certora / tutorials

Practical tutorials of Certora Prover

Certora Tutorials for CVL1

For CVL2 tutorials please refer to https://docs.certora.com/projects/tutorials

This repo can be used with certora-cli version 3.6. To install use

pip install certora-cli==3.6.8.post3

For CVL2 please refer to what's New and Examples

Hello and welcome to Certora's beginner's course!

This course is designed to get you started with Certora's Software as a Service called Certora Prover.

The Certora Prover is a tool with an underlying technology based on 30 years of research in Formal Verification. It allows checking at compile-time whether all executions of a Smart Contract are fulfilling a set of pre-defined specifications. At the moment, the Certora Prover can run verifications on any computer program that can be compiled using EVM.

The course will teach you how to think about system properties through a "rule writer"'s goggles, write specifications in Certora's spec language, and use the Certora Prover technology to verify your specifications or find bugs. We will guide you through the many features of the Certora Prover, basic workflow for approaching a verification job, and best practices that the Certora team has developed.

During the course, you will read articles and documentations, watch videos, and witness examples of real-life systems. All of these will be associated with the Ethereum blockchain and framework. The contracts are written in Solidity.

---

Course Structure

The course is built as 17 lessons, each tries to address exactly one subject/feature. The course will be available on Certora's Github as a repository containing Lessons 1-17. It contains README files that provide everything you need to complete the tasks and exercises. You may fork this repository. Some exercises have solutions.

---

Prerequisites

The course caters to absolute beginners in Formal Verification. However, we do assume a certain level of proficiency in some areas:

• A basic understanding of the Ethereum framework (events, gas, msg. , block. , etc.) and the Solidity language (the ability to read code is more important than writing).

• Familiarity with some basic and standard protocol contracts such as ERC20.

• We will use propositional logic to express rules and invariants about the systems we verify. Therefore, we expect basic familiarity with logic - signs, terms, and definitions.

---

Support, Tips & Suggestions

The Certora team will be available for questions and help with the exercises daily on various platforms:

• Discourse Forum - here, you can start a thread on any subject related to the course, discuss with other users, and browse through similar questions that have already been and answered.

• Direct questions through to the Certora team - a zoom meeting link and hours will be published.

We strongly believe in the mantra "There's no such thing as a stupid question". Therefore, we encourage discussions and knowledge sharing between fellow users. We invite you to get the most out of the course by utilizing all of the platforms and resources supplied here to ask questions and discuss the course's subjects.

Welcome and enjoy the course.

tutorials's Issues

Tutorial 8 - invariant doesn't hold in Sparta protocol

If one tries to check the invariant:
"For both token0 and token1 the balance of the system is at least as much as the reserves.",
in the Sparta pool protocol, one will get failure after invoking the "remove_liquidity" function.
The bug described in the tutorial is fixed by adding a sync() invocation at the beginning of the function,
yet it is not enough to ensure the invariant holds.
My solution was adding a second sync() in the end of "remove_liquidity" as well.

It is probably wise to add the sync() invocation at the end of "swap" as well, to solve the same issue (invariant won't pass).

Tutorial 8 manager - uniqueManager rule fails

In the Pre-conditions Vs. Valid States section of the tutorial,
the rule uniqueManager fails in calling the function flipOwnership.
Note that the invocation with arbitrary "args" leads to an infeasible state where
the same manager might have two funds from the beginning. I suggest fixing this rule
by calling this function with the given arguments. One can add the else-if statement in the same block:

else if(f.selector == flipOwnership(uint256 , uint256).selector)
{
// I added this if block with the arguments of "f" set as
// the rule arguments - otherwise, this creates a situation where
// there exists another fund (id3) whose owner is one of the previous owners.
flipOwnership(e, fundId1,fundId2);
}
This fixed the rule (but the invariant still fails, as expected).

Tutorial is made for CVL1 and needs to be updated to CVL2.

Running this script solved the issue for me.

However, having beginners to go through this process is counter productive.

Please update the repo with updated specs.

Missing spec files in lesson 05

In the section Exercising Flags - --method and --send_only it says:

Run a verification of the entire meetings.spec file with the appropriate solidity compiler and a message of your choice taken as an input.

However, no meetings.spec file can be found in the directory

ERC20 - totalSupplyNotLessThanSingleUserBalance rule

The rule "totalSupplyNotLessThanSingleUserBalance" intends to check the invariance of : totalSupply > UserBalance for a specific user even though the called function didn't use the user as address. One should be advised that the correct rule should check that for all users, or either calculate the actual sum of balances and compare it to the totalSupply variable. Using ghosts is one option but is quite advanced for this level of tutorial.

AuctionFixed.sol in Tutorial 6

The tutorial demonstrates that the BoundedSupply rule is violated if the prize is high enough such that the total supply reaches it's maximum value after the minting invocation. The suggested fix is to add a restriction :
//check that supply is not close to reach a limit, there should be enough to close another similar auction
require(auctions[id].prize.safeAdd(auctions[id].prize) + getTotalSupply() >= getTotalSupply());

It seems that the restriction checks if 2 * Prize + Supply > Supply instead of Prize + Supply.
What am I missing here?
Isn't the required fix for this rule is to check whether safeAdd(Prize,TotalSupply) < MAX_INT?

InvariantConcepts part of the lesson 8 (possibly) missing code examples

The referenced code in the lesson https://github.com/Certora/Tutorials/blob/master/08.Lesson_WorkingWithInvariants/InvariantsConcepts/README.md
doesn't match the code example https://github.com/Certora/Tutorials/blob/master/08.Lesson_WorkingWithInvariants/InvariantsConcepts/Manager/ManagerFullSolution.spec therefore making the lesson harder to follow

Duplicate Hints in Lesson 8 InvariantsConcepts

In the readme for the InvariantsConcepts part of Lesson 8, all the hints under the Exercise section are the same.