.
16+
17+
### How to install the tool?
18+
19+
First, clone the repository into your local machine:
20+
```
21+
git clone https://github.com/Elexy101/solscan
22+
```
23+
24+
Next, you will need click python library. You can download it by:
25+
```
26+
pip install click
27+
```
28+
If you encounter any problem with the library, you can try to install it into folder containg the tool.
29+
30+
```
31+
pip install --target=/path/to/the/tool click
32+
```
33+
Same goes to the rest of the libraries. Install termcolor and pyfiglet library:
34+
```
35+
pip install termcolor
36+
```
37+
```
38+
pip install pyfiglet
39+
```
40+
After that you should be good to go.
41+
42+
## Usage
43+
To use the tool, go to the solscan directory, then use following command:
44+
```
45+
python3 main.py scan /path/to/your/contract.sol
46+
```
47+
After the scan is completed, you will get the results and corresponding recommendations.
48+
## Detectors
49+
50+
Solscan gives you the ability to scan your smart contract code to find some underlying vulnerabilities listed below:
51+
| ID | VULNERABILITY |
52+
|----|------------------------------|
53+
| 1 | ArbitraryFrom |
54+
| 2 | Assembly |
55+
| 3 | Assert Violation |
56+
| 4 | Bad Assignment Operator |
57+
| 5 | Delegate Call |
58+
| 6 | Blockhash |
59+
| 7 | Callcode |
60+
| 8 | Msgas |
61+
| 9 | Now |
62+
| 10 | Sha3 |
63+
| 11 | Throw |
64+
| 12 | Dynamic Array Length |
65+
| 13 | Ether Lock |
66+
| 14 | Floating Pragma |
67+
| 15 | Functions Default Visibility |
68+
| 16 | Hash Colission |
69+
| 17 | Insecure Randomsource |
70+
| 18 | Int Over/underflow |
71+
| 19 | Looped Calls |
72+
| 20 | Multidigits |
73+
| 21 | Reentrancy |
74+
| 22 | RTLO |
75+
| 23 | Selfdestruct |
76+
| 24 | Stored credentials |
77+
| 25 | Strict Equality |
78+
| 26 | TX-Origin |
79+
| 27 | Unchecked external call |
80+
| 28 | Wrong Constructor Name |

‎checks_to_implement.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
1) Floating pragma - DONE
2+
2) different pragma directives
3+
2) non reentrancy
4+
3) unused declaration
5+
4) selfdestruct
6+
5)

‎logo.png

24.6 KB
Loading

‎main.py

+227
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
import click
2+
import re
3+
import time
4+
import random
5+
import pyfiglet
6+
import os
7+
8+
from modules.floating_pragma import *
9+
from modules.utils.parse_contract_util import parse_contract
10+
from modules.selfdestruct import selfdestruct
11+
from modules.re_entrancy import *
12+
from modules.unchecked_external_call import *
13+
from modules.wrong_constructor_name import *
14+
from modules.stored_credentials import *
15+
from modules.insec_randomsource import *
16+
from modules.tx_origin import *
17+
from modules.assembly import *
18+
from modules.delegate_call import *
19+
#from modules.block_timestamp import *
20+
from modules.ether_lock import *
21+
from modules.delegate_call import *
22+
from modules.utils.remove_comments import *
23+
from modules.integer_underflow_overflow import *
24+
from modules.rtlo import *
25+
from modules.multiple_constructors import *
26+
from modules.dynamic_array_length import *
27+
from modules.utils.banner import *
28+
from modules.looped_calls import *
29+
from modules.hash_colission import *
30+
from modules.functions_default_visibility import *
31+
from modules.assert_violation import *
32+
from modules.arbitraryfrom import *
33+
from modules.bad_assignment_operator import *
34+
from modules.depr_blockhash import *
35+
from modules.depr_msggas import *
36+
from modules.depr_now import *
37+
from modules.depr_now import *
38+
from modules.depr_sha3 import *
39+
from modules.depr_throw import *
40+
from modules.multidigits import *
41+
from modules.strict_equality import *
42+
43+
44+
@click.group()
45+
def mycommands():
46+
pass
47+
48+
def update_bar(progress_bar_iterator):
49+
progress_bar_iterator.update(1)
50+
print("\n")
51+
time.sleep(0.1)
52+
53+
@click.command('scan', help="scan contract")
54+
@click.argument('contract', type=click.Path(exists=True), required=1)
55+
def scan_contract(contract):
56+
print_banner(contract)
57+
with click.progressbar(length=30, label="Running checks") as bar:
58+
print("\n")
59+
for i in range(30):
60+
pass
61+
update_bar(bar)
62+
print('''
63+
======================================
64+
RESULTS
65+
======================================
66+
''')
67+
try:
68+
arbitraryfrom(contract)
69+
except:
70+
print("An error occured while checking arbitrary form. This vulnerability class was NOT checked.")
71+
72+
try:
73+
assembly(contract)
74+
except:
75+
print("An error occured while checking assembly. This vulnerability class was NOT checked.")
76+
77+
try:
78+
assert_violation(contract)
79+
except:
80+
print("An error occured while checking assert violation. This vulnerability class was NOT checked.")
81+
82+
try:
83+
bad_assignment_operator(contract)
84+
except:
85+
print("An error occured while checking bad assignment operator. This vulnerability class was NOT checked.")
86+
87+
try:
88+
block_timestamp(contract)
89+
except:
90+
print("An error occured while checking block timestamp. This vulnerability class was NOT checked.")
91+
92+
try:
93+
delegate_call(contract)
94+
except:
95+
print("An error occured while checking delegate call. This vulnerability class was NOT checked.")
96+
97+
try:
98+
blockhash(contract)
99+
except:
100+
print("An error occured while checking blockhash. This vulnerability class was NOT checked.")
101+
102+
try:
103+
callcode(contract)
104+
except:
105+
print("An error occured while checking callcode. This vulnerability class was NOT checked.")
106+
107+
try:
108+
msggas(contract)
109+
except:
110+
print("An error occured while checking msggas. This vulnerability class was NOT checked.")
111+
112+
try:
113+
now(contract)
114+
except:
115+
print("An error occured while checking now. This vulnerability class was NOT checked.")
116+
117+
try:
118+
sha3(contract)
119+
except:
120+
print("An error occured while checking sha3. This vulnerability class was NOT checked.")
121+
122+
try:
123+
throw(contract)
124+
except:
125+
print("An error occured while checking throw. This vulnerability class was NOT checked.")
126+
127+
try:
128+
dynamic_array_length(contract)
129+
except:
130+
print("An error occured while checking dynamic array length. This vulnerability class was NOT checked.")
131+
132+
try:
133+
ether_lock(contract)
134+
except:
135+
print("An error occured while checking integer ether lock. This vulnerability class was NOT checked.")
136+
137+
try:
138+
floating_pragma(contract)
139+
except:
140+
print("An error occured while checking floating pragma. This vulnerability class was NOT checked.")
141+
142+
try:
143+
function_default_visibility(contract)
144+
except:
145+
print("An error occured while checking function default visibility. This vulnerability class was NOT checked.")
146+
147+
try:
148+
hash_colission(contract)
149+
except:
150+
print("An error occured while checking hash colission. This vulnerability class was NOT checked.")
151+
152+
try:
153+
insec_randomsource(contract)
154+
except:
155+
print("An error occured while checking insec randomsource. This vulnerability class was NOT checked.")
156+
157+
try:
158+
integer_underflow_overflow(contract)
159+
except:
160+
print("An error occured while checking integer under/overflow. This vulnerability class was NOT checked.")
161+
162+
try:
163+
looped_calls(contract)
164+
except:
165+
print("An error occured while checking looped calls. This vulnerability class was NOT checked.")
166+
167+
try:
168+
multidigit(contract)
169+
except:
170+
print("An error occured while checking multidigit. This vulnerability class was NOT checked.")
171+
172+
173+
try:
174+
multiple_constructors(contract)
175+
except:
176+
print("An error occured while checking multiple constructors. This vulnerability class was NOT checked.")
177+
178+
try:
179+
re_entrancy(contract)
180+
except:
181+
print("An error occured while checking reentrancy. This vulnerability class was NOT checked.")
182+
183+
184+
try:
185+
rtlo(contract)
186+
except:
187+
print("An error occured while checking rtlo. This vulnerability class was NOT checked.")
188+
189+
try:
190+
selfdestruct(contract)
191+
except:
192+
print("An error occured while checking selfdestruct. This vulnerability class was NOT checked.")
193+
194+
try:
195+
stored_credentials(contract)
196+
except:
197+
print("An error occured while checking stored credentials. This vulnerability class was NOT checked.")
198+
199+
try:
200+
strict_equality(contract)
201+
except:
202+
print("An error occured while checking strict equality This vulnerability class was NOT checked.")
203+
204+
try:
205+
tx_origin(contract)
206+
except:
207+
print("An error occured while checking tx origin. This vulnerability class was NOT checked.")
208+
209+
try:
210+
unchecked_external_call(contract)
211+
except:
212+
print("An error occured while checking unchecked external call. This vulnerability class was NOT checked.")
213+
214+
try:
215+
wrong_constructor_name(contract)
216+
except:
217+
print("An error occured while checking wrong constructor name. This vulnerability class was NOT checked.")
218+
219+
click.echo("Scan completed. See results above.")
220+
221+
222+
223+
mycommands.add_command(scan_contract)
224+
225+
if __name__ == '__main__':
226+
mycommands()
227+

0 commit comments

Comments
 (0)