Add ERC-4337 EntryPoint invariant benchmark case#32
Merged
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 81bd0dfabd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Member
Author
|
Migrated this benchmark PR to the faithful Verity model from lfglabs-dev/verity#1746. Changes pushed in 7891277:
Local verification: |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 789127790c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8bf0bcd7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| require verity from git | ||
| "https://github.com/Th0rgal/verity.git"@"4ebe4931d25e5a1594fcd3f43ff040ecc3c4225a" | ||
| "https://github.com/lfglabs-dev/verity.git"@"de9377951c00bbd5fbf72e85d56fe50b8ff40d0c" |
There was a problem hiding this comment.
Updating the global Verity dependency pin here to de937... without updating existing cases/*/*/case.yaml manifests leaves most cases still declaring 4ebe..., and scripts/run_case.sh records provenance from each case manifest’s verity_version rather than from Lake. In practice, non-ERC4337 runs after this commit build against one Verity commit but publish a different verity_commit in results metadata, which breaks reproducibility/auditability; either update all case manifests in the same commit or source the recorded commit from lakefile.lean.
Useful? React with 👍 / 👎.
Th0rgal
pushed a commit
to lfglabs-dev/verity
that referenced
this pull request
Jun 7, 2026
Promotes a set of reusable EVM-frame and counting-trace primitives from the ERC-4337 EntryPoint benchmark (lfglabs-dev/ethereum-verification-benchmark#32) into Verity proper. Each component closes a trust gap or removes boilerplate for every benchmark that uses external calls, transient reentrancy guards, solc memory layouts, or trace-counting properties. ## New modules - Verity/Core.lean (item 2): nonReentrantTransient (EIP-1153) alongside the existing storage-slot nonReentrant. Includes nonReentrantTransient_locked_reverts (@[simp]) and nonReentrantTransient_revert_preserves_state. Modern OpenZeppelin contracts use ReentrancyGuardTransient. - Verity/EVM/MemoryModel.lean (item 4 abstract part): MemState + myMload/myMstore + callWithReturnBuffer + Disjoint predicate + call_preserves_disjoint_region + iterated form + memory_frame_under_arbitrary_callee. - Verity/EVM/Frame.lean (item 1): CallerFrame + CalleeResult + applyCallToCaller + the four caller-frame preservation theorems (storage, transient storage, memory outside output buffer, and disjoint-region form) + iterated-CALL variants. Discharges the 'CALL preserves caller state' frame condition as a theorem rather than an axiom, for every benchmark. - Verity/EVM/Layout.lean (item 5): SolcLayout schema + canonicalSolcLayout + ScratchOutputBuffer + call_buffer_disjoint_from_heap and its MemoryModel.Disjoint form. Discharges the disjointness premise from the standard solc memory layout invariants for any solc-compiled contract. - Verity/Trace.lean (item 6): generic countMatching + emitLoop + emitLoop_event_origin + emitLoop_contains_emitted_event + count_le_one_under_pairwise_distinct. Reusable 'this event happens exactly N times' machinery, parametric over the event type and matching key. ## Parser fix - Contracts/Common.lean (item 8): rewrites 'let _ := rhs' inside the verity_contract DSL to a fresh-name binding so users can discard external-call results naturally. Without this rule the verity_contract function-body parser rejects 'let _ := …' as an unsupported do element. ## Documentation - AXIOMS.md: External Call Module section now points to the new caller-frame preservation theorems and clarifies that EVM frame preservation is no longer an assumption. - TRUST_ASSUMPTIONS.md: #7 External Call Modules entry calls out the same shift. - docs/ROADMAP.md: new section 'ERC-4337 Frame Primitives Landed' lists the modules above, plus follow-ups (EvmYul correspondence, solc_disjoint tactic, verity_contract doc-comment support). ## Deferred (item 7) verity_contract doc-comment support (/-- … -/ before function) requires adding a doc-comment-prefixed alternative to verityFunction syntax and threading it through parseFunction. The parser surgery touches a hot path; ship as its own PR with cross-benchmark testing. ## Removed (item 3 — fromSolidity) The Verity.Compiler.FromSolidity scaffold has been removed pending a proper in-process translator design. A CLI-shelling wrapper is not sufficient trust reduction to justify the public API surface. ## Build lake build green on the modules above plus their downstream consumers.
Th0rgal
pushed a commit
that referenced
this pull request
Jun 7, 2026
Closes two of the gaps identified post-merge of #32: ## Item: Indexed counting biconditional (drops the pairwise-distinct premise) New file IndexedCounting.lean introduces: - IndexedCallEvent: a CallEvent tagged with its source op index. - IndexedTrace: List IndexedCallEvent. - executionLoopIndexed: emits one event per executable op tagged with its position in the input list. - countByIndex: counts events whose opIdx matches a target index. - handleOpsIndexedTrace: the indexed version of the handleOps trace. Core lemmas (no pairwise-distinctness premise): - executionLoopIndexed_count_eq_one_of_executable: exactly one event emitted at index i when op i has non-empty callData. - executionLoopIndexed_count_eq_zero_of_not_executable: zero events emitted at index i when op i has empty callData. Headline theorem: yoav_indexed_counting_biconditional (ops : List PackedUserOperation) (table : Nonce2DTable) (approvals : List Bool) (i : Nat) (hi : i < ops.length) : countByIndex (handleOpsIndexedTrace ops table approvals) i = 1 ↔ batchValidated ops table approvals = true ∧ hasCallData ops[i] = true This is the unconditional form of Yoav's claim: 'execution exactly once per validated op with non-empty callData'. No pairwise-distinct (sender, callData) assumption — op indices are inherently unique, so two ops with identical (sender, callData) are still counted separately by index. The realistic per-nonce uniqueness bundlers enforce makes this the natural form. ## Item: handleAggregatedOps via parameterization New file Aggregator.lean models the BLS aggregator path: - OpsGroup: a list of ops + aggregator address (matches the Solidity PackedUserOpsPerAggregator struct). - flattenGroups: flat ordering for handleOpsMulti. - groupVerdicts: per-group (aggregatorOk, ops.length) projection. - combinedApprovals: composes aggregator verdicts with per-op account approvals into the flat approvals list handleOpsMulti consumes. - handleAggregatedOps: reduces to handleOpsMulti with combined approvals — no new validation/execution logic. - yoav_aggregated_biconditional: applies yoav_indexed_counting_biconditional to the flattened batch. **Proof reused verbatim, no duplication.** This shows the proof shape generalises across both entry points: the aggregator path is the same two-loop structure, just with the per-op signature gate replaced by the aggregator decision. The counting biconditional, the frame conditions, the refinement — all carry through. ## Updated docs CRITICAL_PATH.md now points to yoav_indexed_counting_biconditional as the headline theorem (the no-distinctness form), with the original counting biconditional and the aggregator variant cited as siblings. ## Build note Verification of the build was performed in a system contended by another mission's lean process (45 GB resident). The IndexedCounting build returned exit 0 in a previous run; the verification of the latest changes was killed for resource pressure. CI rebuilds will confirm.
Th0rgal
pushed a commit
to lfglabs-dev/verity
that referenced
this pull request
Jun 7, 2026
Promotes a set of reusable EVM-frame and counting-trace primitives from the ERC-4337 EntryPoint benchmark (lfglabs-dev/ethereum-verification-benchmark#32) into Verity proper. Each component closes a trust gap or removes boilerplate for every benchmark that uses external calls, transient reentrancy guards, solc memory layouts, or trace-counting properties. ## New modules - Verity/Core.lean (item 2): nonReentrantTransient (EIP-1153) alongside the existing storage-slot nonReentrant. Includes nonReentrantTransient_locked_reverts (@[simp]) and nonReentrantTransient_revert_preserves_state. Modern OpenZeppelin contracts use ReentrancyGuardTransient. - Verity/EVM/MemoryModel.lean (item 4 abstract part): MemState + myMload/myMstore + callWithReturnBuffer + Disjoint predicate + call_preserves_disjoint_region + iterated form + memory_frame_under_arbitrary_callee. - Verity/EVM/Frame.lean (item 1): CallerFrame + CalleeResult + applyCallToCaller + the four caller-frame preservation theorems (storage, transient storage, memory outside output buffer, and disjoint-region form) + iterated-CALL variants. Discharges the 'CALL preserves caller state' frame condition as a theorem rather than an axiom, for every benchmark. - Verity/EVM/Layout.lean (item 5): SolcLayout schema + canonicalSolcLayout + ScratchOutputBuffer + call_buffer_disjoint_from_heap and its MemoryModel.Disjoint form. Discharges the disjointness premise from the standard solc memory layout invariants for any solc-compiled contract. - Verity/Trace.lean (item 6): generic countMatching + emitLoop + emitLoop_event_origin + emitLoop_contains_emitted_event + count_le_one_under_pairwise_distinct. Reusable 'this event happens exactly N times' machinery, parametric over the event type and matching key. ## Parser fix - Contracts/Common.lean (item 8): rewrites 'let _ := rhs' inside the verity_contract DSL to a fresh-name binding so users can discard external-call results naturally. Without this rule the verity_contract function-body parser rejects 'let _ := …' as an unsupported do element. ## Documentation - AXIOMS.md: External Call Module section now points to the new caller-frame preservation theorems and clarifies that EVM frame preservation is no longer an assumption. - TRUST_ASSUMPTIONS.md: #7 External Call Modules entry calls out the same shift. - docs/ROADMAP.md: new section 'ERC-4337 Frame Primitives Landed' lists the modules above, plus follow-ups (EvmYul correspondence, solc_disjoint tactic, verity_contract doc-comment support). ## Deferred (item 7) verity_contract doc-comment support (/-- … -/ before function) requires adding a doc-comment-prefixed alternative to verityFunction syntax and threading it through parseFunction. The parser surgery touches a hot path; ship as its own PR with cross-benchmark testing. ## Removed (item 3 — fromSolidity) The Verity.Compiler.FromSolidity scaffold has been removed pending a proper in-process translator design. A CLI-shelling wrapper is not sufficient trust reduction to justify the public API surface. ## Build lake build green on the modules above plus their downstream consumers.
Member
Author
|
Pushed three rounds of improvements following an in-depth faithfulness/ECM audit of the EntryPoint v0.9 model:
Next planned: 2D nonce keying + packed validationData tightening, then real Verity scalar events for the counting theorem. |
Prove the core ERC-4337 security property that Certora could not verify with SMT solvers: execution happens if and only if validation passed. The model abstracts the two-loop handleOps structure as pure Lean functions with universally quantified validation results. All 8 theorems are fully proven (zero sorry), including: - Safety (execution implies validation) - Liveness (validation implies execution) - Combined biconditional invariant - All-validated/all-executed on success - No-execution on revert - Verity contract proofs for single-op model Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…4337 Creates the erc4337 family manifest, erc4337_v09 implementation manifest, and 8 generated task template files to fix CI manifest validation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extends the model with a refined OpInfo structure (validation, hasCallData, innerCallReverted) capturing the Solidity callData.length > 0 sender-call branch and try/catch absorption of inner reverts. Adds 10 new fully-proven theorems on top of the original 8 (18 total, zero sorry, zero axiom): Deeper pure-model properties: - handleOps_deterministic: pure function of validation list - handleOps_empty: empty batch is a successful no-op - execution_length_eq_validation_length: one execution slot per UserOp - executed_index_in_bounds: recorded indices respect batch size - single_failure_reverts: any failed validation reverts the batch - count_executed_eq_validated: executed count = validated count on success Refined-model properties (calldata + inner revert + fees): - sender_call_iff_validated_and_calldata: tight innerHandleOp branch claim - execution_independent_of_inner_revert: try/catch absorption - fees_collected_eq_ops_length: fee conservation on success - no_fees_on_revert: all-or-nothing fees Adds task YAML + Lean skeleton for each new theorem, updates benchmark.toml active_cases, regenerates REPORT.md and benchmark-inventory.json. Full lake build green; 161 task manifests validated.
Adds 5 more theorems (23 total, still zero sorry / zero axiom): - executionR_iff_in_bounds: sharpest characterization of when execution is attempted in the refined model (success ∧ i in bounds) - validation_concat: validation success composes over batch concatenation - validation_concat_fail_left / _right: failure propagates from either half - fees_concat_additive: fee additivity on a successful concatenated batch These deal with the multi-op batch-composition structure that is implicit in the EntryPoint two-loop control flow. Full lake build green, 166 task manifests validated.
Adds a FullOpInfo structure modeling the rest of EntryPoint.handleOps: - declaredNonce + accountApproves (account.validateUserOp + nonce++) - paymaster + paymasterApproves (_validatePaymasterPrepayment) - prefund per op + beneficiary compensation (_compensate) handleOpsFull sequentially validates ops against a monotonically-incrementing nonce, returning the final nonce on success. 10 new fully-proven theorems (33 total, still zero sorry / zero axiom): Nonce / replay protection: - nonce_advances_by_batch_size: precise nonce advance equals batch size - nonce_strictly_increases: non-empty success strictly raises the nonce - nonce_mismatch_reverts: replay attempts revert Authority requirements: - account_rejection_reverts: account approval is mandatory - paymaster_rejection_reverts_when_present: paymaster mandatory when attached - paymaster_irrelevant_when_absent: paymaster flag has no effect when absent - full_success_implies_all_account_approved: global account-approval invariant Beneficiary / fee accounting: - beneficiary_eq_total_prefund: collected = Σ prefunds on success - no_beneficiary_payout_on_revert - total_prefund_concat: additivity over concatenation Full lake build green, 176 task manifests validated.
…aithful post-account/pre-paymaster order - Change nonces storage from Address→ to Uint256→ (keyed on the decoded param, per one-op projection style; matches Frame.lean approach). - Reorder in _validateAccount: account externalCall first, then nonce check+ bump (using get/setMappingUint), then success require. This places the check after account validation and before paymaster (in _validatePrepayment caller). - Update Refinement storage assumptions to storageMapUint keyed by key. - Update Contract full-model comment for accurate placement and 2D note (scalar model kept as illustration). - Update all related doc comments to keep claims honest: this remains a decoded-parameter projection; 2D faithfulness for theorems is in UserOp/Trace. - No new axioms/sorries; build-clean. Fits the audit Priority 3 nonce gap.
…horizer gate, sig-fail vs time distinctions) - In EntryPointV09: elaborate that oracle returns are packed validationData; success gate (==0) matches authorizer=0 (SIG_VALIDATION_SUCCESS); nonzero models both explicit SIG_VALIDATION_FAILED (1) and expired/not-yet-valid cases. Distinction in error strings not branched in projection (harmless for control-flow), but accept/reject decision now documented against the real _getValidationData / authorizer checks. - Update stub generator to document the packed return shape for differential oracles. - Cross-ref UserOp.lean vd* decomposition (already present, now explicitly tied). - Projection honesty preserved; no behavior change to oracles or requires (0 remains the success packed word). - Part of audit Priority 3 validation-data gap. Complements the nonce fidelity commit. No theorem changes (abstract approvals still Bool; vdValid used in pure model only).
Th0rgal
force-pushed
the
feat/erc4337-entrypoint-invariant
branch
from
June 20, 2026 20:46
b09f3cd to
f731f09
Compare
Th0rgal
force-pushed
the
feat/erc4337-entrypoint-invariant
branch
from
June 22, 2026 11:44
a9e6df9 to
7737968
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e500f8c. Configure here.
| (sender : IAccount, key : Uint256, hasCallData : Uint256, | ||
| callDataOffset : Uint256, callDataLength : Uint256) : Uint256 := do | ||
| let _innerResult ← _innerHandleOp sender key hasCallData callDataOffset callDataLength | ||
| setMappingUint opInfoRecord key OP_INFO_EXECUTED |
There was a problem hiding this comment.
opInfoRecord key collisions
Medium Severity
_validatePrepayment and _executeUserOp write opInfoRecord keyed only by the decoded nonce key, while batch handleOps can process multiple ops sharing that key with different sequence numbers. Later ops overwrite earlier per-op status instead of indexing by batch position like in-memory opInfos[i].
Additional Locations (1)
Reviewed by Cursor Bugbot for commit e500f8c. Configure here.
| let paymaster := wordToAddress 0 | ||
| let _exec ← handleOp sender paymaster key declaredNonce beneficiary hasInitCode hasCallData | ||
| 0 callDataLength | ||
| pure ()) |
There was a problem hiding this comment.
Batch handleOps interleaves phases
High Severity
The ABI handleOps loop calls handleOp per element, running validation, execution, postOp, and compensation for each op before starting the next. Upstream EntryPoint completes validation for the entire batch first, then runs the execution loop, so later ops are not validated before earlier ops execute.
Reviewed by Cursor Bugbot for commit e500f8c. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
handleOpsstructure (validation phase + execution phase) as pure Lean functions with universally quantified validation resultssorry— builds clean withlake buildWhat is proven
The core ERC-4337 security property from the EIP spec:
This decomposes into:
execution_implies_validationvalidation_implies_executionexecution_iff_validationall_validated_on_successall_executed_on_successno_execution_on_revertsingle_op_execution_on_validationsingle_op_fee_collectedWhy this matters
Certora's SMT-based approach cannot universally quantify over arbitrary Turing-complete programs (the account/paymaster contracts). Lean's interactive theorem proving handles this naturally — the proofs hold for ALL possible validation outcomes via standard universal quantification over
List Bool.Files
Benchmark/Cases/ERC4337/EntryPointInvariant/Contract.lean— Abstract model of handleOps two-loop structureBenchmark/Cases/ERC4337/EntryPointInvariant/Specs.lean— Invariant specificationsBenchmark/Cases/ERC4337/EntryPointInvariant/Proofs.lean— Complete proofs (no sorry)Benchmark/Cases/ERC4337/EntryPointInvariant/Compile.lean— Build gatecases/erc4337/entry_point_invariant/— YAML metadata (case + 8 tasks)Test plan
lake buildpasses with no errorssorryin all proof files🤖 Generated with Claude Code
Note
Medium Risk
Large new formal proof surface and CI that pulls Foundry/solc and runs bytecode differential tests; mistakes could hide compile or semantic drift, but changes are confined to benchmark/CI paths.
Overview
Adds a full ERC-4337 EntryPoint v0.9 benchmark: Lean models and proofs for the validation-before-execution invariant (Yoav-style execution counts exactly once iff batch validated and op has callData), plus a Verity
EntryPointV09projection, ABI boundary wiring for realhandleOps(PackedUserOperation[], address), and supporting paths (indexed counting,handleAggregatedOps, frame/layout/refinement layers).Registers the case in the benchmark build graph (
Compilegate,caseReady) and documents the load-bearing proof path inCRITICAL_PATH.md.Introduces
.github/workflows/erc4337-differential.yml: on relevant path changes, builds the compile gate, installs Foundry/solc, and runsdifferential/run.shto compare Verity-compiled output against upstream solcEntryPoint.solon Foundry scenarios.Reviewed by Cursor Bugbot for commit e500f8c. Bugbot is set up for automated code reviews on this repo. Configure here.