Detectors related to improper usage of Oracle APIs

[talfao]

Describe the desired feature

Hello folks,

I am working on a bachelor's thesis related to smart contract security. My goal is to use static analysis to detect improper usage of Oracle APIs and, therefore, prevent possible vulnerabilities. I have created a few detectors in Slither, currently focusing on Chainlink data validation. I plan to support other Oracles and generalise the detectors, if possible.

The code is available here (it's a clone, not a fork of Slither at the moment): repository. To see what gets detected, you can check the tests. For example when calling priceFeed.latestRoundData(), the return value price should be checked:

       (
            uint80 roundID,
            int256 price,
            ,
            uint256 updatedAt,
            uint80 answeredInRound
        ) = priceFeedDAIETH.latestRoundData();

        require(price_check(price));
        require(updatedAt - block.timestamp < 500);
        require(answeredInRound > roundID);

Omitting such a check can lead to potentially serious issues if the oracles provide incorrect data. The detector checks whether the price-check is present.

Would you be interested in such a type of detector in Slither? It does not detect Solidity/Vyper syntax-related bugs but could be a valuable detector anyway. Maybe running such a detector could be hidden behind a feature flag.

I am looking forward to hearing any feedback from you on both the code and the idea of such detectors. Also, I am more than happy to improve/refactor the code to fit Slither better.

Cheers, Talfao

[0xalpharush]

Really great work @talfao! I think we're interested in upstreaming these. Would you make a PR and add the tests according to our guidelines (let me know if I can help or answer any questions) please? Then, I can do a more thorough review in the PR

[talfao]

Hello @0xalpharush,

Thanks for quick answer. That are great news. I will create PR soon.

[talfao]

Hello @0xalpharush,

The PR #2289 was created. I would be glad to receive any feedback on the detector. However, I still have some features in my backlog and will improve the overall detection soon.

Talfao

[talfao]

Hello @0xalpharush,

I have already pushed improvements and fixed some issues after evaluation on several contracts.

From my perspective, the PR is ready for review. I am looking forward to your feedback.

Thank you.
Talfao