GovernorFunctions.spec 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299
  1. import "helpers.spec"
  2. import "methods/IGovernor.spec"
  3. import "Governor.helpers.spec"
  4. /*
  5. ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  6. │ Rule: propose effect and liveness. Includes "no double proposition" │
  7. └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
  8. */
  9. rule propose_liveness(uint256 pId, env e) {
  10. require nonpayable(e);
  11. require clockSanity(e);
  12. uint8 stateBefore = state(e, pId);
  13. address[] targets; uint256[] values; bytes[] calldatas; string descr;
  14. require validString(descr);
  15. require targets.length < 0xffff;
  16. require values.length < 0xffff;
  17. require calldatas.length < 0xffff;
  18. require pId == propose@withrevert(e, targets, values, calldatas, descr);
  19. // liveness & double proposal
  20. assert !lastReverted <=> (
  21. stateBefore == UNSET() &&
  22. validProposal(targets, values, calldatas)
  23. );
  24. }
  25. rule propose_effect(uint256 pId, env e) {
  26. require nonpayable(e);
  27. require clockSanity(e);
  28. address[] targets; uint256[] values; bytes[] calldatas; string descr;
  29. require pId == propose(e, targets, values, calldatas, descr);
  30. // effect
  31. assert state(e, pId) == PENDING();
  32. assert proposalProposer(pId) == e.msg.sender;
  33. assert proposalSnapshot(pId) == clock(e) + votingDelay();
  34. assert proposalDeadline(pId) == clock(e) + votingDelay() + votingPeriod();
  35. }
  36. rule propose_sideeffect(uint256 pId, env e) {
  37. require nonpayable(e);
  38. require clockSanity(e);
  39. uint256 otherId;
  40. uint8 otherStateBefore = state(e, otherId);
  41. uint256 otherVoteStart = proposalSnapshot(otherId);
  42. uint256 otherVoteEnd = proposalDeadline(otherId);
  43. address otherProposer = proposalProposer(otherId);
  44. address[] targets; uint256[] values; bytes[] calldatas; string descr;
  45. require pId == propose(e, targets, values, calldatas, descr);
  46. // no side-effect
  47. assert state(e, otherId) != otherStateBefore => otherId == pId;
  48. assert proposalSnapshot(otherId) == otherVoteStart;
  49. assert proposalDeadline(otherId) == otherVoteEnd;
  50. assert proposalProposer(otherId) == otherProposer;
  51. }
  52. /*
  53. ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  54. │ Rule: votes effect and liveness. Includes "A user cannot vote twice" │
  55. └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
  56. */
  57. rule castVote_liveness(uint256 pId, env e, method f)
  58. filtered { f -> voting(f) }
  59. {
  60. require nonpayable(e);
  61. require clockSanity(e);
  62. uint8 support;
  63. address voter;
  64. uint8 stateBefore = state(e, pId);
  65. bool hasVotedBefore = hasVoted(pId, voter);
  66. uint256 voterWeight = token_getPastVotes(voter, proposalSnapshot(pId));
  67. // voting weight overflow check
  68. require getAgainstVotes(pId) + voterWeight <= max_uint256;
  69. require getForVotes(pId) + voterWeight <= max_uint256;
  70. require getAbstainVotes(pId) + voterWeight <= max_uint256;
  71. helperVoteWithRevert(e, f, pId, voter, support);
  72. assert !lastReverted <=> (
  73. stateBefore == ACTIVE() &&
  74. !hasVotedBefore &&
  75. (support == 0 || support == 1 || support == 2)
  76. );
  77. }
  78. rule castVote_effect(uint256 pId, env e, method f)
  79. filtered { f -> voting(f) }
  80. {
  81. require nonpayable(e);
  82. require clockSanity(e);
  83. uint8 support;
  84. address voter;
  85. uint256 againstVotesBefore = getAgainstVotes(pId);
  86. uint256 forVotesBefore = getForVotes(pId);
  87. uint256 abstainVotesBefore = getAbstainVotes(pId);
  88. uint256 voterWeight = token_getPastVotes(voter, proposalSnapshot(pId));
  89. uint256 weight = helperVoteWithRevert(e, f, pId, voter, support);
  90. require !lastReverted;
  91. assert state(e, pId) == ACTIVE();
  92. assert voterWeight == weight;
  93. assert getAgainstVotes(pId) == againstVotesBefore + (support == 0 ? weight : 0);
  94. assert getForVotes(pId) == forVotesBefore + (support == 1 ? weight : 0);
  95. assert getAbstainVotes(pId) == abstainVotesBefore + (support == 2 ? weight : 0);
  96. assert hasVoted(pId, voter);
  97. }
  98. rule castVote_sideeffect(uint256 pId, env e, method f)
  99. filtered { f -> voting(f) }
  100. {
  101. require nonpayable(e);
  102. require clockSanity(e);
  103. uint8 support;
  104. address voter;
  105. address otherVoter;
  106. uint256 otherId;
  107. bool otherVotedBefore = hasVoted(otherId, otherVoter);
  108. uint256 otherAgainstVotesBefore = getAgainstVotes(otherId);
  109. uint256 otherForVotesBefore = getForVotes(otherId);
  110. uint256 otherAbstainVotesBefore = getAbstainVotes(otherId);
  111. helperVoteWithRevert(e, f, pId, voter, support);
  112. require !lastReverted;
  113. // no side-effect
  114. assert hasVoted(otherId, otherVoter) != otherVotedBefore => (otherId == pId && otherVoter == voter);
  115. assert getAgainstVotes(otherId) != otherAgainstVotesBefore => (otherId == pId);
  116. assert getForVotes(otherId) != otherForVotesBefore => (otherId == pId);
  117. assert getAbstainVotes(otherId) != otherAbstainVotesBefore => (otherId == pId);
  118. }
  119. /*
  120. ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  121. │ Rule: queue effect and liveness. │
  122. └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
  123. */
  124. rule queue_liveness(uint256 pId, env e) {
  125. require nonpayable(e);
  126. require clockSanity(e);
  127. uint8 stateBefore = state(e, pId);
  128. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  129. require targets.length < 0xffff;
  130. require values.length < 0xffff;
  131. require calldatas.length < 0xffff;
  132. require pId == queue@withrevert(e, targets, values, calldatas, descrHash);
  133. // liveness
  134. assert !lastReverted <=> stateBefore == SUCCEEDED();
  135. }
  136. rule queue_effect(uint256 pId, env e) {
  137. require nonpayable(e);
  138. require clockSanity(e);
  139. uint8 stateBefore = state(e, pId);
  140. bool queuedBefore = isQueued(pId);
  141. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  142. require pId == queue(e, targets, values, calldatas, descrHash);
  143. assert state(e, pId) == QUEUED();
  144. assert isQueued(pId);
  145. assert !queuedBefore;
  146. }
  147. rule queue_sideeffect(uint256 pId, env e) {
  148. require nonpayable(e);
  149. require clockSanity(e);
  150. uint256 otherId;
  151. uint8 otherStateBefore = state(e, otherId);
  152. bool otherQueuedBefore = isQueued(otherId);
  153. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  154. require pId == queue(e, targets, values, calldatas, descrHash);
  155. // no side-effect
  156. assert state(e, otherId) != otherStateBefore => otherId == pId;
  157. assert isQueued(otherId) != otherQueuedBefore => otherId == pId;
  158. }
  159. /*
  160. ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  161. │ Rule: execute effect and liveness. │
  162. └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
  163. */
  164. rule execute_liveness(uint256 pId, env e) {
  165. require nonpayable(e);
  166. require clockSanity(e);
  167. uint8 stateBefore = state(e, pId);
  168. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  169. require targets.length < 0xffff;
  170. require values.length < 0xffff;
  171. require calldatas.length < 0xffff;
  172. require pId == execute@withrevert(e, targets, values, calldatas, descrHash);
  173. // liveness: can't check full equivalence because of execution call reverts
  174. assert !lastReverted => (stateBefore == SUCCEEDED() || stateBefore == QUEUED());
  175. }
  176. rule execute_effect(uint256 pId, env e) {
  177. require nonpayable(e);
  178. require clockSanity(e);
  179. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  180. require pId == execute(e, targets, values, calldatas, descrHash);
  181. // effect
  182. assert state(e, pId) == EXECUTED();
  183. }
  184. rule execute_sideeffect(uint256 pId, env e) {
  185. require nonpayable(e);
  186. require clockSanity(e);
  187. uint256 otherId;
  188. uint8 otherStateBefore = state(e, otherId);
  189. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  190. require pId == execute(e, targets, values, calldatas, descrHash);
  191. // no side-effect
  192. assert state(e, otherId) != otherStateBefore => otherId == pId;
  193. }
  194. /*
  195. ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  196. │ Rule: cancel (public) effect and liveness. │
  197. └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
  198. */
  199. rule cancel_liveness(uint256 pId, env e) {
  200. require nonpayable(e);
  201. require clockSanity(e);
  202. uint8 stateBefore = state(e, pId);
  203. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  204. require targets.length < 0xffff;
  205. require values.length < 0xffff;
  206. require calldatas.length < 0xffff;
  207. require pId == cancel@withrevert(e, targets, values, calldatas, descrHash);
  208. // liveness
  209. assert !lastReverted <=> (
  210. stateBefore == PENDING() &&
  211. e.msg.sender == proposalProposer(pId)
  212. );
  213. }
  214. rule cancel_effect(uint256 pId, env e) {
  215. require nonpayable(e);
  216. require clockSanity(e);
  217. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  218. require pId == cancel(e, targets, values, calldatas, descrHash);
  219. // effect
  220. assert state(e, pId) == CANCELED();
  221. assert !isQueued(pId); // cancel resets timelockId
  222. }
  223. rule cancel_sideeffect(uint256 pId, env e) {
  224. require nonpayable(e);
  225. require clockSanity(e);
  226. uint256 otherId;
  227. uint8 otherStateBefore = state(e, otherId);
  228. bool otherQueuedBefore = isQueued(otherId);
  229. address[] targets; uint256[] values; bytes[] calldatas; bytes32 descrHash;
  230. require pId == cancel(e, targets, values, calldatas, descrHash);
  231. // no side-effect
  232. assert state(e, otherId) != otherStateBefore => otherId == pId;
  233. assert isQueued(otherId) != otherQueuedBefore => otherId == pId;
  234. }