Merge branch 'main' into 4-dos-unbounded-operation

CoinFabrik · Dec 15, 2023 · 3fc1d9f · 3fc1d9f
2 parents 864ec50 + c9f5249
commit 3fc1d9f
Show file tree

Hide file tree

Showing 33 changed files with 68 additions and 65 deletions.
diff --git a/.gitignore b/.gitignore
@@ -18,6 +18,9 @@ test-cases/**/Cargo.lock
 detectors/**/Cargo.lock
 scout-audit-internal/Cargo.lock
 
+#ignore test generated files
+test-cases/**/test_snapshots/**
+
 # -------------------------------------------------------------------------------------
 # -------------------------------------- Misc -----------------------------------------
 # -------------------------------------------------------------------------------------

diff --git a/detectors/overflow-check/README.md b/detectors/overflow-check/README.md
@@ -27,7 +27,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]
@@ -63,7 +63,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1/remediated-example/Cargo.toml b/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1/vulnerable-example/Cargo.toml b/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1/vulnerable-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-1/remediated-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-1/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-1/vulnerable-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-1/vulnerable-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-2/remediated-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-2/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-2/vulnerable-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-2/vulnerable-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-3/remediated-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-3/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/divide-before-multiply/divide-before-multiply-3/vulnerable-example/Cargo.toml b/test-cases/divide-before-multiply/divide-before-multiply-3/vulnerable-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/...insufficiently-random-values/insufficiently-random-values-1/remediated-example/Cargo.toml b/...insufficiently-random-values/insufficiently-random-values-1/remediated-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/...insufficiently-random-values/insufficiently-random-values-1/remediated-example/src/lib.rs b/...insufficiently-random-values/insufficiently-random-values-1/remediated-example/src/lib.rs
@@ -18,7 +18,7 @@ impl Contract {
         if max_val == 0 {
             Err(Error::MaxValZero)
         } else {
-            let val = env.prng().u64_in_range(0..max_val);
+            let val = env.prng().gen_range(0..max_val);
             Ok(val)
         }
     }
@@ -39,16 +39,16 @@ mod test {
 
         // When
         let first_random_value = client.generate_random_value(&10);
-        let second_random_value = client.generate_random_value(&10);
-        let third_random_value = client.generate_random_value(&10);
-        let fourth_random_value = client.generate_random_value(&10);
-        let fifth_random_value = client.generate_random_value(&10);
+        let second_random_value = client.generate_random_value(&100);
+        let third_random_value = client.generate_random_value(&1000);
+        let fourth_random_value = client.generate_random_value(&10000);
+        let fifth_random_value = client.generate_random_value(&100000);
 
         // Then
-        assert_eq!(first_random_value, 6);
-        assert_eq!(second_random_value, 5);
-        assert_eq!(third_random_value, 8);
-        assert_eq!(fourth_random_value, 8);
-        assert_eq!(fifth_random_value, 4);
+        assert!(first_random_value < 10);
+        assert!(second_random_value < 100);
+        assert!(third_random_value < 1000);
+        assert!(fourth_random_value < 10000);
+        assert!(fifth_random_value < 100000);
     }
 }
diff --git a/...insufficiently-random-values/insufficiently-random-values-1/vulnerable-example/Cargo.toml b/...insufficiently-random-values/insufficiently-random-values-1/vulnerable-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/overflow-check/overflow-check-1/remediated-example/Cargo.toml b/test-cases/overflow-check/overflow-check-1/remediated-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/overflow-check/overflow-check-1/vulnerable-example/Cargo.toml b/test-cases/overflow-check/overflow-check-1/vulnerable-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-1/remediated-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-1/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-1/remediated-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-1/remediated-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(100, 100);
+        storage.extend_ttl(100, 100);
         count
     }
 }
@@ -33,7 +33,7 @@ mod tests {
         let contract_id = env.register_contract(None, SetContractStorage);
         let client = SetContractStorageClient::new(&env, &contract_id);
         env.mock_all_auths();
-        let user = <Address as testutils::Address>::random(&env);
+        let user = <Address as testutils::Address>::generate(&env);
 
         // When
         let first_increment = client.increment(&user);

diff --git a/test-cases/set-contract-storage/set-contract-storage-1/vulnerable-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-1/vulnerable-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-1/vulnerable-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-1/vulnerable-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(100, 100);
+        storage.extend_ttl(100, 100);
         count
     }
 }

diff --git a/test-cases/set-contract-storage/set-contract-storage-2/remediated-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-2/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-2/remediated-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-2/remediated-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(&COUNTER, 100, 100);
+        storage.extend_ttl(&COUNTER, 100, 100);
         count
     }
 }
@@ -33,7 +33,7 @@ mod tests {
         let contract_id = env.register_contract(None, SetContractStorage);
         let client = SetContractStorageClient::new(&env, &contract_id);
         env.mock_all_auths();
-        let user = <Address as testutils::Address>::random(&env);
+        let user = <Address as testutils::Address>::generate(&env);
 
         // When
         let first_increment = client.increment(&user);

diff --git a/test-cases/set-contract-storage/set-contract-storage-2/vulnerable-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-2/vulnerable-example/Cargo.toml
@@ -1,16 +1,16 @@
 [package]
-name = "set-contract-storage-vulnerable-1"
+name = "set-contract-storage-vulnerable-2"
 version = "0.1.0"
 edition = "2021"
 
 [lib]
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-2/vulnerable-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-2/vulnerable-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(&COUNTER, 100, 100);
+        storage.extend_ttl(&COUNTER, 100, 100);
         count
     }
 }

diff --git a/test-cases/set-contract-storage/set-contract-storage-3/remediated-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-3/remediated-example/Cargo.toml
@@ -7,10 +7,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-3/remediated-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-3/remediated-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(&COUNTER, 100, 100);
+        storage.extend_ttl(&COUNTER, 100, 100);
         count
     }
 }
@@ -33,7 +33,7 @@ mod tests {
         let contract_id = env.register_contract(None, SetContractStorage);
         let client = SetContractStorageClient::new(&env, &contract_id);
         env.mock_all_auths();
-        let user = <Address as testutils::Address>::random(&env);
+        let user = <Address as testutils::Address>::generate(&env);
 
         // When
         let first_increment = client.increment(&user);

diff --git a/test-cases/set-contract-storage/set-contract-storage-3/vulnerable-example/Cargo.toml b/test-cases/set-contract-storage/set-contract-storage-3/vulnerable-example/Cargo.toml
@@ -1,16 +1,16 @@
 [package]
-name = "set-contract-storage-vulnerable-1"
+name = "set-contract-storage-vulnerable-3"
 version = "0.1.0"
 edition = "2021"
 
 [lib]
 crate-type = ["cdylib"]
 
 [dependencies]
-soroban-sdk = { version = "20.0.0-rc2" }
+soroban-sdk = { version = "=20.0.0" }
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/test-cases/set-contract-storage/set-contract-storage-3/vulnerable-example/src/lib.rs b/test-cases/set-contract-storage/set-contract-storage-3/vulnerable-example/src/lib.rs
@@ -15,7 +15,7 @@ impl SetContractStorage {
         let mut count: u32 = storage.get(&COUNTER).unwrap_or(0);
         count += 1;
         storage.set(&COUNTER, &count);
-        storage.bump(&COUNTER, 100, 100);
+        storage.extend_ttl(&COUNTER, 100, 100);
         count
     }
 }

diff --git a/...nt-contract-wasm/unprotected-update-current-contract-wasm-1/remediated-example/Cargo.toml b/...nt-contract-wasm/unprotected-update-current-contract-wasm-1/remediated-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

diff --git a/...nt-contract-wasm/unprotected-update-current-contract-wasm-1/vulnerable-example/Cargo.toml b/...nt-contract-wasm/unprotected-update-current-contract-wasm-1/vulnerable-example/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 soroban-sdk = "20.0.0-rc2"
 
 [dev_dependencies]
-soroban-sdk = { version = "20.0.0-rc2", features = ["testutils"] }
+soroban-sdk = { version = "=20.0.0", features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]