dapphub / k-dss

formal verification of multicollateral dai in the K framework

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Deal with implicitly distinct storage keys

livnev opened this issue · comments

K's Maps have an implicit assumption that separate keys have distinct values, e.g. that if you write:

<storage>
A |-> X => Xprime
B |-> Y => Yprime
</storage>

then logically only the cases where A =/= B will be treated (there is a missing "branch" where A == B which will not be created). This is a blind spot of some of our existing specs, like Vat.move etc.

Idea to resolve: for every behaviour where there are abstract keys references which could in theory be distinct, actually generate two specs, one where the two abstract keys are collapsed into one abstract key, and another where you keep two keys and postulate that they are distinct. So we would have to have a way of determining when abstract keys might have the same value, for which it is necessary to look in storage.k.md which is pretty daunting... Better ideas? @mhhf @MrChico

Daunting indeed considering that the conditions for success would need to be modified as well, combined in a non-trivial way depending on information that would not be present in the spec (like the order in which operations are applied). The alternative would be to just add acts for those cases, I think I'm leaning towards this solution

I added a feature to (klab) that warns when two storage locations might be the same, by looking at their definition given in storage.md. When storage locations are expressed in this format it's easy to check what the arguments of the functions are, and you can substitute the arguments to see whether a collision might occur.

Running klab build on this repo shows that we need to write 16 extra cases to handle collisions:

Parsing act Vat.wards
Building k-spec Vat.wards
Building k-spec Vat.ilks
Building k-spec Vat.urns
Building k-spec Vat.gem
Building k-spec Vat.dai
Building k-spec Vat.sin
Building k-spec Vat.debt
Building k-spec Vat.vice
Building k-spec Vat.rely
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Vat.deny
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Vat.init
Building k-spec Vat.slip
Building k-spec Vat.flux
Warning! Potential collision in storage index gem[ilk]. Arguments ilk,src and ilk,dst may be equal.
Building k-spec Vat.move
Warning! Potential collision in storage index dai. Arguments src and dst may be equal.
Building k-spec Vat.tune
Building k-spec Vat.grab
Building k-spec Vat.heal
Building k-spec Vat.fold
Building k-spec Vat.toll
Building k-spec Drip.wards
Building k-spec Drip.ilks
Building k-spec Drip.vat
Building k-spec Drip.vow
Building k-spec Drip.repo
Building k-spec Drip.era
Building k-spec Drip.rely
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Drip.deny
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Drip.init
Building k-spec Drip.file
Building k-spec Drip.file-repo
Building k-spec Drip.file-vow
Building k-spec Drip.drip
Building k-spec Pit.wards
Building k-spec Pit.ilks
Building k-spec Pit.live
Building k-spec Pit.vat
Building k-spec Pit.Line
Building k-spec Pit.drip
Building k-spec Pit.rely
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Pit.deny
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Pit.file-ilk
Building k-spec Pit.file-Line
Building k-spec Pit.frob
Building k-spec Vow.wards
Building k-spec Vow.era
Building k-spec Vow.sin
Building k-spec Vow.Sin
Building k-spec Vow.Woe
Building k-spec Vow.Ash
Building k-spec Vow.wait
Building k-spec Vow.sump
Building k-spec Vow.bump
Building k-spec Vow.hump
Building k-spec Vow.Awe
Building k-spec Vow.Joy
Building k-spec Vow.rely
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Vow.deny
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Vow.file-data
Building k-spec Vow.file-addr
Building k-spec Vow.heal
Building k-spec Vow.kiss
Building k-spec Vow.fess
Building k-spec Vow.flog
Building k-spec Vow.flop
Building k-spec Vow.flap
Building k-spec Cat.wards
Building k-spec Cat.ilks
Building k-spec Cat.flips
Building k-spec Cat.nflip
Building k-spec Cat.live
Building k-spec Cat.vat
Building k-spec Cat.pit
Building k-spec Cat.vow
Building k-spec Cat.rely
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Cat.deny
Warning! Potential collision in storage index wards. Arguments CALLER_ID and guy may be equal.
Building k-spec Cat.file-addr
Building k-spec Cat.file
Building k-spec Cat.file-flip
Building k-spec Cat.bite
Building k-spec Cat.flip
Building k-spec GemJoin.vat
Building k-spec GemJoin.ilk
Building k-spec GemJoin.gem
Building k-spec GemJoin.join
Warning! Potential collision in storage index balances. Arguments CALLER_ID and ACCT_ID may be equal.
Implementation of contract alias GemLike not found!
Building k-spec GemJoin.exit
Warning! Potential collision in storage index balances. Arguments CALLER_ID and ACCT_ID may be equal.
Implementation of contract alias GemLike not found!
Building k-spec ETHJoin.vat
Building k-spec ETHJoin.ilk
Building k-spec ETHJoin.join
Building k-spec ETHJoin.exit
Building k-spec DaiJoin.vat
Building k-spec DaiJoin.dai
Building k-spec DaiJoin.join
Warning! Potential collision in storage index #Gem.balances. Arguments CALLER_ID and ACCT_ID may be equal.
Implementation of contract alias GemLike not found!
Building k-spec DaiJoin.exit
Warning! Potential collision in storage index #Gem.balances. Arguments CALLER_ID and ACCT_ID may be equal.
Implementation of contract alias GemLike not found!