[GH-ISSUE #2393] [Feature] Solidity: inspect offline proxy patterns and supplied implementation-slot evidence #802

New issue

Open

opened 2026-10-15 18:28:36 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:36 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2393

Analyst question and current gap

Interface inference on proxy bytecode can hide the distinction between proxy dispatch and implementation behavior. REA needs explicitly attributed offline proxy relationships rather than automatic network resolution or guessed deployed identities.

Proposed outcome

Recognize admitted ERC-1167 runtime patterns from exact local bytecode and retain the embedded implementation address with byte-range evidence.
Interpret explicitly supplied recorded ERC-1967 implementation/beacon/admin slots with snapshot identity, availability and precision.
Separate observed slot values, bytecode-pattern classification and inferred delegation edges. Missing storage differs from observed zero.
Preserve code address and storage/execution context separately for delegatecall; retain unresolved beacon relationships instead of executing implementation() implicitly.
Keep proxy-chain cycles, modified/unknown patterns and unmatched implementation bytecode explicit. No RPC lookup, wallet or deployment action is implied.

Acceptance and verification

Own/synthetic fixtures cover exact minimal proxies, altered patterns, implementation/beacon alternatives and observed zero versus unavailable slots.
Wrong snapshot/chain/block associations cannot become verified implementation relationships.
Cycles and missing implementation artifacts terminate with explicit unresolved edges.
CLI/MCP preserve raw bytes/slots and distinguish pattern evidence from actual runtime calls.
Record one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/proxy-evidence/ before code.

Scope and relationships

Independently scoped follow-up to roadmap #972 and existing EVM interface PR #1051; parent TIOBE language tracker #2383. Initial analysis uses caller-selected local evidence and owned fixtures. New provider choices require the explicit CONTRIBUTING.md maintainer decision before substantial implementation for integration. Runtime acquisition, local execution and blockchain mutation are not implicit parts of this feature.

Primary references

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2393 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Blockchain RE](https://img.shields.io/badge/domain-blockchain_RE-orange.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Analyst question and current gap Interface inference on proxy bytecode can hide the distinction between proxy dispatch and implementation behavior. REA needs explicitly attributed offline proxy relationships rather than automatic network resolution or guessed deployed identities. ## Proposed outcome - Recognize admitted ERC-1167 runtime patterns from exact local bytecode and retain the embedded implementation address with byte-range evidence. - Interpret explicitly supplied recorded ERC-1967 implementation/beacon/admin slots with snapshot identity, availability and precision. - Separate observed slot values, bytecode-pattern classification and inferred delegation edges. Missing storage differs from observed zero. - Preserve code address and storage/execution context separately for delegatecall; retain unresolved beacon relationships instead of executing implementation() implicitly. - Keep proxy-chain cycles, modified/unknown patterns and unmatched implementation bytecode explicit. No RPC lookup, wallet or deployment action is implied. ## Acceptance and verification - [ ] Own/synthetic fixtures cover exact minimal proxies, altered patterns, implementation/beacon alternatives and observed zero versus unavailable slots. - [ ] Wrong snapshot/chain/block associations cannot become verified implementation relationships. - [ ] Cycles and missing implementation artifacts terminate with explicit unresolved edges. - [ ] CLI/MCP preserve raw bytes/slots and distinguish pattern evidence from actual runtime calls. - [ ] Record one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/proxy-evidence/ before code. ## Scope and relationships Independently scoped follow-up to roadmap #972 and existing EVM interface PR #1051; parent TIOBE language tracker #2383. Initial analysis uses caller-selected local evidence and owned fixtures. New provider choices require the explicit CONTRIBUTING.md maintainer decision before substantial implementation for integration. Runtime acquisition, local execution and blockchain mutation are not implicit parts of this feature. ## Primary references - [ERC-1167 minimal proxy](https://eips.ethereum.org/EIPS/eip-1167) - [ERC-1967 proxy slots](https://eips.ethereum.org/EIPS/eip-1967)

bsakaguchi added the

area: evidence

enhancement

P2: medium

labels

2026-10-15 18:28:36 +00:00

bsakaguchi commented

2026-10-15 18:28:37 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Triage & Architectural Review Notes

Objective (ELI5):
Identify upgradeable proxy patterns (ERC-1967, ERC-1822 UUPS, Diamond Multi-Facet ERC-2535) and trace static implementation slots entirely offline.

Implementation Invariants:

Verify canonical storage slots directly:
- ERC-1967 Implementation: 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
- ERC-1967 Admin: 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
- ERC-1967 Beacon: 0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50
If an implementation address cannot be resolved from supplied artifacts or recorded storage diffs, report implementation: unknown instead of executing remote eth_call heuristics.

@matbrgz commented on GitHub (Oct 12, 2026): ### Triage & Architectural Review Notes **Objective (ELI5):** Identify upgradeable proxy patterns (ERC-1967, ERC-1822 UUPS, Diamond Multi-Facet ERC-2535) and trace static implementation slots entirely offline. **Implementation Invariants:** - Verify canonical storage slots directly: - ERC-1967 Implementation: `0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc` - ERC-1967 Admin: `0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103` - ERC-1967 Beacon: `0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50` - If an implementation address cannot be resolved from supplied artifacts or recorded storage diffs, report `implementation: unknown` instead of executing remote eth_call heuristics.

bsakaguchi referenced this issue

2026-10-16 21:16:18 +00:00

[PR #802] [CLOSED] fix(reconstruction): preserve unknown graph limitations #2252

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #815] [MERGED] fix: integrate 24 reviewed browser/native/semantics corrections #2262

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:42 +00:00