Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat: integrate sierra-analyzer tool into forge #2871

Open
wants to merge 8 commits into
base: master
Choose a base branch
from

Conversation

Rog3rSm1th
Copy link

@Rog3rSm1th Rog3rSm1th commented Jan 23, 2025

Introduced changes

This PR creates an analyzer subcommand in forge based on the sierra-analyzer tool from @FuzzingLabs. The available options allow you to decompile the Sierra once it's built, generate its control flow graph, its call graph and run security detectors on it.

$ ~ snforge analyze --help

Analyze the project using the sierra-analyzer

Usage: snforge analyze [OPTIONS] --contract <CONTRACT>

Options:
      --function <FUNCTION>
          Specify the function name to analyze
      --contract <CONTRACT>
          Specify the contract name to analyze
      --cfg
          Generate a CFG (Control Flow Graph) instead of normal output
      --callgraph
          Generate a Call Graph instead of normal output
  -v, --verbose
          Enable verbose decompiler output
  -d, --detectors
          Run the detectors
      --detector-names <DETECTOR_NAMES>
          List of detector names to run
  -h, --help
          Print help

Checklist

  • Linked relevant issue
  • Updated relevant documentation
  • Added relevant tests
  • Performed self-review of the code
  • Added changes to CHANGELOG.md

@cptartur
Copy link
Member

cptartur commented Feb 6, 2025

Hey, this contribution is quite out of the blue. A couple of concerns:
First of all, what's the motivation for including this into Starknet Foundry? I see the linked tool is entirely standalone and I'm not sure what's the benefit in bundling it. Right now, we don't bundle anything intentionally - even "ours" profiler and coverage have to be installed separately.

Additionally, Starknet Foundry uses https://github.com/software-mansion/universal-sierra-compiler so we are pretty much independent from the Sierra version, is this true for the proposed changes?

Lastly, I see that a lot of code was basically copied over from the original repo, why isn't it used as a library? I'm agains introducing 124k lines of new code into foundry.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants