What is Aderyn?

Step-by-Step Guide to Developing the division_before_multiplication Detector

Step One: Knowing Which Vulnerability to Detect

Step Two: Write Our Own Contract Containing the Vulnerability

1pragma solidity 0.8.20;
2
3contract DivisionBeforeMultiplication {
4    uint public result;
5
6    function calculateWrong(uint a, uint b, uint c, uint d) external {
7        result = a * d + b / c * b / d;
8    }
9
10    function calculateAlsoWrong(uint a, uint b, uint c) external {
11        result = (a + b / c * b) * c;
12    }
13
14    function calculateAl(uint a, uint b, uint c) external {
15        result = (a / b * c);
16    }
17
18    function calculateStillWrong(uint a, uint b, uint c) external {
19        result = a + b / c * b * c;
20    }
21
22    function calculateCorrect(uint a, uint b, uint c) external {
23        result = a + b * b / c + b * c;
24    }
25
26    function calculateAlsoCorrect(uint a, uint b, uint c, uint d) external {
27        result = (a + ((b * d) / (c * b))) * d;
28    }
29}

Step Three: Understand the .json AST File Result

Step Four: Writing the Detector

1. Define the Detector Structure We define a structure to hold instances of the detected issue:

1pub struct DivisionBeforeMultiplicationDetector {
2    found_instances: BTreeMap<(String, usize, String), NodeID>,
3}

2. Implement theIssueDetector Trait We implement the theIssueDetector trait for our detector. This trait requires a detect method that performs the analysis.

1    fn detect(&mut self, context: &WorkspaceContext) -> Result<bool, Box<dyn Error>> {
2        // Iterate over all binary operations in the context and filter for multiplication operations (*)
3        for op in context.binary_operations().iter().filter(|op| op.operator == "*") {
4            // Check if the left operand of the multiplication is a binary operation (i.e., another operation)
5            if let Expression::BinaryOperation(left_op) = op.left_expression.as_ref() {
6                // Check if this left operation is a division
7                if left_op.operator == "/" {
8                    // Capture the instance of the vulnerability
9                    capture!(self, context, left_op)
10                }
11            }
12        }
13        // Return true if any instances were found, otherwise false
14        Ok(!self.found_instances.is_empty())
15    }
16}

3. Detailed Logic

• Iterate Over Binary Operations: We use context.binary_operations() to get all binary operations and filter to select only multiplication operations.
• Check the Left Operand: This checks if the left operand of the multiplication is another binary operation.
• Identify Division Operation: We then check if this left binary operation is a division.

Step Five: Add your Detector to the mod.rs file

Step Six: Register your detector

Step Seven: Run your custom detector locally

Code complete:

1use std::error::Error;
2
3use crate::ast::NodeID;
4
5use crate::capture;
6use crate::detect::detector::IssueDetectorNamePool;
7use crate::{
8    ast::Expression,
9    context::workspace_context::WorkspaceContext,
10    detect::detector::{IssueDetector, IssueSeverity},
11};
12use eyre::Result;
13
14#[derive(Default)]
15pub struct DivisionBeforeMultiplicationDetector {
16    // Keys are source file name, line number, and description
17    found_instances: BTreeMap<(String, usize, String), NodeID>,
18}
19
20impl IssueDetector for DivisionBeforeMultiplicationDetector {
21    fn detect(&mut self, context: &WorkspaceContext) -> Result<bool, Box<dyn Error>> {
22        for op in context
23            .binary_operations()
24            .iter()
25            .filter(|op| op.operator == "*")
26        {
27            if let Expression::BinaryOperation(left_op) = op.left_expression.as_ref() {
28                if left_op.operator == "/" {
29                    capture!(self, context, left_op)
30                }
31            }
32        }
33
34        Ok(!self.found_instances.is_empty())
35    }
36
37    fn severity(&self) -> IssueSeverity {
38        IssueSeverity::Low
39    }
40
41    fn title(&self) -> String {
42        String::from("Incorrect Order of Division and Multiplication")
43    }
44
45    fn description(&self) -> String {
46        String::from("Division operations followed directly by multiplication operations can lead to precision loss due to the way integer arithmetic is handled in Solidity.")
47    }
48
49    fn instances(&self) -> BTreeMap<(String, usize, String), NodeID> {
50        self.found_instances.clone()
51    }
52
53    fn name(&self) -> String {
54        format!("{}", IssueDetectorNamePool::DivisionBeforeMultiplication)
55    }
56}
57
58#[cfg(test)]
59mod division_before_multiplication_detector_tests {
60    use super::DivisionBeforeMultiplicationDetector;
61    use crate::detect::detector::{detector_test_helpers::load_contract, IssueDetector};
62
63    #[test]
64    fn test_template_detector() {
65        let context = load_contract(
66            "../tests/contract-playground/out/DivisionBeforeMultiplication.sol/DivisionBeforeMultiplication.json",
67        );
68
69        let mut detector = DivisionBeforeMultiplicationDetector::default();
70        let found = detector.detect(&context).unwrap();
71        assert!(found);
72        assert_eq!(detector.instances().len(), 4);
73        assert_eq!(
74            detector.severity(),
75            crate::detect::detector::IssueSeverity::Low
76        );
77        assert_eq!(
78            detector.title(),
79            String::from("Incorrect Order of Division and Multiplication")
80        );
81        assert_eq!(
82            detector.description(),
83            String::from("Division operations followed directly by multiplication operations can lead to precision loss due to the way integer arithmetic is handled in Solidity.")
84        );
85    }
86}

Resources:

• Detectors Quickstart
• Rust + Solidity | How to build an aderyn static analysis detector
• Cyfrin Aderyn Contributing Guide