certora-cli 8.13.1__tar.gz → 8.16.2__tar.gz

{certora_cli-8.13.1/certora_cli.egg-info → certora_cli-8.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: certora-cli
-Version: 8.13.1
+Version: 8.16.2
 Summary: Runner for the Certora Prover
 Home-page: https://pypi.org/project/certora-cli
 Author: Certora
@@ -38,4 +38,4 @@ Dynamic: requires-dist
 Dynamic: requires-python
 Dynamic: summary
 
-Commit deb4423.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.
+Commit 94b86f7.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.16.2/README.md

@@ -0,0 +1 @@
+Commit 94b86f7.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/CertoraProver/certoraBuild.py

@@ -1448,7 +1448,7 @@ class CertoraBuildGenerator:
             if not self.context.strict_solc_optimizer and self.get_solc_via_ir_value(contract_file_path):
                 # The default optimizer steps (taken from libsolidity/interface/OptimiserSettings.h) but with the
                 # full inliner step removed
-                solc0_8_34_to_0_8_34 = ("dfDvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLvifMCTUca[r]LSsTFOtfDnca[r]"
+                solc0_8_34_to_0_8_35 = ("dfDvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLvifMCTUca[r]LSsTFOtfDnca[r]"
                                         "IulcscCTUtvifMx[scCTUt]TOntnfDIulvifMjmul[jul]VcTOculjmul")
                 solc0_8_26_to_0_8_33 = ("dhfoDgvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLCTUca[r]LSsTFOtfDnca[r]" +
                                         "IulcscCTUtx[scCTUt]TOntnfDIuljmul[jul]VcTOculjmul")
@@ -1501,8 +1501,8 @@ class CertoraBuildGenerator:
                     yul_optimizer_steps = solc0_8_13_to_0_8_25
                 elif minor == 8 and 26 <= patch <= 33:
                     yul_optimizer_steps = solc0_8_26_to_0_8_33
-                elif minor == 8 and 34 <= patch <= 34:
-                    yul_optimizer_steps = solc0_8_34_to_0_8_34
+                elif minor == 8 and 34 <= patch <= 35:
+                    yul_optimizer_steps = solc0_8_34_to_0_8_35
                 assert yul_optimizer_steps is not None, \
                     'Yul Optimizer steps missing for requested Solidity version. Please contact Certora team.'
 
@@ -1839,6 +1839,42 @@ class CertoraBuildGenerator:
                         else:
                             raise Util.CertoraUserInputError(err_msg)
 
+    def _resolve_data_contracts_key(self,
+                                    contract_file: str,
+                                    compile_wd: Path,
+                                    data: Dict[str, Any],
+                                    resolved_to_orig: Optional[Dict[str, str]] = None,
+                                    ) -> str:
+        """Resolve which key in data[CONTRACTS] corresponds to ``contract_file``.
+
+        solc's standard-json output keys files in whatever form solc saw them — relative to
+        compile_wd, absolute, the raw input string, or (for symlinks) a previously seen original.
+        We try each in order and return the matching key. Raises if no form matches.
+
+        ``resolved_to_orig`` is optional: the worklist populates it from base contracts and link
+        references; the pre-worklist seed for the primary file passes ``None``.
+        """
+        contract_file_abs = str(Util.abs_norm_path(contract_file))
+        # using os.path.relpath because Path.relative_to cannot go up the directory tree (no ..)
+        contract_file_rel = os.path.relpath(Path(contract_file_abs), compile_wd)
+
+        build_logger.debug(f"available keys: {data[CONTRACTS].keys()}")
+        if contract_file_rel in data[CONTRACTS]:
+            return contract_file_rel
+        if contract_file_abs in data[CONTRACTS]:
+            return contract_file_abs
+        if contract_file in data[CONTRACTS]:
+            # when does this happen? Saw this in TrustToken on a package source file
+            return contract_file
+        orig = resolved_to_orig.get(contract_file) if resolved_to_orig is not None else None
+        if orig is not None and orig in data[CONTRACTS]:
+            return orig
+        # our file may be a symlink!
+        raise Exception(
+            f"Worklist contains {contract_file} (relative {contract_file_rel}, "
+            f"absolute {contract_file_abs}), resolved from {orig} "
+            f"that does not exist in contract set {orig in data[CONTRACTS] if orig else False}")
+
     def collect_for_file(self,
                          build_arg_contract_file: str,
                          file_index: int,
@@ -1986,6 +2022,12 @@ class CertoraBuildGenerator:
         contracts_with_libraries = {}
         file_compiler_path = compiler_collector.normalize_file_compiler_path_name(file_abs_path)
 
+        # Resolve the data[CONTRACTS] key for the primary file once, before the worklist runs.
+        # This is the (file, *) half of the primary contract-handle set used to scope the bytecode
+        # check inside get_bytecode — see the primary_contract_handles construction just below.
+        primary_file_key = self._resolve_data_contracts_key(str(Path(file_compiler_path)), compile_wd, data)
+        primary_contract_handles: Set[Tuple[str, str]] = {(primary_file_key, n) for n in contracts_in_file}
+
         # But apparently this heavily depends on the Solidity AST format anyway
 
         # Need to add all library dependencies that are in a different file:
@@ -1997,31 +2039,8 @@ class CertoraBuildGenerator:
             contract_file_obj = contracts_to_add_dependencies_queue.pop()
             contract_file = str(contract_file_obj)
             build_logger.debug(f"Processing dependencies from file {contract_file}")
-            # make sure path name is in posix format.
-            contract_file_abs = str(Util.abs_norm_path(contract_file))
-
-            # using os.path.relpath because Path.relative_to cannot go up the directory tree (no ..)
-            contract_file_rel = os.path.relpath(Path(contract_file_abs), compile_wd)
-
-            build_logger.debug(f"available keys: {data['contracts'].keys()}")
-            if contract_file_rel in data[CONTRACTS]:
-                contract_file = contract_file_rel
-                unsorted_contract_list = data[CONTRACTS][contract_file]
-            elif contract_file_abs in data[CONTRACTS]:
-                contract_file = contract_file_abs
-                unsorted_contract_list = data[CONTRACTS][contract_file_abs]
-            elif contract_file in data[CONTRACTS]:
-                # when does this happen? Saw this in TrustToken on a package source file
-                unsorted_contract_list = data[CONTRACTS][contract_file]
-            elif resolved_to_orig.get(contract_file) in data[CONTRACTS]:
-                unsorted_contract_list = data[CONTRACTS][resolved_to_orig[contract_file]]
-                contract_file = resolved_to_orig[contract_file]
-            else:
-                # our file may be a symlink!
-                raise Exception(
-                    f"Worklist contains {contract_file} (relative {contract_file_rel}, "
-                    f"absolute {contract_file_abs}), resolved from {resolved_to_orig.get(contract_file)} "
-                    f"that does not exist in contract set {resolved_to_orig.get(contract_file) in data['contracts']}")
+            contract_file = self._resolve_data_contracts_key(contract_file, compile_wd, data, resolved_to_orig)
+            unsorted_contract_list = data[CONTRACTS][contract_file]
 
             contract_list = sorted([c for c in unsorted_contract_list])
             # every contract file may contain numerous primary contracts, but the dependent contracts
@@ -2125,7 +2144,7 @@ class CertoraBuildGenerator:
                     contracts_with_chosen_addresses,
                     data,
                     report_source_file,
-                    contracts_in_file,
+                    primary_contract_handles,
                     build_arg_contract_file,
                     compiler_collector,
                     compile_wd,
@@ -2208,7 +2227,7 @@ class CertoraBuildGenerator:
     def get_bytecode(self,
                      bytecode_object: Dict[str, Any],
                      contract_name: str,
-                     primary_contracts: List[str],
+                     is_primary: bool,
                      contracts_with_chosen_addresses: List[Tuple[int, Any]],
                      is_deployed_bytecode: bool
                      ) -> str:
@@ -2218,7 +2237,11 @@ class CertoraBuildGenerator:
 
         @param bytecode_object - the output from the Solidity compiler
         @param contract_name - the contract that we are working on
-        @param primary_contracts - the names of the primary contracts we check to have a bytecode
+        @param is_primary - whether (source_file, contract_name) is a primary handle in the current
+            compilation; only primaries are required to have non-empty bytecode. The (file, name)
+            scoping avoids false positives when a transitively-imported abstract contract shares a
+            name with a primary (e.g. local concrete `Proxy` vs OpenZeppelin's abstract `Proxy`).
+            Caller computes membership against the primary_contract_handles set.
         @param contracts_with_chosen_addresses - a list of tuples of addresses and the
             associated contract identifier
         @param is_deployed_bytecode - true if we deal with deployed (runtime) bytecode,
@@ -2241,7 +2264,7 @@ class CertoraBuildGenerator:
                              f"If you need the contract, import the missing library directly and add a dummy usage:\n"
                 orig_msg = str(e)
                 raise Util.CertoraUserInputError(prefix_msg + orig_msg)
-        if contract_name in primary_contracts and len(bytecode) == 0:
+        if is_primary and len(bytecode) == 0:
             msg = f"Contract {contract_name} has no bytecode. " \
                   f"It may be caused because the contract is abstract, " \
                   f"or is missing constructor code. Please check the output of the Solidity compiler."
@@ -2350,7 +2373,7 @@ class CertoraBuildGenerator:
                             contracts_with_chosen_addresses: List[Tuple[int, Any]],
                             data: Dict[str, Any],
                             report_source_file: str,
-                            primary_contracts: List[str],
+                            primary_contract_handles: Set[Tuple[str, str]],
                             build_arg_contract_file: str,
                             compiler_collector_for_contract_file: CompilerCollector,
                             compile_wd: Path,
@@ -2422,12 +2445,14 @@ class CertoraBuildGenerator:
         (srcmap, constructor_srcmap) = self.collect_srcmap(contract_data)
 
         varmap = ""
+        contract_is_primary = (source_code_file, contract_name) in primary_contract_handles
         deployed_bytecode = self.get_bytecode(contract_data["evm"]["deployedBytecode"], contract_name,
-                                              primary_contracts,
+                                              contract_is_primary,
                                               contracts_with_chosen_addresses, True)
         deployed_bytecode = compiler_lang.normalize_deployed_bytecode(
             deployed_bytecode)
-        constructor_bytecode = self.get_bytecode(contract_data["evm"]["bytecode"], contract_name, primary_contracts,
+        constructor_bytecode = self.get_bytecode(contract_data["evm"]["bytecode"], contract_name,
+                                                 contract_is_primary,
                                                  contracts_with_chosen_addresses, False)
         constructor_bytecode = compiler_lang.normalize_deployed_bytecode(
             constructor_bytecode)
@@ -2509,7 +2534,24 @@ class CertoraBuildGenerator:
 
     @staticmethod
     def get_primary_contract_from_sdc(contracts: List[ContractInSDC], primary: str, primary_file: str) -> List[ContractInSDC]:
-        return [x for x in contracts if x.name == primary and Util.abs_norm_path(x.original_file) == Util.abs_norm_path(primary_file)]
+        name_matched = [x for x in contracts if x.name == primary]
+        if not name_matched:
+            return []
+        primary_parts = Path(Util.abs_norm_path(primary_file)).parts
+        best = None
+        best_suffix_len = -1
+        for x in name_matched:
+            x_parts = Path(Util.abs_norm_path(x.original_file)).parts
+            suffix_len = 0
+            for a, b in zip(reversed(primary_parts), reversed(x_parts)):
+                if a == b:
+                    suffix_len += 1
+                else:
+                    break
+            if suffix_len > best_suffix_len:
+                best_suffix_len = suffix_len
+                best = x
+        return [best] if best is not None else []
 
     @staticmethod
     def generate_library_import(file_absolute_path: str, library_name: str) -> str:

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/CertoraProver/certoraCloudIO.py

@@ -18,6 +18,8 @@ import json
 import os
 import re
 import uuid
+from collections import UserDict
+from collections.abc import MutableMapping
 
 import requests
 import sys
@@ -823,24 +825,22 @@ class CloudVerification:
 
         return True
 
-    def cli_verify_and_report(self, cl_args: str, wait_for_results: str) -> bool:
+    def cli_verify(self, cl_args: str) -> Optional[JobList]:
         """
         Sends a verification request to HTTP Handler, uploads a zip file, and outputs the results.
-        :param wait_for_results: If "all", we will wait for the results of the verification. If "none",
-               the run will be terminated after sending the job to the cloud.
         :param cl_args: A string that can be copied to and run by the shell to recreate this run.
-        @returns If compareToExpected is True, returns True when the expected output equals the actual results.
-                 Otherwise, returns False if there was at least one violated rule.
+        @returns job_list which defines the jobs that have been submitted successfully.
+                 Otherwise, returns None.
         """
 
         post_result = self.__send_verification_request(cl_args)
         if not post_result:
-            return False
+            return None
 
         file_upload_success = self.__compress_and_upload_zip_files()
 
         if not file_upload_success:
-            return False
+            return None
 
         # set results urls. They are all functions of the form: self.set_output_url(self.userId, self.anonymousKey)
         for func_name in ["set_output_url", "set_report_url", "set_zip_output_url", "set_json_output_url",
@@ -860,6 +860,18 @@ class CloudVerification:
         self.vscode_extension_info_writer.add_field("verification_report_url", self.url_print_format())
         self.vscode_extension_info_writer.write_file()
 
+        return job_list
+
+    def cli_report(self, job_list: JobList, wait_for_results: str) -> bool:
+        """
+        Outputs and report the results from verification.
+        :param wait_for_results: If "all", we will wait for the results of the verification. If "none",
+               the run will be terminated after sending the job to the cloud.
+        :param job_list: A JobList which contains data relevant to the job which was sent for verification.
+        @returns If compareToExpected is True, returns True when the expected output equals the actual results.
+                 Otherwise, returns False if there was at least one violated rule.
+        """
+
         if not wait_for_results or wait_for_results == str(Vf.WaitForResultOptions.NONE):
             job_list.save_data()
             job_list.save_recent_jobs_to_path()
@@ -927,10 +939,10 @@ class CloudVerification:
         response = None
         print("\nConnecting to server...")
         cloud_logger.debug(f"requesting verification from {verify_url}")
-        headers = {
+        headers: MutableMapping[str, str | bytes] = UserDict({
             'Authorization': f'Bearer {self.context.key}',
             "Content-Type": "application/json"
-        }
+        })
 
         # retry on request timeout or 502 (must take no more than 3 minutes)
         # print error message on the 3rd exception and return
@@ -953,6 +965,9 @@ class CloudVerification:
                 elif status == 401:
                     print("Invalid key or key is missing. Please, make sure you entered a valid key.")
                     return None
+                elif status == 426:
+                    output_error_response(response)
+                    return None
                 elif status >= 500:
                     cloud_logger.debug(f'{status} received. Retry...')
                     if i < self.verification_request_retries:
@@ -961,7 +976,7 @@ class CloudVerification:
                     else:
                         print("Oops, an error occurred when sending your request. Please try again later")
                         return None
-                else:  # status != 200, 403, 5XX
+                else:  # status != 200, 403, 401, 426, 5XX
                     output_error_response(response)
                     return None
             except requests.exceptions.Timeout:

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/CertoraProver/certoraSourceFinders.py

@@ -220,6 +220,33 @@ def handle_unsupported_decl_value(source_snippet: str,
         False)
 
 
+def is_idempotent_index_expr(expr: Dict[str, Any]) -> bool:
+    """Check if an index expression is idempotent (safe to duplicate without side effects).
+    Only allows Identifier, Literal, and arithmetic BinaryOperations (recursively)."""
+    node_type = expr.get("nodeType")
+    if node_type in ("Identifier", "Literal"):
+        return True
+    if node_type == "BinaryOperation" and expr.get("operator") in ("+", "-", "*", "/", "%"):
+        left = expr.get("leftExpression", {})
+        right = expr.get("rightExpression", {})
+        return is_idempotent_index_expr(left) and is_idempotent_index_expr(right)
+    return False
+
+
+def has_non_idempotent_index(left_hand_side: Dict[str, Any]) -> bool:
+    """Walk the LHS chain and check that all IndexAccess indexExpressions are idempotent."""
+    node = left_hand_side
+    while node["nodeType"] in ("MemberAccess", "IndexAccess"):
+        if node["nodeType"] == "IndexAccess":
+            index_expr = node.get("indexExpression", {})
+            if not is_idempotent_index_expr(index_expr):
+                return True
+            node = node["baseExpression"]
+        else:  # MemberAccess
+            node = node["expression"]
+    return False
+
+
 def handle_multi_def(source_snippet: str, assignment: Dict[str, Any]) -> LocalAssignmentFinderData:
     return handle_unsupported_def_value(source_snippet, assignment)
 
@@ -260,6 +287,12 @@ def handle_single_def(source_snippet: str, finder_running_id: int, assignment: D
                 f"The assignment {source_snippet} assigns to a storage variable, skipping")
             return handle_to_skip()
 
+        # check that all index expressions in the LHS chain are idempotent (no side effects like i++)
+        if has_non_idempotent_index(left_hand_side):
+            instrumentation_logger.debug(
+                f"The assignment {source_snippet} has a non-idempotent index expression, treating as unsupported")
+            return handle_unsupported_def_value(source_snippet, assignment)
+
         type_string = left_hand_side["typeDescriptions"]["typeString"]
 
         if is_unsupported_type(type_string):

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/Mutate/mutateApp.py

@@ -22,6 +22,7 @@ import re
 import shutil
 import subprocess
 import sys
+from collections import UserDict
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Optional, Any, List, Dict, Tuple, Set, Union
@@ -503,7 +504,7 @@ class WebUtils:
         self.mutation_test_final_result_url = f"https://{mutation_test_domain}"
         mutation_logger.debug(f"Using server {args.server} with mutation_test_id_url {self.mutation_test_id_url}")
 
-    def put_response_with_timeout(self, url: str, data: Any, headers: Dict[str, str]) -> Optional[requests.Response]:
+    def put_response_with_timeout(self, url: str, data: Any, headers: UserDict) -> Optional[requests.Response]:
         """
         Executes a put request and returns the response, uses a timeout mechanism
 
@@ -526,7 +527,7 @@ class WebUtils:
         return None
 
     def put_json_request_with_timeout(self, url: str, body: Dict[str, Any],
-                                      headers: Dict[str, str]) -> Optional[requests.Response]:
+                                      headers: UserDict) -> Optional[requests.Response]:
         """
         Executes a put request and returns the response, uses a timeout mechanism
 
@@ -1725,7 +1726,7 @@ class MutateApp:
     @staticmethod
     def upload_file_to_cloud_storage(web_utils: WebUtils, presigned_url: str, data: Any) -> None:
         mutation_logger.debug("Uploading file")
-        headers = {"Content-Type": "application/json"}
+        headers = UserDict({"Content-Type": "application/json"})
         put_resp = web_utils.put_response_with_timeout(presigned_url, json.dumps(data), headers)
         if not put_resp:
             raise ConnectionError(f"Failed to submit to presigned URL. url - {presigned_url}")
@@ -1973,7 +1974,7 @@ def get_top_level_rules(progress_json: Dict[str, Any]) -> Optional[List[Dict[str
 
 
 certora_key = os.getenv(KEY_ENV_VAR, '')
-auth_headers = {"Authorization": f"Bearer {certora_key}", "Content-Type": "application/json"}
+auth_headers = UserDict({"Authorization": f"Bearer {certora_key}", "Content-Type": "application/json"})
 default_cookies = {str(MConstants.CERTORA_KEY): certora_key}
 
 

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/Shared/certoraValidateFuncs.py

@@ -93,6 +93,8 @@ class RunSources(Util.NoValEnum):
     LIGHT_TEST = auto()
     REPORT = auto()
     TIMEOUTER = auto()
+    STATIC_ANALYZER = auto()
+    AUTO_PROVER = auto()
 
 
 class WaitForResultOptions(Util.NoValEnum):

{certora_cli-8.13.1 → certora_cli-8.16.2}/certora_cli/Shared/proverCommon.py

@@ -50,6 +50,7 @@ log = logging.getLogger(__name__)
 
 
 VIOLATIONS_EXIT_CODE = 100
+CLOUD_ERROR_EXIT_CODE = 426
 
 @dataclass
 class CertoraRunResult:
@@ -220,9 +221,13 @@ def run_remote(
 
     pretty_args = [f"'{a}'" if " " in a else a for a in args]
 
-    ok = cloud.cli_verify_and_report(" ".join(pretty_args), context.wait_for_results)
+    job_list = cloud.cli_verify(" ".join(pretty_args))
+    if job_list:
+        ok = cloud.cli_report(job_list, context.wait_for_results)
+        exit_code = 0 if ok else VIOLATIONS_EXIT_CODE
+    else:
+        exit_code = CLOUD_ERROR_EXIT_CODE
 
-    exit_code = 0 if ok else VIOLATIONS_EXIT_CODE
     result: Optional[CertoraRunResult] = None
     if cloud.statusUrl:
         result = CertoraRunResult(
@@ -248,8 +253,10 @@ def handle_exit(exit_code: int, return_value: Optional[CertoraRunResult]) -> Opt
     """
     if exit_code == VIOLATIONS_EXIT_CODE:
         raise CertoraFoundViolations("violations were found", return_value)
+    if exit_code == CLOUD_ERROR_EXIT_CODE:
+        raise Util.CertoraUserInputError("Certora Prover run failed due to a job submission error")
     if exit_code != 0:
-        raise Util.CertoraUserInputError(f"run_certora failed (code {exit_code})")
+        raise Util.CertoraUserInputError(f"Certora Prover run failed (code {exit_code})")
     return return_value
 
 

{certora_cli-8.13.1 → certora_cli-8.16.2/certora_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: certora-cli
-Version: 8.13.1
+Version: 8.16.2
 Summary: Runner for the Certora Prover
 Home-page: https://pypi.org/project/certora-cli
 Author: Certora
@@ -38,4 +38,4 @@ Dynamic: requires-dist
 Dynamic: requires-python
 Dynamic: summary
 
-Commit deb4423.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.
+Commit 94b86f7.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.16.2/certora_jars/CERTORA-CLI-VERSION-METADATA.json

@@ -0,0 +1 @@
+{"name": "certora-cli", "tag": "8.16.2", "branch": "", "commit": "94b86f7", "timestamp": "20260625.11.18.041053", "version": "8.16.2"}

{certora_cli-8.13.1 → certora_cli-8.16.2}/setup.py

@@ -3,11 +3,11 @@ import setuptools
 
 setuptools.setup(
     name="certora-cli",
-    version="8.13.1",
+    version="8.16.2",
     author="Certora",
     author_email="support@certora.com",
     description="Runner for the Certora Prover",
-    long_description="Commit deb4423.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.",
+    long_description="Commit 94b86f7.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.",
     long_description_content_type="text/markdown",
     url="https://pypi.org/project/certora-cli",
     packages=setuptools.find_packages(),

certora_cli-8.13.1/README.md

@@ -1 +0,0 @@
-Commit deb4423.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.13.1/certora_jars/CERTORA-CLI-VERSION-METADATA.json

@@ -1 +0,0 @@
-{"name": "certora-cli", "tag": "8.13.1", "branch": "", "commit": "deb4423", "timestamp": "20260519.10.54.736103", "version": "8.13.1"}