feat(scanner): implement Unchecked Return Value detection plugin (#16) - #106

Summary

Implements the Unchecked Return Value detection plugin requested in #16.

The plugin flags low-level calls whose boolean return value is ignored — address.call(...), address.send(...), and address.delegatecall(...) — since these do not revert on failure and a silently-dropped false can leave a contract in an inconsistent state (SWC-104).

Files created

• plugins/unchecked-return/package.json
• plugins/unchecked-return/tsconfig.json
• plugins/unchecked-return/vitest.config.ts
• plugins/unchecked-return/.eslintrc.js
• plugins/unchecked-return/src/index.ts
• plugins/unchecked-return/src/index.test.ts

Files modified

• packages/scanner-core/src/plugin-registry.ts — adds createBuiltinPlugins() / createDefaultRegistry() that register the new plugin.
• packages/scanner-core/package.json + pnpm-lock.yaml — workspace dependency wiring.

Behaviour

• Detects unchecked .call() / .call{...}(), .send(), and .delegatecall() return values.
• Treats a call as checked when its result is assigned/destructured ((bool ok, ) = ..., bool ok = ...) or consumed by require/assert/if/while/return/boolean operators.
• Ignores matches inside comments.
• getFixRecommendation() returns the require(success) remediation pattern.

Acceptance criteria

• Implements IRulePlugin from @veridion/scanner-types
• Detects unchecked address.call() return values
• Detects unchecked address.send() return values
• Detects unchecked address.delegatecall() return values
• Provides fix recommendations using the require(success) pattern
• Unit tests (14 cases) covering every branch — all passing

Testing

pnpm --filter @veridion/plugin-unchecked-return test       # 14 passed
pnpm --filter @veridion/plugin-unchecked-return typecheck   # clean
pnpm --filter @veridion/plugin-unchecked-return lint        # clean
pnpm --filter @veridion/scanner-core test                   # 5 passed (registry)

Note: the repo does not currently include @vitest/coverage-v8, so the --coverage gate can't emit a report locally; the 14 tests exercise all three call types, every "checked" path, comments, the fix recommendation, and init.

Closes #16

🤖 Generated with Claude Code