Module arbitrary_send_erc20 

Structs

Analyzer 🔒

AssignRhs 🔒

RHS facts captured before any write so tuple-swap assignments stay consistent.

FlowState 🔒

InternalCallsiteCollector 🔒

NestedCallCollector 🔒

Walks an expression tree and records every internal callee resolvable to a FunctionId. Used to widen collect_state_writes by one call level.

ParamCallsiteFacts 🔒

PendingRepayment 🔒

Outstanding EIP-3156 repayment licensed by a prior onFlashLoan call.

PermitRecord 🔒

(token, owner) of an EIP-2612 permit recorded earlier on the current path with spender == address(this).

ProjectIndex 🔒

StateWriteCollector 🔒

Collects state-variable assignments / deletes reached from the given stmts. Single-level: does not follow nested function calls.

Enums

TokenKey 🔒

Identifier used to correlate permit / sink token receivers. Field lets cfg.token.permit(...) and cfg.token.transferFrom(...) match (FN-5).

Constants

HELPER_DEPTH 🔒

Recursion budget for _msgSender()-style helper chains.

PROJECT_INDEX 🔒

Statics

ARBITRARY_SEND_ERC20

ARBITRARY_SEND_ERC20_PERMIT

Functions

body_has_break_or_continue 🔒

break/continue targeting the current loop (nested loops shadow them).

branch_always_exits 🔒

return, custom-error revert, revert(...), or assert(false) / require(false, ...).

build_project_index 🔒

canonical_args 🔒

Resolves positional or named call args to a fixed positional ordering. aliases[i] holds the parameter names accepted for slot i in the named form. Returns None if arity differs or any slot is unmatched.

collect_modifier_safety 🔒

Hoists require(modParam == msg.sender | address(this)) guards from the modifier prefix (statements before _;) to the caller’s argument. out_self receives params proven equal to address(this).

collect_state_writes 🔒

contains_unanalysable 🔒

true if any statement is StmtKind::Err (currently catches inline assembly, which solar doesn’t yet lower to HIR).

contract_has_function 🔒

count_placeholders 🔒

direct_contract_id 🔒

do_while_user_stmts 🔒

Strips the synthesized trailing if (!cond) break; from the HIR do-while lowering.

expr_contract_id 🔒

expr_is_address 🔒

True when expr’s static type is address / address payable.

expr_ty 🔒

has_solady_safe_transfer_lib 🔒

Whether the sources declare a Solady-shaped SafeTransferLib library.

internal_call_args 🔒

is_address 🔒

is_address_cast 🔒

is_address_self 🔒

address(this) or bare this, including through payable(...) and parens wraps.

is_amount_plus_fee 🔒

True when expr is amount + fee or fee + amount, parens-tolerant.

is_break_stmt 🔒

is_builtin 🔒

is_cast_callee 🔒

true when callee is a type-cast head, i.e. address(...), an elementary-type cast, or an interface/contract cast like IERC20(...).

is_elementary 🔒

is_exit_call 🔒

is_internal_callsite_seed_candidate 🔒

is_loop_termination_if 🔒

is_require_or_assert 🔒

library_has_safe_transfer_from 🔒

4-arg safeTransferFrom(token, address, address, uint256). token is either address (Solady) or a contract declaring ERC20’s transferFrom(...)→bool (OZ SafeERC20); ERC721/1155 helpers are excluded since their transferFrom has no return.

match_flash_loan_call 🔒

EIP-3156 onFlashLoan(address,address,uint256,uint256,bytes) returns (bytes32). Only returns a record when the receiver type declares the exact sig and every tracked arg resolves to a VariableId; literal args yield None.

match_sink 🔒

Matches an ERC20-like transfer sink. Returns (from_arg, token_var) where token_var is the receiver’s underlying variable id when available (used for permit correlation).

modifier_prefix_always_exits 🔒

true when the modifier body has a single _; and any preceding statement definitely exits (making the calling function’s body unreachable).

project_index_for 🔒

receiver_contract_id 🔒

Resolves the static contract type of recv: a contract-typed expression, a direct contract reference (e.g. a library), or an interface/contract cast.

resolve_internal_fn 🔒

Resolves a call’s callee to a FunctionId for plain name() / this.name() patterns inside the same contract. Returns None for external / library / member-of-state-var / unresolved calls.

seed_immutable_facts 🔒

Harvests self_vars / safe_vars facts about immutable / constant state vars of cid: both declaration initializers and direct constructor assignments.

seed_internal_callsite_facts 🔒

token_key 🔒

Constructs a TokenKey for the receiver of a permit/sink call. Supports <var> (with cast / payable peeling via underlying_var) and <var>.<field> (a struct-field path).

ty_contract_id 🔒

ty_is_address 🔒

underlying_var 🔒

Resolves a VariableId for bare idents and type-cast / payable(...) / parens wraps.