argotorg / argotorg/solidity

[SMTChecker] Buggy invariants

Open
#13,937 2 comments 0 reactions 0 assignees View on GitHub
bug :bug: high effort smt
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

```solidity
contract S {
uint x;

function setZero() external {
if (x == 1)
x = 0;
}

function setOne() external {
if (x == 0)
x = 1;
}

function inv() external view {
assert(x < 2);
}
}
```

```bash
solc s.sol --model-checker-engine chc --model-checker-invariants contract`
```

The command above gives the invariant below which is clearly wrong.

```bash
Info: Contract invariant(s) for s.sol:S:
(true || true || !(x >= 2) || true)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with solc s.sol --model-checker-engine chc --model-checker-invariants contract using the Solidity contract shown. Start by tracing SMTChecker's contract-invariant generation and compare the reported invariant with the assert in inv(). Done means the generated invariant no longer contains the incorrect tautological clauses and reflects the contract's actual invariant.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.