fix: classify using-for library calls as internal (#2073)

[MycCellium420]

Summary

Fixes #2073

addr.sendValue(amount) via using Address for address was incorrectly reported as an external call in the function-summary printer. Root cause: classify_calls ran during analyze_expressions — before _analyze_using_for had parsed the using … for directives.

Changes

slither/visitors/expression/call_classification.py

• New _is_using_for_library_call() helper checks if a variable's type has a matching library function via using for
• classify_calls() gains an optional using_for parameter

slither/solc_parsing/slither_compilation_unit_solc.py

• Re-classifies node calls at the end of _analyze_using_for, after directives are available

slither/solc_parsing/cfg/node.py

• Comment update only (initial classification still runs without using-for)

tests/unit/core/test_external_calls_classification.py

• 16 new unit tests (mock-based, no compiler needed)

Verified with real Solidity (solc 0.8.24)

using Address for address payable;
using SafeMath for uint256;

function testUsingFor(address payable r) external { r.sendValue(1 ether); }
function testUsingForUint(uint256 a, uint256 b) external pure { return a.add(b); }
function testExternal(address to, uint256 amt) external { token.transfer(to, amt); }

Function	Before	After
r.sendValue() (using-for)	external (false positive)	internal
a.add(b) (using-for)	external (false positive)	internal
token.transfer() (real)	external	external

Test plan

• 16/16 unit tests pass (TestClassifyCalls + TestUsingForClassification)
• slither test.sol --print function-summary verified with solc 0.8.24 on Linux
• abi.encode, direct library calls, this.foo() all still classified correctly

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.