-
Notifications
You must be signed in to change notification settings - Fork 101
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FV add warnings to symbolic eval #1175
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the test coverage to ensure that none of this interferes with how the code worked before?
These modifications still passes the test-suite. Additionally, I added:
|
Would you mind adding some examples into the PR description?
Other than wanting to see these, the PR looks good to me. I couple nits and a couple suggestions. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The following REPL session looks good to me:
pact> (module m g (defcap g () true) (defun test: string (x: integer)
....> @model [(property (not (= result "")))]
....> (hash x)))
"Loaded module m, hash S3g2Lou829zTfcRLArFv_dhnPj9xhFlI4e7Ij1J_oP0"
pact> (verify 'm)
"Verification of m succeeded"
:OutputWarning: Shimmed native 'hash' (of type 'integer', substitute 'A_fIcwIweiXXYXnKU59CNCAUoIXHXwQtB_D8xhEflLY'))
This PR aims to enable warning emission during model building (and later shimming), which was previously only possible through translation to the FV AST.
One benefit of this is the ability to remove the static knowledge requirement for the parameter in hash, which has limited the use of the FV system in real-world contract verification, as pointed out by @EnoF
Specifically, the use of
hash
requires statically known content. Prior to this PR, we failed verification for dynamic content (i.e. table reads). Now we check, if the data is statically known, we compute the hash, otherwise we pick (depending on the type) shimmed values and emit a warning that we did so.This is not optimal, but usually you are not interested in verifying a specific hash value.