// C3 线性化示例

// 继承链: A -> B -> C -> D

// 方法查找顺序按 "最左优先、深度优先" 确定

contract A { function f() public pure returns (string memory) { return "A"; } }

contract B is A { function f() public pure returns (string memory) { return "B"; } }

contract C is A { function f() public pure returns (string memory) { return "C"; } }

contract D is B, C {} // f() 返回 "B"（B 在左）

// 顺序反过来:

// contract D2 is C, B {} // f() 返回 "C"

/**

 * TypeScript 模拟 C3 线性化的拓扑排序

 */

function linearizeC3(

  bases: Map<string, string[]>

): Map<string, string[]> {

  const result = new Map<string, string[]>();

  function merge(className: string, parents: string[]): string[] {

    if (result.has(className)) return result.get(className)!;

    const merged: string[] = [className];

    

    // 合并父类线性化结果

    for (const parent of parents) {

      const parentLinear = merge(parent, bases.get(parent) || []);

      for (const cls of parentLinear) {

        if (!merged.includes(cls)) merged.push(cls);

      }

    }

    result.set(className, merged);

    return merged;

  }

  for (const [name, parents] of bases) {

    merge(name, parents);

  }

  return result;

}

// 示例

const inheritanceDAG = new Map([

  ["A", []],

  ["B", ["A"]],

  ["C", ["A"]],

  ["D", ["B", "C"]],

]);

const mro = linearizeC3(inheritanceDAG);

console.log("D 的 MRO:", mro.get("D")); // ["D", "B", "A", "C"] — 优先 B

interface IERC20 {

    function totalSupply() external view returns (uint256);

    function balanceOf(address account) external view returns (uint256);

    function transfer(address recipient, uint256 amount) external returns (bool);

}

abstract contract BasePausable {

    bool internal _paused;

    

    modifier whenNotPaused() {

        require(!_paused, "paused");

        _;

    }

    

    function _pause() internal { _paused = true; }

}

// 组合使用：接口来定义标准，抽象合约来复用逻辑

contract MyToken is BasePausable, IERC20 {

    // 实现具体逻辑

}

library SafeMath {

    function add(uint256 a, uint256 b) internal pure returns (uint256) {

        uint256 c = a + b;

        require(c >= a, "overflow");

        return c;

    }

}

using SafeMath for uint256;

uint256 result = a.add(b);  // 编译器内联为 SafeMath.add(a, b)

/**

 * 模拟 SafeMath 溢出检查的纯 TS 实现

 * 核心：a + b < a 当且仅当发生了 unsigned 溢出

 */

function safeAdd(a: bigint, b: bigint): { result: bigint; overflow: boolean } {

  const sum = a + b;

  // 在 true 256-bit 无符号域中：如果 a + b < a，则发生了溢出

  const MAX_UINT256 = (1n << 256n) - 1n;

  const overflow = sum > MAX_UINT256; // 注意：BigInt 本身不限制位宽，但 EVM 会 wrap

  // 这里用范围检查模拟 EVM 语义

  return {

    result: overflow ? sum & MAX_UINT256 : sum,

    overflow,

  };

}

// --- 模拟 EVM 回滚行为 ---

function checkedAdd(a: bigint, b: bigint): bigint {

  const { result, overflow } = safeAdd(a, b);

  if (overflow) throw new Error("SafeMath: overflow");

  return result;

}

// Solidity 0.8.0+ 已经内置 checked arithmetic，0.7.x 仍需要手动用库

console.log(checkedAdd(2n**255n, 2n**255n)); // Error: overflow

console.log(checkedAdd(1000n, 500n));         // 1500n

// 标准 Solidity: 每次访问都有边界检查

function sumArray(uint256[] memory arr) public pure returns (uint256) {

    uint256 sum;

    for (uint i; i < arr.length; ) {     // unchecked 增量

        sum += arr[i++];

    }

    return sum;

}

// 内联汇编版本：消除所有边界检查（假设编译器无法证明）

function sumArrayAssembly(uint256[] memory arr) public pure returns (uint256 s) {

    assembly {

        let len := mload(arr)  // arr 在 memory 中的第一个 word 是长度

        let ptr := add(arr, 0x20) // 数据从第 32 字节开始

        let end := add(ptr, mul(len, 0x20))

        

        for {} lt(ptr, end) { ptr := add(ptr, 0x20) } {

            s := add(s, mload(ptr))

        }

    }

}

/**

 * 模拟 EVM 内存数组布局

 * 内存布局: [length: 32 bytes][item0: 32][item1: 32]...

 * 地址从 0x80 开始

 */

function evmMemoryArray(arr: bigint[]): { mem: Uint8Array; lengthSlot: number; dataStart: number } {

  // 简化：32 字节对齐

  const totalSize = 32 + arr.length * 32;

  const mem = new Uint8Array(totalSize);

  

  // 写入长度

  const lenView = new DataView(mem.buffer, 0, 8);

  lenView.setBigUint64(24, BigInt(arr.length), false); // 写入最后 8 字节，零填充前 24 字节

  

  // 写入数据

  for (let i = 0; i < arr.length; i++) {

    const offset = 32 + i * 32;

    const view = new DataView(mem.buffer, offset + 24, 8);

    view.setBigUint64(0, arr[i], false);

  }

  

  return { mem, lengthSlot: 0, dataStart: 32 };

}

// 演示

const sample = evmMemoryArray([1n, 2n, 3n, 4n]);

console.log("Length slot:", sample.mem.slice(0, 32));

console.log("Data starts at offset 32:", sample.dataStart);

console.log("Item[0]:", new DataView(sample.mem.buffer, 32 + 24, 8).getBigUint64(0, false));

pragma solidity ^0.8.0;

contract EventDemo {

    event Transfer(address indexed from, address indexed to, uint256 value, string memo);

    event Approval(address indexed owner, address indexed spender, uint256 value);

    

    // indexed 参数存储在 "topic" 中，允许直接过滤

    // 非 indexed 参数在 "data" 字段，ABI 编码，不用于索引

    

    function transferWithMemo(address to, uint256 value, string calldata memo) external {

        // ... 检查逻辑 ...

        emit Transfer(msg.sender, to, value, memo);

    }

}

/**

 * 基于 keccak 事件签名和 topics 的日志过滤逻辑

 * 模拟 EIP-20 Transfer 事件的链下监听

 */

function keccak256(input: string): string {

  // 简化：用简单哈希模拟，真实实现需要 sha3-256

  let h = 0;

  for (let i = 0; i < input.length; i++) {

    h = ((h << 5) - h + input.charCodeAt(i)) | 0;

  }

  return "0x" + (h >>> 0).toString(16).padStart(64, '0');

}

// 真实 Event 签名哈希: keccak256("Transfer(address,address,uint256)")

// = 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef

const TRANSFER_EVENT_SIGNATURE = "Transfer(address,address,uint256)";

const TRANSFER_TOPIC0 = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";

interface LogFilter {

  fromBlock: number;

  toBlock: number | "latest";

  address: string;      // 合约地址

  topics: (string | null)[]; // topic[0]=事件签名, [1]=from, [2]=to

}

function buildTransferFilter(

  contractAddress: string,

  fromBlock: number,

  from?: string,

  to?: string,

): LogFilter {

  return {

    fromBlock,

    toBlock: "latest",

    address: contractAddress,

    topics: [

      TRANSFER_TOPIC0,

      from ? from.slice(2).padStart(64, '0').toLowerCase() : null,

      to ? to.slice(2).padStart(64, '0').toLowerCase() : null,

    ],

  };

}

// 示例：监听从 Vitalik 地址发出的所有 USDC 转账

const vitalikAddress = "0xd8dA6BF26964aF9D7aEd9e03E53415D3aD4803d1";

const usdcContract = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";

const filter = buildTransferFilter(usdcContract, 18000000, vitalikAddress, undefined);

console.log("Filter:", JSON.stringify(filter, null, 2));

// 解析日志数据（非 topics）

interface DecodedTransfer {

  from: string;

  to: string;

  value: bigint;

  blockNumber: number;

  transactionHash: string;

}

function decodeTransferLog(data: string, topics: string[]): DecodedTransfer {

  // 简化：假设 topics[0]=signature, [1]=from, [2]=to

  const padToAddr = (hex: string): string => "0x" + hex.slice(-40);

  const from = padToAddr(topics[1]);

  const to = padToAddr(topics[2]);

  

  // data 中只包含 value (uint256)，ABI 编码为 32 字节

  const valueHex = data.slice(2, 66);

  const value = BigInt("0x" + valueHex);

  

  return { from, to, value, blockNumber: 0, transactionHash: "0x" }; // 占位

}

// 有漏洞的版本

contract VulnerableVault {

    mapping(address => uint256) public balances;

    function withdraw() public {

        uint256 amount = balances[msg.sender];

        require(amount > 0, "no balance");

        (bool ok, ) = msg.sender.call{value: amount}("");  // 外部调用 -> 攻击者回调

        require(ok, "transfer failed");

        balances[msg.sender] = 0;  // 状态更新在转账之后！

    }

}

// 攻击合约

contract Attacker {

    VulnerableVault target;

    function attack() external {

        target.withdraw(); // 触发第一次，目标会在 fallback 前调用这里

    }

    fallback() external payable {

        if (address(target).balance > 0) {

            target.withdraw(); // 再次调用，balance 还没被扣减！

        }

    }

}

/**

 * 重入攻击的数学模型：状态更新的不同顺序导致的差异

 */

function simulateReentrancy(

  initialBalance: bigint,

  hackerDeposits: bigint,

  safe: boolean,  // 如果 true，状态先更新

): { victimDrained: bigint; hackerWins: bigint } {

  let contractBalance = initialBalance + hackerDeposits;

  let hackerBalance = 0n; // 攻击者在目标合约中"看起来"的余额

  

  // 攻击者先存入

  // 然后触发 withdraw

  

  if (safe) {

    // CEI 模式：先扣减余额，再发钱

    const claim = hackerDeposits;

    hackerBalance = 0n;  // 扣减！

    contractBalance -= claim;

    // 外部调用...

    return { victimDrained: 0n, hackerWins: claim };

  } else {

    // 攻击路径：先外部调用，再扣减

    let drained = 0n;

    let iterations = 0;

    while (contractBalance > 0 && iterations < 10) {

      const amount = hackerDeposits; // 扣减前余额仍为 hackerDeposits

      if (contractBalance >= amount) {

        drained += amount;

        contractBalance -= amount;

        iterations++;

      } else { break; }

      // 注意：在目标中，只有在最后才设置 hackerBalance = 0

    }

    return { victimDrained: drained - hackerDeposits, hackerWins: drained };

  }

}

// 模拟：攻击者存 1 ETH，合约有 10 ETH

const result = simulateReentrancy(10n, 1n, false);

console.log(`重入攻击: 攻击者投入 1 ETH，最终到手 ${result.hackerWins} ETH`);

console.log(`受害者损失: ${result.victimDrained} ETH`);

// 如果未加防护，攻击者可能榨干全部合约余额

/**

 * 抢跑攻击的数学模型：AMM 上的三明治攻击

 * 恒定乘积做市商: x * y = k

 */

class ConstantProductAMM {

  private x: bigint;  // 资产 X 储备

  private y: bigint;  // 资产 Y 储备

  private fee = 30n;  // 0.3% = 30 basis points

  private feeDen = 10000n;

  constructor(reserveX: bigint, reserveY: bigint) {

    this.x = reserveX; this.y = reserveY;

  }

  // 给定 xIn，计算 yOut（含手续费）

  getAmountOut(xIn: bigint): bigint {

    const xInFee = (xIn * this.fee) / this.feeDen; // 0.3% 手续费给 LP

    const xInNet = xIn - xInFee;

    const yOut = (this.y * xInNet) / (this.x + xInNet);

    return yOut;

  }

  swap(xIn: bigint): bigint {

    const yOut = this.getAmountOut(xIn);

    this.x += xIn;

    this.y -= yOut;

    return yOut;

  }

}

// 三明治攻击模拟

function simulateSandwich(

  amm: ConstantProductAMM,

  victimAmount: bigint,

  attackerAmount: bigint,

): { attackerProfit: bigint; victimSlippage: number } {

  // 攻击前状态

  const x0 = 10000n; const y0 = 10000n; // 1:1 价格

  const amm = new ConstantProductAMM(x0, y0);

  

  // 正常情况（无攻击）

  const normalOut = amm.getAmountOut(victimAmount);

  

  // 重置 + 攻击

  const amm2 = new ConstantProductAMM(x0, y0);

  const attackerIn = attackerAmount;

  const attackerOut1 = amm2.swap(attackerIn);  // 攻击者先买 → 推高 Y 的价格

  

  const victimOut = amm2.swap(victimAmount);   // 受害者以更高价格买

  

  const attackerOut2 = amm2.swap(attackerOut1); // 攻击者回卖，赚差价

  

  const attackerProfit = attackerOut2 - attackerIn;

  const slippageLoss = Number(normalOut - victimOut) / Number(normalOut);

  

  return { attackerProfit, victimSlippage: slippageLoss };

}

const result = simulateSandwich(

  new ConstantProductAMM(10000n, 10000n),

  100n,   // 受害者买 100 X

  50n,    // 攻击者用 50 X 做三明治

);

console.log(`攻击者利润: ${result.attackerProfit} Y（手续费后的净赚）`);

console.log(`受害者额外滑点损失: ${(result.victimSlippage * 100).toFixed(2)}%`);

// Solidity 0.7.x 之前

uint8 a = 255;

uint8 b = 1;

uint8 c = a + b; // c = 0! (溢出绕回)

// 0.8.0 之后自动 revert，但 assembly 中仍然需要手动检查

/**

 * 简化静态分析逻辑：模拟重入检测的核心模式

 */

interface ASTNode {

  type: string;

  children: ASTNode[];

  externalCall?: boolean;  // msg.sender.call() 等外部调用

  stateWrite?: boolean;    // balances[x] = ... 等状态写

  functionName: string;

}

function detectReentrancy(functions: ASTNode[]): {

  vulnerabilities: { functionName: string; confidence: "high" | "low" }[];

  totalFunctions: number;

} {

  const vulns: { functionName: string; confidence: "high" | "low" }[] = [];

  for (const fn of functions) {

    // 模式：存在 externalCall 且在其之后有 stateWrite

    // 实际 Slither 使用数据依赖分析，这里是简化启发式

    const externalCalls = collectNodes(fn, n => n.externalCall);

    const stateWrites = collectNodes(fn, n => n.stateWrite);

    

    if (externalCalls.length > 0) {

      // 检查是否有 stateWrite 发生在 AFTER 外部调用之后

      const callIndex = fn.children.findIndex(findMaxDepth(externalCalls));

      const writeIndex = fn.children.findIndex(findMaxDepth(stateWrites));

      if (callIndex >= 0 && writeIndex > callIndex) {

        vulns.push({ functionName: fn.functionName, confidence: "high" });

      } else if (callIndex >= 0 && writeIndex === -1) {

        vulns.push({ functionName: fn.functionName, confidence: "low" });

      }

    }

  }

  return { vulnerabilities: vulns, totalFunctions: functions.length };

}

function collectNodes(root: ASTNode, predicate: (n: ASTNode) => boolean): ASTNode[] {

  const result: ASTNode[] = [];

  function walk(n: ASTNode) {

    if (predicate(n)) result.push(n);

    for (const c of n.children) walk(c);

  }

  walk(root);

  return result;

}

function findMaxDepth(nodes: ASTNode[]) {

  return (n: ASTNode) => nodes.some(target => target === n);

}

// 示例

const badWithdraw: ASTNode = {

  type: "function",

  functionName: "withdraw",

  children: [

    { type: "call", externalCall: true, functionName: "msg.sender.call", children: [], stateWrite: false },

    { type: "write", externalCall: false, functionName: "balances[msg.sender]=0", stateWrite: true, children: [] },

  ],

  externalCall: false,

  stateWrite: false,

};

console.log("Bad pattern:", detectReentrancy([badWithdraw]).vulnerabilities);

// 输出: high confidence: 外部调用在状态写之前

约束1: a = α, b = β, a >= 0, b >= 0

约束2: a + b < a  (溢出条件)

    => β > MAX_UINT256 - α

SMT solver response: 可解！示例: α = 2^255, β = 2^255

// 代理合约

contract Proxy {

    address public implementation;

    

    fallback() external {

        (bool ok, ) = implementation.delegatecall(msg.data);

        // 状态变化写在 Proxy 的存储中！

    }

}

// 实现合约

contract LogicV1 {

    address public implementation; // 必须与代理存储布局一致！

    mapping(address => uint256) public balances;

    

    function deposit() external {

        balances[msg.sender] += msg.value; // 写 Proxy 的存储！

    }

}

/**

 * EVM 存储布局分析：变量定义的偏移必须一致

 * 否则升级后数据会错位

 */

interface StorageSlot {

  offset: number;   // 字节偏移（连续变量可共享 32 字节槽位）

  slot: number;     // 存储槽位索引（每个 32 字节）

  type: string;

  variable: string;

}

// V1 布局

const layoutV1: StorageSlot[] = [

  { offset: 0, slot: 0, type: "address", variable: "owner" },

  { offset: 0, slot: 1, type: "uint256", variable: "totalSupply" },

  { offset: 0, slot: 2, type: "mapping(address=>uint256)", variable: "balances" },

  // mapping 本身只占 1 槽位，数据在 keccak256(key, slot)

];

// V2 升级——错误！插入新变量到中间

const layoutV2_Wrong: StorageSlot[] = [

  { offset: 0, slot: 0, type: "address", variable: "owner" },

  { offset: 0, slot: 1, type: "bool", variable: "paused" },      // 插入！

  { offset: 1, slot: 1, type: "uint248", variable: "totalSupply" }, // 位移错位

  { offset: 0, slot: 2, type: "mapping", variable: "balances" },

];

// V2 正确——新变量只能追加到最末尾

const layoutV2_Correct: StorageSlot[] = [

  { offset: 0, slot: 0, type: "address", variable: "owner" },

  { offset: 0, slot: 1, type: "uint256", variable: "totalSupply" },

  { offset: 0, slot: 2, type: "mapping", variable: "balances" },

  // ---- 追加新变量到 slot 3 ----

  { offset: 0, slot: 3, type: "bool", variable: "paused" },

  { offset: 0, slot: 4, type: "uint256", variable: "newField" },

];

function checkUpgradeCompatibility(oldL: StorageSlot[], newL: StorageSlot[]): {

  compatible: boolean;

  issues: string[];

} {

  const issues: string[] = [];

  for (const oldVar of oldL) {

    const match = newL.find(nv =>

      nv.slot === oldVar.slot && nv.variable === oldVar.variable && nv.type === oldVar.type

    );

    if (!match) {

      issues.push(`变量 ${oldVar.variable} (slot${oldVar.slot}) 被修改或删除`);

    }

  }

  return { compatible: issues.length === 0, issues };

}

const check = checkUpgradeCompatibility(layoutV1, layoutV2_Wrong);

console.log("V2_Wrong 兼容性:", check.compatible, check.issues);

// 预期: false + “变量 totalSupply (slot 1) 被修改”

const check2 = checkUpgradeCompatibility(layoutV1, layoutV2_Correct);

console.log("V2_Correct 兼容性:", check2.compatible, check2.issues);

// 预期: true

// UUPS 代理（极简，无逻辑）

contract UUPSProxy {

    address public implementation;

    

    fallback() external {

        implementation.delegatecall(msg.data);

    }

}

// 实现合约包含升级函数

contract UUPSImplementation {

    address public implementation;  // 与代理同一槽位

    

    function upgradeTo(address newImpl) external {

        require(msg.sender == owner, "only owner");

        // 检查新实现是否是有效合约

        implementation = newImpl;

    }

    

    function _authorizeUpgrade(address) internal view virtual; // 子类覆盖权限

}

mapping(bytes4 => address) selectorToFacet;

function _delegate(bytes4 selector) internal {

    address facet = selectorToFacet[selector];

    assembly { delegatecall(gas(), facet, 0, 0, 0, 0) }

}

// 优势：可以同时升级单个函数，无需替换整个实现

// 代价：复杂度极高，Gas 略增

contract TokenV1 {

    bool private _initialized;  // 防止 double init

    

    function initialize(address owner, string calldata name) public {

        require(!_initialized, "already initialized");

        _initialized = true;

        owner = owner; // 在代理上下文中写存储！

        name_ = name;

    }

}

合约核心 = 状态机 (S, S₀, Next, Invariant)

S   = 所有可能状态的集合（合约变量赋值）

S₀  = 所有可能初始状态

Next ⊆ S × S  合法转移关系

Invariant ⊆ S  必须在所有可达状态中被满足的谓词

Safety 定理: ∀ s ∈ Reachable(S₀, Next), Invariant(s) = true

Coq 逻辑:

Theorem no_reentrancy:

  forall s s' old_bal caller target amount,

    old_bal = s.balances[caller] /\

    s.balances[contract] >= amount /\

    step(s, withdraw(caller, amount), s') ->

    s'.balances[caller] = 0.

Proof.

  intros. unfold step, withdraw.

  apply state_before_transfer.  // 核心：先扣减再转出的不变式

  contradiction.  // 任何重入路径都导致矛盾

Qed.

// 指定 ERC20 Transfer 语义

rule transfer_invariant {

    env e;

    address from; address to; uint amount;

    

    require e.msg.sender == from;

    mathint fromBal_before = balanceOf(e, from);

    mathint toBal_before = balanceOf(e, to);

    

    transfer(e, to, amount);

    

    mathint fromBal_after = balanceOf(e, from);

    mathint toBal_after = balanceOf(e, to);

    

    // 不变式：from 的余额减少 amount，to 的余额增加 amount

    assert from == to 

        => fromBal_after == fromBal_before,

        "transfer:self-transfer balance shouldn't change";

    assert from != to 

        => toBal_after == toBal_before + amount 

        && fromBal_after == fromBal_before - amount,

        "transfer:balance conservation";

}