Visualization of code bases with the Solidity extension for VSCode by Gonçalo Sá and Martin Ortner

so I think introductions are done me and Martin from consensus diligence will be I'll be talking for 20 minutes today about visualization of large code bases but also framing it as to why we've built the tools that we did and how they play a role in securing large code bases right this is not only about visualization this is about making your code secure when your code needs to be big right because security and oftentimes as the security team too many products we advocate for small code but sometimes it's just not possible right some things are neat to be complex and need to be sizeable so that's that's why we're talking about this today so I wanted to start if I may add to that we have this unique not problem but challenge some sometimes that new hires in your companies might have as well so they they get to see your codebase and it's fairly large and how do they start understanding the whole codebase and for us all it does this is kind of like regular business so with every new client we get like a new more or less complex copays and we want to make sure that we spend as little time as possible in understanding the complete system and finding the red lines so that we can start auditing and finding any any security issues in there so that's why it's also an interesting take on what tools are available or how can we eight new hires that we want to have in this ecosystem to be able to quickly write up code and quickly understand existing code bases and kind of awesomeness cumin and that's what we are going to talk about so for the history of the tools we'll give you a little bit of background on like why things happen and what happened and at what time so this whole thing started well this whole thing obviously we we we have always been thinking about security but this specific branch of our tooling started because of Aragon OS right up until then all the code bases that we had seen were me specifically had been related to tokens simple implementation of VIPs stuff like that right and then came Aragon OS and it was a beast of a codebase trade and I'm not saying that it that it was not well reached ridden which it was in very well document documented to write probably better than most of the projects that we have audited but still the sheer size of the system made it so that it's really hard for you to create mental models right even with threat modeling exercises you always end up to do some sort of visualization right bead UML diagrams were something that helps your brain come to terms with such a high level of modularity and composability right so sizes does not only play is not the only factor that plays a big role in making a system complicated modularity too right and this is why Surya was born it's raised purely another abstraction on top of the ASD that actually maps it out right it's a call graph printer nothing fancy that it was born out of necessity the the main drivers for Syria to be built the way it was were Portability and in the low dependency tree right we wanted to make these tools so they could be run everywhere right and anywhere and and also have have a small footprint right so that we could run them everywhere and also we cross-platform we just want to make it easy to run these things right we don't want to deal with versioning we don't want to do any of those things that end up complicating too like this because it's the tools purpose to begin with was to make it easy for people to visualize and mental map something so if we make it hard to run then it's it's it's going backwards right so we went with the Federico's awesome tools on the the antlr for grammar and parser that he had built for for a long time already and then came along the best part of the stack of this tooling branch that that martin the road which is the solidity visual auditor extension now i'm now looking at the name in in doing the presentation i see how we could probably make it more more receptive towards developers because even though there's auditor in the name it's not it's it's only target audience for sure and again going back to what i was saying before if our goal is to make it as easy as possible for people to visualize and map out systems then using CLE tools is not really the way to go right while you're developing you don't want to interrupt flow by having to run a system on your terminal or in another terminal session if you use beam right or just like even going through the trouble of visualizing those things in another window is already too much and so Martin brought us this beauty here so basically like how this how this was born was I was new to solidity but I didn't want to always have to keep everything in my mind about all the language specific things like what parts of the language are actually considered [Music] insecure or not as secure as they should be or like if you if you write your code for example in research to do code which is the ID that I'm using it wouldn't alert me on like certain things that I would want to see from security perspective which is passive information about what functions are actually publicly accessible what are public interface what are the only internal functions or when I'm pasting like some piece of code from Stack Exchange because I want to do like a delegate called proxy and I'm totally unaware what this is actually doing it's it's pretty easy to mess it up right and if you paste it into the IDE and you have this extension enabled it will like throw a whole lot of red flags at you by highlighting the delegate call itself in in playing pole threat so that you know like oh I should probably read up on the thing what is what is it doing they can even like hover over that delegate call and we can give you extra information about what the call is about and also what security concerns take the might be around it so it's it's initially it was initially geared to towards allowing new developers to develop code by getting passive security information while they are writing code so it was starting out as a syntax highlighting like as an extended syntax highlighting extension but it it got into that big beast of a lot of other nice tools that we kind of put into that at some point because they were always useful for us when we had to engage with new code bases hence the name for this is for this talk yeah so you can see a little bit of it will show the tools in in a minute but you can see a little bit of it like the syntax highlighting under the pragma and under the state variables also this is like an accompanying thing that Martin built which is basically in SVG interactive graph pervious code which is like the frosting on top of the cake honestly what happened a little bit after so like probably when you're into development is that we realized that we needed to own all of the dependencies for her speed of development in support right so we took them recently and thank you so much I thought I'd wink at the team and thank you guys for for doing that we don't need to worry about the grammar anymore because the solidity team actually to get under their wing so we're free of that now also with the whole corona thing and like our workload has been extreme these past few weeks and so I know that there's another organ on github solidity parser that started a new fork of the solidity parser that is more up-to-date than ours we are very very very excited about contributing there but thinking that we should probably still maintain our own in case in the future we need it again yeah this is also like a recommendation from our site when you're developing a new language always make sure that people have like have grandma's easy really available to their tools like the aunt Ella our grandma is nice because we can use it in a fussy way it doesn't need to be like as strict as the compiler will be afterwards because we are mainly using it for visualizations even though I like that can be some uncharted in that case all you have to be aware of that but for most of the case it's fine if we find all the functions all the state variables and stuff and we don't need to find like a hundred percent of it all the time but it's it's utterly important that if if parcels are readily available like generic ones as the empty lot Parsa then it's very easy to build a whole lot of tools or ID integrations for all kinds of platforms and it makes it just easier for people to adopt the language so thanks for taking it on though you went along yeah and yeah since then a lot more tools have been built by Martin all again with the same goal of building passive security as Martin has said right and this might mean syntax highlighting this might mean more information about the code that you're writing and keeping yourself up to date with it including as we just said giving you tools that allow you to find the dred line through a new that is kind of like through a new code base quickly that's kind of what we are also showing in in a few seconds then in life example and again I have been talking about this throughout the whole presentation but the reason why we're building these tools is because of these three main factors right we understand that everybody has deadlines and obviously this comes very much from an auditors perspective so this may be biased but we try to put ourselves in the developers shoes right in think what is important for them and in what constraints they have right and what challenges they're saying they're facing and we know that everybody has deadlines right time Bassets you you don't have 200 years to write a good way see you at most you have your whole lifetime right so good external support it's important even when you're when you have like straight timelines and you also should understand your code before anyone else right then other people will need to understand it too hopefully but you should be the first person to understand your code right I can remember who said this but code is made to be read by humans and then incidentally by machines so so you should make sure that you understand your code even before someone else does and when you're new to a language you learned by making mistakes right and our tools can help flatten that curve and hopefully the mistakes associated with it right again passive security okay yeah and just again borrowing very much from the on from the preparedness mindset for an audit and and this is actually very specific to audits right but it's we can also generalize it towards writing safe code you should document your code you should make it easy for everybody else to run right so understand it first make everybody understand it and and and and and run it after that it clean it up run preliminary tools like a linter raid run proper analysis tools and then release it to the world as you might or might not know we have a branch of toolings the delicious team has also started a branch of two links that is now an entity in its own right mythix that does dynamic analysis right like it's a colleague execution engine static and and fuzzer but this part that were talking about today is made to tackle the first the the the second and third sections that you see here right so it it it it basically helps you earlier in the development lifecycle so that when you get to steps four and five you already have both again a good mental map of what's happening in your whole system you have a good knowledge of like where the danger areas lay in your code and hopefully just make everybody his job easier right the developers Quality Assurance auditors I don't know whatever is there what stakeholders are there in the middle we just wanna attack it attack this problem super early in the development lifecycle so that everybody can have like a merrier life so let's see the lead tools in action Johanna take on the screen Martin and share that let's do it we have a couple of minutes left right so let's quickly do that so you should be able to see my wishes studio code instance and notice we're doing Eragon we're doing Eragon because it all started out with Aragon and consolidated sense of the codebase like years ago when you first had the glance on it so this is Visual Studio code basically I tried a whole lot of ideas and this is what I like this is the last thing that actually basically worked quite well and the it is quite extensible so that's why most of the things that I do we are nowadays code so it's like in the middle you see the codes the code editor there's no window open right now and on the left side this each like the code 3 or filed 3 with all the files I'd like to show you'd like the metrics plug-in first you install it from the extension marketplace it's all free it's all open source you can audit it and then just go ahead click here on any folder but you want to like why you expect solidity files click right click solidity metrics and it will take a few seconds because it's now parsing it's finding all this will identify sin they're inspiring all of them with the Antelope R so in the end and then we do some nice number crunching on it so you see like this is the workspace name table of contents let's skip to the scope you see what is in scope was out of scope codebase we were using and then you get that and this is quite nice like the first time I see a code base I usually run this tool because it shows me how many solidity files are in the codebase how many contracts are in total in the in the in the codebase these are all the logic contracts and there's nine interfaces in the concert as well then you see for each file you see what type of contract it is where it's or just an ordinary contract or even like an interface from this icon you see the number of lines normalized source code lines which is like normalizing the function signatures comments that are in the file which is a good indicator of whether you need to explain a little bit more time on documenting stuff you get even a complexity score which is not psycho cyclomatic complexity but this something is much more simpler basically we find anything that is risky and and and add a score to it even if it's a branch anything it's at complexity or security concern just add something to the score the higher it is the more likely like the higher should be probably your priority to look at things in here and we also like watch out for any patterns or calls that we know that that should be investigated for example this file is using any is using hash functions basically catch our calculations and this this file is doing any assembly stuff and then we have this file which is to be honest I prepared this so that it does show up with a lot of things it's not really the Aragon codebase that has all this stuff inside but you see like there is payable function in there the concept is destroyable it's it's initiating Aoife transfers and stuff like that it's even creating stuff so you get a nice overview on where might be some risky points in that 60 files of code bases and it helps you to like dissect the the interfacing stuff that you don't need to look at in the beginning from the stuff that could be very critical in the code base you have the summer review you see everything that was in excluded from it we even have some experimental stuff in there like which is kind of like our take on a bit on a risk chart this is something that we feel like should be presented to you solidity developer so that in know like the more often they use assembly code in there the the more complexity add to the system and the the more time it will take to actually also reveal that and make sure it's secure you get a new another overview on what type of contracts are instantiated and versions were observed and also like anything you might want to know like from the inner workings of this extension we just printed out just for fun because we have the data and you also get like for everything inheritance graphs and stuff this is basically serial output so this is the metrics plug in I think are we already over time or do we have like two minutes or three minutes or so show up the auditor extension for a second if you guys are over time but we are running into the break so it's okay okay cool go for it so I try to be fast so you can also install the solid which will auditor extension which basically this one once you installed it it will show a new icon in the in the panel on the left side you can click on it to get like a quick overview you can also hide it if you don't want to have that because I know that I'm usually pretty I don't want to see all the icons on the left side so what you can do to explore the codebase for example is we can click on this view and it should update the workspace Explorer view unless my machine is too slow today let me just quickly check it again okay so it's now searching for all these Lydia files in in the codebase the idea of this Explorer is it should only show you anything related to solidity files you don't want to see any any JavaScript files or any other things so that you can specifically specifically focus on solidity code so you can program whatever you want to see in there you can right-click and even find top-level contracts this is kind of something that I usually do in the beginning when I am exploring your code bases I want to see what is the main interfaces so that contract system so this list there's now populated here will show all the contracts that are the most derived basically that are not inherited by any other contracts in the system anymore and they are very likely to be deployed at the end for your smart contact system you can also from this view on just flatten all the files if you want to flatten stuff but you can also graph create graphs with basically Syria for certain folders or selected files or anything so let's just try that by the way we always give you like the source code so that you can modify stuff because you might want to use it in a different way so this is basically what's going on in the whole Aragon OS system from Syria's call graph here and it's kind of a lot of things if we just boil it down to like generating the graph for a couple of files it might even be easier all right so that's DV you just for the APM part what you can now do for example is some like simple taint analysis if you want to see like any calls that reach to root note then you can even like visually trace that path or to any other thing in the codebase where you want to use that also we can show the inheritance graph just for this part or what's also interesting a lot of time is you wanna see for example the UML charts for that file and you can also just generate in you can even do that for a flattened version of that file so if you click here select flatten that file it will flatten it down and you can then just visualize that flatten file this will take a little bit more time but it's worth the wait so this is everything around the ACL flattened and how the contracts are derived from each other and we even parse out which is kind of like an experimental features feature a bit we parse out potential actors in the system so whenever we see any addresses in the system we we denote them as possible access to the system yeah so that's basically the graphing functionality that we have in here one thing that might also be interesting is let's just go back to you for example a CEO for a second if you're cooking at the time Martin and because we want to allow the people to have a little break at least what I would like to do is already remind the people on the last room if you have questions please put them in the chat now and if you have questions in the room please already raise your hand so that I can estimate whether we need to discuss stuff or whether Martin can go on all right I will come to an end so one interesting feature we were working on recently is context-sensitive information that's what we call that your cockpit view so if you click into a method here you get like context specific information in East use on the side table just like this view just shows all the public stage changing methods plus their modifiers so you can see like what a create permission has an authentication modifier on it just quickly check if any of these are like missing modifiers and stuff and the last feature I'm talking about is basically also from Syria which is the call tracing function so when you click into this method for example will update the function call trace which basically shows all the downstream calls that are happening within that method method or even like somewhere in the layer below something that we might also integrate in the future is this in into the other direction so that you can find all the callers to that function and other things all right so that's basically it from the demo side