Skip to content

RFC: allow to concretize dynamic arrays in calldata up to N values#1057

Open
gustavo-grieco wants to merge 3 commits intomainfrom
poc-dynamic-array-calldata-concretization
Open

RFC: allow to concretize dynamic arrays in calldata up to N values#1057
gustavo-grieco wants to merge 3 commits intomainfrom
poc-dynamic-array-calldata-concretization

Conversation

@gustavo-grieco
Copy link
Copy Markdown
Collaborator

Description

This is an attempt to introduce size concretization for dynamic arrays to fix #847 with a similar approach to halmos. Some limitations: (1) it will only work with calldata parameters and (2) it will not work with recursive/complex dynamic types.

Checklist

  • tested locally
  • added automated tests
  • updated the docs
  • updated the changelog

@msooseth
Copy link
Copy Markdown
Collaborator

msooseth commented Apr 2, 2026

Nice! Let's add 2-3 test cases where the calldata would need to be longer than 100 to be able to find the CEX. In these cases, the system should give the user an Expr End Partial, so the user knows that we couldn't explore everything. In other words, I want to assert via test cases, that the system doesn't give false sense of security just because the fault is beyond len 100 of the calldata.

Comment thread test/test.hs
} |]
let sig = Just $ Sig "fun(bytes)" [AbiBytesDynamicType]
(e, ret) <- withDefaultSolver $ \s -> checkAssert s defaultPanicCodes c sig [] defaultVeriOpts
assertBoolM "must report partial due to bounded bytes" $ any isPartial e
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❤️

@msooseth
Copy link
Copy Markdown
Collaborator

msooseth commented Apr 2, 2026

Looking a LOT better, thanks!!!

@msooseth
Copy link
Copy Markdown
Collaborator

I think this is okay-ish? @blishko do you wanna have a look?

The only thing I don't like is the "insert a Partial in the result to warn" because it feels like that should be kinda automatic the way the system works. But it's possible that I am wrong, so I approve.

@blishko
Copy link
Copy Markdown
Collaborator

blishko commented Apr 20, 2026

@msooseth, you are bringing up a very good point. I don't understand why should the analysis be inserting this extra Partial result. Seems weird.

@gustavo-grieco
Copy link
Copy Markdown
Collaborator Author

Maybe we need a different kind of partial type?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement concretization of dynamic data structures (e.g. dynamic arrays)

3 participants