recon-generate 0.0.17 → 0.0.19

package/dist/cfg/builder.js

@@ -0,0 +1,1295 @@
+"use strict";
+/**
+ * CFG Builder - Transforms Solidity AST into Control Flow Graph
+ *
+ * Key features:
+ * - Enumerates ALL paths (for "n total, m covered" tracking)
+ * - Each branch creates a CoverageEdge
+ * - External calls marked for oracle integration
+ * - Supports forward/backward/mid-point solving
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CFGBuilder = void 0;
+const solc_typed_ast_1 = require("solc-typed-ast");
+const types_1 = require("./types");
+const utils_1 = require("../utils");
+const ethers_1 = require("ethers");
+// ============================================================================
+// Main Builder Class
+// ============================================================================
+class CFGBuilder {
+    constructor() {
+        this.ctx = {
+            counter: new Map(),
+            types: new Map(),
+            blockCounter: 0,
+            pathCounter: 0,
+            edgeCounter: 0
+        };
+        this.blocks = new Map();
+        this.edges = [];
+        this.paths = [];
+        this.externalCalls = [];
+        this.ternaryEdges = [];
+        this.loops = [];
+        this.hasKeccak = false;
+        this.inUnchecked = false;
+        this.currentFunction = '';
+        this.contract = null;
+        this.ternaryCounter = 0;
+        this.loopCounter = 0;
+    }
+    /**
+     * Build CFG for a contract from CallTreeData
+     */
+    buildContract(contract, callTrees) {
+        this.contract = contract;
+        const functions = [];
+        for (const ctData of callTrees) {
+            if (ctData.contract !== contract.name)
+                continue;
+            const funcCFG = this.buildFunction(ctData.function, ctData.callTree);
+            functions.push(funcCFG);
+        }
+        // Extract state variables with storage slot computation
+        // IMPORTANT: Solidity storage layout follows C3 linearization order
+        // Parent contract state vars come FIRST, then child contract vars
+        // We use forwardLinearization which gives us [child, parent1, parent2, ...]
+        // So we process in REVERSE order to get correct slot assignments
+        //
+        // MUTABILITY:
+        // - constant: Compile-time constant, embedded in bytecode, no slot
+        // - immutable: Set in constructor, stored in bytecode, no slot
+        // - mutable: Regular storage variable, has slot
+        const stateVars = [];
+        const mappings = [];
+        const constants = [];
+        const immutables = [];
+        let currentSlot = 0;
+        // Get all contracts in linearization order and reverse to process parents first
+        const linearized = (0, utils_1.forwardLinearization)(contract);
+        const contractsInStorageOrder = [...linearized].reverse();
+        // Track seen variable names to avoid duplicates from overrides
+        const seenVars = new Set();
+        for (const c of contractsInStorageOrder) {
+            for (const v of c.vStateVariables) {
+                // Skip if we've already seen this var name (override)
+                if (seenVars.has(v.name))
+                    continue;
+                seenVars.add(v.name);
+                const typeStr = v.typeString || 'unknown';
+                const contractName = c.name;
+                // Handle constant variables - no storage slot, value known at compile time
+                if (v.mutability === solc_typed_ast_1.Mutability.Constant) {
+                    let constValue;
+                    if (v.vValue) {
+                        // Try to extract the constant value
+                        constValue = this.tryExtractConstantValue(v.vValue);
+                    }
+                    constants.push({
+                        name: v.name,
+                        type: typeStr,
+                        value: constValue,
+                        contract: contractName
+                    });
+                    continue; // No storage slot for constants
+                }
+                // Handle immutable variables - no storage slot, set in constructor
+                if (v.mutability === solc_typed_ast_1.Mutability.Immutable) {
+                    immutables.push({
+                        name: v.name,
+                        type: typeStr,
+                        contract: contractName
+                    });
+                    continue; // No storage slot for immutables
+                }
+                // Regular mutable state variables - have storage slots
+                if (typeStr.startsWith('mapping')) {
+                    // Parse mapping(K => V)
+                    const match = typeStr.match(/mapping\((\w+)\s*=>\s*(.+)\)/);
+                    if (match) {
+                        mappings.push({
+                            name: v.name,
+                            keyType: match[1],
+                            valueType: match[2].trim(),
+                            slot: currentSlot,
+                            contract: contractName
+                        });
+                    }
+                    currentSlot++; // Mappings use one slot for base
+                }
+                else if (typeStr.includes('[]')) {
+                    // Dynamic array - uses one slot for length
+                    stateVars.push({ name: v.name, type: typeStr, slot: currentSlot, contract: contractName });
+                    currentSlot++;
+                }
+                else {
+                    // Simple type - compute slot based on type size
+                    const typeSize = this.getTypeSlots(typeStr);
+                    stateVars.push({ name: v.name, type: typeStr, slot: currentSlot, contract: contractName });
+                    currentSlot += typeSize;
+                }
+            }
+        }
+        // Build variable roles map
+        const varRoles = this.buildVarRoles(contract, functions, stateVars, mappings);
+        const totalPaths = functions.reduce((sum, f) => sum + f.paths.length, 0);
+        const totalEdges = functions.reduce((sum, f) => sum + f.edges.length, 0);
+        return {
+            name: contract.name,
+            solidityVersion: '0.8.x', // TODO: extract from pragma
+            stateVars,
+            mappings,
+            functions,
+            totalPaths,
+            totalEdges,
+            oracle: [],
+            varRoles,
+            constants,
+            immutables
+        };
+    }
+    /**
+     * Try to extract a constant value from an expression
+     */
+    tryExtractConstantValue(expr) {
+        if (expr instanceof solc_typed_ast_1.Literal) {
+            return expr.value;
+        }
+        // For more complex constant expressions, we could evaluate them
+        // For now, just return the source representation
+        try {
+            return (0, utils_1.toSource)(expr);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Get number of storage slots a type uses
+     */
+    getTypeSlots(typeStr) {
+        // Most types fit in one slot (32 bytes)
+        // Structs and fixed arrays may use more
+        if (typeStr.includes('struct')) {
+            // Simplified: assume 1 slot per struct (would need ABI for accurate count)
+            return 1;
+        }
+        if (typeStr.match(/\[\d+\]/)) {
+            // Fixed array - extract size
+            const match = typeStr.match(/\[(\d+)\]/);
+            if (match) {
+                return parseInt(match[1]);
+            }
+        }
+        return 1;
+    }
+    /**
+     * Build variable roles map from functions and state variables
+     */
+    buildVarRoles(contract, functions, stateVars, mappings) {
+        const roles = new Map();
+        // State variables
+        for (const sv of stateVars) {
+            roles.set(sv.name, {
+                name: sv.name,
+                baseName: sv.name,
+                role: 'state',
+                type: sv.type,
+                slot: sv.slot
+            });
+        }
+        // Mappings
+        for (const m of mappings) {
+            roles.set(m.name, {
+                name: m.name,
+                baseName: m.name,
+                role: 'state',
+                type: `mapping(${m.keyType} => ${m.valueType})`,
+                slot: m.slot,
+                isMapping: true,
+                keyTypes: [m.keyType]
+            });
+        }
+        // Global variables
+        const globals = [
+            { name: 'msg_sender', type: 'address' },
+            { name: 'msg_value', type: 'uint256' },
+            { name: 'msg_data', type: 'bytes' },
+            { name: 'block_timestamp', type: 'uint256' },
+            { name: 'block_number', type: 'uint256' },
+            { name: 'block_coinbase', type: 'address' },
+            { name: 'block_difficulty', type: 'uint256' },
+            { name: 'block_gaslimit', type: 'uint256' },
+            { name: 'block_basefee', type: 'uint256' },
+            { name: 'tx_origin', type: 'address' },
+            { name: 'tx_gasprice', type: 'uint256' },
+        ];
+        for (const g of globals) {
+            roles.set(g.name, {
+                name: g.name,
+                baseName: g.name,
+                role: 'global',
+                type: g.type
+            });
+        }
+        // Function parameters and locals (from functions)
+        for (const func of functions) {
+            // Parameters are inputs
+            for (const p of func.params) {
+                // SSA version will be param_1, param_2, etc.
+                for (let v = 1; v <= 10; v++) {
+                    const ssaName = `${p.name}_${v}`;
+                    roles.set(ssaName, {
+                        name: ssaName,
+                        baseName: p.name,
+                        role: 'input',
+                        type: p.type
+                    });
+                }
+            }
+            // Local variables defined in let statements
+            for (const block of func.blocks.values()) {
+                for (const stmt of block.statements) {
+                    if (stmt.kind === 'let') {
+                        const baseName = stmt.name.replace(/_\d+$/, '');
+                        // Check if it's a state var read or a local
+                        const isStateVar = stateVars.some(sv => sv.name === baseName) ||
+                            mappings.some(m => m.name === baseName);
+                        if (!isStateVar) {
+                            roles.set(stmt.name, {
+                                name: stmt.name,
+                                baseName,
+                                role: 'local',
+                                type: stmt.type
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return roles;
+    }
+    /**
+     * Build CFG for a single function
+     */
+    buildFunction(func, callTree) {
+        // Reset state
+        this.ctx = {
+            counter: new Map(),
+            types: new Map(),
+            blockCounter: 0,
+            pathCounter: 0,
+            edgeCounter: 0
+        };
+        this.blocks = new Map();
+        this.edges = [];
+        this.paths = [];
+        this.externalCalls = [];
+        this.ternaryEdges = [];
+        this.loops = [];
+        this.ternaryCounter = 0;
+        this.loopCounter = 0;
+        this.hasKeccak = false;
+        this.currentFunction = func.name;
+        // Initialize parameters as SSA variables
+        const params = [];
+        for (const p of func.vParameters.vParameters) {
+            const type = p.typeString || 'uint256';
+            (0, types_1.freshSSA)(this.ctx, p.name, type);
+            params.push({ name: p.name, type });
+        }
+        // Returns
+        const returns = [];
+        for (const r of func.vReturnParameters.vParameters) {
+            returns.push({ name: r.name || undefined, type: r.typeString || 'uint256' });
+        }
+        // Build CFG from function body
+        const entryBlock = (0, types_1.newBlock)(this.ctx);
+        if (func.vBody) {
+            const exitBlock = this.processBlock(func.vBody, entryBlock, null);
+            // Ensure the exit block has a proper terminator (implicit return if missing)
+            const exitBlockData = this.blocks.get(exitBlock);
+            if (exitBlockData && exitBlockData.terminator.kind === 'jump' && exitBlockData.terminator.target === '') {
+                // Implicit return at end of function
+                exitBlockData.terminator = { kind: 'return', values: [] };
+            }
+        }
+        else {
+            // Abstract function - single empty block
+            this.blocks.set(entryBlock, {
+                id: entryBlock,
+                statements: [],
+                terminator: { kind: 'return', values: [] },
+                astIds: [func.id]
+            });
+        }
+        // Enumerate all complete paths
+        this.enumeratePaths(entryBlock);
+        // Extract internal calls from CallTree
+        const internalCalls = this.extractInternalCalls(callTree);
+        // Get selector
+        const selector = this.computeSelector(func);
+        return {
+            contract: this.contract.name,
+            name: func.name,
+            selector,
+            visibility: func.visibility,
+            params,
+            returns,
+            blocks: this.blocks,
+            entryBlock,
+            edges: [...this.edges, ...this.ternaryEdges], // Include ternary edges in main edges
+            paths: this.paths,
+            externalCalls: this.externalCalls,
+            hasKeccak: this.hasKeccak,
+            internalCalls,
+            modifiers: func.vModifiers.map(m => m.vModifierName.name),
+            ternaryEdges: this.ternaryEdges,
+            loops: this.loops
+        };
+    }
+    // ==========================================================================
+    // Statement Processing
+    // ==========================================================================
+    /**
+     * Process a block of statements, returns exit block ID
+     */
+    processBlock(block, currentBlockId, exitTarget) {
+        const wasUnchecked = this.inUnchecked;
+        if (block instanceof solc_typed_ast_1.UncheckedBlock) {
+            this.inUnchecked = true;
+        }
+        let blockId = currentBlockId;
+        // Ensure block exists
+        if (!this.blocks.has(blockId)) {
+            this.blocks.set(blockId, {
+                id: blockId,
+                statements: [],
+                terminator: { kind: 'jump', target: '' },
+                astIds: []
+            });
+        }
+        for (const stmt of block.vStatements) {
+            blockId = this.processStatement(stmt, blockId);
+        }
+        // If we have an exit target and the current block hasn't terminated
+        const currentBlock = this.blocks.get(blockId);
+        if (exitTarget && currentBlock.terminator.kind === 'jump' && currentBlock.terminator.target === '') {
+            currentBlock.terminator = { kind: 'jump', target: exitTarget };
+            this.addEdge(blockId, exitTarget, { kind: 'bool', value: true }, 'J');
+        }
+        this.inUnchecked = wasUnchecked;
+        return blockId;
+    }
+    /**
+     * Process a single statement, returns the block ID to continue from
+     */
+    processStatement(stmt, blockId) {
+        const block = this.blocks.get(blockId);
+        block.astIds.push(stmt.id);
+        if (stmt instanceof solc_typed_ast_1.IfStatement) {
+            return this.processIf(stmt, blockId);
+        }
+        if (stmt instanceof solc_typed_ast_1.WhileStatement) {
+            return this.processWhile(stmt, blockId);
+        }
+        if (stmt instanceof solc_typed_ast_1.ForStatement) {
+            return this.processFor(stmt, blockId);
+        }
+        if (stmt instanceof solc_typed_ast_1.Return) {
+            return this.processReturn(stmt, blockId);
+        }
+        if (stmt instanceof solc_typed_ast_1.RevertStatement) {
+            block.terminator = { kind: 'revert', reason: this.extractRevertReason(stmt) };
+            return blockId;
+        }
+        if (stmt instanceof solc_typed_ast_1.VariableDeclarationStatement) {
+            this.processVarDecl(stmt, block);
+            return blockId;
+        }
+        if (stmt instanceof solc_typed_ast_1.ExpressionStatement) {
+            this.processExprStmt(stmt, block);
+            return blockId;
+        }
+        if (stmt instanceof solc_typed_ast_1.Block) {
+            return this.processBlock(stmt, blockId, null);
+        }
+        if (stmt instanceof solc_typed_ast_1.UncheckedBlock) {
+            return this.processBlock(stmt, blockId, null);
+        }
+        if (stmt instanceof solc_typed_ast_1.PlaceholderStatement) {
+            block.terminator = { kind: 'placeholder' };
+            // Create continuation block
+            const nextBlock = (0, types_1.newBlock)(this.ctx);
+            this.blocks.set(nextBlock, {
+                id: nextBlock,
+                statements: [],
+                terminator: { kind: 'jump', target: '' },
+                astIds: []
+            });
+            return nextBlock;
+        }
+        // Unknown statement type - add as comment/skip
+        return blockId;
+    }
+    // ==========================================================================
+    // Control Flow
+    // ==========================================================================
+    processIf(stmt, blockId) {
+        const block = this.blocks.get(blockId);
+        // Convert condition to symbolic expression
+        const cond = this.exprToSym(stmt.vCondition);
+        // Create blocks for true/false branches
+        const trueBlockId = (0, types_1.newBlock)(this.ctx);
+        const falseBlockId = (0, types_1.newBlock)(this.ctx);
+        const mergeBlockId = (0, types_1.newBlock)(this.ctx);
+        // Initialize blocks
+        this.blocks.set(trueBlockId, {
+            id: trueBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: mergeBlockId },
+            astIds: []
+        });
+        this.blocks.set(falseBlockId, {
+            id: falseBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: mergeBlockId },
+            astIds: []
+        });
+        this.blocks.set(mergeBlockId, {
+            id: mergeBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: '' },
+            astIds: []
+        });
+        // Set branch terminator
+        block.terminator = { kind: 'branch', cond, trueBlock: trueBlockId, falseBlock: falseBlockId };
+        // Add coverage edges
+        this.addEdge(blockId, trueBlockId, cond, 'T');
+        this.addEdge(blockId, falseBlockId, { kind: 'unop', op: 'not', arg: cond }, 'F');
+        // Process true branch - handle both Block and single Statement
+        if (stmt.vTrueBody instanceof solc_typed_ast_1.Block || stmt.vTrueBody instanceof solc_typed_ast_1.UncheckedBlock) {
+            this.processBlock(stmt.vTrueBody, trueBlockId, mergeBlockId);
+        }
+        else {
+            // Single statement - process directly
+            this.processStatement(stmt.vTrueBody, trueBlockId);
+            const tb = this.blocks.get(trueBlockId);
+            if (tb.terminator.kind === 'jump' && tb.terminator.target === '') {
+                tb.terminator = { kind: 'jump', target: mergeBlockId };
+            }
+        }
+        // Process false branch if exists
+        if (stmt.vFalseBody) {
+            if (stmt.vFalseBody instanceof solc_typed_ast_1.Block || stmt.vFalseBody instanceof solc_typed_ast_1.UncheckedBlock) {
+                this.processBlock(stmt.vFalseBody, falseBlockId, mergeBlockId);
+            }
+            else {
+                // Single statement
+                this.processStatement(stmt.vFalseBody, falseBlockId);
+                const fb = this.blocks.get(falseBlockId);
+                if (fb.terminator.kind === 'jump' && fb.terminator.target === '') {
+                    fb.terminator = { kind: 'jump', target: mergeBlockId };
+                }
+            }
+        }
+        else {
+            // No else - false block jumps directly to merge
+            const fb = this.blocks.get(falseBlockId);
+            fb.terminator = { kind: 'jump', target: mergeBlockId };
+        }
+        return mergeBlockId;
+    }
+    processWhile(stmt, blockId) {
+        const block = this.blocks.get(blockId);
+        // Create blocks: header (condition check), body, exit
+        const headerBlockId = (0, types_1.newBlock)(this.ctx);
+        const bodyBlockId = (0, types_1.newBlock)(this.ctx);
+        const exitBlockId = (0, types_1.newBlock)(this.ctx);
+        // Jump to header
+        block.terminator = { kind: 'jump', target: headerBlockId };
+        this.addEdge(blockId, headerBlockId, { kind: 'bool', value: true }, 'J');
+        // Header block - condition check
+        const cond = this.exprToSym(stmt.vCondition);
+        this.blocks.set(headerBlockId, {
+            id: headerBlockId,
+            statements: [],
+            terminator: { kind: 'branch', cond, trueBlock: bodyBlockId, falseBlock: exitBlockId },
+            astIds: [stmt.vCondition.id]
+        });
+        this.addEdge(headerBlockId, bodyBlockId, cond, 'T');
+        this.addEdge(headerBlockId, exitBlockId, { kind: 'unop', op: 'not', arg: cond }, 'F');
+        // Body block
+        this.blocks.set(bodyBlockId, {
+            id: bodyBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: headerBlockId }, // Loop back
+            astIds: []
+        });
+        // Process body - handle both Block and single Statement
+        if (stmt.vBody instanceof solc_typed_ast_1.Block || stmt.vBody instanceof solc_typed_ast_1.UncheckedBlock) {
+            this.processBlock(stmt.vBody, bodyBlockId, headerBlockId);
+        }
+        else {
+            this.processStatement(stmt.vBody, bodyBlockId);
+            const bb = this.blocks.get(bodyBlockId);
+            if (bb.terminator.kind === 'jump' && bb.terminator.target === '') {
+                bb.terminator = { kind: 'jump', target: headerBlockId };
+            }
+        }
+        // Exit block
+        this.blocks.set(exitBlockId, {
+            id: exitBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: '' },
+            astIds: []
+        });
+        // Record loop info for symbolic reasoning
+        const loopId = `L${this.loopCounter++}`;
+        this.loops.push({
+            id: loopId,
+            headerBlock: headerBlockId,
+            exitBlock: exitBlockId,
+            condition: cond,
+            bodyBlocks: [bodyBlockId]
+        });
+        return exitBlockId;
+    }
+    processFor(stmt, blockId) {
+        const block = this.blocks.get(blockId);
+        // For loop: init; cond; post { body }
+        // Try to extract induction variable from init
+        let inductionVar;
+        let startValue;
+        // Process init in current block
+        if (stmt.vInitializationExpression) {
+            if (stmt.vInitializationExpression instanceof solc_typed_ast_1.VariableDeclarationStatement) {
+                const decls = stmt.vInitializationExpression.vDeclarations;
+                if (decls.length === 1) {
+                    inductionVar = (0, types_1.currentSSA)(this.ctx, decls[0].name);
+                    if (stmt.vInitializationExpression.vInitialValue) {
+                        startValue = this.exprToSym(stmt.vInitializationExpression.vInitialValue);
+                    }
+                }
+                this.processVarDecl(stmt.vInitializationExpression, block);
+                // Update inductionVar to the SSA version after processing
+                if (decls.length === 1) {
+                    inductionVar = (0, types_1.currentSSA)(this.ctx, decls[0].name);
+                }
+            }
+            else if (stmt.vInitializationExpression instanceof solc_typed_ast_1.ExpressionStatement) {
+                this.processExprStmt(stmt.vInitializationExpression, block);
+            }
+        }
+        // Create blocks
+        const headerBlockId = (0, types_1.newBlock)(this.ctx);
+        const bodyBlockId = (0, types_1.newBlock)(this.ctx);
+        const postBlockId = (0, types_1.newBlock)(this.ctx);
+        const exitBlockId = (0, types_1.newBlock)(this.ctx);
+        // Jump to header
+        block.terminator = { kind: 'jump', target: headerBlockId };
+        this.addEdge(blockId, headerBlockId, { kind: 'bool', value: true }, 'J');
+        // Header - condition check
+        const cond = stmt.vCondition
+            ? this.exprToSym(stmt.vCondition)
+            : { kind: 'bool', value: true };
+        // Try to extract bound from condition (e.g., i < n)
+        let bound;
+        if (cond.kind === 'binop' && (cond.op === 'lt' || cond.op === 'le')) {
+            bound = cond.right;
+        }
+        this.blocks.set(headerBlockId, {
+            id: headerBlockId,
+            statements: [],
+            terminator: { kind: 'branch', cond, trueBlock: bodyBlockId, falseBlock: exitBlockId },
+            astIds: stmt.vCondition ? [stmt.vCondition.id] : []
+        });
+        this.addEdge(headerBlockId, bodyBlockId, cond, 'T');
+        this.addEdge(headerBlockId, exitBlockId, { kind: 'unop', op: 'not', arg: cond }, 'F');
+        // Body
+        this.blocks.set(bodyBlockId, {
+            id: bodyBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: postBlockId },
+            astIds: []
+        });
+        // Handle both Block and single statement bodies
+        if (stmt.vBody instanceof solc_typed_ast_1.Block || stmt.vBody instanceof solc_typed_ast_1.UncheckedBlock) {
+            this.processBlock(stmt.vBody, bodyBlockId, postBlockId);
+        }
+        else {
+            // Single statement body (not a block)
+            this.processStatement(stmt.vBody, bodyBlockId);
+            // Fix terminator if still empty
+            const bb = this.blocks.get(bodyBlockId);
+            if (bb.terminator.kind === 'jump' && bb.terminator.target === postBlockId) {
+                // Already correct
+            }
+            else if (bb.terminator.kind === 'jump' && bb.terminator.target === '') {
+                bb.terminator = { kind: 'jump', target: postBlockId };
+            }
+        }
+        // Post (loop increment)
+        this.blocks.set(postBlockId, {
+            id: postBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: headerBlockId },
+            astIds: []
+        });
+        if (stmt.vLoopExpression) {
+            this.processExprStmt(stmt.vLoopExpression, this.blocks.get(postBlockId));
+        }
+        // Exit
+        this.blocks.set(exitBlockId, {
+            id: exitBlockId,
+            statements: [],
+            terminator: { kind: 'jump', target: '' },
+            astIds: []
+        });
+        // Record loop info for symbolic reasoning
+        const loopId = `L${this.loopCounter++}`;
+        this.loops.push({
+            id: loopId,
+            headerBlock: headerBlockId,
+            exitBlock: exitBlockId,
+            condition: cond,
+            inductionVar,
+            bound,
+            bodyBlocks: [bodyBlockId, postBlockId]
+        });
+        return exitBlockId;
+    }
+    processReturn(stmt, blockId) {
+        const block = this.blocks.get(blockId);
+        const values = [];
+        if (stmt.vExpression) {
+            if (stmt.vExpression instanceof solc_typed_ast_1.TupleExpression) {
+                for (const comp of stmt.vExpression.vComponents) {
+                    if (comp)
+                        values.push(this.exprToSym(comp));
+                }
+            }
+            else {
+                values.push(this.exprToSym(stmt.vExpression));
+            }
+        }
+        block.terminator = { kind: 'return', values };
+        return blockId;
+    }
+    // ==========================================================================
+    // Variable/Expression Processing
+    // ==========================================================================
+    processVarDecl(stmt, block) {
+        const decls = stmt.vDeclarations;
+        const init = stmt.vInitialValue;
+        if (decls.length === 1 && init) {
+            const decl = decls[0];
+            const type = decl.typeString || 'uint256';
+            const name = (0, types_1.freshSSA)(this.ctx, decl.name, type);
+            const expr = this.exprToSym(init);
+            block.statements.push({ kind: 'let', name, type, expr });
+        }
+        else if (decls.length > 1 && init) {
+            // Tuple assignment
+            for (let i = 0; i < decls.length; i++) {
+                const decl = decls[i];
+                if (decl) {
+                    const type = decl.typeString || 'uint256';
+                    const name = (0, types_1.freshSSA)(this.ctx, decl.name, type);
+                    // Extract i-th component
+                    const expr = {
+                        kind: 'field',
+                        base: this.exprToSym(init),
+                        field: `_${i}`
+                    };
+                    block.statements.push({ kind: 'let', name, type, expr });
+                }
+            }
+        }
+    }
+    processExprStmt(stmt, block) {
+        const expr = stmt.vExpression;
+        if (expr instanceof solc_typed_ast_1.Assignment) {
+            this.processAssignment(expr, block);
+        }
+        else if (expr instanceof solc_typed_ast_1.FunctionCall) {
+            this.processFunctionCall(expr, block);
+        }
+        else if (expr instanceof solc_typed_ast_1.UnaryOperation) {
+            // Could be ++/-- which modify state
+            this.processUnaryOp(expr, block);
+        }
+    }
+    processAssignment(expr, block) {
+        const lhs = expr.vLeftHandSide;
+        const rhs = this.exprToSym(expr.vRightHandSide);
+        if (lhs instanceof solc_typed_ast_1.Identifier) {
+            // Simple variable assignment
+            const type = lhs.typeString || 'uint256';
+            // For compound assignments (+=, -=, etc.), get the OLD SSA name BEFORE incrementing
+            const oldName = (0, types_1.currentSSA)(this.ctx, lhs.name);
+            // Now create the new SSA version
+            const name = (0, types_1.freshSSA)(this.ctx, lhs.name, type);
+            // Handle compound assignments (+=, -=, etc.)
+            let value = rhs;
+            if (expr.operator !== '=') {
+                const op = this.compoundOpToBinOp(expr.operator);
+                if (op) {
+                    value = {
+                        kind: 'binop',
+                        op,
+                        left: { kind: 'var', name: oldName, type }, // Use the OLD version
+                        right: rhs,
+                        checked: !this.inUnchecked,
+                        signed: this.isSigned(type)
+                    };
+                }
+            }
+            block.statements.push({ kind: 'let', name, type, expr: value });
+        }
+        else if (lhs instanceof solc_typed_ast_1.IndexAccess) {
+            // Array/mapping assignment: arr[idx] = value or arr[idx] += value
+            const array = this.exprToSym(lhs.vBaseExpression);
+            const index = this.exprToSym(lhs.vIndexExpression);
+            // Handle compound assignments (+=, -=, etc.)
+            let value = rhs;
+            if (expr.operator !== '=') {
+                const op = this.compoundOpToBinOp(expr.operator);
+                if (op) {
+                    // For compound assignment, need to read the old value first
+                    const oldValue = { kind: 'select', array, index };
+                    value = {
+                        kind: 'binop',
+                        op,
+                        left: oldValue,
+                        right: rhs,
+                        checked: !this.inUnchecked,
+                        signed: this.isSigned(lhs.typeString || 'uint256')
+                    };
+                }
+            }
+            block.statements.push({ kind: 'store', target: array, index, value });
+        }
+        else if (lhs instanceof solc_typed_ast_1.MemberAccess) {
+            // Struct field or state var via this
+            const base = this.exprToSym(lhs.vExpression);
+            const index = { kind: 'lit', value: lhs.memberName, type: 'string' };
+            // Handle compound assignment (+=, -=, etc.) for member access
+            let value = rhs;
+            if (expr.operator !== '=') {
+                const op = this.compoundOpToBinOp(expr.operator);
+                if (op) {
+                    const oldValue = { kind: 'select', array: base, index };
+                    value = {
+                        kind: 'binop',
+                        op,
+                        left: oldValue,
+                        right: rhs,
+                        checked: !this.inUnchecked,
+                        signed: this.isSigned(lhs.typeString || 'uint256')
+                    };
+                }
+            }
+            // Model as store with field name as "index"
+            block.statements.push({
+                kind: 'store',
+                target: base,
+                index,
+                value
+            });
+        }
+    }
+    processFunctionCall(call, block) {
+        // Check if it's require/assert
+        if (call.vExpression instanceof solc_typed_ast_1.Identifier) {
+            const name = call.vExpression.name;
+            if (name === 'require' || name === 'assert') {
+                const cond = this.exprToSym(call.vArguments[0]);
+                const reason = call.vArguments.length > 1
+                    ? this.extractStringLiteral(call.vArguments[1])
+                    : undefined;
+                // Generate a revert edge ID for tracking
+                const revertEdgeId = `${this.currentFunction}_${name}${this.ctx.edgeCounter++}_revert`;
+                block.statements.push({ kind: 'assume', cond, reason, revertEdge: revertEdgeId });
+                // Add coverage edges for require/assert conditions
+                // These allow the solver to target specific require failures
+                // T edge: condition is true (continue execution)
+                // F edge: condition is false (revert) - this is the revert edge
+                this.edges.push({
+                    id: `${this.currentFunction}_B${block.id.slice(1)}_${name}${this.ctx.edgeCounter - 1}_T`,
+                    from: block.id,
+                    to: block.id, // Same block - continue execution
+                    condition: cond,
+                    functionName: this.currentFunction,
+                    astId: call.id
+                });
+                this.edges.push({
+                    id: revertEdgeId.replace('_revert', '_F'), // Use consistent naming
+                    from: block.id,
+                    to: 'REVERT', // Special marker for revert
+                    condition: { kind: 'unop', op: 'not', arg: cond },
+                    functionName: this.currentFunction,
+                    astId: call.id
+                });
+                return;
+            }
+        }
+        // Regular function call
+        const sym = this.exprToSym(call);
+        if (sym.kind === 'call' || sym.kind === 'external_return') {
+            block.statements.push({ kind: 'call', expr: sym });
+        }
+    }
+    processUnaryOp(expr, block) {
+        // Handle ++/--
+        if (expr.operator === '++' || expr.operator === '--') {
+            const operand = expr.vSubExpression;
+            if (operand instanceof solc_typed_ast_1.Identifier) {
+                const type = operand.typeString || 'uint256';
+                const oldName = (0, types_1.currentSSA)(this.ctx, operand.name);
+                const newName = (0, types_1.freshSSA)(this.ctx, operand.name, type);
+                const op = expr.operator === '++' ? 'add' : 'sub';
+                block.statements.push({
+                    kind: 'let',
+                    name: newName,
+                    type,
+                    expr: {
+                        kind: 'binop',
+                        op,
+                        left: { kind: 'var', name: oldName, type },
+                        right: { kind: 'lit', value: '1', type },
+                        checked: !this.inUnchecked,
+                        signed: this.isSigned(type)
+                    }
+                });
+            }
+        }
+    }
+    // ==========================================================================
+    // Expression to Symbolic
+    // ==========================================================================
+    exprToSym(expr) {
+        if (expr instanceof solc_typed_ast_1.Identifier) {
+            const type = expr.typeString || 'uint256';
+            return { kind: 'var', name: (0, types_1.currentSSA)(this.ctx, expr.name), type };
+        }
+        if (expr instanceof solc_typed_ast_1.Literal) {
+            const type = expr.typeString || 'uint256';
+            const value = expr.value || '0';
+            if (type === 'bool') {
+                return { kind: 'bool', value: value === 'true' };
+            }
+            // Convert to hex if numeric
+            if (/^\d+$/.test(value)) {
+                return { kind: 'lit', value: '0x' + BigInt(value).toString(16), type };
+            }
+            return { kind: 'lit', value, type };
+        }
+        if (expr instanceof solc_typed_ast_1.BinaryOperation) {
+            const op = this.solOpToBinOp(expr.operator);
+            if (!op) {
+                return { kind: 'lit', value: '0', type: 'uint256' }; // Unsupported
+            }
+            return {
+                kind: 'binop',
+                op,
+                left: this.exprToSym(expr.vLeftExpression),
+                right: this.exprToSym(expr.vRightExpression),
+                checked: !this.inUnchecked,
+                signed: this.isSigned(expr.typeString || '')
+            };
+        }
+        if (expr instanceof solc_typed_ast_1.UnaryOperation) {
+            const op = this.solOpToUnOp(expr.operator);
+            if (op) {
+                return { kind: 'unop', op, arg: this.exprToSym(expr.vSubExpression) };
+            }
+        }
+        if (expr instanceof solc_typed_ast_1.IndexAccess) {
+            return {
+                kind: 'select',
+                array: this.exprToSym(expr.vBaseExpression),
+                index: this.exprToSym(expr.vIndexExpression)
+            };
+        }
+        if (expr instanceof solc_typed_ast_1.MemberAccess) {
+            // Check for msg.sender, block.timestamp, etc.
+            if (expr.vExpression instanceof solc_typed_ast_1.Identifier) {
+                const base = expr.vExpression.name;
+                if (base === 'msg' || base === 'block' || base === 'tx') {
+                    return { kind: 'var', name: `${base}_${expr.memberName}`, type: this.getEnvType(base, expr.memberName) };
+                }
+            }
+            return {
+                kind: 'field',
+                base: this.exprToSym(expr.vExpression),
+                field: expr.memberName
+            };
+        }
+        if (expr instanceof solc_typed_ast_1.Conditional) {
+            // Generate coverage edges for ternary expressions
+            const cond = this.exprToSym(expr.vCondition);
+            const ternaryId = this.ternaryCounter++;
+            const trueEdgeId = `${this.currentFunction}_ternary${ternaryId}_T`;
+            const falseEdgeId = `${this.currentFunction}_ternary${ternaryId}_F`;
+            // Add ternary edges for coverage tracking
+            this.ternaryEdges.push({
+                id: trueEdgeId,
+                from: `ternary${ternaryId}`,
+                to: 'then',
+                condition: cond,
+                functionName: this.currentFunction,
+                astId: expr.id
+            });
+            this.ternaryEdges.push({
+                id: falseEdgeId,
+                from: `ternary${ternaryId}`,
+                to: 'else',
+                condition: { kind: 'unop', op: 'not', arg: cond },
+                functionName: this.currentFunction,
+                astId: expr.id
+            });
+            return {
+                kind: 'ite',
+                cond,
+                then: this.exprToSym(expr.vTrueExpression),
+                else: this.exprToSym(expr.vFalseExpression)
+            };
+        }
+        if (expr instanceof solc_typed_ast_1.FunctionCall) {
+            return this.functionCallToSym(expr);
+        }
+        if (expr instanceof solc_typed_ast_1.TupleExpression) {
+            // Single element tuple - unwrap
+            const comps = expr.vComponents.filter(c => c !== null);
+            if (comps.length === 1) {
+                return this.exprToSym(comps[0]);
+            }
+        }
+        // Fallback
+        return { kind: 'lit', value: '0', type: 'uint256' };
+    }
+    functionCallToSym(call) {
+        // Check for keccak256
+        if (call.vExpression instanceof solc_typed_ast_1.Identifier && call.vExpression.name === 'keccak256') {
+            this.hasKeccak = true;
+            return { kind: 'keccak', arg: this.exprToSym(call.vArguments[0]) };
+        }
+        // Check for type conversion
+        if (call.kind === solc_typed_ast_1.FunctionCallKind.TypeConversion) {
+            const toType = call.typeString || 'uint256';
+            return { kind: 'cast', toType, arg: this.exprToSym(call.vArguments[0]) };
+        }
+        // Check if external call
+        if (this.isExternalCall(call)) {
+            const { target, method } = this.extractCallTarget(call);
+            const args = call.vArguments.map(a => this.exprToSym(a));
+            const ssaId = (0, types_1.freshSSA)(this.ctx, `ext_${target}_${method.split('(')[0]}`, call.typeString || 'uint256');
+            this.externalCalls.push({ target, method, ssaVar: ssaId });
+            return {
+                kind: 'external_return',
+                target,
+                method,
+                args,
+                ssaId
+            };
+        }
+        // Internal/library call
+        const { target, method } = this.extractCallTarget(call);
+        const args = call.vArguments.map(a => this.exprToSym(a));
+        return {
+            kind: 'call',
+            target,
+            method,
+            args,
+            callType: this.getCallType(call)
+        };
+    }
+    // ==========================================================================
+    // Path Enumeration
+    // ==========================================================================
+    /**
+     * Enumerate all paths from entry to any terminal block (return/revert)
+     */
+    enumeratePaths(entryBlock) {
+        const worklist = [{
+                currentBlock: entryBlock,
+                edges: [],
+                condition: { kind: 'bool', value: true }
+            }];
+        const visited = new Set();
+        const maxPaths = 100; // Keep paths small - edges are the key metric
+        const maxDepth = 50; // Limit path depth to avoid loop explosion
+        while (worklist.length > 0 && this.paths.length < maxPaths) {
+            const state = worklist.pop();
+            const block = this.blocks.get(state.currentBlock);
+            if (!block)
+                continue;
+            // Skip if path is too deep (loop protection)
+            if (state.edges.length > maxDepth)
+                continue;
+            // Check for loops - simple cycle detection
+            const pathKey = state.edges.join(',') + ':' + state.currentBlock;
+            if (visited.has(pathKey))
+                continue;
+            visited.add(pathKey);
+            const term = block.terminator;
+            if (term.kind === 'return') {
+                // Complete path - success
+                this.paths.push({
+                    id: (0, types_1.newPath)(this.ctx),
+                    edges: state.edges,
+                    entryBlock,
+                    exitBlock: state.currentBlock,
+                    pathCondition: state.condition,
+                    outcome: 'success',
+                    solvable: !this.hasKeccak
+                });
+            }
+            else if (term.kind === 'revert') {
+                // Complete path - revert
+                this.paths.push({
+                    id: (0, types_1.newPath)(this.ctx),
+                    edges: state.edges,
+                    entryBlock,
+                    exitBlock: state.currentBlock,
+                    pathCondition: state.condition,
+                    outcome: 'revert',
+                    solvable: !this.hasKeccak
+                });
+            }
+            else if (term.kind === 'branch') {
+                // Fork into two paths
+                const trueEdgeId = `${this.currentFunction}_${state.currentBlock}_T`;
+                const falseEdgeId = `${this.currentFunction}_${state.currentBlock}_F`;
+                // True branch
+                worklist.push({
+                    currentBlock: term.trueBlock,
+                    edges: [...state.edges, trueEdgeId],
+                    condition: this.andConditions(state.condition, term.cond)
+                });
+                // False branch
+                worklist.push({
+                    currentBlock: term.falseBlock,
+                    edges: [...state.edges, falseEdgeId],
+                    condition: this.andConditions(state.condition, { kind: 'unop', op: 'not', arg: term.cond })
+                });
+            }
+            else if (term.kind === 'jump') {
+                // Follow jump
+                if (term.target) {
+                    worklist.push({
+                        currentBlock: term.target,
+                        edges: state.edges,
+                        condition: state.condition
+                    });
+                }
+            }
+        }
+    }
+    andConditions(a, b) {
+        if (a.kind === 'bool' && a.value === true)
+            return b;
+        if (b.kind === 'bool' && b.value === true)
+            return a;
+        return { kind: 'binop', op: 'land', left: a, right: b, checked: false, signed: false };
+    }
+    // ==========================================================================
+    // Helper Methods
+    // ==========================================================================
+    addEdge(from, to, condition, dir) {
+        var _a;
+        const id = (0, types_1.newEdge)(this.ctx, this.currentFunction, from, dir);
+        this.edges.push({
+            id,
+            from,
+            to,
+            condition,
+            functionName: this.currentFunction,
+            astId: (_a = this.blocks.get(from)) === null || _a === void 0 ? void 0 : _a.astIds[0]
+        });
+    }
+    isExternalCall(call) {
+        // Check for .call, .delegatecall, or cross-contract calls
+        if (call.vExpression instanceof solc_typed_ast_1.MemberAccess) {
+            const memberName = call.vExpression.memberName;
+            if (memberName === 'call' || memberName === 'delegatecall' || memberName === 'staticcall') {
+                return true;
+            }
+            // Check if calling a different contract
+            const baseType = call.vExpression.vExpression.typeString || '';
+            if (baseType.startsWith('contract ') || baseType.startsWith('interface ')) {
+                return true;
+            }
+        }
+        return false;
+    }
+    extractCallTarget(call) {
+        if (call.vExpression instanceof solc_typed_ast_1.MemberAccess) {
+            const base = call.vExpression.vExpression;
+            const method = call.vExpression.memberName;
+            let target = 'unknown';
+            if (base instanceof solc_typed_ast_1.Identifier) {
+                target = base.name;
+                // Resolve 'super' to actual contract in linearization
+                if (target === 'super' && this.contract) {
+                    target = this.resolveSuperTarget(method);
+                }
+            }
+            else {
+                try {
+                    target = (0, utils_1.toSource)(base).slice(0, 32);
+                }
+                catch { }
+            }
+            return { target, method };
+        }
+        if (call.vExpression instanceof solc_typed_ast_1.Identifier) {
+            return { target: 'this', method: call.vExpression.name };
+        }
+        return { target: 'unknown', method: 'unknown' };
+    }
+    /**
+     * Resolve super.method() to actual contract name using C3 linearization
+     */
+    resolveSuperTarget(methodName) {
+        if (!this.contract)
+            return 'super';
+        // Get linearized base contracts (skip self which is first)
+        const linearized = this.contract.vLinearizedBaseContracts;
+        for (let i = 1; i < linearized.length; i++) {
+            const baseContract = linearized[i];
+            // Check if this base contract has the method
+            for (const fn of baseContract.vFunctions) {
+                if (fn.name === methodName) {
+                    return baseContract.name;
+                }
+            }
+        }
+        return 'super'; // Fallback if not found
+    }
+    getCallType(call) {
+        if (this.isExternalCall(call))
+            return 'external';
+        // Could add more sophisticated detection
+        return 'internal';
+    }
+    extractInternalCalls(callTree) {
+        const calls = [];
+        const visit = (node, parentContract) => {
+            var _a;
+            let callType = 'internal';
+            let contractName = this.contract.name;
+            if (node.definition instanceof solc_typed_ast_1.FunctionDefinition) {
+                const funcDef = node.definition;
+                const target = (0, utils_1.getSignature)(funcDef);
+                // Determine the contract this function belongs to
+                if (funcDef.vScope && funcDef.vScope instanceof solc_typed_ast_1.ContractDefinition) {
+                    contractName = funcDef.vScope.name;
+                }
+                // Detect call type
+                if (funcDef.isConstructor) {
+                    callType = 'constructor';
+                }
+                else if (funcDef.vScope && funcDef.vScope instanceof solc_typed_ast_1.ContractDefinition) {
+                    const funcContract = funcDef.vScope;
+                    // Check if it's a library call
+                    if (funcContract.kind === 'library') {
+                        callType = 'library';
+                    }
+                    // Check if it's a super call (function from parent contract)
+                    else if (funcContract.name !== this.contract.name &&
+                        ((_a = this.contract.vLinearizedBaseContracts) === null || _a === void 0 ? void 0 : _a.some(c => c && c.id === funcContract.id))) {
+                        callType = 'super';
+                    }
+                }
+                // Check if this is via ModifierInvocation (super constructor or base call)
+                if (node.fnCall && 'vModifierName' in node.fnCall) {
+                    if (funcDef.isConstructor) {
+                        callType = 'constructor';
+                    }
+                    else {
+                        callType = 'super';
+                    }
+                }
+                const args = node.callArgs.map(a => this.exprToSym(a));
+                calls.push({ target, contract: contractName, callType, args });
+            }
+            else if (node.definition instanceof solc_typed_ast_1.ModifierDefinition) {
+                const modDef = node.definition;
+                const target = modDef.name;
+                // Get contract for modifier
+                if (modDef.vScope && modDef.vScope instanceof solc_typed_ast_1.ContractDefinition) {
+                    contractName = modDef.vScope.name;
+                }
+                const args = node.callArgs.map(a => this.exprToSym(a));
+                calls.push({ target, contract: contractName, callType: 'modifier', args });
+            }
+            for (const child of node.children) {
+                visit(child, contractName);
+            }
+        };
+        for (const child of callTree.children) {
+            visit(child);
+        }
+        return calls;
+    }
+    computeSelector(func) {
+        // Compute proper Solidity function selector using keccak256
+        const sig = (0, utils_1.getSignature)(func);
+        const hash = (0, ethers_1.keccak256)((0, ethers_1.toUtf8Bytes)(sig));
+        return hash.slice(0, 10); // First 4 bytes = 8 hex chars + '0x'
+    }
+    solOpToBinOp(op) {
+        const map = {
+            '+': 'add', '-': 'sub', '*': 'mul', '/': 'div', '%': 'mod', '**': 'exp',
+            '==': 'eq', '!=': 'ne', '<': 'lt', '<=': 'le', '>': 'gt', '>=': 'ge',
+            '&': 'and', '|': 'or', '^': 'xor', '<<': 'shl', '>>': 'shr',
+            '&&': 'land', '||': 'lor'
+        };
+        return map[op] || null;
+    }
+    compoundOpToBinOp(op) {
+        const map = {
+            '+=': 'add', '-=': 'sub', '*=': 'mul', '/=': 'div', '%=': 'mod',
+            '&=': 'and', '|=': 'or', '^=': 'xor', '<<=': 'shl', '>>=': 'shr'
+        };
+        return map[op] || null;
+    }
+    solOpToUnOp(op) {
+        const map = {
+            '!': 'not', '-': 'neg', '~': 'bnot'
+        };
+        return map[op] || null;
+    }
+    isSigned(type) {
+        return /^int\d*$/.test(type.trim());
+    }
+    getEnvType(base, member) {
+        var _a;
+        const types = {
+            msg: { sender: 'address', value: 'uint256', data: 'bytes', sig: 'bytes4' },
+            block: { timestamp: 'uint256', number: 'uint256', basefee: 'uint256', chainid: 'uint256', coinbase: 'address' },
+            tx: { origin: 'address', gasprice: 'uint256' }
+        };
+        return ((_a = types[base]) === null || _a === void 0 ? void 0 : _a[member]) || 'uint256';
+    }
+    extractRevertReason(stmt) {
+        var _a;
+        try {
+            if (((_a = stmt.errorCall) === null || _a === void 0 ? void 0 : _a.vArguments.length) > 0) {
+                return this.extractStringLiteral(stmt.errorCall.vArguments[0]);
+            }
+        }
+        catch { }
+        return undefined;
+    }
+    extractStringLiteral(expr) {
+        if (expr instanceof solc_typed_ast_1.Literal && expr.kind === 'string') {
+            return expr.value;
+        }
+        return undefined;
+    }
+}
+exports.CFGBuilder = CFGBuilder;