Numeric domains meet algebraic data types

Abstract

We report on the design and formalization of a novel abstract domain, called numeric path relations (NPRs), that combines numeric relational domains with algebraic data types. This domain expresses relations between algebraic values that can contain scalar data. The construction of the domain is parameterized by the choice of a relational domain on scalar values. The construction employs projection paths on algebraic values, and in particular projections on variant cases, whose sound treatment is subtle due to mutual exclusiveness.CCS Concepts: • Theory of computation → Program analysis; • Software and its engineering → Automated static analysis.

Abstract interpretation of Michelson smart-contracts

“…Domains handling scalar values, such as numeric domains, ultimately work on environments mixing components from different algebraic values, making it possible to infer relations between values that appear inside pairs or options. This technique is similar to that of Bautista et al [3], but we support recursive types and do not partition with respect to which variant is used by each variable.…”

Lifting Numeric Relational Domains to Algebraic Data Types

“…Using extended variables, we define in §3.3 a first way to lift numeric domains to languages with algebraic types: the Numeric Path Relations lifting, or NPR lifting for short. This first lifting builds on the ideas of [2], but achieves a better precision. It can express, for example, that a call to do_ticks can only decrease the value in the field secs of processes (that denotes the number of seconds for which a process should remain asleep), thanks to the constraint on extended variables p.status@Asleep.secs ≥ p ′ .status@Asleep.secs.…”

“…In this section, extending ideas from [2], we define the Numeric Path Relations lifting D ↑ NPR as a generic way to lift a domain D that is numeric-i.e., that denotes sets of stores that map variables to numbers-to a domain that denotes sets of stores that map variables to structured values (Def. 1).…”

“…Our domain differs significantly from the correlation domain, in the sense that correlations are recursively defined so that parts of abstract values relate parts of structured values, whereas our domain is not a recursive structure, and instead exploits extended variables to relate the parts of structured values that are accessible through projection paths. We published a preliminary version of our approach in [2]. In this previous work, the analysis was not input-output relational, since it inferred approximations of the final states, as opposed to the relations between input and output states that the current paper is dealing with.…”