Description:
Use the Kani model checker to prove properties of the pure (non-Env) helpers: compute_slash_amount (never exceeds the bond, never negative), tier_fill_window (monotonic, no overflow), fee math (fee ≤ amount, rounding direction), Dutch-decay math, tier lookup monotonicity, and the proof registry's payload byte decoding.
Problem Statement & Context:
Proptests sample the input space, while Kani proves the property for all inputs. Arithmetic helpers are small enough to verify fully, and their bugs directly move funds.
Scope & Acceptance Criteria:
- Pull the helpers into
Env-free functions (a pure math module) if they aren't already.
- At least 10 Kani harnesses with
#[kani::proof], each with a documented property.
- A
make kani target, and harnesses that finish in under 10 minutes in total.
- Out of scope: proving
Env-dependent code.
Implementation Guidelines:
- Key Files/Modules:
intent_settlement/src/math.rs, solver_registry/src/lib.rs (score_of, tier), proof_registry/src/lib.rs (the decode helpers), Makefile.
- Design/Architecture: Keep
soroban-sdk types out of the proven functions and use primitive types.
- Edge Cases/Constraints: i128 multiplication overflow, where Kani needs
unwind bounds for the loops.
- Testing: The Kani harnesses themselves, plus unit tests.
Definition of "Done":
- Kani passes locally with the output in the PR, and the Makefile target is added.
- Reviewed and approved.
Resources:
Complexity: High (200 points)
Description:
Use the Kani model checker to prove properties of the pure (non-
Env) helpers:compute_slash_amount(never exceeds the bond, never negative),tier_fill_window(monotonic, no overflow), fee math (fee ≤ amount, rounding direction), Dutch-decay math, tier lookup monotonicity, and the proof registry's payload byte decoding.Problem Statement & Context:
Proptests sample the input space, while Kani proves the property for all inputs. Arithmetic helpers are small enough to verify fully, and their bugs directly move funds.
Scope & Acceptance Criteria:
Env-free functions (a puremathmodule) if they aren't already.#[kani::proof], each with a documented property.make kanitarget, and harnesses that finish in under 10 minutes in total.Env-dependent code.Implementation Guidelines:
intent_settlement/src/math.rs,solver_registry/src/lib.rs(score_of, tier),proof_registry/src/lib.rs(the decode helpers),Makefile.soroban-sdktypes out of the proven functions and use primitive types.unwindbounds for the loops.Definition of "Done":
Resources:
Complexity: High (200 points)