Struct Analyzer 

struct Analyzer<'hir> {
    gcx: Gcx<'hir>,
    hir: &'hir Hir<'hir>,
    safe_vars: HashSet<VariableId>,
    self_vars: HashSet<VariableId>,
    permits: HashSet<PermitRecord>,
    repayments: HashMap<PendingRepayment, u32>,
    aliases: HashMap<VariableId, VariableId>,
    sum_of: HashMap<VariableId, (VariableId, VariableId)>,
    has_solady_lib: bool,
    hits: Vec<(Span, &'static SolLint)>,
    written: HashSet<VariableId>,
}

Fields

gcx: Gcx<'hir>

hir: &'hir Hir<'hir>

safe_vars: HashSet<VariableId>

Variables proven safe (equal to msg.sender or address(this)) on this path. Function-locals and immutable/constant state vars only — mutable storage may be rewritten between the check and the sink.

self_vars: HashSet<VariableId>

Locals proven equal to address(this). Subset of safe_vars, used to recognise the permit spender arg via an alias.

permits: HashSet<PermitRecord>

Permits seen earlier on this path. Killed on token/owner reassignment.

repayments: HashMap<PendingRepayment, u32>

Pending flash-loan repayments, as a multiset: repeated onFlashLoan calls each license one consumption.

aliases: HashMap<VariableId, VariableId>

x = y records x -> canonical(y); killed on writes to either side.

sum_of: HashMap<VariableId, (VariableId, VariableId)>

x = a + b records x -> (a, b); matches flash-repayment sums.

has_solady_lib: bool

Gates the using ... for address sink branch on a SafeTransferLib being present.

hits: Vec<(Span, &'static SolLint)>

written: HashSet<VariableId>

Vars written by an assignment / delete. Used to drop unsound modifier-param hoists when the modifier rewrote the param.

Implementations

impl<'hir> Analyzer<'hir>

fn new(gcx: Gcx<'hir>, hir: &'hir Hir<'hir>, has_solady_lib: bool) -> Self

fn snapshot(&self) -> FlowState

fn restore(&mut self, state: FlowState)

fn canonical(&self, v: VariableId) -> VariableId

Follows the alias chain to its root. Bounded to guard against cycles.

fn is_safe(&self, expr: &Expr<'_>) -> bool

fn is_safe_inner(&self, expr: &Expr<'_>, depth: u8) -> bool

fn callee_returns_safe(&self, callee: &Expr<'_>, depth: u8) -> bool

fn assign(&mut self, target: VariableId, rhs: &Expr<'_>)

Variant of assign_one_flags for declarations: skips permit/repayment kills since a freshly declared variable has no prior facts.

fn is_self_expr(&self, expr: &Expr<'_>) -> bool

true when expr resolves to address(this): bare form, a local alias, payable(...)/cast wraps, a ternary whose both branches are self, or a no-arg helper returning a statically-self expression.

fn is_self_expr_inner(&self, expr: &Expr<'_>, depth: u8) -> bool

fn callee_returns_self(&self, callee: &Expr<'_>, depth: u8) -> bool

fn match_permit_call(&self, expr: &'hir Expr<'hir>) -> Option<PermitRecord>

Matches EIP-2612 token.permit(owner, <self>, value, deadline, v, r, s), plus the library form Lib.safePermit(token, owner, <self>, value, deadline, v, r, s) (OpenZeppelin-style wrapper that delegates to token.permit).

fn kill_permits_for(&mut self, target: VariableId)

Drops permits referencing target by raw id. Permits are stored at the canonical chain root, so reassigning an alias var leaves the root’s permit intact — only reassigning the root itself kills it.

fn canonical_key(&self, k: TokenKey) -> TokenKey

Canonicalizes a TokenKey: Var chases the alias chain; Field’s base var is canonicalized so aCfg = cfg; aCfg.token aliases to cfg.token.

fn invalidate(&mut self, v: VariableId)

Drops all facts about v (treats it as freshly assigned an unknown value).

fn call_state_writes(&self, callee: &Expr<'_>) -> Option<HashSet<VariableId>>

Returns state vars written by callee if it resolves to a function in the current contract; walks one level of nested internal calls. Resolution is conservative: any unresolved or non-local call returns None.

fn permit_covers(&self, token: Option<TokenKey>, from: &Expr<'_>) -> bool

fn amount_matches( &self, amount_arg: &Expr<'_>, amount: VariableId, fee: VariableId, ) -> bool

amount_arg is amount + fee syntactically, or a local var bound to that sum.

fn kill_repayments_for(&mut self, target: VariableId)

Drops pending repayments referencing target.

fn consume_repayment( &mut self, call_expr: &Expr<'_>, from: &Expr<'_>, token: Option<TokenKey>, ) -> bool

Matches from/token plus a sink call with to == address(this) and amount amount + fee against a pending repayment, consuming one occurrence on hit.

fn add_facts(&mut self, pred: &Expr<'_>, negate: bool)

Records vars proven safe by pred. Handles ==/!=, &&/|| and ! via De Morgan; disjunctions keep only facts true on both sides.

fn is_safe_target(&self, v: VariableId) -> bool

fn kill_field_permits(&mut self, lhs: &Expr<'_>)

Drops permits whose token is Field(base, name) when the LHS is the corresponding <base>.<name> (assignment or delete).

fn handle_assign(&mut self, lhs: &Expr<'_>, rhs: &Expr<'_>)

Handles single-var and tuple LHS; tuple slots align with a tuple-literal RHS.

fn assign_one(&mut self, lhs: &Expr<'_>, rhs: Option<&Expr<'_>>)

rhs == None (unknown slot) drops the target’s safe-fact.

fn eval_rhs(&self, rhs: Option<&Expr<'_>>) -> AssignRhs

Pre-evaluates RHS facts; the resulting AssignRhs is independent of later state changes (needed for tuple-swap assignments).

fn assign_one_flags(&mut self, lhs: &Expr<'_>, eval: AssignRhs)

Applies a pre-evaluated RHS to the LHS variable.

fn visit_isolated(&mut self, stmts: &'hir [Stmt<'hir>])

Visits a body that may execute zero times or out-of-line (loops, try clauses): in-body kills survive, in-body additions don’t.

fn visit_stmts_until_loop_exit( &mut self, stmts: &'hir [Stmt<'hir>], exits: &mut Vec<FlowState>, ) -> Option<FlowState>

fn visit_stmt_until_loop_exit( &mut self, stmt: &'hir Stmt<'hir>, exits: &mut Vec<FlowState>, ) -> Option<()>

Trait Implementations

impl<'hir> Visit<'hir> for Analyzer<'hir>

type BreakValue = <fn() -> ! as GetReturnType>::ReturnType

The value returned when breaking from the traversal.

fn hir(&self) -> &'hir Hir<'hir>

Returns the HIR map.

fn visit_stmt( &mut self, stmt: &'hir Stmt<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_expr( &mut self, expr: &'hir Expr<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_source(&mut self, id: SourceId) -> ControlFlow<Self::BreakValue>

fn visit_nested_item(&mut self, id: ItemId) -> ControlFlow<Self::BreakValue>

fn visit_item( &mut self, item: Item<'hir, 'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_contract( &mut self, id: ContractId, ) -> ControlFlow<Self::BreakValue>

fn visit_contract( &mut self, contract: &'hir Contract<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_function( &mut self, id: FunctionId, ) -> ControlFlow<Self::BreakValue>

fn visit_function( &mut self, func: &'hir Function<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_modifier( &mut self, modifier: &'hir Modifier<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_struct(&mut self, id: StructId) -> ControlFlow<Self::BreakValue>

fn visit_struct( &mut self, strukt: &'hir Struct<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_enum(&mut self, id: EnumId) -> ControlFlow<Self::BreakValue>

fn visit_enum( &mut self, _enumm: &'hir Enum<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_udvt(&mut self, id: UdvtId) -> ControlFlow<Self::BreakValue>

fn visit_udvt( &mut self, udvt: &'hir Udvt<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_error(&mut self, id: ErrorId) -> ControlFlow<Self::BreakValue>

fn visit_error( &mut self, error: &'hir Error<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_event(&mut self, id: EventId) -> ControlFlow<Self::BreakValue>

fn visit_event( &mut self, event: &'hir Event<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_nested_var(&mut self, id: VariableId) -> ControlFlow<Self::BreakValue>

fn visit_var( &mut self, var: &'hir Variable<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_call_args( &mut self, args: &'hir CallArgs<'hir>, ) -> ControlFlow<Self::BreakValue>

fn visit_ty(&mut self, ty: &'hir Type<'hir>) -> ControlFlow<Self::BreakValue>

fn walk_nested_source(&mut self, id: SourceId) -> ControlFlow<Self::BreakValue>

fn walk_nested_item(&mut self, id: ItemId) -> ControlFlow<Self::BreakValue>

fn walk_item(&mut self, item: Item<'hir, 'hir>) -> ControlFlow<Self::BreakValue>

fn walk_nested_contract( &mut self, id: ContractId, ) -> ControlFlow<Self::BreakValue>

fn walk_contract( &mut self, contract: &'hir Contract<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_function( &mut self, id: FunctionId, ) -> ControlFlow<Self::BreakValue>

fn walk_function( &mut self, func: &'hir Function<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_modifier( &mut self, modifier: &'hir Modifier<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_struct(&mut self, id: StructId) -> ControlFlow<Self::BreakValue>

fn walk_struct( &mut self, strukt: &'hir Struct<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_enum(&mut self, id: EnumId) -> ControlFlow<Self::BreakValue>

fn walk_enum( &mut self, _enumm: &'hir Enum<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_udvt(&mut self, id: UdvtId) -> ControlFlow<Self::BreakValue>

fn walk_udvt(&mut self, udvt: &'hir Udvt<'hir>) -> ControlFlow<Self::BreakValue>

fn walk_nested_error(&mut self, id: ErrorId) -> ControlFlow<Self::BreakValue>

fn walk_error( &mut self, error: &'hir Error<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_event(&mut self, id: EventId) -> ControlFlow<Self::BreakValue>

fn walk_event( &mut self, event: &'hir Event<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_nested_var(&mut self, id: VariableId) -> ControlFlow<Self::BreakValue>

fn walk_var( &mut self, var: &'hir Variable<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_expr(&mut self, expr: &'hir Expr<'hir>) -> ControlFlow<Self::BreakValue>

fn walk_call_args( &mut self, args: &'hir CallArgs<'hir>, ) -> ControlFlow<Self::BreakValue>

fn walk_stmt(&mut self, stmt: &'hir Stmt<'hir>) -> ControlFlow<Self::BreakValue>

fn walk_ty(&mut self, ty: &'hir Type<'hir>) -> ControlFlow<Self::BreakValue>

Layout

Note: Most layout information is completely unstable and may even differ between compilations. The only exception is types with certain repr(...) attributes. Please see the Rust Reference's “Type Layout” chapter for details on type layout guarantees.

Size: 384 bytes