recon-generate 0.0.15 → 0.0.17

package/dist/z3Solver.d.ts

@@ -0,0 +1,11 @@
+import { FunctionDefinition } from 'solc-typed-ast';
+interface Z3Solution {
+    variable: string;
+    value: string;
+    type: string;
+    expression: string;
+}
+export declare const setZ3Silent: (silent: boolean) => void;
+export declare const findZ3Solutions: (fnDef: FunctionDefinition) => Promise<Z3Solution[]>;
+export declare const cleanupZ3: () => Promise<void>;
+export {};

package/dist/z3Solver.js

@@ -0,0 +1,425 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cleanupZ3 = exports.findZ3Solutions = exports.setZ3Silent = void 0;
+const z3_solver_1 = require("z3-solver");
+const solc_typed_ast_1 = require("solc-typed-ast");
+let z3Context = null;
+const initZ3 = async () => {
+    if (z3Context)
+        return z3Context;
+    const { Context } = await (0, z3_solver_1.init)();
+    const ctx = Context('main');
+    const solver = new ctx.Solver();
+    z3Context = { ctx, solver };
+    return z3Context;
+};
+const getBitSize = (typeString) => {
+    // Extract bit size from type like int128, uint256, etc.
+    const match = typeString.match(/u?int(\d+)/);
+    if (match)
+        return parseInt(match[1], 10);
+    // Handle bytes types (bytes1 = 8 bits, bytes32 = 256 bits)
+    const bytesMatch = typeString.match(/^bytes(\d+)$/);
+    if (bytesMatch)
+        return parseInt(bytesMatch[1], 10) * 8;
+    // Default sizes
+    if (typeString.includes('int'))
+        return 256;
+    if (typeString === 'bool')
+        return 8;
+    if (typeString.startsWith('bytes'))
+        return 256; // dynamic bytes
+    return 256;
+};
+const isSigned = (typeString) => {
+    return typeString.startsWith('int') && !typeString.startsWith('uint');
+};
+const extractVariables = (expr) => {
+    const vars = [];
+    const visit = (node) => {
+        if (node instanceof solc_typed_ast_1.Identifier) {
+            // Skip constants and special identifiers
+            if (node.name !== 'true' && node.name !== 'false') {
+                vars.push({
+                    name: node.name,
+                    type: node.typeString || 'uint256',
+                    node
+                });
+            }
+        }
+        else if (node instanceof solc_typed_ast_1.IndexAccess) {
+            // foo[0] - treat as a variable
+            const baseName = getExpressionName(node);
+            vars.push({
+                name: baseName,
+                type: node.typeString || 'uint256',
+                node
+            });
+        }
+        else if (node instanceof solc_typed_ast_1.MemberAccess) {
+            // foo.bar - could be a variable access
+            // Check if it's not a function call parent
+            const baseName = getExpressionName(node);
+            vars.push({
+                name: baseName,
+                type: node.typeString || 'uint256',
+                node
+            });
+        }
+        else if (node instanceof solc_typed_ast_1.FunctionCall) {
+            // Handle type conversions - recurse into the argument
+            if (node.kind === solc_typed_ast_1.FunctionCallKind.TypeConversion && node.vArguments.length === 1) {
+                visit(node.vArguments[0]);
+            }
+            else {
+                // foo.bar() - treat whole thing as a variable
+                const baseName = getExpressionName(node);
+                vars.push({
+                    name: baseName,
+                    type: node.typeString || 'uint256',
+                    node
+                });
+            }
+        }
+        else if (node instanceof solc_typed_ast_1.BinaryOperation) {
+            visit(node.vLeftExpression);
+            visit(node.vRightExpression);
+        }
+        else if (node instanceof solc_typed_ast_1.UnaryOperation) {
+            visit(node.vSubExpression);
+        }
+        else if (node instanceof solc_typed_ast_1.TupleExpression) {
+            // Handle parentheses - visit all components
+            for (const comp of node.vComponents) {
+                if (comp)
+                    visit(comp);
+            }
+        }
+    };
+    visit(expr);
+    return vars;
+};
+const getExpressionName = (expr) => {
+    if (expr instanceof solc_typed_ast_1.Identifier) {
+        return expr.name;
+    }
+    else if (expr instanceof solc_typed_ast_1.IndexAccess) {
+        const base = getExpressionName(expr.vBaseExpression);
+        const index = expr.vIndexExpression ? getExpressionName(expr.vIndexExpression) : '0';
+        return `${base}_${index}`.replace(/[^a-zA-Z0-9_]/g, '');
+    }
+    else if (expr instanceof solc_typed_ast_1.MemberAccess) {
+        const base = getExpressionName(expr.vExpression);
+        return `${base}_${expr.memberName}`.replace(/[^a-zA-Z0-9_]/g, '');
+    }
+    else if (expr instanceof solc_typed_ast_1.FunctionCall) {
+        if (expr.vExpression instanceof solc_typed_ast_1.MemberAccess) {
+            return getExpressionName(expr.vExpression).replace(/[^a-zA-Z0-9_]/g, '');
+        }
+        return getExpressionName(expr.vExpression).replace(/[^a-zA-Z0-9_]/g, '');
+    }
+    else if (expr instanceof solc_typed_ast_1.Literal) {
+        return expr.value || '0';
+    }
+    return 'unknown';
+};
+const expressionToZ3 = (ctx, expr, varMap, bitSize, signed) => {
+    if (expr instanceof solc_typed_ast_1.Literal) {
+        let value = expr.value || '0';
+        // Handle hex values
+        if (value.startsWith('0x')) {
+            value = BigInt(value).toString();
+        }
+        // Handle negative values for signed types
+        if (value.startsWith('-')) {
+            const absVal = BigInt(value.slice(1));
+            // Two's complement
+            const maxVal = BigInt(1) << BigInt(bitSize);
+            const signedVal = maxVal - absVal;
+            return ctx.BitVec.val(signedVal, bitSize);
+        }
+        return ctx.BitVec.val(BigInt(value), bitSize);
+    }
+    if (expr instanceof solc_typed_ast_1.Identifier) {
+        const z3Var = varMap.get(expr.name);
+        if (z3Var)
+            return z3Var;
+        // Create new variable
+        const newVar = ctx.BitVec.const(expr.name, bitSize);
+        varMap.set(expr.name, newVar);
+        return newVar;
+    }
+    if (expr instanceof solc_typed_ast_1.FunctionCall) {
+        // Handle type conversions like uint24(...), uint256(...)
+        if (expr.kind === solc_typed_ast_1.FunctionCallKind.TypeConversion && expr.vArguments.length === 1) {
+            // Recursively process the inner expression
+            // The type conversion just changes interpretation, not the bits we're solving for
+            return expressionToZ3(ctx, expr.vArguments[0], varMap, bitSize, signed);
+        }
+        // Other function calls - treat as opaque variable
+        const name = getExpressionName(expr);
+        const z3Var = varMap.get(name);
+        if (z3Var)
+            return z3Var;
+        const newVar = ctx.BitVec.const(name, bitSize);
+        varMap.set(name, newVar);
+        return newVar;
+    }
+    if (expr instanceof solc_typed_ast_1.IndexAccess || expr instanceof solc_typed_ast_1.MemberAccess) {
+        const name = getExpressionName(expr);
+        const z3Var = varMap.get(name);
+        if (z3Var)
+            return z3Var;
+        const newVar = ctx.BitVec.const(name, bitSize);
+        varMap.set(name, newVar);
+        return newVar;
+    }
+    if (expr instanceof solc_typed_ast_1.UnaryOperation) {
+        const subExpr = expressionToZ3(ctx, expr.vSubExpression, varMap, bitSize, signed);
+        if (!subExpr)
+            return null;
+        switch (expr.operator) {
+            case '-':
+                return ctx.BitVec.val(0, bitSize).sub(subExpr);
+            case '~':
+                return subExpr.neg(); // bitwise not
+            case '!':
+                // Logical not - treat as comparison with 0
+                return null; // Skip for now
+            default:
+                return null;
+        }
+    }
+    if (expr instanceof solc_typed_ast_1.BinaryOperation) {
+        const left = expressionToZ3(ctx, expr.vLeftExpression, varMap, bitSize, signed);
+        const right = expressionToZ3(ctx, expr.vRightExpression, varMap, bitSize, signed);
+        if (!left || !right)
+            return null;
+        switch (expr.operator) {
+            case '+':
+                return left.add(right);
+            case '-':
+                return left.sub(right);
+            case '*':
+                return left.mul(right);
+            case '/':
+                return signed ? left.sdiv(right) : left.udiv(right);
+            case '%':
+                return signed ? left.smod(right) : left.urem(right);
+            case '>>':
+                return signed ? left.shr(right) : left.lshr(right);
+            case '<<':
+                return left.shl(right);
+            case '&':
+                return left.and(right);
+            case '|':
+                return left.or(right);
+            case '^':
+                return left.xor(right);
+            default:
+                return null;
+        }
+    }
+    if (expr instanceof solc_typed_ast_1.TupleExpression) {
+        // Handle parentheses - just unwrap if single component
+        if (expr.vComponents.length === 1 && expr.vComponents[0]) {
+            return expressionToZ3(ctx, expr.vComponents[0], varMap, bitSize, signed);
+        }
+        return null;
+    }
+    return null;
+};
+const createZ3Constraint = (ctx, expr, varMap, bitSize, signed) => {
+    const left = expressionToZ3(ctx, expr.vLeftExpression, varMap, bitSize, signed);
+    const right = expressionToZ3(ctx, expr.vRightExpression, varMap, bitSize, signed);
+    if (!left || !right)
+        return null;
+    switch (expr.operator) {
+        case '==':
+            return left.eq(right);
+        case '!=':
+            return left.neq(right);
+        case '<':
+            return signed ? left.slt(right) : left.ult(right);
+        case '<=':
+            return signed ? left.sle(right) : left.ule(right);
+        case '>':
+            return signed ? left.sgt(right) : left.ugt(right);
+        case '>=':
+            return signed ? left.sge(right) : left.uge(right);
+        default:
+            return null;
+    }
+};
+/**
+ * Parse Z3 value string to BigInt
+ * Z3 returns hex values in format like #xFFFF... or decimal strings
+ */
+const parseZ3Value = (valueStr) => {
+    // Handle Z3 hex format: #xFFFF... -> 0xFFFF...
+    if (valueStr.startsWith('#x')) {
+        return BigInt('0x' + valueStr.slice(2));
+    }
+    // Handle Z3 binary format: #b0101... -> 0b0101...
+    if (valueStr.startsWith('#b')) {
+        return BigInt('0b' + valueStr.slice(2));
+    }
+    // Handle regular decimal or hex
+    return BigInt(valueStr);
+};
+const solveConstraint = async (ctx, constraint, varMap, bitSize, signed) => {
+    const solver = new ctx.Solver();
+    solver.add(constraint);
+    const result = await solver.check();
+    if (result !== 'sat')
+        return null;
+    const model = solver.model();
+    const solutions = new Map();
+    for (const [name, z3Var] of varMap) {
+        const value = model.eval(z3Var);
+        const valueStr = value.toString();
+        let numValue = parseZ3Value(valueStr);
+        // Convert to signed if needed
+        if (signed && numValue >= BigInt(1) << BigInt(bitSize - 1)) {
+            numValue = numValue - (BigInt(1) << BigInt(bitSize));
+        }
+        solutions.set(name, numValue);
+    }
+    return solutions;
+};
+// Global silent mode flag
+let silentMode = false;
+const setZ3Silent = (silent) => {
+    silentMode = silent;
+};
+exports.setZ3Silent = setZ3Silent;
+const findZ3Solutions = async (fnDef) => {
+    const solutions = [];
+    try {
+        const { ctx } = await initZ3();
+        // Find all comparison operations
+        const binOps = fnDef.getChildrenByType(solc_typed_ast_1.BinaryOperation);
+        for (const binOp of binOps) {
+            // Only handle equality operator
+            if (binOp.operator !== '==') {
+                continue;
+            }
+            // Skip trivial comparisons where left side is just a simple variable or member access
+            // e.g., "x == 5" or "block.number == 100000" - the answer is obvious
+            const leftIsTrivial = binOp.vLeftExpression instanceof solc_typed_ast_1.Identifier || binOp.vLeftExpression instanceof solc_typed_ast_1.MemberAccess;
+            const rightIsTrivial = binOp.vRightExpression instanceof solc_typed_ast_1.Identifier || binOp.vRightExpression instanceof solc_typed_ast_1.MemberAccess;
+            const leftIsLiteral = binOp.vLeftExpression instanceof solc_typed_ast_1.Literal;
+            const rightIsLiteral = binOp.vRightExpression instanceof solc_typed_ast_1.Literal;
+            // Check if right side is an enum value (MemberAccess with type reference)
+            const rightIsEnum = binOp.vRightExpression instanceof solc_typed_ast_1.MemberAccess &&
+                binOp.vRightExpression.vExpression instanceof solc_typed_ast_1.Identifier &&
+                /^[A-Z]/.test(binOp.vRightExpression.vExpression.name); // Enum types typically start with uppercase
+            const leftIsEnum = binOp.vLeftExpression instanceof solc_typed_ast_1.MemberAccess &&
+                binOp.vLeftExpression.vExpression instanceof solc_typed_ast_1.Identifier &&
+                /^[A-Z]/.test(binOp.vLeftExpression.vExpression.name);
+            if (leftIsTrivial && (rightIsLiteral || rightIsEnum)) {
+                continue;
+            }
+            // Also skip the reverse: "5 == x" or "ProposalState.Approved == p.state"
+            if (rightIsTrivial && (leftIsLiteral || leftIsEnum)) {
+                continue;
+            }
+            const exprStr = getExpressionString(binOp);
+            // Extract variables from both sides
+            const leftVars = extractVariables(binOp.vLeftExpression);
+            const rightVars = extractVariables(binOp.vRightExpression);
+            const allVars = [...leftVars, ...rightVars];
+            // Only solve if there's exactly one unique variable
+            const uniqueVars = new Map();
+            for (const v of allVars) {
+                // Skip if the "variable" is actually a literal-like number
+                if (/^\d+$/.test(v.name))
+                    continue;
+                uniqueVars.set(v.name, { type: v.type, node: v.node });
+            }
+            if (uniqueVars.size !== 1) {
+                continue;
+            }
+            const [varName, varInfo] = [...uniqueVars.entries()][0];
+            const bitSize = getBitSize(varInfo.type);
+            const signed = isSigned(varInfo.type);
+            const varMap = new Map();
+            const z3Var = ctx.BitVec.const(varName, bitSize);
+            varMap.set(varName, z3Var);
+            const constraint = createZ3Constraint(ctx, binOp, varMap, bitSize, signed);
+            if (!constraint) {
+                continue;
+            }
+            const result = await solveConstraint(ctx, constraint, varMap, bitSize, signed);
+            if (!result) {
+                continue;
+            }
+            for (const [name, value] of result) {
+                solutions.push({
+                    variable: name,
+                    value: value.toString(),
+                    type: varInfo.type.replace(/\s+/g, ''),
+                    expression: exprStr
+                });
+            }
+        }
+    }
+    catch (e) {
+        // Z3 errors are non-fatal
+        if (!silentMode) {
+            console.warn(`[z3] Warning: ${e}`);
+        }
+    }
+    return solutions;
+};
+exports.findZ3Solutions = findZ3Solutions;
+const getExpressionString = (expr) => {
+    if (expr instanceof solc_typed_ast_1.Literal) {
+        return expr.value || '0';
+    }
+    if (expr instanceof solc_typed_ast_1.Identifier) {
+        return expr.name;
+    }
+    if (expr instanceof solc_typed_ast_1.IndexAccess) {
+        const base = getExpressionString(expr.vBaseExpression);
+        const index = expr.vIndexExpression ? getExpressionString(expr.vIndexExpression) : '0';
+        return `${base}[${index}]`;
+    }
+    if (expr instanceof solc_typed_ast_1.MemberAccess) {
+        const base = getExpressionString(expr.vExpression);
+        return `${base}.${expr.memberName}`;
+    }
+    if (expr instanceof solc_typed_ast_1.FunctionCall) {
+        const fn = getExpressionString(expr.vExpression);
+        const args = expr.vArguments.map(a => getExpressionString(a)).join(', ');
+        return `${fn}(${args})`;
+    }
+    if (expr instanceof solc_typed_ast_1.UnaryOperation) {
+        const sub = getExpressionString(expr.vSubExpression);
+        if (expr.prefix) {
+            return `${expr.operator}${sub}`;
+        }
+        return `${sub}${expr.operator}`;
+    }
+    if (expr instanceof solc_typed_ast_1.BinaryOperation) {
+        const left = getExpressionString(expr.vLeftExpression);
+        const right = getExpressionString(expr.vRightExpression);
+        return `(${left} ${expr.operator} ${right})`;
+    }
+    if (expr instanceof solc_typed_ast_1.TupleExpression) {
+        // TupleExpression with single component is just parentheses
+        if (expr.vComponents.length === 1 && expr.vComponents[0]) {
+            return getExpressionString(expr.vComponents[0]);
+        }
+        // Multi-component tuple
+        return `(${expr.vComponents.map(c => c ? getExpressionString(c) : '').join(', ')})`;
+    }
+    return '?';
+};
+const cleanupZ3 = async () => {
+    if (z3Context) {
+        // Z3 context cleanup if needed
+        z3Context = null;
+    }
+};
+exports.cleanupZ3 = cleanupZ3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "recon-generate",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "CLI to scaffold Recon fuzzing suite inside Foundry projects",
   "main": "dist/index.js",
   "bin": {
@@ -26,7 +26,8 @@
     "handlebars": "^4.7.8",
     "solc-typed-ast": "^19.1.0",
     "src-location": "^1.1.0",
-    "yaml": "^2.8.2"
+    "yaml": "^2.8.2",
+    "z3-solver": "^4.15.4"
   },
   "devDependencies": {
     "@types/node": "^24.0.4",