Tales-Cunha commited on
Commit
e8aa1e7
·
1 Parent(s): 2eb19c1

fix: change the tests

Browse files
src/index.ts CHANGED
@@ -15,25 +15,46 @@ const auditorResult = await auditorAgent.invoke({ solidityFile: coderResult.cont
15
  console.log("\n======= Auditor =======");
16
  // console.log(auditorResult.vulnerabilities);
17
 
18
- function mapFindingToReport(finding: Finding, sourceCode: string): VulnerabilityReport {
19
- // Extract contract name from path (e.g., "contracts/CafeToken.sol" -> "CafeToken")
20
- const nameMatch = finding.path.match(/([^\/]+)\.sol$/);
 
 
 
 
 
 
 
 
 
21
  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
22
 
 
 
 
 
 
 
 
 
 
 
 
 
23
  return {
24
- id: finding.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
25
- severity: finding.severity === "high" ? "high" : finding.severity === "medium" ? "medium" : "low",
26
- type: "custom",
27
- title: finding.title,
28
- description: finding.description,
29
  affectedContract: {
30
  name: contractName,
31
- sourceCode: sourceCode,
32
  },
33
- attackVector: finding.judgeReview.exploitablePaths[0] || "Unknown vector",
34
- exploitablePaths: finding.judgeReview.exploitablePaths,
35
- codeSnippet: finding.codeSnippet,
36
- location: finding.location
37
  };
38
  }
39
 
 
15
  console.log("\n======= Auditor =======");
16
  // console.log(auditorResult.vulnerabilities);
17
 
18
+ function mapFindingToReport(finding: Partial<Finding> & { type?: string; severity?: string }, sourceCode: string): VulnerabilityReport {
19
+ const title = typeof finding.title === "string" && finding.title.trim().length > 0
20
+ ? finding.title
21
+ : typeof finding.type === "string" && finding.type.trim().length > 0
22
+ ? finding.type
23
+ : "Unknown vulnerability";
24
+
25
+ const description = typeof finding.description === "string" && finding.description.trim().length > 0
26
+ ? finding.description
27
+ : "No description provided by auditor.";
28
+
29
+ const nameMatch = finding.path?.match(/([^\/]+)\.sol$/);
30
  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
31
 
32
+ const exploitablePaths = Array.isArray(finding.judgeReview?.exploitablePaths)
33
+ ? finding.judgeReview.exploitablePaths
34
+ : [];
35
+
36
+ const severity = finding.severity === "high" || finding.severity === "medium" || finding.severity === "low"
37
+ ? finding.severity
38
+ : "low";
39
+
40
+ if (!finding.path || !finding.judgeReview) {
41
+ console.warn("Auditor returned incomplete finding; using fallbacks for PoC generation.");
42
+ }
43
+
44
  return {
45
+ id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
46
+ severity,
47
+ type: typeof finding.type === "string" && finding.type.trim().length > 0 ? finding.type : "custom",
48
+ title,
49
+ description,
50
  affectedContract: {
51
  name: contractName,
52
+ sourceCode,
53
  },
54
+ attackVector: exploitablePaths[0] ?? "Unknown vector",
55
+ exploitablePaths,
56
+ codeSnippet: typeof finding.codeSnippet === "string" ? finding.codeSnippet : undefined,
57
+ location: typeof finding.location === "string" ? finding.location : undefined,
58
  };
59
  }
60
 
tests/e2e/poc-generator.test.ts CHANGED
@@ -1,3 +1,5 @@
 
 
1
  import { runPoCGenerator } from "../../src/agents/tester/index.js";
2
  import { VulnerabilityReport } from "../../src/agents/tester/types.js";
3
 
@@ -26,31 +28,12 @@ const mockReport: VulnerabilityReport = {
26
  suggestedCheatcodes: ["vm.deal", "vm.startPrank", "vm.stopPrank"],
27
  };
28
 
29
- async function runE2ETest() {
30
- console.log("Iniciando smoke test end-to-end (Reentrancy)...");
31
-
32
- // Garantir que o sandbox está limpo
33
- // No mundo real, scripts/setup-sandbox.sh deve ser rodado uma vez no setup do sistema
34
-
35
- try {
36
  const result = await runPoCGenerator(mockReport);
37
 
38
- console.log("\n======= E2E RESULT =======");
39
- console.log(`Status: ${result.status}`);
40
- console.log(`Iterações: ${result.iterations}`);
41
- console.log(`Logs: ${result.executionLogs.length} entrada(s)`);
42
-
43
- console.assert(result.status === "success", `FALHOU: status esperado 'success', recebido '${result.status}'`);
44
- console.assert(result.solidityCode.includes("test_Exploit"), "FALHOU: código não contém test_Exploit");
45
-
46
- if (result.status === "success") {
47
- console.log("\nSmoke test PASSOU: Vulnerabilidade confirmada via PoC!");
48
- } else {
49
- console.error("\nSmoke test FALHOU: Agente não conseguiu gerar PoC válido.");
50
- }
51
- } catch (error) {
52
- console.error("Erro fatal no teste E2E:", error);
53
- }
54
- }
55
-
56
- runE2ETest().catch(console.error);
 
1
+ import { describe, expect, it } from "vitest";
2
+
3
  import { runPoCGenerator } from "../../src/agents/tester/index.js";
4
  import { VulnerabilityReport } from "../../src/agents/tester/types.js";
5
 
 
28
  suggestedCheatcodes: ["vm.deal", "vm.startPrank", "vm.stopPrank"],
29
  };
30
 
31
+ describe("PoC generator (e2e)", () => {
32
+ it("generates a PoC from a vulnerability report", async () => {
 
 
 
 
 
33
  const result = await runPoCGenerator(mockReport);
34
 
35
+ expect(result.status).toBe("success");
36
+ expect(result.solidityCode).toContain("test_Exploit");
37
+ expect(result.executionLogs.length).toBeGreaterThan(0);
38
+ }, 120000);
39
+ });
 
 
 
 
 
 
 
 
 
 
 
 
 
 
tests/scaffold.test.ts CHANGED
@@ -1,15 +1,19 @@
 
 
1
  import { generateLocalScaffold } from "../src/agents/tester/tools/scaffoldGenerator.js";
2
 
3
- const mockReport = {
4
- id: "t1",
5
- severity: "high" as const,
6
- type: "reentrancy",
7
- title: "Reentrancy in withdraw()",
8
- description: "withdraw() sends ETH before zeroing balance",
9
- attackVector: "Malicious callback",
10
- affectedContract: {
11
- name: "VulnerableBank",
12
- sourceCode: `
 
 
13
  pragma solidity ^0.8.20;
14
  contract VulnerableBank {
15
  mapping(address=>uint) public balances;
@@ -18,18 +22,15 @@ contract VulnerableBank {
18
  (bool ok,) = msg.sender.call{value:a}("");
19
  require(ok); balances[msg.sender] = 0;
20
  }
21
- }`
22
- }
23
- };
24
-
25
- const scaffold = generateLocalScaffold(mockReport);
26
- console.log("--- Scaffold Output ---");
27
- console.log(scaffold);
28
- console.log("--- End Scaffold ---");
29
 
30
- console.assert(scaffold.includes("contract ExploitTest is Test"), "Scaffold missing ExploitTest");
31
- console.assert(scaffold.includes("VulnerableBank target"), "Scaffold missing target declaration");
32
- console.assert(scaffold.includes("function setUp()"), "Scaffold missing setUp");
33
- console.assert(scaffold.includes("function test_Exploit()"), "Scaffold missing test_Exploit");
34
 
35
- console.log("Scaffold generator test passed");
 
 
 
 
 
 
1
+ import { describe, expect, it } from "vitest";
2
+
3
  import { generateLocalScaffold } from "../src/agents/tester/tools/scaffoldGenerator.js";
4
 
5
+ describe("generateLocalScaffold", () => {
6
+ it("creates a basic exploit scaffold", () => {
7
+ const mockReport = {
8
+ id: "t1",
9
+ severity: "high" as const,
10
+ type: "reentrancy",
11
+ title: "Reentrancy in withdraw()",
12
+ description: "withdraw() sends ETH before zeroing balance",
13
+ attackVector: "Malicious callback",
14
+ affectedContract: {
15
+ name: "VulnerableBank",
16
+ sourceCode: `
17
  pragma solidity ^0.8.20;
18
  contract VulnerableBank {
19
  mapping(address=>uint) public balances;
 
22
  (bool ok,) = msg.sender.call{value:a}("");
23
  require(ok); balances[msg.sender] = 0;
24
  }
25
+ }`,
26
+ },
27
+ };
 
 
 
 
 
28
 
29
+ const scaffold = generateLocalScaffold(mockReport);
 
 
 
30
 
31
+ expect(scaffold).toContain("contract ExploitTest is Test");
32
+ expect(scaffold).toContain("VulnerableBank target");
33
+ expect(scaffold).toContain("function setUp()");
34
+ expect(scaffold).toContain("function test_Exploit()");
35
+ });
36
+ });
tests/state.test.ts CHANGED
@@ -1,23 +1,16 @@
1
- import { PoCStateAnnotation } from "../src/agents/tester/state.js";
2
 
3
- const s = (PoCStateAnnotation as any).spec;
4
- if (s.iterations !== undefined) {
5
- console.log("Estado OK: iterations existe");
6
- } else {
7
- console.error("Erro: iterations não existe no spec");
8
- process.exit(1);
9
- }
10
 
11
- // Teste de reducer aditivo para iterations
12
- const iterationsSpec = s.iterations;
13
- const initial = 0;
14
- const update = 1;
15
- const result = (iterationsSpec.reducer || ((x: number, y: number) => x + y))(initial, update);
16
- if (result === 1) {
17
- console.log("Reducer aditivo OK: 0 + 1 = 1");
18
- } else {
19
- console.error(`Erro no reducer aditivo: esperado 1, recebido ${result}`);
20
- process.exit(1);
21
- }
22
 
23
- console.log("Teste de estado concluído com sucesso");
 
 
 
 
 
 
1
+ import { describe, expect, it } from "vitest";
2
 
3
+ import { PoCStateAnnotation } from "../src/agents/tester/state.js";
 
 
 
 
 
 
4
 
5
+ describe("PoCStateAnnotation", () => {
6
+ it("defines the iterations field", () => {
7
+ const spec = (PoCStateAnnotation as any).spec;
8
+ expect(spec.iterations).toBeDefined();
9
+ });
 
 
 
 
 
 
10
 
11
+ it("uses additive reducer for iterations", () => {
12
+ const spec = (PoCStateAnnotation as any).spec;
13
+ const reducer = spec.iterations.reducer ?? ((x: number, y: number) => x + y);
14
+ expect(reducer(0, 1)).toBe(1);
15
+ });
16
+ });