[SMTChecker] Add a new trusted mode which assumes that code that is

available at compile time is trusted.

test/libsolidity/SMTCheckerTest.cpp

@@ -33,6 +33,12 @@ SMTCheckerTest::SMTCheckerTest(string const& _filename): SyntaxTest(_filename, E
 	if (!contract.empty())
 		m_modelCheckerSettings.contracts.contracts[""] = {contract};
 
+	auto extCallsMode = ModelCheckerExtCalls::fromString(m_reader.stringSetting("SMTExtCalls", "untrusted"));
+	if (extCallsMode)
+		m_modelCheckerSettings.externalCalls = *extCallsMode;
+	else
+		BOOST_THROW_EXCEPTION(runtime_error("Invalid SMT external calls mode."));
+
 	auto const& showUnproved = m_reader.stringSetting("SMTShowUnproved", "yes");
 	if (showUnproved == "no")
 		m_modelCheckerSettings.showUnproved = false;
@@ -51,8 +57,13 @@ SMTCheckerTest::SMTCheckerTest(string const& _filename): SyntaxTest(_filename, E
 	m_modelCheckerSettings.solvers &= ModelChecker::availableSolvers();
 
 	/// Underflow and Overflow are not enabled by default for Solidity >=0.8.7,
-	/// so we explicitly enable all targets for the tests.
-	m_modelCheckerSettings.targets = ModelCheckerTargets::All();
+	/// so we explicitly enable all targets for the tests,
+	/// if the targets were not explicitly set by the test.
+	auto targets = ModelCheckerTargets::fromString(m_reader.stringSetting("SMTTargets", "all"));
+	if (targets)
+		m_modelCheckerSettings.targets = *targets;
+	else
+		BOOST_THROW_EXCEPTION(runtime_error("Invalid SMT targets."));
 
 	auto engine = ModelCheckerEngine::fromString(m_reader.stringSetting("SMTEngine", "all"));
 	if (engine)

test/libsolidity/smtCheckerTests/array_members/length_1d_struct_array_2d_1.sol

@@ -22,4 +22,4 @@ contract C {
 // SMTEngine: all
 // SMTIgnoreOS: macos
 // ----
-// Info 1180: Contract invariant(s) for :C:\n!(s1.arr.length <= 0)\n!(s2.arr.length <= 0)\n(((s2.arr[0].length + ((- 1) * s1.arr[0].length)) <= 0) && ((s1.arr[0].length + ((- 1) * s2.arr[0].length)) <= 0))\n
+// Info 1180: Contract invariant(s) for :C:\n!(s1.arr.length <= 0)\n!(s2.arr.length <= 0)\n(((s1.arr[0].length + ((- 1) * s2.arr[0].length)) <= 0) && ((s2.arr[0].length + ((- 1) * s1.arr[0].length)) <= 0))\n

test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_3_fail.sol

@@ -31,4 +31,4 @@ contract C {
 // Warning 6328: (349-375): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\nx = 0\ny = 0\nz = 9\nt = 0\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
 // Warning 6328: (379-402): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\nx = 0\ny = 0\nz = 9\nt = 0\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
 // Warning 6328: (406-432): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\nx = 0\ny = 0\nz = 9\nt = 0\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
-// Info 1180: Contract invariant(s) for :C:\n!(arr.length <= 7)\n!(arr.length <= 8)\n
+// Info 1180: Contract invariant(s) for :C:\n!(arr.length <= 5)\n!(arr.length <= 7)\n!(arr.length <= 8)\n

test/libsolidity/smtCheckerTests/array_members/push_as_lhs_1d.sol

@@ -18,5 +18,6 @@ contract C {
 // ====
 // SMTEngine: all
 // SMTIgnoreOS: macos
+// SMTIgnoreCex: yes
 // ----
 // Warning 6328: (199-229): CHC: Assertion violation happens here.\nCounterexample:\nb = [1]\n\nTransaction trace:\nC.constructor()\nState: b = []\nC.g()

test/libsolidity/smtCheckerTests/array_members/push_as_lhs_2d.sol

@@ -20,5 +20,6 @@ contract C {
 }
 // ====
 // SMTEngine: all
+// SMTIgnoreCex: yes
 // ----
 // Warning 6328: (362-420): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/complex/slither/external_function.sol

@@ -83,6 +83,6 @@ contract InternalCall {
 // Warning 2018: (1111-1173): Function state mutability can be restricted to pure
 // Warning 2018: (1179-1241): Function state mutability can be restricted to pure
 // Warning 2018: (1247-1309): Function state mutability can be restricted to pure
-// Warning 4588: (681-716): Assertion checker does not yet implement this type of function call.
-// Warning 4588: (854-886): Assertion checker does not yet implement this type of function call.
+// Warning 8729: (681-716): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 8729: (854-886): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
 // Warning 5729: (1370-1375): BMC does not yet implement this type of function call.

test/libsolidity/smtCheckerTests/deployment/deploy_bmc_trusted.sol

@@ -0,0 +1,18 @@
+contract D {
+	uint x;
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	function g() public {
+		D d = new D();
+		uint y = d.f();
+		assert(y == 0); // should fail in BMC
+	}
+}
+// ====
+// SMTEngine: bmc
+// SMTExtCalls: trusted
+// ----
+// Warning 8729: (124-131): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 4661: (153-167): BMC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/deployment/deploy_bmc_untrusted.sol

@@ -0,0 +1,17 @@
+contract D {
+	uint x;
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	function g() public {
+		D d = new D();
+		uint y = d.f();
+		assert(y == 0); // should fail in ext calls untrusted mode
+	}
+}
+// ====
+// SMTEngine: bmc
+// ----
+// Warning 8729: (124-131): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 4661: (153-167): BMC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/deployment/deploy_trusted.sol

@@ -0,0 +1,16 @@
+contract D {
+	uint x;
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	function g() public {
+		D d = new D();
+		uint y = d.f();
+		assert(y == 0); // should hold in ext calls trusted mode
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_addresses.sol

@@ -0,0 +1,19 @@
+contract D {
+	uint x;
+}
+
+contract C {
+	function f() public {
+		D d1 = new D();
+		D d2 = new D();
+
+		assert(d1 != d2); // should hold in ext calls trusted mode
+		assert(address(this) != address(d1)); // should hold in ext calls trusted mode
+		assert(address(this) != address(d2)); // should hold in ext calls trusted mode
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Info 1180: Contract invariant(s) for :C:\n(:var 0).isActive[address(this)]\n

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_flow.sol

@@ -0,0 +1,32 @@
+contract D {
+	uint x;
+	function inc() public { ++x; }
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	function f() public {
+		D d = new D();
+		assert(d.f() == 0); // should hold
+		d.inc();
+		assert(d.f() == 1); // should hold
+		d = new D();
+		assert(d.f() == 0); // should hold
+		assert(d.f() == 1); // should fail
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 4984: (47-50): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
+// Warning 6328: (167-185): CHC: Assertion violation might happen here.
+// Warning 6328: (215-233): CHC: Assertion violation might happen here.
+// Warning 6328: (267-285): CHC: Assertion violation might happen here.
+// Warning 6328: (304-322): CHC: Assertion violation might happen here.
+// Warning 2661: (47-50): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 4661: (167-185): BMC: Assertion violation happens here.
+// Warning 4661: (215-233): BMC: Assertion violation happens here.
+// Warning 4661: (267-285): BMC: Assertion violation happens here.
+// Warning 4661: (304-322): BMC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_keep_storage_constraints.sol

@@ -0,0 +1,17 @@
+contract D {
+	uint x;
+}
+
+contract C {
+	uint y;
+	function g() public {
+		D d = new D();
+		assert(y == 0); // should hold
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Warning 2072: (72-75): Unused local variable.
+// Info 1180: Contract invariant(s) for :C:\n(y <= 0)\n

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_state_flow.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint x;
+	function inc() public { ++x; }
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	D d;
+	constructor() {
+		d = new D();
+		assert(d.f() == 0); // should hold
+	}
+	function g() public view {
+		assert(d.f() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 4984: (47-50): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
+// Warning 6328: (233-251): CHC: Assertion violation happens here.
+// Warning 2661: (47-50): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_state_flow_2.sol

@@ -0,0 +1,20 @@
+contract D {
+	uint x;
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	D d;
+	constructor() {
+		d = new D();
+		assert(d.f() == 0); // should hold
+	}
+	function g() public view {
+		assert(d.f() == 0); // should hold
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Info 1180: Contract invariant(s) for :C:\n((:var 1).storage.storage_D_12[d].x_3_D_12 <= 0)\nReentrancy property(ies) for :D:\n((x' <= 0) || !(x <= 0))\n

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_state_flow_3.sol

@@ -0,0 +1,21 @@
+contract D {
+	uint x;
+	function s(uint _x) public { x = _x; }
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	D d;
+	constructor() {
+		d = new D();
+	}
+	function g() public view {
+		assert(d.f() == 0); // should fail
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (204-222): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/deployment/deploy_trusted_state_flow_4.sol

@@ -0,0 +1,20 @@
+contract D {
+	bool b;
+	function s() public { b = true; }
+	function f() public view returns (bool) { return b; }
+}
+
+contract C {
+	D d;
+	constructor() {
+		d = new D();
+	}
+	function g() public view {
+		assert(d.f()); // should fail
+	}
+}
+// ====
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (199-212): CHC: Assertion violation happens here.\nCounterexample:\nd = (- 1)\n\nTransaction trace:\nC.constructor()\nState: d = (- 1)\nC.g()\n    D.f() -- trusted external call

test/libsolidity/smtCheckerTests/deployment/deploy_untrusted.sol

@@ -0,0 +1,17 @@
+contract D {
+	uint x;
+	function f() public view returns (uint) { return x; }
+}
+
+contract C {
+	function g() public {
+		D d = new D();
+		uint y = d.f();
+		assert(y == 0); // should fail in ext calls untrusted mode
+	}
+}
+// ====
+// SMTEngine: all
+// ----
+// Warning 8729: (124-131): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 6328: (153-167): CHC: Assertion violation happens here.\nCounterexample:\n\nd = 0\ny = 1\n\nTransaction trace:\nC.constructor()\nC.g()\n    d.f() -- untrusted external call

test/libsolidity/smtCheckerTests/deployment/deploy_untrusted_addresses.sol

@@ -0,0 +1,22 @@
+contract D {
+	uint x;
+}
+
+contract C {
+	function f() public {
+		D d1 = new D();
+		D d2 = new D();
+
+		assert(d1 != d2); // should fail in ext calls untrusted mode
+		assert(address(this) != address(d1)); // should fail in ext calls untrusted mode
+		assert(address(this) != address(d2)); // should fail in ext calls untrusted mode
+	}
+}
+// ====
+// SMTEngine: all
+// ----
+// Warning 8729: (70-77): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 8729: (88-95): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 6328: (100-116): CHC: Assertion violation happens here.\nCounterexample:\n\nd1 = 0\nd2 = 0\n\nTransaction trace:\nC.constructor()\nC.f()
+// Warning 6328: (163-199): CHC: Assertion violation happens here.\nCounterexample:\n\nd1 = 21238\nd2 = 21238\n\nTransaction trace:\nC.constructor()\nC.f()
+// Warning 6328: (246-282): CHC: Assertion violation happens here.\nCounterexample:\n\nd1 = 21238\nd2 = 21238\n\nTransaction trace:\nC.constructor()\nC.f()

test/libsolidity/smtCheckerTests/deployment/deploy_untrusted_erase_storage_constraints.sol

@@ -0,0 +1,17 @@
+contract D {
+	uint x;
+}
+
+contract C {
+	uint y;
+	function g() public {
+		D d = new D();
+		assert(y == 0); // should fail in ext calls untrusted mode
+	}
+}
+// ====
+// SMTEngine: all
+// ----
+// Warning 2072: (72-75): Unused local variable.
+// Warning 8729: (78-85): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 6328: (89-103): CHC: Assertion violation happens here.\nCounterexample:\ny = 1\nd = 0\n\nTransaction trace:\nC.constructor()\nState: y = 0\nC.g()

test/libsolidity/smtCheckerTests/deployment/deployment_trusted_with_value_1.sol

@@ -0,0 +1,20 @@
+contract A {
+	constructor() payable {}
+}
+
+contract B {
+	function f() public payable {
+		require(address(this).balance == 100);
+		A a = new A{value: 50}();
+		assert(address(this).balance == 50); // should hold
+		assert(address(this).balance == 60); // should fail
+		assert(address(a).balance >= 50); // should hold
+		assert(address(a).balance == 50); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (211-246): CHC: Assertion violation happens here.
+// Warning 6328: (316-348): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_abstract_constructor_trusted_1.sol

@@ -0,0 +1,28 @@
+contract D {
+	constructor(uint _x) { x = _x; }
+	uint public x;
+}
+
+contract E {
+	constructor() { x = 2; }
+	uint public x;
+}
+
+contract C {
+	constructor() {
+		address d = address(new D(42));
+		assert(D(d).x() == 42); // should hold
+		assert(D(d).x() == 43); // should fail
+		uint y = E(d).x();
+		assert(y == 2); // should fail, it would still call D.x() == 42
+		assert(y == 42); // should hold, but fails due to false positive
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (231-253): CHC: Assertion violation happens here.
+// Warning 6328: (293-307): CHC: Assertion violation happens here.
+// Warning 6328: (359-374): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_abstract_constructor_trusted_2.sol

@@ -0,0 +1,25 @@
+contract D {
+	constructor(uint _x) { x = _x; }
+	function setD(uint _x) public { x = _x; }
+	uint public x;
+}
+
+contract C {
+	constructor() {
+		address d = address(new D(42));
+		assert(D(d).x() == 42); // should hold
+		assert(D(d).x() == 21); // should fail
+		d.call(abi.encodeCall(D.setD, (21)));
+		assert(D(d).x() == 21); // should hold, but false positive cus low level calls are not handled precisely
+		assert(D(d).x() == 42); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreCex: yes
+// ----
+// Warning 9302: (257-293): Return value of low-level calls not used.
+// Warning 6328: (216-238): CHC: Assertion violation happens here.
+// Warning 6328: (297-319): CHC: Assertion violation happens here.
+// Warning 6328: (404-426): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_abstract_trusted_1.sol

@@ -0,0 +1,28 @@
+contract D {
+	constructor(uint _x) { x = _x; }
+	uint public x;
+}
+
+contract E {
+	constructor() { x = 2; }
+	uint public x;
+}
+
+contract C {
+	function f() public {
+		address d = address(new D(42));
+		assert(D(d).x() == 42); // should hold
+		assert(D(d).x() == 43); // should fail
+		uint y = E(d).x();
+		assert(y == 2); // should fail, it would still call D.x() == 42
+		assert(y == 42); // should hold, but fails due to false positive
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (237-259): CHC: Assertion violation happens here.
+// Warning 6328: (299-313): CHC: Assertion violation happens here.
+// Warning 6328: (365-380): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_abstract_trusted_2.sol

@@ -0,0 +1,25 @@
+contract D {
+	constructor(uint _x) { x = _x; }
+	function setD(uint _x) public { x = _x; }
+	uint public x;
+}
+
+contract C {
+	function f() public {
+		address d = address(new D(42));
+		assert(D(d).x() == 42); // should hold
+		assert(D(d).x() == 21); // should fail
+		d.call(abi.encodeCall(D.setD, (21)));
+		assert(D(d).x() == 21); // should hold, but false positive cus low level calls are not handled precisely
+		assert(D(d).x() == 42); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreCex: yes
+// ----
+// Warning 9302: (263-299): Return value of low-level calls not used.
+// Warning 6328: (222-244): CHC: Assertion violation happens here.
+// Warning 6328: (303-325): CHC: Assertion violation happens here.
+// Warning 6328: (410-432): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_abstract_trusted_3.sol

@@ -0,0 +1,29 @@
+contract D {
+	constructor(uint _x) { x = _x; }
+	function setD(uint _x) public { x = _x; }
+	uint public x;
+}
+
+contract C {
+	uint x;
+
+	function f() public {
+		x = 666;
+		address d = address(new D(42));
+		assert(D(d).x() == 42); // should hold
+		assert(D(d).x() == 21); // should fail
+		d.call(abi.encodeCall(D.setD, (21)));
+		assert(D(d).x() == 21); // should hold, but false positive cus low level calls are not handled precisely
+		assert(D(d).x() == 42); // should fail
+		assert(x == 666); // should hold, C's storage should not have been havoced
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreCex: yes
+// ----
+// Warning 9302: (284-320): Return value of low-level calls not used.
+// Warning 6328: (243-265): CHC: Assertion violation happens here.
+// Warning 6328: (324-346): CHC: Assertion violation happens here.
+// Warning 6328: (431-453): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/call_reentrancy_view.sol

@@ -15,4 +15,4 @@ contract C {
 // Warning 2519: (106-112): This declaration shadows an existing declaration.
 // Warning 2072: (106-112): Unused local variable.
 // Warning 2072: (114-131): Unused local variable.
-// Info 1180: Contract invariant(s) for :C:\n(x <= 0)\nReentrancy property(ies) for :C:\n((!(x <= 0) || (x' <= 0)) && (!(x <= 0) || (<errorCode> <= 0)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(x == 0)\n
+// Info 1180: Contract invariant(s) for :C:\n(x <= 0)\nReentrancy property(ies) for :C:\n((!(x <= 0) || (x' <= 0)) && ((<errorCode> <= 0) || !(x <= 0)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(x == 0)\n

test/libsolidity/smtCheckerTests/external_calls/external_call_from_constructor_1_trusted.sol

@@ -0,0 +1,21 @@
+contract State {
+	function f(uint _x) public pure returns (uint) {
+		assert(_x < 100); // should fail
+		return _x;
+	}
+}
+contract C {
+	State s;
+	uint z = s.f(2);
+
+	function f() public view {
+		assert(z == 2); // should hold in trusted mode
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: all
+// SMTExtCalls: trusted
+// SMTIgnoreInv: yes
+// ----
+// Warning 6328: (69-85): CHC: Assertion violation happens here.\nCounterexample:\n\n_x = 100\n = 0\n\nTransaction trace:\nState.constructor()\nState.f(100)

test/libsolidity/smtCheckerTests/external_calls/external_call_from_constructor_2_trusted.sol

@@ -0,0 +1,17 @@
+contract C {
+	uint z = this.g(2);
+
+	function g(uint _x) public pure returns (uint) {
+		assert(_x > 0); // should fail
+		return _x;
+	}
+
+	function f() public view {
+		assert(z == 2); // should hold
+	}
+}
+// ====
+// SMTEngine: all
+// ----
+// Warning 6328: (87-101): CHC: Assertion violation happens here.\nCounterexample:\nz = 2\n_x = 0\n = 0\n\nTransaction trace:\nC.constructor()\nState: z = 2\nC.g(0)
+// Info 1180: Contract invariant(s) for :C:\n(!(z >= 3) && !(z <= 1))\n

test/libsolidity/smtCheckerTests/external_calls/external_call_from_constructor_3_trusted.sol

@@ -0,0 +1,25 @@
+contract State {
+	function f(uint _x) public pure returns (uint) {
+		assert(_x < 100); // should fail
+		return _x;
+	}
+}
+contract C {
+	State s;
+	uint z;
+
+	constructor() {
+		z = s.f(2);
+	}
+
+	function f() public view {
+		assert(z == 2); // should hold in trusted mode
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (69-85): CHC: Assertion violation happens here.\nCounterexample:\n\n_x = 100\n = 0\n\nTransaction trace:\nState.constructor()\nState.f(100)
+// Info 1180: Contract invariant(s) for :C:\n(!(z >= 3) && !(z <= 1))\n

test/libsolidity/smtCheckerTests/external_calls/external_call_indirect_1.sol

@@ -0,0 +1,41 @@
+contract A {
+	uint x;
+	function setX(uint _x) public {
+		x = _x;
+	}
+	function getX() public view returns (uint) {
+		return x;
+	}
+}
+
+contract B {
+	A a;
+	constructor() {
+		a = new A();
+		assert(a.getX() == 0); // should hold
+	}
+	function g() public view {
+		assert(a.getX() == 0); // should fail because A.setX() can be called without B
+	}
+	function getX() public view returns (uint) {
+		return a.getX();
+	}
+}
+
+contract C {
+	B b;
+	constructor() {
+		b = new B();
+		assert(b.getX() == 0); // should hold
+	}
+	function f() public view {
+		assert(b.getX() == 0); // should fail because A.setX() can be called without A
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 6328: (256-277): CHC: Assertion violation happens here.
+// Warning 6328: (533-554): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_call_indirect_2.sol

@@ -0,0 +1,52 @@
+contract A {
+    uint x;
+    address immutable owner;
+    constructor() {
+        owner = msg.sender;
+    }
+    function setX(uint _x) public {
+        require(msg.sender == owner);
+        x = _x;
+    }
+    function getX() public view returns (uint) {
+        return x;
+    }
+}
+
+contract B {
+    A a;
+    constructor() {
+        a = new A();
+        assert(a.getX() == 0); // should hold
+    }
+    function g() public view {
+        assert(a.getX() == 0); // should hold, but fails because
+        // the nondet_interface constraint added for `A a` in between
+        // txs of `B` does not have the constraint that `msg.sender != address(this)`
+        // so `A.setX` is allowed with `msg.sender = address(this)` inside
+        // the current rules defining nondet_interface.
+        // If we want to support that, we likely need a new type of nondet_interface
+        // `nondet_interface_with_tx` that contains tx data as well as restricts
+        // every further `nondet_interface_with_tx` to not have that `msg.sender`.
+    }
+    function getX() public view returns (uint) {
+        return a.getX();
+    }
+}
+
+contract C {
+    B b;
+    constructor() {
+        b = new B();
+        assert(b.getX() == 0); // should hold
+    }
+    function f() public view {
+        assert(b.getX() == 0); // should hold
+    }
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (434-455): CHC: Assertion violation happens here.
+// Warning 6328: (1270-1291): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_call_indirect_3.sol

@@ -0,0 +1,45 @@
+contract A {
+	uint x;
+	address immutable owner;
+	constructor() {
+		owner = msg.sender;
+	}
+	function setX(uint _x) public {
+		require(msg.sender == owner);
+		x = _x;
+	}
+	function getX() public view returns (uint) {
+		return x;
+	}
+}
+
+contract B {
+	A a;
+	constructor() {
+		a = new A();
+		assert(a.getX() == 0); // should hold
+	}
+	function g() public {
+		a.setX(42);
+	}
+	function getX() public view returns (uint) {
+		return a.getX();
+	}
+}
+
+contract C {
+	B b;
+	constructor() {
+		b = new B();
+		assert(b.getX() == 0); // should hold
+	}
+	function f() public view {
+		assert(b.getX() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 6328: (561-582): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_call_indirect_4.sol

@@ -0,0 +1,48 @@
+contract A {
+	uint x;
+	address immutable owner;
+	constructor() {
+		owner = msg.sender;
+	}
+	function setX(uint _x) public {
+		require(msg.sender == owner);
+		x = _x;
+	}
+	function getX() public view returns (uint) {
+		return x;
+	}
+}
+
+contract B {
+	A a;
+	address immutable owner;
+	constructor() {
+		owner = msg.sender;
+		a = new A();
+		assert(a.getX() == 0); // should hold
+	}
+	function g() public {
+		require(msg.sender == owner);
+		a.setX(42);
+	}
+	function getX() public view returns (uint) {
+		return a.getX();
+	}
+}
+
+contract C {
+	B b;
+	constructor() {
+		b = new B();
+		assert(b.getX() == 0); // should hold
+	}
+	function f() public view {
+		assert(b.getX() == 0); // should hold
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 6328: (641-662): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_call_indirect_5.sol

@@ -0,0 +1,50 @@
+contract A {
+	uint x;
+	address immutable owner;
+	constructor() {
+		owner = msg.sender;
+	}
+	function setX(uint _x) public {
+		require(msg.sender == owner);
+		x = _x;
+	}
+	function getX() public view returns (uint) {
+		return x;
+	}
+}
+
+contract B {
+	A a;
+	address immutable owner;
+	constructor() {
+		owner = msg.sender;
+		a = new A();
+	}
+	function g() public {
+		require(msg.sender == owner);
+		a.setX(42);
+	}
+	function getX() public view returns (uint) {
+		return a.getX();
+	}
+}
+
+contract C {
+	B b;
+	constructor() {
+		b = new B();
+		assert(b.getX() == 0); // should hold
+	}
+	function f() public view {
+		assert(b.getX() == 0); // should fail
+	}
+	function h() public {
+		b.g();
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (601-622): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_call_semantic_this_1.sol

@@ -0,0 +1,17 @@
+contract C {
+	uint x;
+	function i() public { ++x; }
+	function f() public {
+		x = 0;
+		this.i();
+		assert(x == 1); // should hold in trusted mode
+		assert(x != 1); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (147-161): CHC: Assertion violation happens here.\nCounterexample:\nx = 1\n\nTransaction trace:\nC.constructor()\nState: x = 0\nC.f()\n    C.i() -- trusted external call

test/libsolidity/smtCheckerTests/external_calls/external_call_semantic_this_2.sol

@@ -0,0 +1,16 @@
+contract C {
+	uint x;
+	function i() public { ++x; }
+	function f() public {
+		x = 0;
+		((this)).i();
+		assert(x == 1); // should hold in trusted mode
+		assert(x != 1); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (151-165): CHC: Assertion violation happens here.\nCounterexample:\nx = 1\n\nTransaction trace:\nC.constructor()\nState: x = 0\nC.f()\n    C.i() -- trusted external call

test/libsolidity/smtCheckerTests/external_calls/external_call_semantic_this_3.sol

@@ -0,0 +1,17 @@
+contract C {
+	uint x;
+	function i() public { ++x; }
+	function f() public {
+		x = 0;
+		C c = this;
+		c.i();
+		assert(x == 1); // should hold in trusted mode
+		assert(x != 1); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (158-172): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_array_struct_trusted_1.sol

@@ -0,0 +1,23 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	S[] ss;
+	constructor() {
+		ss.push(S(address(new D())));
+		assert(D(ss[0].d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(ss[0].d).x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (210-237): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_array_struct_trusted_2.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	S[] ss;
+	constructor() {
+		ss.push(S(address(new D())));
+		assert(D(ss[0].d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(ss[0].d).x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (253-280): CHC: Assertion violation happens here.\nCounterexample:\nss = [{d: 0x4706}]\n\nTransaction trace:\nC.constructor()\nState: ss = [{d: 0x4706}]\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_array_trusted_1.sol

@@ -0,0 +1,21 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	address[] ds;
+	constructor() {
+		ds.push(address(new D()));
+		assert(D(ds[0]).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(ds[0]).x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (226-251): CHC: Assertion violation happens here.\nCounterexample:\nds = [0x0]\n\nTransaction trace:\nC.constructor()\nState: ds = [0x0]\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_array_trusted_2.sol

@@ -0,0 +1,20 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	address[] ds;
+	constructor() {
+		ds.push(address(new D()));
+		assert(D(ds[0]).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(ds[0]).x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (183-208): CHC: Assertion violation happens here.\nCounterexample:\nds = [0x25]\n\nTransaction trace:\nC.constructor()\nState: ds = [0x25]\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_struct_trusted_1.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	S s;
+	constructor() {
+		s.d = address(new D());
+		assert(D(s.d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(s.d).x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (240-263): CHC: Assertion violation happens here.\nCounterexample:\ns = {d: 0x5039}\n\nTransaction trace:\nC.constructor()\nState: s = {d: 0x5039}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_struct_trusted_2.sol

@@ -0,0 +1,23 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	S s;
+	constructor() {
+		s.d = address(new D());
+		assert(D(s.d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(s.d).x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (197-220): CHC: Assertion violation happens here.\nCounterexample:\ns = {d: 0x5039}\n\nTransaction trace:\nC.constructor()\nState: s = {d: 0x5039}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_struct_trusted_3.sol

@@ -0,0 +1,26 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	struct T {
+		S s;
+	}
+	T t;
+	constructor() {
+		t.s.d = address(new D());
+		assert(D(t.s.d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(t.s.d).x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (223-248): CHC: Assertion violation happens here.\nCounterexample:\nt = {s: {d: 0x5039}}\n\nTransaction trace:\nC.constructor()\nState: t = {s: {d: 0x5039}}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_address_inside_struct_trusted_4.sol

@@ -0,0 +1,27 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		address d;
+	}
+	struct T {
+		S s;
+	}
+	T t;
+	constructor() {
+		t.s.d = address(new D());
+		assert(D(t.s.d).x() == 0); // should hold
+	}
+	function f() public view {
+		assert(D(t.s.d).x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (266-291): CHC: Assertion violation happens here.\nCounterexample:\nt = {s: {d: 0x5039}}\n\nTransaction trace:\nC.constructor()\nState: t = {s: {d: 0x5039}}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_array_struct_trusted_1.sol

@@ -0,0 +1,23 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	S[] ss;
+	constructor() {
+		ss.push(S(new D()));
+		assert(ss[0].d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(ss[0].d.x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (192-216): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_array_struct_trusted_2.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	S[] ss;
+	constructor() {
+		ss.push(S(new D()));
+		assert(ss[0].d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(ss[0].d.x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (235-259): CHC: Assertion violation happens here.\nCounterexample:\nss = [{d: 20819}]\n\nTransaction trace:\nC.constructor()\nState: ss = [{d: 20819}]\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_array_trusted_1.sol

@@ -0,0 +1,21 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	D[] ds;
+	constructor() {
+		ds.push(new D());
+		assert(ds[0].x() == 0); // should hold
+	}
+	function f() public view {
+		assert(ds[0].x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (208-230): CHC: Assertion violation happens here.\nCounterexample:\nds = [39]\n\nTransaction trace:\nC.constructor()\nState: ds = [39]\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_array_trusted_2.sol

@@ -0,0 +1,21 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	D[] ds;
+	constructor() {
+		ds.push(new D());
+		assert(ds[0].x() == 0); // should hold
+	}
+	function f() public view {
+		assert(ds[0].x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (165-187): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_struct_trusted_1.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	S s;
+	constructor() {
+		s.d = new D();
+		assert(s.d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(s.d.x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (222-242): CHC: Assertion violation happens here.\nCounterexample:\ns = {d: 20819}\n\nTransaction trace:\nC.constructor()\nState: s = {d: 20819}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_struct_trusted_2.sol

@@ -0,0 +1,24 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	S s;
+	constructor() {
+		s.d = new D();
+		assert(s.d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(s.d.x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (179-199): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_struct_trusted_3.sol

@@ -0,0 +1,27 @@
+contract D {
+	uint public x;
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	struct T {
+		S s;
+	}
+	T t;
+	constructor() {
+		t.s.d = new D();
+		assert(t.s.d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(t.s.d.x() == 0); // should hold, but fails because we havoc the state
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (205-227): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_call_state_var_contract_inside_struct_trusted_4.sol

@@ -0,0 +1,27 @@
+contract D {
+	uint public x;
+	function setD(uint _x) public { x = _x; }
+}
+
+contract C {
+	struct S {
+		D d;
+	}
+	struct T {
+		S s;
+	}
+	T t;
+	constructor() {
+		t.s.d = new D();
+		assert(t.s.d.x() == 0); // should hold
+	}
+	function f() public view {
+		assert(t.s.d.x() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (248-270): CHC: Assertion violation happens here.\nCounterexample:\nt = {s: {d: 20819}}\n\nTransaction trace:\nC.constructor()\nState: t = {s: {d: 20819}}\nC.f()

test/libsolidity/smtCheckerTests/external_calls/external_call_this_with_value_1.sol

@@ -11,4 +11,4 @@ contract C {
 // ====
 // SMTEngine: all
 // ----
-// Warning 6328: (157-192): CHC: Assertion violation happens here.
+// Warning 6328: (157-192): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.g()\n    C.h() -- trusted external call

test/libsolidity/smtCheckerTests/external_calls/external_call_this_with_value_2.sol

@@ -1,7 +1,11 @@
 contract C {
 	function g(uint i) public {
 		require(address(this).balance == 100);
+		// if called address is same as this, don't do anything with the value stuff
+		// or fix the receiving end
 		this.h{value: i}();
+		uint x = address(this).balance;
+		assert(x == 100); // should hold
 		assert(address(this).balance == 100); // should hold
 		assert(address(this).balance == 90); // should fail
 	}
@@ -12,4 +16,4 @@ contract C {
 // SMTEngine: all
 // SMTIgnoreCex: yes
 // ----
-// Warning 6328: (162-197): CHC: Assertion violation happens here.
+// Warning 6328: (340-375): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_pure_trusted.sol

@@ -0,0 +1,33 @@
+contract Crypto {
+	function hash(bytes32) external pure returns (bytes32) {
+		return bytes32(0);
+	}
+}
+
+contract C {
+	address owner;
+	bytes32 sig_1;
+	bytes32 sig_2;
+	Crypto d;
+
+	constructor() {
+		owner = msg.sender;
+	}
+
+	function f1(bytes32 _msg) public {
+		address prevOwner = owner;
+		sig_1 = d.hash(_msg);
+		sig_2 = d.hash(_msg);
+		assert(prevOwner == owner);
+	}
+
+	function inv() public view {
+		assert(sig_1 == sig_2);
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: all
+// SMTExtCalls: trusted
+// ----
+// Info 1180: Contract invariant(s) for :C:\n((sig_1 <= 0) && (sig_2 <= 0))\nReentrancy property(ies) for :Crypto:\n(<errorCode> = 0)\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(prevOwner == owner)\n<errorCode> = 3 -> Assertion failed at assert(sig_1 == sig_2)\n

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_reentrancy_2_trusted.sol

@@ -0,0 +1,47 @@
+contract State {
+	C c;
+	constructor(C _c) {
+		c = _c;
+	}
+	function f() public view returns (uint) {
+		return c.g();
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	uint z;
+	State s;
+	bool insidef;
+
+	constructor() {
+		owner = msg.sender;
+		s = new State(this);
+	}
+
+	function zz() public {
+		require(insidef);
+		z = 3;
+	}
+
+	function f() public {
+		require(!insidef);
+		address prevOwner = owner;
+		insidef = true;
+		s.f();
+		assert(z == y);
+		assert(prevOwner == owner);
+		insidef = false;
+	}
+
+	function g() public view returns (uint) {
+		return y;
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Info 1180: Contract invariant(s) for :C:\n((y <= 0) && (insidef || (z <= 0)))\nReentrancy property(ies) for :State:\n(<errorCode> = 0)\n<errorCode> = 0 -> no errors\n<errorCode> = 2 -> Assertion failed at assert(z == y)\n<errorCode> = 3 -> Assertion failed at assert(prevOwner == owner)\n

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_reentrancy_indirect_trusted.sol

@@ -0,0 +1,56 @@
+contract Other {
+	C c;
+	constructor(C _c) {
+		c = _c;
+	}
+	function h() public {
+		c.setOwner(address(0));
+	}
+}
+
+contract State {
+	uint x;
+	Other o;
+	C c;
+	constructor(C _c) {
+		c = _c;
+		o = new Other(_c);
+	}
+	function f() public returns (uint) {
+		o.h();
+		return c.g();
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	State s;
+
+	constructor() {
+		owner = msg.sender;
+		s = new State(this);
+	}
+
+	function setOwner(address _owner) public {
+		owner = _owner;
+	}
+
+	function f() public {
+		address prevOwner = owner;
+		uint z = s.f();
+		assert(z == y); // should hold
+		assert(prevOwner == owner); // should not hold because of reentrancy
+	}
+
+	function g() public view returns (uint) {
+		return y;
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (531-545): CHC: Assertion violation might happen here.
+// Warning 6328: (564-590): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_reentrancy_trusted.sol

@@ -0,0 +1,38 @@
+contract State {
+	C c;
+	constructor(C _c) {
+		c = _c;
+	}
+	function f() public view returns (uint) {
+		return c.g();
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	State s;
+
+	constructor() {
+		owner = msg.sender;
+		s = new State(this);
+	}
+
+	function f() public view {
+		address prevOwner = owner;
+		uint z = s.f();
+		assert(z == y);
+		assert(prevOwner == owner);
+	}
+
+	function g() public view returns (uint) {
+		return y;
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (314-328): CHC: Assertion violation might happen here.
+// Info 1180: Reentrancy property(ies) for :State:\n(<errorCode> = 0)\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(z == y)\n<errorCode> = 2 -> Assertion failed at assert(prevOwner == owner)\n

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_reentrancy_unsafe_trusted.sol

@@ -0,0 +1,44 @@
+contract State {
+	C c;
+	constructor(C _c) {
+		c = _c;
+	}
+	function f() public returns (uint) {
+		c.setOwner(address(0));
+		return c.g();
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	State s;
+
+	constructor() {
+		owner = msg.sender;
+		s = new State(this);
+	}
+
+	function setOwner(address _owner) public {
+		owner = _owner;
+	}
+
+	function f() public {
+		address prevOwner = owner;
+		uint z = s.f();
+		assert(z == y); // should hold
+		assert(prevOwner == owner); // should not hold because of reentrancy
+	}
+
+	function g() public view returns (uint) {
+		return y;
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTIgnoreOS: macos
+// ----
+// Warning 6328: (396-410): CHC: Assertion violation might happen here.
+// Warning 6328: (429-455): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_trusted.sol

@@ -0,0 +1,36 @@
+contract State {
+	uint x;
+	function f() public returns (uint) {
+		if (x == 0) x = 1;
+		else if (x == 1) x = 2;
+		else if (x == 2) x = 0;
+		return x;
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	uint z;
+	State s;
+
+	constructor() {
+		s = new State();
+		owner = msg.sender;
+	}
+
+	function f() public {
+		address prevOwner = owner;
+		y = s.f();
+		z = s.f();
+		assert(prevOwner == owner);
+		assert(y != z);
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (355-381): CHC: Assertion violation might happen here.
+// Warning 6328: (385-399): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_hash_known_code_state_unsafe_trusted.sol

@@ -0,0 +1,40 @@
+contract State {
+	uint x;
+	function f() public returns (uint) {
+		if (x == 0) x = 1;
+		else if (x == 1) x = 2;
+		else if (x == 2) x = 0;
+		return x;
+	}
+}
+
+contract C {
+	address owner;
+	uint y;
+	uint z;
+	State s;
+
+	constructor() {
+		owner = msg.sender;
+		s = new State();
+	}
+
+	function setOwner(address _owner) public {
+		owner = _owner;
+	}
+
+	function f() public {
+		address prevOwner = owner;
+		y = s.f();
+		z = s.f();
+		assert(prevOwner == owner);
+		assert(y != z);
+	}
+}
+// ====
+// SMTContract: C
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// ----
+// Warning 6328: (421-447): CHC: Assertion violation might happen here.
+// Warning 6328: (451-465): CHC: Assertion violation might happen here.

test/libsolidity/smtCheckerTests/external_calls/external_reentrancy_2.sol

@@ -13,4 +13,4 @@ contract C {
 // ====
 // SMTEngine: all
 // ----
-// Warning 6328: (117-131): CHC: Assertion violation happens here.\nCounterexample:\nlocked = false\ntarget = 0x0\n\nTransaction trace:\nC.constructor()\nState: locked = true\nC.call(0x0)\n    D(target).e() -- untrusted external call, synthesized as:\n        C.call(0x0) -- reentrant call
+// Warning 6328: (117-131): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/external_safe.sol

@@ -18,3 +18,5 @@ contract C {
 // SMTEngine: all
 // SMTIgnoreOS: macos
 // ----
+// Warning 6328: (167-181): CHC: Assertion violation might happen here.
+// Warning 4661: (167-181): BMC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/external_calls/token_trusted_transfer_correct.sol

@@ -0,0 +1,64 @@
+interface Token {
+	function balanceOf(address _a) external view returns (uint);
+	function transfer(address _to, uint _amt) external;
+}
+
+contract TokenCorrect is Token {
+	mapping (address => uint) balance;
+	constructor(address _a, uint _b) {
+		balance[_a] = _b;
+	}
+	function balanceOf(address _a) public view override returns (uint) {
+		return balance[_a];
+	}
+	function transfer(address _to, uint _amt) public override {
+		require(balance[msg.sender] >= _amt);
+		balance[msg.sender] -= _amt;
+		balance[_to] += _amt;
+	}
+}
+
+contract Test {
+	function property_transfer(address _token, address _to, uint _amt) public {
+		require(_to != address(this));
+
+		TokenCorrect t = TokenCorrect(_token);
+
+		uint xPre = t.balanceOf(address(this));
+		require(xPre >= _amt);
+		uint yPre = t.balanceOf(_to);
+
+		t.transfer(_to, _amt);
+		uint xPost = t.balanceOf(address(this));
+		uint yPost = t.balanceOf(_to);
+
+		assert(xPost == xPre - _amt);
+		assert(yPost == yPre + _amt);
+	}
+
+	function test_concrete() public {
+		TokenCorrect t = new TokenCorrect(address(this), 1000);
+
+		uint b = t.balanceOf(address(this));
+		assert(b == 1000);
+
+		address other = address(0x333);
+		require(address(this) != other);
+
+		uint c = t.balanceOf(other);
+		assert(c == 0);
+
+		t.transfer(other, 100);
+
+		uint d = t.balanceOf(address(this));
+		assert(d == 900);
+
+		uint e = t.balanceOf(other);
+		assert(e == 100);
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTContract: Test
+// SMTTargets: assert

test/libsolidity/smtCheckerTests/external_calls/token_trusted_transfer_wrong.sol

@@ -0,0 +1,68 @@
+interface Token {
+	function balanceOf(address _a) external view returns (uint);
+	function transfer(address _to, uint _amt) external;
+}
+
+contract TokenWrong is Token {
+	mapping (address => uint) balance;
+	constructor(address _a, uint _b) {
+		balance[_a] = _b;
+	}
+	function balanceOf(address _a) public view override returns (uint) {
+		return balance[_a];
+	}
+	function transfer(address _to, uint _amt) public override {
+		require(balance[msg.sender] >= _amt);
+		// Commented out to make this token implementation wrong.
+		//balance[msg.sender] -= _amt;
+		balance[_to] += _amt;
+	}
+}
+
+contract Test {
+	function property_transfer(address _token, address _to, uint _amt) public {
+		require(_to != address(this));
+
+		TokenWrong t = TokenWrong(_token);
+
+		uint xPre = t.balanceOf(address(this));
+		require(xPre >= _amt);
+		uint yPre = t.balanceOf(_to);
+
+		t.transfer(_to, _amt);
+		uint xPost = t.balanceOf(address(this));
+		uint yPost = t.balanceOf(_to);
+
+		assert(xPost == xPre - _amt); // should fail
+		assert(yPost == yPre + _amt);
+	}
+
+	function test_concrete() public {
+		TokenWrong t = new TokenWrong(address(this), 1000);
+
+		uint b = t.balanceOf(address(this));
+		assert(b == 1000);
+
+		address other = address(0x333);
+		require(address(this) != other);
+
+		uint c = t.balanceOf(other);
+		assert(c == 0);
+
+		t.transfer(other, 100);
+
+		uint d = t.balanceOf(address(this));
+		assert(d == 900); // should fail
+
+		uint e = t.balanceOf(other);
+		assert(e == 100);
+	}
+}
+// ====
+// SMTContract: Test
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (950-978): CHC: Assertion violation happens here.
+// Warning 6328: (1370-1386): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/file_level/new_operator.sol

@@ -14,5 +14,5 @@ contract D {
 // ====
 // SMTEngine: all
 // ----
-// Warning 4588: (78-85): Assertion checker does not yet implement this type of function call.
+// Warning 8729: (78-85): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
 // Warning 6328: (133-152): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nD.constructor()\nD.f()\n    test() -- internal call\n        (new C()).x() -- untrusted external call

test/libsolidity/smtCheckerTests/functions/functions_external_2.sol

@@ -25,4 +25,4 @@ contract C
 // SMTIgnoreOS: macos
 // ----
 // Warning 6328: (234-253): CHC: Assertion violation happens here.
-// Info 1180: Reentrancy property(ies) for :C:\n!(<errorCode> = 1)\n((!((map[1] + ((- 1) * map[0])) <= 0) || ((map'[1] + ((- 1) * map'[0])) <= 0)) && !(<errorCode> = 2) && (!((map[1] + ((- 1) * map[0])) >= 0) || ((map'[0] + ((- 1) * map'[1])) <= 0)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(map[0] == map[1])\n<errorCode> = 2 -> Assertion failed at assert(map[0] == map[1])\n<errorCode> = 3 -> Assertion failed at assert(map[0] == 0)\n
+// Info 1180: Reentrancy property(ies) for :C:\n!(<errorCode> = 1)\n((!((map[1] + ((- 1) * map[0])) >= 0) || ((map'[0] + ((- 1) * map'[1])) <= 0)) && !(<errorCode> = 2) && (!((map[1] + ((- 1) * map[0])) <= 0) || ((map'[1] + ((- 1) * map'[0])) <= 0)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(map[0] == map[1])\n<errorCode> = 2 -> Assertion failed at assert(map[0] == map[1])\n<errorCode> = 3 -> Assertion failed at assert(map[0] == 0)\n

test/libsolidity/smtCheckerTests/functions/getters/external_getter_1.sol

@@ -0,0 +1,22 @@
+contract D {
+	uint public d;
+	function g() public {
+		++d;
+	}
+}
+
+contract C {
+	function f() public {
+		D a = new D();
+		assert(a.d() == 0); // should hold
+		a.g();
+		assert(a.d() == 1); // should hold
+		assert(a.d() == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (203-221): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/getters/external_getter_2.sol

@@ -0,0 +1,33 @@
+contract E {
+	uint public e;
+	function setE(uint _e) public {
+		e = _e;
+	}
+}
+
+contract D {
+	E e;
+	constructor(E _e) {
+		e = _e;
+	}
+	function setE(uint x) public {
+		e.setE(x);
+	}
+}
+
+contract C {
+	function f() public {
+		E e = new E();
+		D d = new D(e);
+		assert(e.e() == 0); // should hold
+		d.setE(42);
+		assert(e.e() == 42); // should hold
+		assert(e.e() == 2); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// ----
+// Warning 6328: (344-362): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/getters/external_getter_this_1.sol

@@ -0,0 +1,18 @@
+contract C {
+	uint public x;
+
+	function f() public {
+		x = 2;
+		x = 3;
+		uint y = this.x();
+		assert(y == 3); // should hold
+		assert(y == 2); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (127-141): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/getters/external_getter_this_2.sol

@@ -0,0 +1,19 @@
+contract C {
+	uint public x;
+
+	function f() public {
+		x = 2;
+		x = 3;
+		C c = this;
+		uint y = c.x();
+		assert(y == 3); // should hold
+		assert(y == 2); // should fail
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTExtCalls: trusted
+// SMTTargets: assert
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (138-152): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/virtual_function_called_by_constructor.sol

@@ -27,4 +27,4 @@ contract C is A {
 // ----
 // Warning 6328: (199-214): CHC: Assertion violation happens here.\nCounterexample:\nx = 2\n\nTransaction trace:\nA.constructor()\nState: x = 2\nA.i()
 // Warning 6328: (387-401): CHC: Assertion violation happens here.\nCounterexample:\nx = 10\n\nTransaction trace:\nC.constructor()\nState: x = 10\nC.i()
-// Info 1180: Contract invariant(s) for :A:\n(!(x <= 1) && !(x >= 3))\nContract invariant(s) for :C:\n(!(x >= 11) && !(x <= 9))\n
+// Info 1180: Contract invariant(s) for :A:\n(!(x <= 1) && !(x >= 3))\nContract invariant(s) for :C:\n(!(x <= 9) && !(x >= 11))\n

test/libsolidity/smtCheckerTests/imports/ExtCall.sol

@@ -39,4 +39,4 @@ contract ExtCallTest {
 // SMTIgnoreCex: yes
 // ----
 // Warning 6328: (ExtCall.sol:362-381): CHC: Assertion violation happens here.
-// Warning 4588: (ExtCall.t.sol:110-123): Assertion checker does not yet implement this type of function call.
+// Warning 8729: (ExtCall.t.sol:110-123): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.

test/libsolidity/smtCheckerTests/imports/import_as_module_2.sol

@@ -17,6 +17,7 @@ function f(uint _x) pure {
 }
 // ====
 // SMTEngine: all
+// SMTIgnoreOS: macos
 // ----
 // Warning 6328: (A:50-64): CHC: Assertion violation happens here.\nCounterexample:\n\n_y = 0\n\nTransaction trace:\nD.constructor()\nD.g(0)\n    s1.sol:f(200) -- internal call\n    s1.sol:f(0) -- internal call\n    A:f(10) -- internal call\n    A:f(0) -- internal call
 // Warning 6328: (s1.sol:28-44): CHC: Assertion violation happens here.\nCounterexample:\n\n_y = 0\n\nTransaction trace:\nD.constructor()\nD.g(0)\n    s1.sol:f(200) -- internal call\n    s1.sol:f(0) -- internal call

test/libsolidity/smtCheckerTests/operators/compound_mul_mapping.sol

@@ -11,5 +11,6 @@ contract C
 }
 // ====
 // SMTEngine: all
+// SMTIgnoreCex: yes
 // ----
-// Warning 6328: (164-183): CHC: Assertion violation happens here.\nCounterexample:\n\nx = 0\np = 0\n\nTransaction trace:\nC.constructor()\nC.f(0, 0)
+// Warning 6328: (164-183): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/operators/conditional_assignment_6.sol

@@ -25,4 +25,4 @@ contract C {
 // SMTIgnoreOS: macos
 // ----
 // Warning 2072: (255-261): Unused local variable.
-// Info 1180: Reentrancy property(ies) for :C:\n((!(x' >= 3) || (a' = a)) && (<errorCode> <= 0) && (!(x' <= 0) || !(x >= 2)) && (!(x <= 2) || !(x' >= 3)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(x == 2 || x == 1)\n
+// Info 1180: Reentrancy property(ies) for :C:\n((!(x <= 2) || !(x' >= 3)) && (<errorCode> <= 0) && (!(x' <= 0) || !(x >= 2)))\n<errorCode> = 0 -> no errors\n<errorCode> = 1 -> Assertion failed at assert(x == 2 || x == 1)\n

test/libsolidity/smtCheckerTests/special/tx_vars_reentrancy_1.sol

@@ -11,6 +11,7 @@ contract C {
 }
 // ====
 // SMTEngine: all
+// SMTIgnoreCex: yes
 // SMTIgnoreOS: macos
 // ----
 // Warning 6328: (135-169): CHC: Assertion violation happens here.\nCounterexample:\n\n_i = 0\nx = 5892\n\nTransaction trace:\nC.constructor()\nC.g(0){ msg.value: 11 }\n    _i.f() -- untrusted external call, synthesized as:\n        C.g(0){ msg.value: 32278 } -- reentrant call\n            _i.f() -- untrusted external call

test/libsolidity/smtCheckerTests/try_catch/try_new.sol

@@ -28,5 +28,5 @@ contract C {
 // ====
 // SMTEngine: all
 // ----
-// Warning 4588: (231-245): Assertion checker does not yet implement this type of function call.
-// Warning 4588: (492-507): Assertion checker does not yet implement this type of function call.
+// Warning 8729: (231-245): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.
+// Warning 8729: (492-507): Contract deployment is only supported in the trusted mode for external calls with the CHC engine.

test/libsolidity/smtCheckerTests/typecast/bytes_to_fixed_bytes_1.sol

@@ -11,4 +11,7 @@ contract C {
 		assert(g == 0x0001020304050607080900010203040506070809000102030405060708090001); // should hold
 	}
 }
+// ====
+// SMTEngine: all
+// SMTIgnoreCex: yes
 // ----

test/libsolidity/smtCheckerTests/typecast/string_to_bytes_push_1.sol

@@ -11,4 +11,4 @@ contract C {
 // ====
 // SMTEngine: all
 // ----
-// Warning 6328: (132-160): CHC: Assertion violation happens here.\nCounterexample:\nx = [0x61, 0x62, 0x63, 0x61]\n\nTransaction trace:\nC.constructor()\nState: x = []\nC.s()
+// Warning 6328: (132-160): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: x = []\nC.s()

test/libsolidity/smtCheckerTests/types/bool_simple_2.sol

@@ -5,5 +5,6 @@ contract C {
 }
 // ====
 // SMTEngine: all
+// SMTIgnoreCex: yes
 // ----
 // Warning 6328: (66-80): CHC: Assertion violation happens here.\nCounterexample:\n\nx = true\ny = false\n\nTransaction trace:\nC.constructor()\nC.f(true, false)

test/libsolidity/smtCheckerTests/userTypes/user_type_as_struct_member_1.sol

@@ -23,4 +23,3 @@ contract C {
         );
     }
 }
-// ----