test-assistant

test-assistant is a unit test suite for detecting common vulnerabilities from the aspect of smart contract

test-assistant contains the following:

✓ pattern manager of unit test and attacker payloads
✓ has on-demand utility for test development

1. reveal reentrancy
   detect reentrancy vulnerability: SWC-107
2. reveal origin
   detect phishable tx.origin vulnerability: SWC-115
3. reveal signature replay
   detect missing protection against signature replay attacks: SWC-121

Setup:

1. Install hyper terminal: hyper terminal
   

2. Install visual code software: vs code
   

3. Install Nodejs: Nodejs
   

4. Follow the instruction of Hardhat: hardhat environment
   Setup the environment and use the local environment.
   

5. Install the test-assistant npm package
   

6. Goto Hardhat directory creates three folders: contracts, test, and test-assistant.
   The contracts folder is related to smart contracts.
   The test folder is related to unit tests and requires test packages.
   The test-assistant folder is related to our test-assistant script.
   

7. Create a new file in the test-assistant folder as assistant.js.
   

8. Write the test-assistant script and pick a unit test pattern.
   For simplicity, write the script below:
   • Toolbox: reveal reentrancy, reveal origin, reveal signature replay
   

   var assistant = require('test-assistant');
   const wait = ms => new Promise(res => setTimeout(res, ms));
   async function done(){
     await wait(1000)
   }
   async function serve(){
     //preparation 
     const hardhat_test ='./test/test.js';
     const hardhat_contracts ='./contracts/test.sol';
     var pick = { "reveal reentrancy":true }; 
   
     //set the configuration and pick the patterns
     assistant.setconfig(pick, hardhat_test, hardhat_contracts);
     await done()
   
     //insert following patterns that were picked before
     await assistant.insert()
     await done()
   }
   
   serve()

   For running the script, open the hyper terminal in the Hardhat directory and write the following:
   node test-assistant/assistant.js
   

9. Follow the inline comment and construct the unit test and payload contract.
   In this step, insert the required aspect.
   

10. Runs npx hardhat test within the hyper terminal.
    

11. View the hardhat result within the hyper terminal.
    

Installation

npm i test-assistant

Usage

var assistant = require('test-assistant');

const wait = ms => new Promise(res => setTimeout(res, ms));
async function done(){
    await wait(1000)
}

async function serve(){
  /* test-assistant Actions */
}

serve()

List of Actions

//get list of unit test patterns
assistant.pattern_list()
await done()

//preparation 
const hardhat_test ='./test/test.js';
const hardhat_contracts ='./contracts/test.sol';
var pick = { "reveal reentrancy":true, "reveal destruct":true}; 

//set the configuration and pick the patterns
assistant.setconfig(pick, hardhat_test, hardhat_contracts);
await done()

//import new pattern to a test-assistant repository
await assistant.add_new_pattern('reveal reentrancy',
                                `${__dirname}/test/test.js`, 
                                `${__dirname}/contracts/test.sol`)
await done()

//insert following patterns that were picked before
await assistant.insert()
await done()

//export all the patterns of the test-assistant repository to new path
await assistant.export_all(`${__dirname}/@unit test/`,`${__dirname}/@payload/`)
await done()

//remove patterns
await assistant.remove_pattern('reveal reentrancy')
await done()

//assistance info
await assistant.info()

Test Utility

/*
@dev: test-assistant has several utilities such as:
  library: Web3, ethers, Web3Utils, Web3Eth, Web3EthAbi, Web3EthContract, Web3Method
  usage:   web3, ethers, utils, eth, ethabi, ethcontract, method
*/

//util
assistant.utils.toWei('1', 'ether') //assistant.toWei, assistant.fromWei
assistant.utils.randomHex(32)
assistant.utils.hexToUtf8('0x49206861766520313030e282ac')

var BN = assistant.utils.BN;
new BN(1234).toString()

//ethabi
assistant.ethabi.encodeFunctionSignature('myMethod(uint256,string)')

//log utility
const [owner, attacker] = await ethers.getSigners()
const Contract = await ethers.getContractFactory("smart_contract")
const Attacker = await ethers.getContractFactory("attacker_contract")

const hardhatContract = await Contract.connect(owner).deploy()
const hardhatAttacker = await Attacker.connect(attacker).deploy()

watch({'owner':owner,'attacker':attacker})
watch({'Smart contract':hardhatContract, 'Attacker contract':hardhatAttacker})

await assistant.getContractBalance({'contract':hardhatContract, 'Attacker':hardhatAttacker})
await assistant.getPartyBalance(attacker)

Last version: 1.1.7
Github: buggerbag team