Awesome

Semgrep rules for smart contracts

In this repository you can find semgrep rules that look for patterns of vulnerabilities in smart contracts based on actual DeFi exploits as well as gas optimization rules that can be used as a part of the CI pipeline. The rules are part of the semgrep registry under p/smart-contracts.

Disclaimer

Currently semgrep supports Solidity in experimental mode. Some of the rules may not work until Solidity is in beta at least.

Scanning

Important: Some of the rules utilize the taint mode, which is restricted to the same function in the open-source version of semgrep. To take advantage of intra-procedural taint analysis, you must include the --pro flag with each command. Please note that this requires semgrep Pro.

1. By cloning the repository:

$ semgrep --config solidity/security path/to/your/project

2. By using semgrep registry:

$ semgrep --config p/smart-contracts path/to/your/project

3. In your CI:

Create run-semgrep.yaml in .github/workflows with the following contents:

# Name of this GitHub Actions workflow.
name: Run Semgrep

on:
  # Scan changed files in PRs (diff-aware scanning):
  pull_request: {}
  # On-demand 
  workflow_dispatch: {}

jobs:
  semgrep:
    # User-definable name of this GitHub Actions job:
    name: Scan
    # If you are self-hosting, change the following `runs-on` value: 
    runs-on: ubuntu-latest

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: returntocorp/semgrep

    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@v3
      # Fetch semgrep rules
      - name: Fetch semgrep rules
        uses: actions/checkout@v3
        with:
          repository: decurity/semgrep-smart-contracts
          path: rules
      # Run security and gas optimization rules
      - run: semgrep ci --sarif --output=semgrep.sarif || true
        env:
           SEMGREP_RULES: rules/solidity/security rules/solidity/performance
      # Upload findings to GitHub Advanced Security Dashboard
      - name: Upload findings to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep.sarif
        if: always()

Testing

Each rule is accompanied by an actual vulnerable source code that was targeted by an exploit. Vulnerable lines are marked with // ruleid: ...

In case a rule is not yet supported by semgrep, you will find // todoruleid: ...

Run tests:

$ semgrep --test solidity

Validate rules:

$ semgrep --validate --config solidity

Feel free to submit any issues with the precision and quality of the rules!

Security Rules

Gas Optimization Rules

Best Practices Rules

Solana Rules

Cairo Rules