solidity/libsolidity/formal/CHC.h

357 lines
13 KiB
C
Raw Normal View History

2019-07-04 12:44:10 +00:00
/*
This file is part of solidity.
solidity is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
solidity is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with solidity. If not, see <http://www.gnu.org/licenses/>.
*/
// SPDX-License-Identifier: GPL-3.0
2019-07-04 12:44:10 +00:00
/**
* Model checker based on Constrained Horn Clauses.
*
* A Solidity contract's CFG is encoded into a system of Horn clauses where
* each block has a predicate and edges are rules.
*
* The entry block is the constructor which has no in-edges.
* The constructor has one out-edge to an artificial block named _Interface_
* which has in/out-edges from/to all public functions.
*
* Loop invariants for Interface -> Interface' are state invariants.
*/
#pragma once
2020-08-13 12:00:33 +00:00
#include <libsolidity/formal/Predicate.h>
2019-07-04 12:44:10 +00:00
#include <libsolidity/formal/SMTEncoder.h>
#include <libsolidity/interface/ReadFile.h>
2020-05-18 15:42:24 +00:00
#include <libsmtutil/CHCSolverInterface.h>
#include <boost/algorithm/string/join.hpp>
#include <map>
#include <optional>
2019-07-04 12:44:10 +00:00
#include <set>
2019-12-11 16:31:36 +00:00
namespace solidity::frontend
2019-07-04 12:44:10 +00:00
{
class CHC: public SMTEncoder
{
public:
2019-09-24 15:35:31 +00:00
CHC(
smt::EncodingContext& _context,
langutil::ErrorReporter& _errorReporter,
2019-12-11 16:31:36 +00:00
std::map<util::h256, std::string> const& _smtlib2Responses,
ReadCallback::Callback const& _smtCallback,
2020-05-19 12:14:46 +00:00
smtutil::SMTSolverChoice _enabledSolvers
2019-09-24 15:35:31 +00:00
);
2019-07-04 12:44:10 +00:00
void analyze(SourceUnit const& _sources);
2019-07-04 12:44:10 +00:00
std::map<ASTNode const*, std::set<VerificationTarget::Type>> const& safeTargets() const { return m_safeTargets; }
std::map<ASTNode const*, std::set<VerificationTarget::Type>> const& unsafeTargets() const { return m_unsafeTargets; }
2019-07-04 12:44:10 +00:00
2019-09-24 15:35:31 +00:00
/// This is used if the Horn solver is not directly linked into this binary.
/// @returns a list of inputs to the Horn solver that were not part of the argument to
/// the constructor.
std::vector<std::string> unhandledQueries() const;
2019-07-04 12:44:10 +00:00
private:
/// Visitor functions.
//@{
bool visit(ContractDefinition const& _node) override;
void endVisit(ContractDefinition const& _node) override;
bool visit(FunctionDefinition const& _node) override;
void endVisit(FunctionDefinition const& _node) override;
bool visit(IfStatement const& _node) override;
bool visit(WhileStatement const&) override;
bool visit(ForStatement const&) override;
2019-07-04 12:44:10 +00:00
void endVisit(FunctionCall const& _node) override;
2019-08-20 13:03:45 +00:00
void endVisit(Break const& _node) override;
void endVisit(Continue const& _node) override;
2019-07-04 12:44:10 +00:00
void visitAssert(FunctionCall const& _funCall);
2020-02-12 02:21:42 +00:00
void internalFunctionCall(FunctionCall const& _funCall);
void externalFunctionCall(FunctionCall const& _funCall);
void unknownFunctionCall(FunctionCall const& _funCall);
2020-05-17 21:21:08 +00:00
void makeArrayPopVerificationTarget(FunctionCall const& _arrayPop) override;
/// Creates underflow/overflow verification targets.
std::pair<smtutil::Expression, smtutil::Expression> arithmeticOperation(
Token _op,
smtutil::Expression const& _left,
smtutil::Expression const& _right,
TypePointer const& _commonType,
Expression const& _expression
) override;
2019-07-04 12:44:10 +00:00
//@}
struct IdCompare
{
bool operator()(ASTNode const* lhs, ASTNode const* rhs) const
{
return lhs->id() < rhs->id();
}
};
2019-07-04 12:44:10 +00:00
/// Helpers.
//@{
void resetSourceAnalysis();
void resetContractAnalysis();
void eraseKnowledge();
void clearIndices(ContractDefinition const* _contract, FunctionDefinition const* _function = nullptr) override;
2020-08-13 12:00:33 +00:00
void setCurrentBlock(Predicate const& _block, std::vector<smtutil::Expression> const* _arguments = nullptr);
std::set<Expression const*, IdCompare> transactionAssertions(ASTNode const* _txRoot);
2019-07-04 12:44:10 +00:00
//@}
/// Sort helpers.
//@{
2020-05-19 12:14:46 +00:00
static std::vector<smtutil::SortPointer> stateSorts(ContractDefinition const& _contract);
smtutil::SortPointer constructorSort();
smtutil::SortPointer interfaceSort();
smtutil::SortPointer nondetInterfaceSort();
2020-05-19 12:14:46 +00:00
static smtutil::SortPointer interfaceSort(ContractDefinition const& _const);
static smtutil::SortPointer nondetInterfaceSort(ContractDefinition const& _const);
2020-08-13 12:00:33 +00:00
smtutil::SortPointer arity0FunctionSort() const;
2020-05-19 12:14:46 +00:00
smtutil::SortPointer sort(FunctionDefinition const& _function);
smtutil::SortPointer sort(ASTNode const* _block);
/// @returns the sort of a predicate that represents the summary of _function in the scope of _contract.
/// The _contract is also needed because the same function might be in many contracts due to inheritance,
/// where the sort changes because the set of state variables might change.
2020-05-19 12:14:46 +00:00
static smtutil::SortPointer summarySort(FunctionDefinition const& _function, ContractDefinition const& _contract);
//@}
/// Predicate helpers.
//@{
/// @returns a new block of given _sort and _name.
2020-08-13 12:00:33 +00:00
Predicate const* createSymbolicBlock(smtutil::SortPointer _sort, std::string const& _name, ASTNode const* _node = nullptr);
/// Creates summary predicates for all functions of all contracts
/// in a given _source.
void defineInterfacesAndSummaries(SourceUnit const& _source);
/// Interface predicate over current variables.
2020-05-19 12:14:46 +00:00
smtutil::Expression interface();
smtutil::Expression interface(ContractDefinition const& _contract);
/// Error predicate over current variables.
2020-05-19 12:14:46 +00:00
smtutil::Expression error();
smtutil::Expression error(unsigned _idx);
/// Creates a block for the given _node.
2020-08-13 12:00:33 +00:00
Predicate const* createBlock(ASTNode const* _node, std::string const& _prefix = "");
/// Creates a call block for the given function _function from contract _contract.
/// The contract is needed here because of inheritance.
2020-08-13 12:00:33 +00:00
Predicate const* createSummaryBlock(FunctionDefinition const& _function, ContractDefinition const& _contract);
2019-08-20 13:03:45 +00:00
/// Creates a new error block to be used by an assertion.
/// Also registers the predicate.
void createErrorBlock();
2020-05-19 12:14:46 +00:00
void connectBlocks(smtutil::Expression const& _from, smtutil::Expression const& _to, smtutil::Expression const& _constraints = smtutil::Expression(true));
/// @returns the symbolic values of the state variables at the beginning
/// of the current transaction.
2020-05-19 12:14:46 +00:00
std::vector<smtutil::Expression> initialStateVariables();
std::vector<smtutil::Expression> initialStateVariables(ContractDefinition const& _contract);
2020-07-08 09:47:03 +00:00
std::vector<smtutil::Expression> stateVariablesAtIndex(unsigned _index);
std::vector<smtutil::Expression> stateVariablesAtIndex(unsigned _index, ContractDefinition const& _contract);
/// @returns the current symbolic values of the current state variables.
2020-05-19 12:14:46 +00:00
std::vector<smtutil::Expression> currentStateVariables();
std::vector<smtutil::Expression> currentStateVariables(ContractDefinition const& _contract);
/// @returns the current symbolic values of the current function's
/// input and output parameters.
2020-05-19 12:14:46 +00:00
std::vector<smtutil::Expression> currentFunctionVariables();
2020-07-13 19:10:30 +00:00
std::vector<smtutil::Expression> currentFunctionVariables(FunctionDefinition const& _function);
std::vector<smtutil::Expression> currentFunctionVariables(ContractDefinition const& _contract);
/// @returns the same as currentFunctionVariables plus
/// local variables.
2020-05-19 12:14:46 +00:00
std::vector<smtutil::Expression> currentBlockVariables();
2019-08-20 13:03:45 +00:00
/// @returns the predicate name for a given node.
std::string predicateName(ASTNode const* _node, ContractDefinition const* _contract = nullptr);
2019-08-20 13:03:45 +00:00
/// @returns a predicate application over the current scoped variables.
2020-08-13 12:00:33 +00:00
smtutil::Expression predicate(Predicate const& _block);
/// @returns a predicate application over @param _arguments.
2020-08-13 12:00:33 +00:00
smtutil::Expression predicate(Predicate const& _block, std::vector<smtutil::Expression> const& _arguments);
2020-02-12 02:21:42 +00:00
/// @returns the summary predicate for the called function.
2020-05-19 12:14:46 +00:00
smtutil::Expression predicate(FunctionCall const& _funCall);
/// @returns a predicate that defines a constructor summary.
2020-05-19 12:14:46 +00:00
smtutil::Expression summary(ContractDefinition const& _contract);
/// @returns a predicate that defines a function summary.
2020-05-19 12:14:46 +00:00
smtutil::Expression summary(FunctionDefinition const& _function);
smtutil::Expression summary(FunctionDefinition const& _function, ContractDefinition const& _contract);
//@}
2019-07-04 12:44:10 +00:00
/// Solver related.
//@{
2019-08-20 13:03:45 +00:00
/// Adds Horn rule to the solver.
2020-05-19 12:14:46 +00:00
void addRule(smtutil::Expression const& _rule, std::string const& _ruleName);
/// @returns <true, empty> if query is unsatisfiable (safe).
/// @returns <false, model> otherwise.
2020-07-07 14:22:51 +00:00
std::pair<smtutil::CheckResult, smtutil::CHCSolverInterface::CexGraph> query(smtutil::Expression const& _query, langutil::SourceLocation const& _location);
2020-05-19 12:14:46 +00:00
void addVerificationTarget(ASTNode const* _scope, VerificationTarget::Type _type, smtutil::Expression _from, smtutil::Expression _constraints, smtutil::Expression _errorId);
void addVerificationTarget(ASTNode const* _scope, VerificationTarget::Type _type, smtutil::Expression _errorId);
2020-05-19 12:14:46 +00:00
void addAssertVerificationTarget(ASTNode const* _scope, smtutil::Expression _from, smtutil::Expression _constraints, smtutil::Expression _errorId);
void checkVerificationTargets();
// Forward declaration. Definition is below.
struct CHCVerificationTarget;
void checkAssertTarget(ASTNode const* _scope, CHCVerificationTarget const& _target);
void checkAndReportTarget(
ASTNode const* _scope,
CHCVerificationTarget const& _target,
unsigned _errorId,
langutil::ErrorId _errorReporterId,
std::string _satMsg,
std::string _unknownMsg = ""
);
std::optional<std::string> generateCounterexample(smtutil::CHCSolverInterface::CexGraph const& _graph, std::string const& _root);
/// @returns a set of pairs _var = _value separated by _separator.
template <typename T>
std::string formatVariableModel(std::vector<T> const& _variables, std::vector<std::string> const& _values, std::string const& _separator) const
{
solAssert(_variables.size() == _values.size(), "");
std::vector<std::string> assignments;
for (unsigned i = 0; i < _values.size(); ++i)
{
auto var = _variables.at(i);
if (var && var->type()->isValueType())
assignments.emplace_back(var->name() + " = " + _values.at(i));
}
return boost::algorithm::join(assignments, _separator);
}
2020-07-17 10:26:55 +00:00
/// @returns a DAG in the dot format.
/// Used for debugging purposes.
std::string cex2dot(smtutil::CHCSolverInterface::CexGraph const& _graph);
2019-07-04 12:44:10 +00:00
//@}
/// Misc.
//@{
/// Returns a prefix to be used in a new unique block name
/// and increases the block counter.
std::string uniquePrefix();
/// @returns a new unique error id associated with _expr and stores
/// it into m_errorIds.
unsigned newErrorId(Expression const& _expr);
//@}
/// Predicates.
//@{
/// Implicit constructor predicate.
/// Explicit constructors are handled as functions.
2020-08-13 12:00:33 +00:00
Predicate const* m_implicitConstructorPredicate = nullptr;
/// Constructor summary predicate, exists after the constructor
/// (implicit or explicit) and before the interface.
2020-08-13 12:00:33 +00:00
Predicate const* m_constructorSummaryPredicate = nullptr;
/// Artificial Interface predicate.
/// Single entry block for all functions.
2020-08-13 12:00:33 +00:00
std::map<ContractDefinition const*, Predicate const*> m_interfaces;
/// Nondeterministic interfaces.
/// These are used when the analyzed contract makes external calls to unknown code,
/// which means that the analyzed contract can potentially be called
/// nondeterministically.
2020-08-13 12:00:33 +00:00
std::map<ContractDefinition const*, Predicate const*> m_nondetInterfaces;
/// Artificial Error predicate.
/// Single error block for all assertions.
2020-08-13 12:00:33 +00:00
Predicate const* m_errorPredicate = nullptr;
/// Function predicates.
2020-08-13 12:00:33 +00:00
std::map<ContractDefinition const*, std::map<FunctionDefinition const*, Predicate const*>> m_summaries;
smt::SymbolicIntVariable m_error{
TypeProvider::uint256(),
TypeProvider::uint256(),
"error",
m_context
};
//@}
/// Variables.
//@{
/// State variables sorts.
/// Used by all predicates.
2020-05-19 12:14:46 +00:00
std::vector<smtutil::SortPointer> m_stateSorts;
/// State variables.
/// Used to create all predicates.
std::vector<VariableDeclaration const*> m_stateVariables;
//@}
2019-07-04 12:44:10 +00:00
/// Verification targets.
//@{
struct CHCVerificationTarget: VerificationTarget
{
2020-05-19 12:14:46 +00:00
smtutil::Expression errorId;
};
std::map<ASTNode const*, CHCVerificationTarget, IdCompare> m_verificationTargets;
2019-07-04 12:44:10 +00:00
/// Targets proven safe.
std::map<ASTNode const*, std::set<VerificationTarget::Type>> m_safeTargets;
2020-05-17 21:21:08 +00:00
/// Targets proven unsafe.
std::map<ASTNode const*, std::set<VerificationTarget::Type>> m_unsafeTargets;
2019-07-04 12:44:10 +00:00
//@}
/// Control-flow.
//@{
FunctionDefinition const* m_currentFunction = nullptr;
std::map<ASTNode const*, std::set<ASTNode const*, IdCompare>, IdCompare> m_callGraph;
std::map<ASTNode const*, std::set<Expression const*>, IdCompare> m_functionAssertions;
/// Maps ASTNode ids to error ids.
/// A multimap is used instead of map anticipating the UnderOverflow
/// target which has 2 error ids.
std::multimap<unsigned, unsigned> m_errorIds;
/// The current block.
2020-05-19 12:14:46 +00:00
smtutil::Expression m_currentBlock = smtutil::Expression(true);
/// Counter to generate unique block names.
unsigned m_blockCounter = 0;
/// Whether a function call was seen in the current scope.
bool m_unknownFunctionCallSeen = false;
2019-08-20 13:03:45 +00:00
/// Block where a loop break should go to.
2020-08-13 12:00:33 +00:00
Predicate const* m_breakDest;
2019-08-20 13:03:45 +00:00
/// Block where a loop continue should go to.
2020-08-13 12:00:33 +00:00
Predicate const* m_continueDest;
2019-07-04 12:44:10 +00:00
//@}
/// CHC solver.
2020-05-19 12:14:46 +00:00
std::unique_ptr<smtutil::CHCSolverInterface> m_interface;
2019-07-04 12:44:10 +00:00
/// ErrorReporter that comes from CompilerStack.
langutil::ErrorReporter& m_outerErrorReporter;
2019-12-03 15:50:28 +00:00
/// SMT solvers that are chosen at runtime.
2020-05-19 12:14:46 +00:00
smtutil::SMTSolverChoice m_enabledSolvers;
2019-07-04 12:44:10 +00:00
};
}