theorem_map.json

{
  "version": "0.5.0",
  "gasper_source": "NyxFoundation/gasper-lean4",
  "gasper_ref": "main",
  "note": "Core-centric theorem -> 01e-property mapping (Stage C). Per the gasper-lean4 maintainer (fab/banri): ~70-80% of the proved substance lives in GasperBeaconChain.Core.* (Theories + Lemmas), NOT the thin, still-growing Executable application layer. So the primary targets are the Core Theories/Lemmas (top-level accountable safety k_safety', the slashable bound, plausible liveness, and the justification/quorum lemmas). The Executable.* entries are retained but reframed as the DECIDABLE/COMPUTABLE Bool-checker versions of the corresponding Core theorem -- that is their real role. NOTE on names: every Core declaration lives in the flat `GasperBeaconChain.Core` namespace regardless of its source subdirectory (Theories/ and Lemmas/ are file paths, not namespace segments), so the fully-qualified `theorem` is `GasperBeaconChain.Core.<name>`; the source path is recorded in x_layer. Fields prefixed x_ are documentation (incl. x_stride, the STRIDE class fab requested) and are NOT emitted; the emitted `type` follows the benchmark vocabulary (invariant). `shard` groups properties into coherent protocol-area subsets for `emit-01e --out-dir`, which writes one 01e_PARTIAL_<shard>.json per shard so per-file property count matches the benchmark granularity (bench 11.62 +/- 3.72 props/file). Since the B1 must-establish decomposition (issue #4) each theorem lowers to N properties (one per must-establish precondition of its Lean statement; 1:1 when it has none), so the shard partition was re-tuned into six protocol-area groups sized for the decomposed counts (fixture-calibrated: safety-accountable 9, safety-cases 10, safety-bound-witness 8, finality-justification 10, finality-quorum 8, finality-liveness 9 -- all within the 1-sigma band; real CI counts may shift and the shards are re-tunable here without touching Lean or Python). `shard` is a grouping key only and is NOT emitted into properties. This file is the TUNING OVERLAY: severity calibration, covers hints, scope/reachability, labels, shards. Statement, hypotheses, must-establish decomposition, conclusion, and proof provenance now come from the Lean exporter, not from this file. STAGE-2 CHECKLIST OVERLAY (speca#88 stage 2, docs/high-angle-checklist.md): the CHK-* entries are LLM-synthesized implementation invariants that descend from the same proved theorems but target the arithmetic/type-width/bounds/termination/resource failure surface documented by real client bugs in ethereum-vuln-dataset (cited per entry in x_dataset_evidence). They carry lowering='verbatim': emitted 1:1 with the hand-written text/assertion, never decomposed per must-establish hypothesis (the decomposition describes the theorem's statement, not these audit items). A theorem may therefore back several properties; theorem-name uniqueness holds among the non-checklist entries only. All CHK-* entries live in the checklist-high-angle shard (15 props, within the benchmark 1-sigma band).",
  "properties": [
    {
      "property_id": "PROP-lean-safety-core-001",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Tampering",
      "text": "Two conflicting k-finalized blocks must force a slashable two-thirds quorum intersection (top-level k-accountable safety)",
      "type": "invariant",
      "assertion": "k_finalized(b1) and k_finalized(b2) and not_ancestor(b1,b2) and not_ancestor(b2,b1) -> q_intersection_slashed(st)",
      "severity": "CRITICAL",
      "covers_hint": [
        "fork choice",
        "finalization",
        "checkpoint",
        "accountable safety",
        "process_justification_and_finalization"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "The headline safety result: any two conflicting finalized histories are provably attributable to a slashable two-thirds intersection. A client that finalizes a fork without this attribution invariant breaks accountable safety.",
      "liveness_only": false,
      "shard": "safety-accountable"
    },
    {
      "property_id": "PROP-lean-safety-core-002",
      "theorem": "GasperBeaconChain.Core.finalization_fork_means_same_finalization_fork_one",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Tampering",
      "text": "A one-finalization fork must be exactly a same-height k-finalization fork at k=1",
      "type": "invariant",
      "assertion": "finalization_fork(st) <-> same_k_finalization_fork(st, k=1)",
      "severity": "HIGH",
      "covers_hint": [
        "finalization",
        "fork",
        "k-finalization",
        "checkpoint"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Structural bridge equating the 1-finalization fork condition with the general k-finalization fork at k=1; a client conflating the two mis-detects fork conditions.",
      "liveness_only": false,
      "shard": "safety-accountable"
    },
    {
      "property_id": "PROP-lean-safety-core-003",
      "theorem": "GasperBeaconChain.Core.no_k_finalized_justified_same_height",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Tampering",
      "text": "Absent slashing, no justified block may share the height of a distinct k-finalized block",
      "type": "invariant",
      "assertion": "k_finalized(bf,h1) and justified(bj,h2) and not slashed and bj!=bf -> h2 != h1",
      "severity": "HIGH",
      "covers_hint": [
        "finalization",
        "justification",
        "checkpoint",
        "height"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Height-uniqueness of finalized vs justified checkpoints given no slashing; violated only if the client accepts a conflicting justification at a finalized height.",
      "liveness_only": false,
      "shard": "safety-accountable"
    },
    {
      "property_id": "PROP-lean-safety-core-004",
      "theorem": "GasperBeaconChain.Core.k_slash_surround_case_general",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Repudiation",
      "text": "A justification link surrounding a k-finalized block must force a slashable quorum intersection (surround case)",
      "type": "invariant",
      "assertion": "justified(s) and link(s,t) and k_finalized(final) and final_h<t_h and s_h<final_h and not_ancestor(final,t) -> q_intersection_slashed(st)",
      "severity": "HIGH",
      "covers_hint": [
        "surround vote",
        "slashing detection",
        "justification link",
        "finalization"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "The surround-vote branch of the accountable-safety case split: a link straddling a finalized block is slashable. Missing this lets surround voting finalize conflicts undetected.",
      "liveness_only": false,
      "shard": "safety-cases"
    },
    {
      "property_id": "PROP-lean-safety-core-005",
      "theorem": "GasperBeaconChain.Core.k_non_equal_height_case",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Tampering",
      "text": "Two conflicting k-finalized blocks at different heights must force a slashable quorum intersection",
      "type": "invariant",
      "assertion": "k_finalized(b1,h1) and k_finalized(b2,h2) and h2<h1 and not_ancestor(b2,b1) -> q_intersection_slashed(st)",
      "severity": "HIGH",
      "covers_hint": [
        "finalization",
        "fork choice",
        "checkpoint",
        "height"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "The unequal-height branch of accountable safety; combined with the equal-height case it yields k_safety'.",
      "liveness_only": false,
      "shard": "safety-cases"
    },
    {
      "property_id": "PROP-lean-bound-001",
      "theorem": "GasperBeaconChain.Core.slashable_bound",
      "label": "beacon-chain:effective-balance-updates",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "text": "A conflicting k-finalization must exhibit two quorums whose intersection weight meets the churn-adjusted slashable lower bound",
      "type": "invariant",
      "assertion": "conflicting_k_finalization(st) -> exists qL,qR: wt(qL inter qR) >= max(wt(vL)-act-ext, wt(vR)-act-ext)",
      "severity": "HIGH",
      "covers_hint": [
        "effective balance",
        "attesting balance",
        "quorum",
        "get_total_active_balance",
        "slashing weight"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "The quantitative half of accountable safety: the slashable intersection has provably positive, churn-adjusted weight. A client whose effective-balance / weight arithmetic diverges from this bound miscomputes how much stake is slashable and whether the 2/3 threshold is met.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-bound-002",
      "theorem": "GasperBeaconChain.Core.quorum_intersection_weight_lower",
      "label": "beacon-chain:effective-balance-updates",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "text": "Two two-thirds quorums must intersect in weight at least their combined weight minus the one-third thresholds",
      "type": "invariant",
      "assertion": "2/3-quorum(qL,vL) and 2/3-quorum(qR,vR) -> wt(vL inter vR) - 1/3wt(vL) - 1/3wt(vR) <= wt(qL inter qR)",
      "severity": "HIGH",
      "covers_hint": [
        "quorum",
        "effective balance",
        "committee",
        "attesting balance",
        "inclusion exclusion"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Inclusion-exclusion lower bound on quorum overlap. Weight arithmetic that overflows or double-counts churned validators can misjudge a two-thirds threshold.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-bound-003",
      "theorem": "GasperBeaconChain.Core.validator_intersection_lower_bound",
      "label": "beacon-chain:effective-balance-updates",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "text": "Validator-set intersection weight must be bounded below by a churn-adjusted (activation/exit) expression",
      "type": "invariant",
      "assertion": "max(wt(vL)-actwt(v0,vL)-extwt(v0,vR), wt(vR)-actwt(v0,vR)-extwt(v0,vL)) <= wt(vL inter vR)",
      "severity": "HIGH",
      "covers_hint": [
        "effective balance",
        "activation",
        "exit",
        "churn",
        "get_total_active_balance"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Bounds the overlap of two validator sets accounting for activation/exit churn relative to a reference set; the arithmetic backbone of the slashable bound. A divergent effective-balance computation violates it.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-justif-safety-001",
      "theorem": "GasperBeaconChain.Core.no_two_justified_same_height",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/AccountableSafety.lean",
      "x_stride": "Tampering",
      "text": "Absent slashing, two distinct blocks must never both be justified at the same height",
      "type": "invariant",
      "assertion": "justified(b1,h1) and justified(b2,h2) and not slashed and b1!=b2 -> h1 != h2",
      "severity": "HIGH",
      "covers_hint": [
        "justification",
        "checkpoint",
        "height",
        "supermajority"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "No two distinct justified blocks share a height without slashing; the structural core of same-height safety.",
      "liveness_only": false,
      "shard": "finality-justification"
    },
    {
      "property_id": "PROP-lean-justif-safety-002",
      "theorem": "GasperBeaconChain.Core.two_justified_same_height_slashed",
      "label": "beacon-chain:slashing",
      "x_layer": "Core/Lemmas/AccountableSafety.lean",
      "x_stride": "Repudiation",
      "text": "Two distinct blocks justified at the same height must force a slashable quorum intersection",
      "type": "invariant",
      "assertion": "justified(b1,h) and justified(b2,h) and b1!=b2 -> q_intersection_slashed(st)",
      "severity": "HIGH",
      "covers_hint": [
        "justification",
        "slashing detection",
        "checkpoint",
        "equivocation"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "The converse witness: same-height justification is provably slashable. Missing this detection permits equivocation to justify conflicts.",
      "liveness_only": false,
      "shard": "finality-justification"
    },
    {
      "property_id": "PROP-lean-justif-001",
      "theorem": "GasperBeaconChain.Core.finalized_means_justified_child",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Justification.lean",
      "x_stride": "Tampering",
      "text": "A finalized block must have a justified child at the next height",
      "type": "invariant",
      "assertion": "finalized(p,h) -> exists c: parent(p,c) and justified(c, h+1)",
      "severity": "MEDIUM",
      "covers_hint": [
        "finalization",
        "justification",
        "process_justification",
        "checkpoint"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Finalization implies a justified child; an off-by-one in the finalize/justify transition breaks this.",
      "liveness_only": false,
      "shard": "finality-justification"
    },
    {
      "property_id": "PROP-lean-justif-002",
      "theorem": "GasperBeaconChain.Core.k_finalized_means_justified",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Justification.lean",
      "x_stride": "Tampering",
      "text": "A k-finalized block must itself be justified",
      "type": "invariant",
      "assertion": "k_finalized(b,h,k) -> justified(b,h)",
      "severity": "MEDIUM",
      "covers_hint": [
        "finalization",
        "justification",
        "k-finalization",
        "checkpoint"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "k-finalization entails justification; a client treating finalized-but-not-justified states as valid violates it.",
      "liveness_only": false,
      "shard": "finality-justification"
    },
    {
      "property_id": "PROP-lean-justif-003",
      "theorem": "GasperBeaconChain.Core.finalized_means_one_finalized",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Justification.lean",
      "x_stride": "Tampering",
      "text": "The plain finalized predicate must coincide exactly with one-finalization (k=1)",
      "type": "invariant",
      "assertion": "finalized(b,h) <-> k_finalized(b,h,1)",
      "severity": "MEDIUM",
      "covers_hint": [
        "finalization",
        "k-finalization",
        "checkpoint"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Bridges plain finalization and the k-generalized definition at k=1; a mismatch means the two finalization code paths disagree.",
      "liveness_only": false,
      "shard": "finality-justification"
    },
    {
      "property_id": "PROP-lean-quorum-core-001",
      "theorem": "GasperBeaconChain.Core.quorum_2_upclosed",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Quorums.lean",
      "x_stride": "Tampering",
      "text": "Any superset of a two-thirds quorum within the validator set must itself be a two-thirds quorum",
      "type": "invariant",
      "assertion": "q subset q' and q' subset vset(b) and quorum_2(q,b) -> quorum_2(q',b)",
      "severity": "MEDIUM",
      "covers_hint": [
        "quorum",
        "committee",
        "attesting balance",
        "supermajority"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Up-closure of the two-thirds quorum predicate; monotonicity a client's quorum test must respect.",
      "liveness_only": false,
      "shard": "finality-quorum"
    },
    {
      "property_id": "PROP-lean-quorum-core-002",
      "theorem": "GasperBeaconChain.Core.quorum_2_nonempty_of_threshold_pos",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Quorums.lean",
      "x_stride": "Tampering",
      "text": "A two-thirds quorum must be non-empty whenever the two-thirds weight threshold is positive",
      "type": "invariant",
      "assertion": "0 < two_third(wt(vset(b))) and quorum_2(q,b) -> q.Nonempty",
      "severity": "MEDIUM",
      "covers_hint": [
        "quorum",
        "committee",
        "effective balance",
        "threshold"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "A positive threshold forces a non-empty quorum; an empty-quorum acceptance (e.g. zero-weight threshold bug) violates it.",
      "liveness_only": false,
      "shard": "finality-quorum"
    },
    {
      "property_id": "PROP-lean-liveness-core-001",
      "theorem": "GasperBeaconChain.Core.plausible_liveness_construct_extension",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/PlausibleLiveness.lean",
      "x_stride": "DenialOfService",
      "text": "With two-thirds honest stake and no slashing the state must be extendable to finalize a new checkpoint without new slashing",
      "type": "invariant",
      "assertion": "two_thirds_good(st) and not slashed and blocks_exist_high -> exists st': unslashed_can_extend(st,st') and no_new_slashed(st,st') and finalizes_new(st')",
      "severity": "MEDIUM",
      "covers_hint": [
        "liveness",
        "quorum",
        "finalization",
        "extension"
      ],
      "bug_bounty_area": "consensus/liveness",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Plausible liveness by explicit two-link extension. Liveness property; typically outside a client bug-bounty's safety scope.",
      "liveness_only": true,
      "shard": "finality-liveness"
    },
    {
      "property_id": "PROP-lean-liveness-core-002",
      "theorem": "GasperBeaconChain.Core.plausible_liveness_from_coq_blocks_exist",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/PlausibleLiveness.lean",
      "x_stride": "DenialOfService",
      "text": "Plausible liveness must hold under the Coq-style block-existence hypothesis for the highest justified block",
      "type": "invariant",
      "assertion": "two_thirds_good(st) and not slashed and blocks_exist_high_coq -> exists st': unslashed_can_extend(st,st') and no_new_slashed(st,st') and finalizes_new(st')",
      "severity": "MEDIUM",
      "covers_hint": [
        "liveness",
        "quorum",
        "finalization",
        "block existence"
      ],
      "bug_bounty_area": "consensus/liveness",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "The plausible-liveness result restated against the Coq block-existence predicate (interoperability with the reference Coq model). Liveness; out of safety scope.",
      "liveness_only": true,
      "shard": "finality-liveness"
    },
    {
      "property_id": "PROP-lean-liveness-core-003",
      "theorem": "GasperBeaconChain.Core.no_new_slashed_two_link_extension",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/PlausibleLiveness.lean",
      "x_stride": "DenialOfService",
      "text": "Extending the state with two supermajority-link vote batches must introduce no new slashing",
      "type": "invariant",
      "assertion": "highest_justified(s1) and good_votes and quorum_2(q1,t1) and quorum_2(q2,t2) and s1_h<=H -> no_new_slashed(st, extend_two_links(st))",
      "severity": "MEDIUM",
      "covers_hint": [
        "liveness",
        "slashing detection",
        "extension",
        "supermajority link"
      ],
      "bug_bounty_area": "consensus/liveness",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "The no-new-slashing guarantee that makes the liveness extension honest; underpins plausible liveness. Liveness; out of safety scope.",
      "liveness_only": true,
      "shard": "finality-liveness"
    },
    {
      "property_id": "PROP-lean-slashing-001",
      "theorem": "GasperBeaconChain.Executable.slashed_double_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_core_counterpart": "S1 equivocation; underlies two_justified_same_height_slashed",
      "x_stride": "Repudiation",
      "text": "The decidable double-vote checker must flag exactly the validators that signed two distinct targets at one target epoch (S1)",
      "type": "invariant",
      "assertion": "slashedB_S1(st,v) <-> exists two attestations by v with same target_epoch and distinct target_root",
      "severity": "HIGH",
      "covers_hint": [
        "attestation validation",
        "slashing detection",
        "double vote",
        "process_attestation"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "Computable Bool checker (iff a bounded existential) for Casper condition S1. A client whose detection disagrees with this predicate misses equivocation.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-slashing-002",
      "theorem": "GasperBeaconChain.Executable.slashed_surround_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_core_counterpart": "S2 surround; underlies k_slash_surround_case_general",
      "x_stride": "Repudiation",
      "text": "The decidable surround-vote checker must flag exactly the validators with a surrounding source-target attestation pair (S2)",
      "type": "invariant",
      "assertion": "slashedB_S2(st,v) <-> exists a1,a2 by v with source(a1)<source(a2) and target(a2)<target(a1)",
      "severity": "HIGH",
      "covers_hint": [
        "attestation validation",
        "slashing detection",
        "surround vote",
        "process_attester_slashing"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "Computable Bool checker (iff a bounded existential) for Casper condition S2. A client whose detection disagrees permits surround voting.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-safety-001",
      "theorem": "GasperBeaconChain.Executable.accountable_safety_witnessB",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/AccountableSafety.lean (decidable checker)",
      "x_core_counterpart": "decidable witness for Core.accountable_safety",
      "x_stride": "Tampering",
      "text": "The decidable accountable-safety witness must certify a slashable quorum intersection for any one-finalization fork",
      "type": "invariant",
      "assertion": "finalization_fork(st) -> witnessB(st) constructs a q_intersection_slashed witness",
      "severity": "CRITICAL",
      "covers_hint": [
        "fork choice",
        "finalization",
        "checkpoint",
        "process_justification_and_finalization"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "The computable witness form of accountable safety (Core.accountable_safety); lets a client actually produce the slashable intersection rather than only assert it exists.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-safety-002",
      "theorem": "GasperBeaconChain.Executable.k_accountable_safety_witnessB",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/AccountableSafety.lean (decidable checker)",
      "x_core_counterpart": "decidable witness for Core.k_safety' / k_accountable_safety",
      "x_stride": "Tampering",
      "text": "The decidable k-accountable-safety witness must certify a slashable quorum intersection for any k-finalization fork",
      "type": "invariant",
      "assertion": "k_finalization_fork(st,k1,k2) -> k_witnessB(st) constructs a q_intersection_slashed witness",
      "severity": "CRITICAL",
      "covers_hint": [
        "finalization",
        "checkpoint",
        "k-finalization",
        "process_justification_and_finalization"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_exploitability_note": "Computable witness form of k_safety' under dynamic validator sets; the executable counterpart of the headline Core theorem.",
      "liveness_only": false,
      "shard": "safety-bound-witness"
    },
    {
      "property_id": "PROP-lean-quorum-001",
      "theorem": "GasperBeaconChain.Executable.q_intersection_slashed_iff_exists_witness",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/Quorums.lean (decidable checker)",
      "x_core_counterpart": "decidable form of the q_intersection_slashed predicate used across Core",
      "x_stride": "Tampering",
      "text": "The decidable quorum-intersection-slashed check must hold iff a concrete slashing witness exists",
      "type": "invariant",
      "assertion": "qIntersectionWitnessB(st) <-> exists witness w: q_intersection_slashed via w",
      "severity": "HIGH",
      "covers_hint": [
        "committee",
        "quorum",
        "effective balance",
        "attesting balance",
        "get_total_active_balance"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Makes the q_intersection_slashed predicate (the conclusion of every accountable-safety theorem) decidable by an explicit witness search.",
      "liveness_only": false,
      "shard": "finality-quorum"
    },
    {
      "property_id": "PROP-lean-justification-001",
      "theorem": "GasperBeaconChain.Executable.justified_iff_bounded",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/Justification.lean (decidable checker)",
      "x_core_counterpart": "decidable characterization backing Core.Lemmas.Justification",
      "x_stride": "Tampering",
      "text": "The decidable justification check must match a bounded supermajority-link chain from the anchor with no unbounded recursion",
      "type": "invariant",
      "assertion": "justified(c) <-> exists bounded chain of supermajority links from anchor to c (decNthAncestor bounded)",
      "severity": "MEDIUM",
      "covers_hint": [
        "justification",
        "supermajority link",
        "checkpoint",
        "ancestor",
        "process_justification"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Decidable, bounded characterization of justification; an unbounded slot/ancestor iterator diverges from it (off-by-one on the height gap or non-termination).",
      "liveness_only": false,
      "shard": "finality-quorum"
    },
    {
      "property_id": "PROP-lean-liveness-001",
      "theorem": "GasperBeaconChain.Executable.two_thirds_good_iff_forall_exists_goodQuorum",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/PlausibleLiveness.lean (decidable checker)",
      "x_core_counterpart": "decidable form used by Core plausible-liveness hypotheses",
      "x_stride": "DenialOfService",
      "text": "The decidable two-thirds-honest check must hold iff every target admits a good quorum",
      "type": "invariant",
      "assertion": "two_thirds_good(st) <-> forall target, exists good quorum at that target (goodQuorumAtB)",
      "severity": "MEDIUM",
      "covers_hint": [
        "liveness",
        "quorum",
        "finalization"
      ],
      "bug_bounty_area": "consensus/liveness",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_exploitability_note": "Decidable form of the two-thirds-honest hypothesis that plausible liveness needs. Liveness; out of safety scope.",
      "liveness_only": true,
      "shard": "finality-quorum"
    },
    {
      "property_id": "CHK-AS-01",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "fork-choice",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "Fork-choice weight/head selection must gate attestation inclusion solely by att.slot/target.epoch eligibility, never by local receipt wall-clock time; arrival-based gating causes nodes to diverge on canonical head under differing network latency.",
      "type": "invariant",
      "assertion": "att in fc_weight(st) -> eligible(att.slot,att.target.epoch,st) and not depends_on(weight(att), wallclock_arrival(att))",
      "severity": "HIGH",
      "covers_hint": [
        "on_attestation",
        "fork choice",
        "attestation timing",
        "proposer boost",
        "get_head"
      ],
      "bug_bounty_area": "consensus/fork-choice",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse LMD-GHOST fork-choice attestation-timing attack (consensus-specs#2101 / ISSUE#1773)",
      "x_exploitability_note": "If arrival timing can steer fork-choice toward a second justifiable head, the two-conflicting-checkpoints antecedent of k_safety' becomes reachable without the quorum intersection being attributable. Audit: is fork-choice weight eligibility gated only by slot/epoch validity, or also by wall-clock arrival?",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-AS-02",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "beacon-chain:attestation",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "Spoofing",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "At the BLS verify() call site in attestation processing, explicitly branch on its return (or catch exceptions); any false, error, or exception must return/reject immediately, never fall through to the code that adds the attestation's weight to fork-choice.",
      "type": "invariant",
      "assertion": "bls_verify(att) in {false,error,exn} -> reject_before(weight_add(att,fc)); no path adds att to fc_weight without checked=ok",
      "severity": "CRITICAL",
      "covers_hint": [
        "process_attestation",
        "signature verification",
        "bls",
        "attestation validation"
      ],
      "bug_bounty_area": "consensus/attestation",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: blst signature-verification bug reachable through network-supplied signed consensus data (Finalized #25)",
      "x_exploitability_note": "A default-accept on a BLS library failure lets unverified network-supplied attestations carry fork-choice weight, voiding the attribution k_safety' guarantees. Audit: the error path of every verify call on the attestation ingest pipeline.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-AS-03",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "fork-choice",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "x_stride": "DenialOfService",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "For any recursive block-tree traversal, require each recursive call to pass a depth counter incremented from the caller's, checked against MAX_DEPTH before recursing; flag call sites that omit or fail to increment it.",
      "type": "invariant",
      "assertion": "forall recursive_call c: c.depth == caller.depth+1 and c.depth <= MAX_DEPTH, else stop recursion",
      "severity": "HIGH",
      "covers_hint": [
        "filter_block_tree",
        "fork choice",
        "recursion",
        "block tree",
        "get_head"
      ],
      "bug_bounty_area": "consensus/fork-choice",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse fork-choice block-tree filter recursion DoS",
      "x_exploitability_note": "An attacker who can stall the fork-choice traversal stalls the node through the window in which the slashable intersection of k_safety' must be detected. Audit: recursion/iteration bounds on the candidate-filter walk.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-QW-01",
      "theorem": "GasperBeaconChain.Core.slashable_bound",
      "label": "beacon-chain:effective-balance-updates",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "In the two-thirds attesting-weight check, wrap the attesting_wt + total_active_wt addition in checked uint64 arithmetic and reject the block/attestation on overflow.",
      "type": "invariant",
      "assertion": "attesting_wt+total_active_wt via checked_add::<u64>; overflow -> reject",
      "severity": "HIGH",
      "covers_hint": [
        "process_effective_balance_updates",
        "effective balance",
        "attesting balance",
        "overflow",
        "deposit count"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse Eth1 deposit-count underflow during block processing (crafted deposit count); Electra effective/attesting-balance arithmetic class",
      "x_exploitability_note": "A miscomputed weight makes the node disagree on whether the two-thirds threshold was met, so it justifies/finalizes on a different quorum than the spec, breaking the bookkeeping under slashable_bound. Audit: the balance-accumulation loops and the deposit-count delta.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-QW-02",
      "theorem": "GasperBeaconChain.Core.quorum_intersection_weight_lower",
      "label": "beacon-chain:attestation",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "On receiving an attestation, check att.validator_index against len(active_set(st)) before any indexing; if index >= active_set length, reject the message immediately without touching balances or committees.",
      "type": "invariant",
      "assertion": "att.validator_index >= len(active_set(st)) -> reject(att) before balance/committee indexing",
      "severity": "HIGH",
      "covers_hint": [
        "process_attestation",
        "validator index",
        "bounds check",
        "committee",
        "overflow"
      ],
      "bug_bounty_area": "consensus/attestation",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse attestation validator_index not capped before use (integer overflow)",
      "x_exploitability_note": "An overflowing or wrapping index corrupts the per-validator weights that the quorum-intersection lower bound quantifies over. Audit: every network-read index on the balance/committee lookup path.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-QW-03",
      "theorem": "GasperBeaconChain.Core.validator_intersection_lower_bound",
      "label": "beacon-chain:registry-updates",
      "x_layer": "Core/Theories/SlashableBound.lean",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "In process_registry_updates, verify each queue-processing loop (activation and exit) tests its counter with strict '<' against get_validator_churn_limit(state); a '<=' guard lets one extra validator pop past the churn limit each epoch.",
      "type": "invariant",
      "assertion": "loop_guard: counter < churn_limit(state); using counter <= churn_limit(state) over-pops by exactly 1 validator/epoch",
      "severity": "MEDIUM",
      "covers_hint": [
        "process_registry_updates",
        "churn",
        "activation",
        "exit",
        "registry"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Electra activation/exit churn arithmetic (effective-balance / attesting-balance class)",
      "x_exploitability_note": "The churn terms a (activations) and e (exits) appear literally in the validator-intersection lower bound; an off-by-one or wrong cap shifts the slashable-weight floor the theorem relies on.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-SL-01",
      "theorem": "GasperBeaconChain.Executable.slashed_double_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_stride": "Repudiation",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "All attestation-data fields compared by the S1/S2 slashing checks must be exact uint64 or 32-byte roots end-to-end; values above 2^53 must be represented and compared exactly, never in a lossy numeric type",
      "type": "invariant",
      "assertion": "typeof(source_epoch, target_epoch, target_root, validator_index) exact uint64/bytes32 decode-to-compare",
      "severity": "CRITICAL",
      "covers_hint": [
        "process_slashings",
        "attester slashing",
        "uint64",
        "type width",
        "decode"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lodestar uint64 slashing values as JS number (CWE-190) — AttesterSlashing/ProposerSlashing above 2^53 accepted by some clients, rejected by others, consensus split (fixed v0.36.0)",
      "x_exploitability_note": "A lossy numeric type silently fails to detect a slashing that slashed_double_vote_iff_bex says exists, and splits validity between clients. Audit: the type of every field on the attester/proposer-slashing path from decode to comparison.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-SL-02",
      "theorem": "GasperBeaconChain.Executable.slashed_double_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_stride": "Repudiation",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "The double-vote check must flag exactly two distinct targets at the same target epoch, neither weakened to same-slot nor strengthened beyond the S1 iff",
      "type": "invariant",
      "assertion": "S1(a1,a2) <-> a1.target_epoch = a2.target_epoch and a1.target_root != a2.target_root",
      "severity": "HIGH",
      "covers_hint": [
        "process_slashings",
        "double vote",
        "equivocation",
        "is_slashable_attestation_data"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lodestar slashing-value class (S1 comparison path)",
      "x_exploitability_note": "The theorem's iff is precise: a weaker predicate misses real equivocations, a stronger one falsely slashes honest validators. Audit: the exact equality/inequality set used in the double-vote predicate.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-SL-03",
      "theorem": "GasperBeaconChain.Executable.slashed_surround_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_stride": "Repudiation",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "The surround-vote check must implement strict containment of source-target spans in both directions; equal endpoints must not count as surround",
      "type": "invariant",
      "assertion": "surround(a1,a2) <-> a1.source < a2.source and a2.target < a1.target (strict inequalities)",
      "severity": "HIGH",
      "covers_hint": [
        "process_slashings",
        "surround vote",
        "is_slashable_attestation_data",
        "boundary"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lodestar slashing-value class (S2 comparison path, boundary conditions)",
      "x_exploitability_note": "slashed_surround_vote_iff_bex is an iff over strict span containment; an equal-endpoint acceptance either misses surrounds or slashes honest validators. Audit: the boundary conditions of the surround predicate.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-SL-04",
      "theorem": "GasperBeaconChain.Executable.slashed_surround_vote_iff_bex",
      "label": "beacon-chain:slashing",
      "x_layer": "Executable/Slashing.lean (decidable checker)",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "Any key-value store read must return an owned/copied value, never a zero-copy reference into a cursor or iterator buffer that a later delete on that cursor can invalidate or overwrite.",
      "type": "invariant",
      "assertion": "db.read(k) returns owned value; bytes remain valid after any subsequent cursor.delete() in same txn",
      "severity": "HIGH",
      "covers_hint": [
        "process_slashings",
        "slasher",
        "database",
        "cursor",
        "memory safety"
      ],
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse slasher LMDB cursor-reuse memory corruption",
      "x_exploitability_note": "The S1/S2 detection store itself: a corrupted read means a missed or fabricated slashing, so the decidable checker the theorem certifies no longer decides the ledger's real contents.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-JF-01",
      "theorem": "GasperBeaconChain.Executable.justified_iff_bounded",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/Justification.lean (decidable checker)",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "When computing justified(c), reject the supermajority link unless (target.height - source.height) equals the required checkpoint gap exactly — treat <, <=, or >= substitutions as defects, not just >.",
      "type": "invariant",
      "assertion": "justified(c) requires (target.height - source.height) == REQUIRED_GAP, strict equality only",
      "severity": "HIGH",
      "covers_hint": [
        "process_justification_and_finalization",
        "supermajority link",
        "ancestor",
        "justification bits"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse Eth1 deposit / block-processing underflow class (justification bookkeeping)",
      "x_exploitability_note": "justified_iff_bounded characterizes justification by a bounded chain of supermajority links; an off-by-one on the height gap lets a non-supermajority-linked checkpoint be treated as justified. Audit: the ancestor walk and the supermajority-link count.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-JF-02",
      "theorem": "GasperBeaconChain.Core.finalized_means_justified_child",
      "label": "beacon-chain:epoch-processing",
      "x_layer": "Core/Lemmas/Justification.lean",
      "x_stride": "DenialOfService",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "Verify the participation-flag update loop in process_epoch does one O(n) pass over the active validator set, with no nested per-validator lookup that makes cost O(n^2) and overruns the slot budget at max churn.",
      "type": "invariant",
      "assertion": "flag update: single O(n) pass over active_validators; no nested O(n) lookup per validator (avoid O(n^2))",
      "severity": "MEDIUM",
      "covers_hint": [
        "process_epoch",
        "participation flags",
        "sync committee",
        "epoch processing"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": false,
      "entry_points": [
        "FunctionCall"
      ],
      "exploitability": "local-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Electra sync-committee / epoch-processing path could stall finality",
      "x_exploitability_note": "A stalling epoch-processing step breaks the finalize-then-justify chain (finalized_means_justified_child) in practice even with an honest supermajority. Audit: unbounded per-validator work in epoch processing.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-JF-03",
      "theorem": "GasperBeaconChain.Core.k_finalized_means_justified",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/Justification.lean",
      "x_stride": "Tampering",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "Verify the epoch delta used to shift justification_bits (current_epoch minus previous_justified_checkpoint.epoch) is non-negative and within bit-width before shifting; an unchecked delta wraps or overflows the shift and corrupts the justified checkpoint.",
      "type": "invariant",
      "assertion": "delta=current_epoch-prev_justified.epoch; require 0<=delta<=BITS_LEN before bits<<=delta, else reject/clamp",
      "severity": "HIGH",
      "covers_hint": [
        "process_justification_and_finalization",
        "justification bits",
        "deposit count",
        "underflow"
      ],
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse Eth1 deposit-count underflow during block processing (crafted deposit count)",
      "x_exploitability_note": "k_finalized_means_justified pins finalization to justification; an under/overflowed count silently changes which checkpoint is justified, so the client finalizes something it never justified per spec.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-JF-04",
      "theorem": "GasperBeaconChain.Executable.justified_iff_bounded",
      "label": "p2p-interface",
      "x_layer": "Executable/Justification.lean (decidable checker)",
      "x_stride": "DenialOfService",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "On timeout-triggered eviction from a bounded pending-item queue/buffer, evict every entry whose age exceeds the timeout, not just the head, so items stuck behind one expired slot cannot starve later arrivals or exhaust queue capacity.",
      "type": "invariant",
      "assertion": "evict = {e in queue : now - e.enqueue_time > timeout}, not queue.pop_front() only",
      "severity": "MEDIUM",
      "covers_hint": [
        "gossip",
        "reprocess queue",
        "attestation",
        "eviction",
        "memory"
      ],
      "bug_bounty_area": "consensus/p2p",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: Lighthouse attestation reprocess-queue memory leak / re-propagation loop",
      "x_exploitability_note": "The queue is the participation input to the bounded justification chain; an attacker who starves it stalls justification while consuming memory. Audit: the eviction policy and cap of the reprocess queue.",
      "liveness_only": false,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-LV-01",
      "theorem": "GasperBeaconChain.Core.plausible_liveness_construct_extension",
      "label": "p2p-interface",
      "x_layer": "Core/Theories/PlausibleLiveness.lean",
      "x_stride": "DenialOfService",
      "x_origin": "high-angle-checklist (stage-2, docs/high-angle-checklist.md)",
      "lowering": "verbatim",
      "text": "After every inflate()/decompress chunk, add its length to a running total and compare with '>' against a fixed max-decompressed-size constant; abort and discard the stream on the first chunk that exceeds it, never only after full inflation.",
      "type": "invariant",
      "assertion": "exists cap: forall chunk in d, running_total(chunk)>cap => abort_at(chunk) before full_inflate(d)",
      "severity": "MEDIUM",
      "covers_hint": [
        "gossip",
        "libp2p",
        "decompression",
        "resource cap",
        "stream limit"
      ],
      "bug_bounty_area": "consensus/liveness",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "x_dataset_evidence": "ethereum-vuln-dataset: consensus-layer DoS class — unbounded libp2p streams / OOM, decompression bombs, unbounded recursion",
      "x_exploitability_note": "Plausible liveness assumes the chain keeps producing blocks; unbounded network-facing resources void that precondition. Out of bug-bounty safety scope, in scope for liveness.",
      "liveness_only": true,
      "shard": "checklist-high-angle"
    },
    {
      "property_id": "CHK-GEN-01",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "fork-choice",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "In on_attestation, require verify_bls(attestation.signature, signing_root, pubkey) to succeed before the attestation updates Store.latest_messages; block any path where get_weight/filter_block_tree tallies a signature-unverified attestation's weight.",
      "type": "invariant",
      "assertion": "∀ a updating Store.latest_messages: verify_bls(a.signature, a.signing_root, pubkey(a))==true, else excluded from get_weight tally",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "consensus_divergence",
      "x_judged_overall": 4,
      "shard": "checklist-high-angle",
      "x_stride": "Tampering",
      "covers_hint": [],
      "bug_bounty_area": "consensus/fork-choice",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: consensus_divergence (critical/high) class; generated pairing of k_safety' with this failure class (no single incident)"
    },
    {
      "property_id": "CHK-GEN-02",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "fork-choice",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "In on_attestation, reject attestations whose slot > store.current_slot or whose beacon_block_root is absent from store.blocks, before updating store.latest_messages or invoking get_weight/get_ancestor/filter_block_tree with them.",
      "type": "invariant",
      "assertion": "forall a: (a.slot>store.current_slot or a.block_root notin store.blocks) => a notin dom(update_latest_messages) U weight_inputs",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 3.8,
      "shard": "checklist-high-angle",
      "x_stride": "Spoofing",
      "covers_hint": [],
      "bug_bounty_area": "consensus/fork-choice",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: missing_input_validation (critical/high) class; generated pairing of k_safety' with this failure class (no single incident)"
    },
    {
      "property_id": "CHK-GEN-03",
      "theorem": "GasperBeaconChain.Executable.justified_iff_bounded",
      "label": "p2p-interface",
      "x_layer": "Executable/Justification.lean (decidable checker)",
      "lowering": "verbatim",
      "text": "Verify every path indexing or shifting the justification-bits array (attestation processing, ancestor lookup, gossip validation, eviction) validates epoch distance against the array's fixed bound before use, rejecting out-of-range inputs instead of truncating.",
      "type": "invariant",
      "assertion": "forall msg: epoch_diff(msg.target.epoch, current_epoch) <= BITS_LEN checked before index/shift; else reject/evict, never truncate",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4.6,
      "shard": "checklist-high-angle",
      "x_stride": "Spoofing",
      "covers_hint": [],
      "bug_bounty_area": "consensus/p2p",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: missing_input_validation (critical/high) class; generated pairing of justified_iff_bounded with this failure class (no single incident)"
    },
    {
      "property_id": "CHK-GEN-04",
      "theorem": "GasperBeaconChain.Core.plausible_liveness_construct_extension",
      "label": "p2p-interface",
      "x_layer": "Core/Theories/PlausibleLiveness.lean",
      "lowering": "verbatim",
      "text": "Confirm each gossip/libp2p decompression path validates compressed-size and declared uncompressed-size against a fixed cap before allocating buffers, rejecting oversized/malformed frames so one peer cannot exhaust resources and stall propagation.",
      "type": "invariant",
      "assertion": "decompress(payload) => precheck(compressed_len<=CAP && declared_len<=CAP) else reject_and_close_stream",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4.8,
      "shard": "checklist-high-angle",
      "x_stride": "Spoofing",
      "covers_hint": [],
      "bug_bounty_area": "consensus/p2p",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: missing_input_validation (critical/high) class; generated pairing of plausible_liveness_construct_extension with this failure class (no single incident)"
    },
    {
      "property_id": "CHK-GEN-05",
      "theorem": "GasperBeaconChain.Core.k_safety'",
      "label": "beacon-chain:attestation",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Verify all writes to the fork choice store (block tree, attestation weights, checkpoints) are serialized under one lock or atomic snapshot, so concurrent attestation/block threads never observe a torn view during filter_block_tree or weight computation.",
      "type": "invariant",
      "assertion": "store_mutations(block_tree,weights,checkpoints) lock-serialized; filter_block_tree & weight reads only see atomic, non-torn snapshots across threads",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "race_condition",
      "x_judged_overall": 4.2,
      "shard": "checklist-high-angle",
      "x_stride": "Tampering",
      "covers_hint": [],
      "bug_bounty_area": "consensus/attestation",
      "attacker_controlled": true,
      "entry_points": [
        "CallbackHandler"
      ],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: race_condition (critical/high) class; generated pairing of k_safety' with this failure class (no single incident)"
    },
    {
      "property_id": "CHK-GEN-06",
      "theorem": "GasperBeaconChain.Core.finalization_fork_means_same_finalization_fork_one",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Confirm every incoming attestation's (source, target) checkpoint pair is validated for epoch ordering and block-tree ancestry before being tallied toward justification/finalization, rejecting pairs that could let conflicting checkpoints both finalize.",
      "type": "invariant",
      "assertion": "is_ancestor(source.root,target.root) and source.epoch<target.epoch required before tally_for_finalization(pair)",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4.2,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-07",
      "theorem": "GasperBeaconChain.Core.k_non_equal_height_case",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Confirm every finalization/fork-choice comparison of checkpoint heights validates the incoming height field is well-formed and in-range before branching on the non-equal-height case, so a malformed message cannot force conflicting finalized checkpoints.",
      "type": "invariant",
      "assertion": "require validate_height(cp.height) before height_cmp(source.height, target.height) in non_equal_height branch; reject null/out-of-range/malformed height",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4.2,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-08",
      "theorem": "GasperBeaconChain.Core.k_slash_surround_case_general",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Verify surround-vote slashing checks validate source/target epoch ordering and bounds on both attestations before comparison, so malformed epochs can't bypass surround detection.",
      "type": "invariant",
      "assertion": "validate(a.src<a.tgt && b.src<b.tgt) before is_surround(a,b)",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4.6,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-09",
      "theorem": "GasperBeaconChain.Core.no_k_finalized_justified_same_height",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Theories/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Confirm the implementation validates that a checkpoint epoch matches compute_epoch_at_slot(block.slot) and that its root is a genuine chain ancestor before accepting it into justification or finalization updates, rejecting any mismatch.",
      "type": "invariant",
      "assertion": "forall c in accepted_checkpoints: c.epoch == epoch_of_slot(block[c.root].slot) and is_ancestor(c.root, head)",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 4,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-10",
      "theorem": "GasperBeaconChain.Core.no_two_justified_same_height",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Core/Lemmas/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Verify checkpoint justification rejects any supermajority computation whose signer set, height, or checkpoint hash fails validation before votes are tallied.",
      "type": "invariant",
      "assertion": "validate(signers, height, checkpoint_hash) before tally_supermajority(votes)",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 3.6,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-11",
      "theorem": "GasperBeaconChain.Core.two_justified_same_height_slashed",
      "label": "beacon-chain:slashing",
      "x_layer": "Core/Lemmas/AccountableSafety.lean",
      "lowering": "verbatim",
      "text": "Verify all height/epoch/index arithmetic in checkpoint and slashing-detection paths uses checked/saturating ops or explicit bounds checks, preventing overflow-induced false negatives in equivocation detection.",
      "type": "invariant",
      "assertion": "no unchecked +,-,* on height/epoch/index vars in checkpoint/slashing paths; all use checked_add/sub/mul or bounds-checked equivalents",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "integer_overflow_underflow",
      "x_judged_overall": 4.2,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/slashing",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:slashing / integer_overflow_underflow class-level evidence; no individual incident is claimed as proof"
    },
    {
      "property_id": "CHK-GEN-12",
      "theorem": "GasperBeaconChain.Executable.q_intersection_slashed_iff_exists_witness",
      "label": "beacon-chain:justification-and-finality",
      "x_layer": "Executable/Quorums.lean (decidable checker)",
      "lowering": "verbatim",
      "text": "Verify pre-quorum validation rejects malformed/duplicate/out-of-range attester weights before they contribute to attesting balance, so total_active_balance and quorum math cannot be inflated to force a false slashing witness.",
      "type": "invariant",
      "assertion": "validate(attester_weight) before sum; reject if weight<=0 || weight>effective_balance_max || duplicate(attester_id)",
      "severity": "HIGH",
      "x_origin": "generated (stage-2 new-property step, tools/generate-properties.py)",
      "x_defect_class": "missing_input_validation",
      "x_judged_overall": 3.8,
      "shard": "checklist-high-angle",
      "bug_bounty_area": "consensus/finality",
      "attacker_controlled": true,
      "entry_points": ["CallbackHandler"],
      "exploitability": "external-attack",
      "liveness_only": false,
      "x_dataset_evidence": "ethereum-vuln-dataset: beacon-chain:justification-and-finality / missing_input_validation class-level evidence; no individual incident is claimed as proof"
    }
  ]
}