Add detectors for incorrect use of Oracle API

slither/detectors/all_detectors.py

@@ -99,3 +99,6 @@
 from .statements.return_bomb import ReturnBomb
 from .functions.out_of_order_retryable import OutOfOrderRetryable
 from .statements.unused_import import UnusedImport
+from .oracles.oracle_data_validation import OracleDataCheck
+from .oracles.oracle_sequencer import SequencerCheck
+from .oracles.deprecated_chainlink_calls import DeprecatedChainlinkCall

slither/detectors/oracles/deprecated_chainlink_calls.py

@@ -0,0 +1,62 @@
+from slither.core.declarations.contract import Contract
+from slither.detectors.abstract_detector import AbstractDetector, DetectorClassification
+from slither.slithir.operations import HighLevelCall
+
+
+class DeprecatedChainlinkCall(AbstractDetector):
+    """
+    Documentation: This detector scans for deprecated Chainlink API calls in Solidity contracts. For example, it flags the use of `getAnswer` which is no longer recommended.
+    """
+
+    ARGUMENT = "deprecated-chainlink-call"
+    HELP = "Oracle vulnerabilities"
+    IMPACT = DetectorClassification.MEDIUM
+    CONFIDENCE = DetectorClassification.MEDIUM
+
+    WIKI = "https://github.com/crytic/slither/wiki/Detector-Documentation#deprecated-chainlink-call"
+    WIKI_TITLE = "Deprecated Chainlink call"
+    WIKI_DESCRIPTION = "Detection of deprecated Chainlink call."
+    WIKI_RECOMMENDATION = "Do not use deprecated Chainlink calls. Visit https://docs.chain.link/data-feeds/api-reference/ for active API calls."
+    WIKI_EXPLOIT_SCENARIO = "---"
+
+    DEPRECATED_CHAINLINK_CALLS = [
+        "getAnswer",
+        "getTimestamp",
+        "latestAnswer",
+        "latestRound",
+        "latestTimestamp",
+    ]
+
+    def is_old_chainlink_call(self, ir) -> bool:
+        """
+        Check if the given operation is an old Chainlink call.
+        """
+        if isinstance(ir, HighLevelCall):
+            if (
+                ir.function.name in self.DEPRECATED_CHAINLINK_CALLS
+                and str(ir.destination.type) == "AggregatorV3Interface"
+            ):
+                return True
+        return False
+
+    def find_usage_of_deprecated_chainlink_calls(self, contracts: Contract):
+        """
+        Find usage of deprecated Chainlink calls in the contracts.
+        """
+        results = []
+        for contract in contracts:
+            for function in contract.functions:
+                for node in function.nodes:
+                    for ir in node.irs:
+                        if self.is_old_chainlink_call(ir):
+                            results.append(
+                                f"Deprecated Chainlink call {ir.destination}.{ir.function.name} used ({node.source_mapping}).\n"
+                            )
+        return results
+
+    def _detect(self):
+        results = self.find_usage_of_deprecated_chainlink_calls(self.contracts)
+        if len(results) > 0:
+            res = self.generate_result(results)
+            return [res]
+        return []

slither/detectors/oracles/oracle_data_validation.py

@@ -0,0 +1,44 @@
+from slither.detectors.abstract_detector import DetectorClassification
+from slither.detectors.oracles.oracle_detector import OracleDetector
+
+
+class OracleDataCheck(OracleDetector):
+    """
+    Documentation
+    """
+
+    ARGUMENT = "oracle-data-validation"  # slither will launch the detector with slither.py --detect mydetector
+    HELP = "Oracle vulnerabilities"
+    IMPACT = DetectorClassification.MEDIUM
+    CONFIDENCE = DetectorClassification.MEDIUM
+
+    WIKI = "https://github.com/crytic/slither/wiki/Detector-Documentation#oracle-data-validation"
+
+    WIKI_TITLE = "Oracle data validation"
+    WIKI_DESCRIPTION = "The detection of not correct validation of oracle data."
+    WIKI_EXPLOIT_SCENARIO = "---"
+    WIKI_RECOMMENDATION = "Validate the data returned by the oracle. For more information visit https://docs.chain.link/data-feeds/api-reference"
+
+    # This function is necessary even though there is a detector for unused return values because the variable can be used but will not be validated in conditional statements
+    def process_not_checked_vars(self):
+        result = []
+        for oracle in self.oracles:
+            if len(oracle.vars_not_in_condition) > 0:
+                result.append(
+                    f"The oracle {oracle.contract}.{oracle.interface} ({oracle.node.source_mapping}) returns the variables {[var.name for var in oracle.vars_not_in_condition]} which are not validated. It can potentially lead to unexpected behaviour.\n"
+                )
+        return result
+
+    def _detect(self):
+        results = []
+        super()._detect()
+        not_checked_vars = self.process_not_checked_vars()
+        if len(not_checked_vars) > 0:
+            res = self.generate_result(not_checked_vars)
+            results.append(res)
+        for oracle in self.oracles:
+            checked_vars = oracle.naive_data_validation()
+            if len(checked_vars) > 0:
+                res = self.generate_result(checked_vars)
+                results.append(res)
+        return results