slither config, ci

.github/workflows/main.yml

@@ -19,6 +19,22 @@ jobs:
       - name: Formatting
         run: yarn format:ci
 
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: "./.github/setup"
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+
+      - name: Install Slither
+        run: pip3 install slither-analyzer
+
+      - name: Running Slither
+        run: yarn analyze:ci
+
   test:
     runs-on: ubuntu-latest
     steps:

README.md

@@ -21,6 +21,7 @@ This mono-repo contains The Sandbox smart contracts, underpinning The Sandbox me
 
 - ⚙️ [NodeJS](https://nodejs.org/)
 - 🧰 [Yarn](https://yarnpkg.com/)
+- 🐍 [Python](https://www.python.org/)
 
 ## Tech stack and getting started
 
@@ -45,6 +46,11 @@ Each package should follow the [audit best practices](./audit-best-practices.md)
 yarn install
 ```
 
+Install Slither (optional)
+```bash
+pip3 install -r requirements.txt
+```
+
 ## Architecture Overview
 
 - 📦 This mono-repository contains a suite of smart contract packages.

package.json

@@ -14,12 +14,14 @@
         "lint": "nx run-many --target=lint",
         "format": "nx run-many --target=format",
         "deploy": "nx run-many --target=deploy",
-        "all": "nx run-many --all --parallel --targets=lint,format,test,deploy && nx run-many --all --targets=coverage",
+        "analyze": "nx run-many --target=analyze",
+        "all": "nx run-many --all --parallel --targets=lint,format,analyze,test,deploy && nx run-many --all --targets=coverage",
         "test:ci": "nx affected --target=test --parallel=1",
         "coverage:ci": "nx affected --target=coverage --parallel=1 && istanbul-combine -r lcov -r html 'packages/*/coverage.json'",
         "lint:ci": "nx affected --target=lint",
         "format:ci": "nx affected --target=format",
         "deploy:ci": "nx affected --target=deploy --parallel=1",
+        "analyze:ci": "nx affected --target=analyze",
         "clean": "rimraf coverage/* && nx run-many --target=clean"
     },
     "repository": "https://github.com/thesandboxgame/sandbox-smart-contracts",

packages/marketplace/package.json

@@ -48,6 +48,7 @@
     "format:fix": "prettier --write \"**/*.{ts,js,sol}\"",
     "test": "hardhat test",
     "coverage": "hardhat coverage --testfiles 'test/*.ts''test/*.js'",
+    "analyze": "slither .",
     "hardhat": "hardhat",
     "compile": "hardhat compile"
   },

packages/marketplace/slither.config.json

@@ -0,0 +1,5 @@
+{
+    "printers_to_run": "human-summary",
+    "detectors_to_exclude": "naming-convention",  
+    "filter_paths": "(mocks/|@openzeppelin/|@sandbox-smart-contracts/)"
+}

requirements.txt

@@ -0,0 +1 @@
+slither-analyzer==0.9.6