chore(security): Add slither

.github/workflows/analyse.yml

@@ -0,0 +1,76 @@
+name: Code Analysis
+
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+
+jobs:
+  slither:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Setup node.js version
+        uses: actions/setup-node@v1
+        with:
+          node-version: 12.x
+
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+
+      - name: Cache yarn cache
+        id: cache-yarn-cache
+        uses: actions/cache@v2
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: yarn-${{ hashFiles('**/yarn.lock') }}
+
+      - name: Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v2
+        with:
+          path: '**/node_modules'
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: node_modules-${{ hashFiles('**/yarn.lock') }}
+
+      - name: Install modules
+        run: yarn
+        if: |
+          steps.cache-yarn-cache.outputs.cache-hit != 'true' ||
+          steps.cache-node-modules.outputs.cache-hit != 'true'
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10.1'
+
+      - name: Install poetry requirements
+        run: >
+          curl -sSL https://install.python-poetry.org | python - &&
+          poetry install --no-root
+
+      - name: Run slither
+        run: >
+          poetry run slither . --sarif results.sarif || true
+
+      - name: Check results.sarif presence
+        id: results
+        if: always()
+        shell: bash
+        run: >
+          test -f results.sarif && 
+          echo '::set-output name=value::present' || 
+          echo '::set-output name=value::not'
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v2
+        if: ${{ always() && steps.results.outputs.value == 'present' }}
+        with:
+          sarif_file: results.sarif

.solhint.json

@@ -1,11 +1,15 @@
 {
   "extends": "solhint:recommended",
+  "plugins": [
+    "lido"
+  ],
   "rules": {
     "no-inline-assembly": "off",
     "var-name-mixedcase": "off",
     "compiler-version": "off",
     "reason-string": "off",
     "no-empty-blocks": "off",
-    "func-name-mixedcase": "off"
+    "func-name-mixedcase": "off",
+    "lido/fixed-compiler-version": "error"
   }
 }

contracts/0.4.24/interfaces/IACL.sol

@@ -2,7 +2,7 @@
  * SPDX-License-Identifier:    MIT
  */
 
-pragma solidity ^0.4.24;
+pragma solidity 0.4.24;
 
 
 interface IACL {

package.json

@@ -125,6 +125,7 @@
     "node-gyp": "^8.4.1",
     "openzeppelin-solidity": "2.0.0",
     "patch-package": "^6.4.7",
+    "solhint-plugin-lido": "^0.0.4",
     "solidity-bytes-utils": "0.0.6",
     "yargs": "^16.0.3"
   },

pyproject.toml

@@ -0,0 +1,18 @@
+[tool.poetry]
+name = "lido-dao"
+version = "0.1.0"
+description = ""
+authors = ["Your Name <[email protected]>"]
+license = "MIT"
+readme = "README.md"
+packages = [{include = "lido_dao"}]
+
+[tool.poetry.dependencies]
+python = "^3.9"
+
+[tool.poetry.group.dev.dependencies]
+slither-analyzer = "^0.8.3"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"

slither.config.json

@@ -0,0 +1,7 @@
+{
+    "exclude_informational": true,
+    "exclude_low": true,
+    "exclude_medium": false,
+    "exclude_high": false,
+    "filter_paths": "(.*test.*/|.*template/|.*mocks/|node_modules/|.*brownie/|.*dependencies/)"
+}

yarn.lock

@@ -3718,6 +3718,7 @@ __metadata:
     patch-package: ^6.4.7
     prettier: ^2.1.2
     solhint: ^3.2.2
+    solhint-plugin-lido: ^0.0.4
     solidity-bytes-utils: 0.0.6
     solidity-coverage: ^0.7.18
     solium: ^1.2.5
@@ -25102,6 +25103,13 @@ [email protected]:
   languageName: node
   linkType: hard
 
+"solhint-plugin-lido@npm:^0.0.4":
+  version: 0.0.4
+  resolution: "solhint-plugin-lido@npm:0.0.4"
+  checksum: eca282c079df0425e8ef3d63727f2f23dc02d9bcbcb269f3d2251fbb496622a0704a0b5ac65a35392c2985faf864650a5127b3934c1de51179485869da6f4d9d
+  languageName: node
+  linkType: hard
+
 "solhint@npm:^3.2.2":
   version: 3.2.2
   resolution: "solhint@npm:3.2.2"