[Certora] OfferTree Soundness

certora/confs/OfferTreeMembership.conf

@@ -0,0 +1,19 @@
+{
+  "files": [
+    "certora/helpers/OfferTree.sol"
+  ],
+  "verify": "OfferTree:certora/specs/OfferTreeMembership.spec",
+  "solc": "solc-0.8.34",
+  "solc_via_ir": true,
+  "solc_optimize": "200",
+  "solc_evm_version": "osaka",
+  "optimistic_loop": true,
+  "loop_iter": 4,
+  "optimistic_hashing": true,
+  "hashing_length_bound": 1024,
+  "prover_args": [
+    "-splitParallel true",
+    "-s [z3:def{randomSeed=1},z3:def{randomSeed=2},z3:def{randomSeed=3},z3:def{randomSeed=4},z3:def{randomSeed=5}]"
+  ],
+  "msg": "Offer Tree Membership"
+}

certora/confs/OfferTreeWellFormed.conf

@@ -0,0 +1,20 @@
+{
+  "files": [
+    "certora/helpers/OfferTree.sol"
+  ],
+  "verify": "OfferTree:certora/specs/OfferTreeWellFormed.spec",
+  "solc": "solc-0.8.34",
+  "solc_via_ir": true,
+  "solc_optimize": "200",
+  "solc_evm_version": "osaka",
+  "optimistic_loop": true,
+  "loop_iter": 4,
+  "optimistic_hashing": true,
+  "hashing_length_bound": 1024,
+  "disable_auto_cache_key_gen": true,
+  "prover_args": [
+    "-splitParallel true",
+    "-s [z3:def{randomSeed=1},z3:def{randomSeed=2},z3:def{randomSeed=3},z3:def{randomSeed=4},z3:def{randomSeed=5}]"
+  ],
+  "msg": "OfferTreeWellFormed"
+}

certora/helpers/GenerateRoot.sol

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (c) 2025 Morpho Association
+pragma solidity ^0.8.0;
+
+import {Offer} from "../../src/interfaces/IMidnight.sol";
+import {OfferTree} from "./OfferTree.sol";
+
+contract GenerateRoot {
+    OfferTree public immutable offerTree;
+
+    constructor(OfferTree _offerTree) {
+        offerTree = _offerTree;
+    }
+
+    // Populate the supplied model and return the root for a non-empty, power-of-two list of offers.
+    function generateRoot(Offer[] memory leaves) public returns (bytes32) {
+        require(leaves.length > 0 && (leaves.length & (leaves.length - 1)) == 0, "invalid leaves length");
+
+        bytes32[] memory level = new bytes32[](leaves.length);
+        for (uint256 i = 0; i < leaves.length; i++) {
+            level[i] = offerTree.newLeaf(leaves[i]);
+        }
+
+        uint256 levelLength = level.length;
+        while (levelLength > 1) {
+            levelLength /= 2;
+            for (uint256 i = 0; i < levelLength; i++) {
+                level[i] = offerTree.newInternalNode(level[2 * i], level[2 * i + 1]);
+            }
+        }
+
+        return level[0];
+    }
+}

certora/helpers/OfferTree.sol

@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (c) 2025 Morpho Association
+pragma solidity ^0.8.0;
+
+import {Offer} from "../../src/interfaces/IMidnight.sol";
+import {HashLib, OFFER_TYPEHASH} from "../../src/ratifiers/libraries/HashLib.sol";
+
+// Fixed-size pre-image of HashLib.hashOffer. Dynamic fields are stored as hashes so CVL can re-hash a leaf without iterating over dynamic data.
+struct Leaf {
+    bytes32 marketHash; // = HashLib.hashMarket(offer.market)
+    bool buy;
+    address maker;
+    uint256 start;
+    uint256 expiry;
+    uint256 tick;
+    bytes32 group;
+    address callback;
+    bytes32 callbackDataHash; // = keccak256(offer.callbackData)
+    address receiverIfMakerIsSeller;
+    address ratifier;
+    bool reduceOnly;
+    uint256 maxUnits;
+    uint256 maxAssets;
+    uint256 continuousFeeCap;
+}
+
+contract OfferTree {
+    struct Node {
+        bytes32 left;
+        bytes32 right;
+        Leaf leaf;
+        // Offer hash for leaves and hash of the children for internal nodes.
+        bytes32 hash;
+    }
+
+    // Every populated node is keyed by its hash.
+    mapping(bytes32 => Node) internal tree;
+
+    // Create a leaf or return its existing hash ID.
+    function newLeaf(Offer memory offer) public returns (bytes32 id) {
+        id = HashLib.hashOffer(offer);
+        require(id != 0, "id is the zero bytes");
+        Node storage n = tree[id];
+        if (!isEmpty(n)) return id;
+        Leaf storage l = n.leaf;
+        l.marketHash = HashLib.hashMarket(offer.market);
+        l.buy = offer.buy;
+        l.maker = offer.maker;
+        l.start = offer.start;
+        l.expiry = offer.expiry;
+        l.tick = offer.tick;
+        l.group = offer.group;
+        l.callback = offer.callback;
+        l.callbackDataHash = keccak256(offer.callbackData);
+        l.receiverIfMakerIsSeller = offer.receiverIfMakerIsSeller;
+        l.ratifier = offer.ratifier;
+        l.reduceOnly = offer.reduceOnly;
+        l.maxUnits = offer.maxUnits;
+        l.maxAssets = offer.maxAssets;
+        l.continuousFeeCap = offer.continuousFeeCap;
+        n.hash = id;
+    }
+
+    // Create an internal node or return its existing hash ID.
+    function newInternalNode(bytes32 left, bytes32 right) public returns (bytes32 id) {
+        bytes32 leftHash = tree[left].hash;
+        bytes32 rightHash = tree[right].hash;
+        require(leftHash != 0, "left empty");
+        require(rightHash != 0, "right empty");
+        id = HashLib.hashNode(leftHash, rightHash);
+        require(id != 0, "zero hash");
+        Node storage n = tree[id];
+        if (!isEmpty(n)) return id;
+        n.left = left;
+        n.right = right;
+        n.hash = id;
+    }
+
+    function isEmpty(Node storage n) internal view returns (bool) {
+        return n.hash == 0;
+    }
+
+    function isEmpty(bytes32 id) public view returns (bool) {
+        return isEmpty(tree[id]);
+    }
+
+    function isLeafNode(bytes32 id) public view returns (bool) {
+        return tree[id].left == 0 && tree[id].right == 0 && tree[id].hash != 0;
+    }
+
+    function hashOffer(Offer memory offer) public pure returns (bytes32) {
+        return HashLib.hashOffer(offer);
+    }
+
+    function isLeaf(bytes32 root, bytes32 leafHash, uint256 leafIndex, bytes32[] memory proof)
+        public
+        pure
+        returns (bool)
+    {
+        return HashLib.isLeaf(root, leafHash, leafIndex, proof);
+    }
+
+    // Reconstruct HashLib.hashOffer from the stored pre-image.
+    function hashLeaf(Leaf storage l) internal view returns (bytes32) {
+        return keccak256(
+            abi.encode(
+                OFFER_TYPEHASH,
+                l.marketHash,
+                l.buy,
+                l.maker,
+                l.start,
+                l.expiry,
+                l.tick,
+                l.group,
+                l.callback,
+                l.callbackDataHash,
+                l.receiverIfMakerIsSeller,
+                l.ratifier,
+                l.reduceOnly,
+                l.maxUnits,
+                l.maxAssets,
+                l.continuousFeeCap
+            )
+        );
+    }
+
+    // Empty nodes are fully zeroed. Populated nodes have their hash as identifier and hash their leaf data or their two non-empty children.
+    function isWellFormed(bytes32 id) public view returns (bool) {
+        Node storage n = tree[id];
+        if (isEmpty(n)) {
+            Leaf storage l = n.leaf;
+            return n.left == 0 && n.right == 0 && l.marketHash == 0 && !l.buy && l.maker == address(0) && l.start == 0
+                && l.expiry == 0 && l.tick == 0 && l.group == 0 && l.callback == address(0) && l.callbackDataHash == 0
+                && l.receiverIfMakerIsSeller == address(0) && l.ratifier == address(0) && !l.reduceOnly
+                && l.maxUnits == 0 && l.maxAssets == 0 && l.continuousFeeCap == 0;
+        }
+        if (n.left == 0 && n.right == 0) {
+            bytes32 expected = hashLeaf(n.leaf);
+            return n.hash == expected && id == expected;
+        }
+        if (n.left != 0 && n.right != 0) {
+            bytes32 leftHash = tree[n.left].hash;
+            bytes32 rightHash = tree[n.right].hash;
+            return leftHash != 0 && rightHash != 0 && n.hash == id && n.hash == HashLib.hashNode(leftHash, rightHash);
+        }
+        return false;
+    }
+
+    // Check the path selected by leafIndex.
+    function wellFormedPath(bytes32 id, uint256 leafIndex, uint256 depth) public view returns (bool) {
+        for (uint256 i = depth;;) {
+            require(isWellFormed(id));
+
+            if (i == 0) break;
+
+            --i;
+            id = ((leafIndex >> i) & 1 == 0) ? tree[id].left : tree[id].right;
+        }
+        return true;
+    }
+}

certora/specs/OfferTreeMembership.spec

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+methods {
+    function isEmpty(bytes32) external returns (bool) envfree;
+    function hashOffer(OfferTree.Offer) external returns (bytes32) envfree;
+    function isLeaf(bytes32, bytes32, uint256, bytes32[]) external returns (bool) envfree;
+    function isLeafNode(bytes32) external returns (bool) envfree;
+    function wellFormedPath(bytes32, uint256, uint256) external returns (bool) envfree;
+}
+
+// Soundness: if a Merkle proof verifies along a well-formed path, hashOffer(offer) must be a leaf node.
+rule membershipSoundness(OfferTree.Offer offer, bytes32 root, uint256 leafIndex, bytes32[] proof) {
+    require !isEmpty(root), "root is a populated node";
+    require wellFormedPath(root, leafIndex, proof.length), "the path from the root to the leaf is well-formed";
+    bytes32 leafId = hashOffer(offer);
+    require isLeaf(root, leafId, leafIndex, proof), "Merkle proof verifies the offer";
+
+    assert isLeafNode(leafId);
+}

certora/specs/OfferTreeWellFormed.spec

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// Leaves store a fixed-size pre-image so isWellFormed can re-hash them without dynamic loops.
+
+methods {
+    function isEmpty(bytes32) external returns (bool) envfree;
+    function isWellFormed(bytes32) external returns (bool) envfree;
+}
+
+// The zero node remains empty.
+strong invariant zeroIsEmpty()
+    isEmpty(to_bytes32(0));
+
+// Every node stays well-formed within the configured Solidity loop bounds.
+strong invariant wellFormed(bytes32 id)
+    isWellFormed(id)
+    {
+        preserved {
+            requireInvariant zeroIsEmpty();
+        }
+    }