Solidity entrypoint detection is unreliable

[infosec-us-team]

We are very excited about Trailmark's potential and looking forward to building tooling on top of it. Thanks for open sourcing it!

In its current state, the entrypoints feature (described as "attack surface") is unreliable for Solidity.

Tagging anything with "public" or "external" as an entry point is a heuristic that will fail with nearly all Solidity smart contracts.

trailmark/src/trailmark/analysis/entrypoints.py

Lines 98 to 100 in a4a8182

	_SOL_VISIBILITY = re.compile(
	r"\bfunction\s+\w+\s*\([^)]*\)\s*(?:[\w\s]*?\b)?(external|public)\b",
	)

For example, view only functions that do not modify the state are marked as an entrypoint / attack surface:

/**
 * @notice seconds until the next epoch begins
 */
function secondsToNextEpoch() external view returns (uint256) {
    return epoch.end.sub(block.timestamp);
}

Interfaces are scanned (when they should be ignored), and as a result, governor() will be listed as an "entry point" of the target project.

interface IOlympusAuthority {
    function governor() external view returns (address);
}

A regex-based approach falls short here, especially with Solidity’s inheritance. When a smart contract overrides an inherited entry point, Trailmark needs to return the override only, not every version in the hierarchy.

Trailofbits implemented in Slither an "entrypoint scanner" for Solidity (thanks @nisedo !) that seems to behave correctly.

Are there any plans to improve entrypoint detection for Solidity?

[tob-scott-a]

Closing this as addressed in v0.5.0 (#67, #68).

Solidity entrypoint detection now uses parser metadata instead of regex-scanning signatures. The new behavior:

• excludes interface declarations from attack_surface();
• detects concrete public and external functions, including view and pure;
• records solidity_visibility, solidity_mutability, and solidity_container_kind attributes on entrypoint nodes;
• keeps overridden base implementations visible, but annotates them with solidity_overridden_by so consumers can filter them without Trailmark silently hiding deployable base-contract surface.

That last point differs slightly from the original “return the override only” request. We chose the more conservative security-analysis behavior: keep the base method because concrete base contracts can be independently deployable, while still exposing override metadata for tools that want the narrower view.

Thanks for the detailed Solidity examples. They directly shaped the v0.5.0 fixes.