Ackee-Blockchain/wake v4.0.0

V4.0.0: Static analysis framework

on GitHub

reviewed, updated and documented IR model

• all IR nodes are now documented, generated docs available at https://ackeeblockchain.com/wake/docs/latest/ in API reference
• added link to SourceUnit from all IR nodes
• added link to nearest StatementAbc from all expressions
• added link to declaration (FunctionDefinition/ModifierDefinition) from all statements
• added link to InlineAssembly from all Yul nodes

updated control flow graph

• Yul is now fully supported; InlineAssembly blocks are now decomposed into Yul statemenets
• successful execution and reverting execution is now distinguished in control flow graph
• assert/require/revert function calls are now handled (including these calls in conditionals)
• fixed missing edge for in try/catch statement

development & testing framework

• all default accounts (default_tx_account, default_call_account, default_estimate_account, default_access_list_account) are now set by default
• may_revert and must_revert context managers now re-raise original exception when it does not match one of arguments
• significantly improved performance when accessing tx.events
• improved event resolving algorithm
• added origin field to all events, describing contract Account that emitted event
• improved forked chain ID detection
• fuzz command was integrated into test command
• both single-process and multi-process tests now use pytest
  • running tests without pytest is still supported with --no-pytest flag

added support for Solidity 0.8.21, 0.8.22 and 0.8.23

added experimental support for Python 3.12

rebranded from Woke to Wake

• implemented automatic migration script for migrating project-specific and global files

all CLI commands now accept --config option for setting local config path

implemented svm install --all to install all matching solc versions

renamed ignore_paths config options to exclude_paths

• automatic migration script performs automatic renaming

all solc optimizer settings may now be configured

implemented new wake init config command for initializing only config file

new detectors & printers API

• printers are similar to detectors but allow printing (or exporting in other ways) any useful information
• users may create custom detectors & printers using documented API
• may be project-specific, global and loaded from plugin packages
• project-specific detectors/printers must be first confirmed as verified to protect users downloading others (potentially malicious) projects
• both detectors and printers may accept any number of Click options and arguments that can be set in CLI, ENV variables and TOML files
• detector results and compiler warnings may be ignored using // wake-disable-* comments
• loading priorities may be specified for multiple detectors/printers with the same name loaded from multiple plugin packages
• wake.analysis, wake.ir and networkx are now imported as lazy modules to improve auto-completions speed in CLI
• detectors cannot crash LSP server or prevent other detectors from executing, errors are reported to LSP clients
• logging module logger attached to each detector/printer; logging messages are redirected to LSP client when running LSP server
• detectors are live-reloaded after modifications when running LSP server, no need to restart LSP server to trigger changes
• added helper CLI and LSP commands for creating new detector/printer from template
• added more export formats to detectors and printers
• both detectors and printers may be launched in --watch mode
• implemented export to SARIF format for detectors
• detectors may now assign dynamic impact & confidence per-detection

implemented ready-to-use printers

• abi for exporting contract ABI
• storage-layout for printing contract storage layout
• tokens for finding all ERC-20/ERC-721/ERC-1155 tokens in project

improved existing detectors

implemented new detectors

• abi-encode-with-signature for detecting invalid ABI signatures
• incorrect-interface for detecting incorrectly implemented ERC-20/ERC-721/ERC-1155 interface
• unused-import for finding unused imports