{
 "about": "Formal proofs of BL127's and BL19's core arithmetic and directed rounding: docs/proofs.md",
 "tools": {
  "halmos": "0.3.3",
  "solver": "bitwuzla 0.8.1",
  "z3": "4.12.6",
  "forge": "forge Version: 1.7.1",
  "solc": "0.8.38"
 },
 "summary": {
  "ops": 43,
  "proven": 35,
  "proven_except": 0,
  "fuzzed": 8,
  "counterexamples": 0,
  "in_progress": 0,
  "solver_seconds": 5933
 },
 "ops": [
  {
   "lib": "BL127",
   "op": "add",
   "status": "proven",
   "spec": "a + b exact; Overflow outside int256",
   "checks": [
    "check_bl127_add"
   ],
   "lemmas": [],
   "seconds": 1.0,
   "paths": 12,
   "fast_checks": [
    "check_bl127_add"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_add)$'"
  },
  {
   "lib": "BL127",
   "op": "sub",
   "status": "proven",
   "spec": "a - b exact; Overflow outside int256",
   "checks": [
    "check_bl127_sub"
   ],
   "lemmas": [],
   "seconds": 1.3,
   "paths": 12,
   "fast_checks": [
    "check_bl127_sub"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_sub)$'"
  },
  {
   "lib": "BL127",
   "op": "mul",
   "status": "proven",
   "spec": "floor(a b / 2^128); Overflow when it leaves int256",
   "checks": [
    "check_bl127_mul"
   ],
   "lemmas": [
    "L1",
    "L2"
   ],
   "seconds": 44.8,
   "paths": 21,
   "fast_checks": [
    "check_bl127_mul"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_mul)$'"
  },
  {
   "lib": "BL127",
   "op": "mulDown",
   "status": "proven",
   "spec": "floor(a b / 2^128)",
   "checks": [
    "check_bl127_mulDown"
   ],
   "lemmas": [
    "L1",
    "L2"
   ],
   "seconds": 47.5,
   "paths": 20,
   "fast_checks": [
    "check_bl127_mulDown"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_mulDown)$'"
  },
  {
   "lib": "BL127",
   "op": "mulUp",
   "status": "proven",
   "spec": "ceil(a b / 2^128); Overflow when it leaves int256",
   "checks": [
    "check_bl127_mulUp_outside",
    "check_bl127_mulUp_window"
   ],
   "lemmas": [
    "L1",
    "L2"
   ],
   "seconds": 418.8,
   "paths": 72,
   "fast_checks": [],
   "note": "two checks: every input outside the window where floor(a b / 2^128) = -2^255 - 1, and the window itself (fixed in #159)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_mulUp_outside|check_bl127_mulUp_window)$'"
  },
  {
   "lib": "BL127",
   "op": "div",
   "status": "proven",
   "spec": "trunc(a 2^128 / b); DivisionByZero; Overflow",
   "checks": [
    "check_bl127_div"
   ],
   "lemmas": [
    "K127",
    "L5"
   ],
   "seconds": 0.8,
   "paths": 23,
   "fast_checks": [
    "check_bl127_div"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_div)$'"
  },
  {
   "lib": "BL127",
   "op": "divDown",
   "status": "proven",
   "spec": "floor(a 2^128 / b)",
   "checks": [
    "check_bl127_divDown"
   ],
   "lemmas": [
    "K127",
    "L5"
   ],
   "seconds": 2.8,
   "paths": 64,
   "fast_checks": [
    "check_bl127_divDown"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_divDown)$'"
  },
  {
   "lib": "BL127",
   "op": "divUp",
   "status": "proven",
   "spec": "ceil(a 2^128 / b)",
   "checks": [
    "check_bl127_divUp"
   ],
   "lemmas": [
    "K127",
    "L5"
   ],
   "seconds": 1.9,
   "paths": 51,
   "fast_checks": [
    "check_bl127_divUp"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_divUp)$'"
  },
  {
   "lib": "BL127",
   "op": "inv",
   "status": "proven",
   "spec": "trunc(2^256 / x); DivisionByZero; Overflow",
   "checks": [
    "check_bl127_inv"
   ],
   "lemmas": [
    "L4",
    "L5"
   ],
   "seconds": 0.4,
   "paths": 11,
   "fast_checks": [
    "check_bl127_inv"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_inv)$'"
  },
  {
   "lib": "BL127",
   "op": "sqrt",
   "status": "proven",
   "spec": "floor(sqrt(x 2^128)); OutOfRange below zero",
   "checks": [],
   "lemmas": [
    "R1",
    "R2",
    "L1"
   ],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "a proof by exhaustion and error bounds (test/proofs/isqrt.py): the seed within 2^-4 for each of its 196,608 leading values, five Newton steps to below 2^-128, and the corrections exact; fixed in #159 where it once returned floor + 1",
   "tool": "exact integer arithmetic, test/proofs/isqrt.py",
   "reproduce": "python3 test/proofs/isqrt.py"
  },
  {
   "lib": "BL127",
   "op": "gavg",
   "status": "fuzzed",
   "spec": "sqrt(a b) to nearest from the exact product (never a tie); OutOfRange for opposite signs; Overflow only at a = b = -2^255",
   "checks": [],
   "lemmas": [],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "FuzzProofs against a bit-by-bit integer root of the exact product: testFuzz_bl127_gavg, testFuzz_bl127_roots_near_mid (next to the midpoints), test_bl127_roots_edges",
   "tool": "forge fuzz, 50,000 runs",
   "reproduce": "FOUNDRY_PROFILE=proofs forge test --match-contract FuzzProofs --match-test bl127_gavg"
  },
  {
   "lib": "BL127",
   "op": "hypot",
   "status": "fuzzed",
   "spec": "sqrt(a^2 + b^2) to nearest from the exact sum of squares (never a tie); Overflow past 2^255 - 1",
   "checks": [],
   "lemmas": [],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "FuzzProofs against a bit-by-bit integer root of the exact sum: testFuzz_bl127_hypot, testFuzz_bl127_roots_near_mid, test_bl127_roots_edges",
   "tool": "forge fuzz, 50,000 runs",
   "reproduce": "FOUNDRY_PROFILE=proofs forge test --match-contract FuzzProofs --match-test bl127_hypot"
  },
  {
   "lib": "BL127",
   "op": "floor",
   "status": "proven",
   "spec": "2^128 floor(x / 2^128)",
   "checks": [
    "check_bl127_floor"
   ],
   "lemmas": [],
   "seconds": 0.0,
   "paths": 1,
   "fast_checks": [
    "check_bl127_floor"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_floor)$'"
  },
  {
   "lib": "BL127",
   "op": "ceil",
   "status": "proven",
   "spec": "2^128 ceil(x / 2^128); Overflow at 2^255",
   "checks": [
    "check_bl127_ceil"
   ],
   "lemmas": [],
   "seconds": 0.3,
   "paths": 9,
   "fast_checks": [
    "check_bl127_ceil"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_ceil)$'"
  },
  {
   "lib": "BL127",
   "op": "round",
   "status": "proven",
   "spec": "2^128 floor(x / 2^128 + 1/2); Overflow at 2^255",
   "checks": [
    "check_bl127_round"
   ],
   "lemmas": [],
   "seconds": 0.2,
   "paths": 6,
   "fast_checks": [
    "check_bl127_round"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_round)$'"
  },
  {
   "lib": "BL127",
   "op": "toFixed18",
   "status": "proven",
   "spec": "floor(x 10^18 / 2^128)",
   "checks": [
    "check_bl127_toFixed18"
   ],
   "lemmas": [],
   "seconds": 20.3,
   "paths": 9,
   "fast_checks": [
    "check_bl127_toFixed18"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_toFixed18)$'"
  },
  {
   "lib": "BL127",
   "op": "toFixed18Down",
   "status": "proven",
   "spec": "floor(x 10^18 / 2^128)",
   "checks": [
    "check_bl127_toFixed18Down"
   ],
   "lemmas": [],
   "seconds": 19.1,
   "paths": 9,
   "fast_checks": [
    "check_bl127_toFixed18Down"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_toFixed18Down)$'"
  },
  {
   "lib": "BL127",
   "op": "toFixed18Up",
   "status": "proven",
   "spec": "ceil(x 10^18 / 2^128)",
   "checks": [
    "check_bl127_toFixed18Up"
   ],
   "lemmas": [],
   "seconds": 48.4,
   "paths": 27,
   "fast_checks": [
    "check_bl127_toFixed18Up"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_toFixed18Up)$'"
  },
  {
   "lib": "BL127",
   "op": "fromFixed18",
   "status": "proven",
   "spec": "trunc(x 2^128 / 10^18); OutOfRange outside [-2^127, 2^127)",
   "checks": [
    "check_bl127_fromFixed18"
   ],
   "lemmas": [],
   "seconds": 0.0,
   "paths": 3,
   "fast_checks": [
    "check_bl127_fromFixed18"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl127_fromFixed18)$'"
  },
  {
   "lib": "BL19",
   "op": "add",
   "status": "fuzzed",
   "spec": "a + b rounded to nearest (237 bits, ties away)",
   "checks": [
    "check_bl19_add"
   ],
   "lemmas": [],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "Halmos ran out of time (2000 s) on check_bl19_add; fuzzed against the exact spec (FuzzProofs.testFuzz_bl19_add, 50,000 runs)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_add)$'"
  },
  {
   "lib": "BL19",
   "op": "sub",
   "status": "fuzzed",
   "spec": "a - b rounded to nearest",
   "checks": [
    "check_bl19_sub"
   ],
   "lemmas": [],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "Halmos ran out of time (2000 s) on check_bl19_sub; fuzzed against the exact spec (FuzzProofs.testFuzz_bl19_sub, 50,000 runs)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_sub)$'"
  },
  {
   "lib": "BL19",
   "op": "mul",
   "status": "proven",
   "spec": "a b rounded to nearest",
   "checks": [
    "check_bl19_mul"
   ],
   "lemmas": [
    "L1",
    "L3"
   ],
   "seconds": 430.2,
   "paths": 722,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_mul)$'"
  },
  {
   "lib": "BL19",
   "op": "mulDown",
   "status": "proven",
   "spec": "a b rounded toward -inf",
   "checks": [
    "check_bl19_mulDown"
   ],
   "lemmas": [
    "L1",
    "L3"
   ],
   "seconds": 1023.4,
   "paths": 3161,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_mulDown)$'"
  },
  {
   "lib": "BL19",
   "op": "mulUp",
   "status": "proven",
   "spec": "a b rounded toward +inf",
   "checks": [
    "check_bl19_mulUp"
   ],
   "lemmas": [
    "L1",
    "L3"
   ],
   "seconds": 730.8,
   "paths": 2561,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_mulUp)$'"
  },
  {
   "lib": "BL19",
   "op": "div",
   "status": "proven",
   "spec": "a / b rounded to nearest",
   "checks": [
    "check_bl19_div"
   ],
   "lemmas": [
    "K19",
    "L3"
   ],
   "seconds": 113.9,
   "paths": 443,
   "fast_checks": [
    "check_bl19_div"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_div)$'"
  },
  {
   "lib": "BL19",
   "op": "divDown",
   "status": "proven",
   "spec": "a / b rounded toward -inf",
   "checks": [
    "check_bl19_divDown"
   ],
   "lemmas": [
    "K19",
    "L3"
   ],
   "seconds": 303.0,
   "paths": 1805,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_divDown)$'"
  },
  {
   "lib": "BL19",
   "op": "divUp",
   "status": "proven",
   "spec": "a / b rounded toward +inf",
   "checks": [
    "check_bl19_divUp"
   ],
   "lemmas": [
    "K19",
    "L3"
   ],
   "seconds": 263.9,
   "paths": 1553,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_divUp)$'"
  },
  {
   "lib": "BL19",
   "op": "inv",
   "status": "proven",
   "spec": "1 / x rounded to nearest",
   "checks": [
    "check_bl19_inv"
   ],
   "lemmas": [
    "K19"
   ],
   "seconds": 60.4,
   "paths": 462,
   "fast_checks": [
    "check_bl19_inv"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_inv)$'"
  },
  {
   "lib": "BL19",
   "op": "sqrt",
   "status": "fuzzed",
   "spec": "sqrt(x) rounded to nearest",
   "checks": [],
   "lemmas": [],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "FuzzProofs against the exact integer root",
   "tool": "forge fuzz, 50,000 runs",
   "reproduce": "FOUNDRY_PROFILE=proofs forge test --match-contract FuzzProofs --match-test bl19_sqrt"
  },
  {
   "lib": "BL19",
   "op": "floor",
   "status": "proven",
   "spec": "the integral number at or below x",
   "checks": [
    "check_bl19_floor"
   ],
   "lemmas": [],
   "seconds": 198.6,
   "paths": 1412,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_floor)$'"
  },
  {
   "lib": "BL19",
   "op": "ceil",
   "status": "proven",
   "spec": "the integral number at or above x",
   "checks": [
    "check_bl19_ceil"
   ],
   "lemmas": [],
   "seconds": 202.2,
   "paths": 1423,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_ceil)$'"
  },
  {
   "lib": "BL19",
   "op": "round",
   "status": "proven",
   "spec": "the nearest integral number, halves away from zero",
   "checks": [
    "check_bl19_round"
   ],
   "lemmas": [],
   "seconds": 206.4,
   "paths": 1380,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_round)$'"
  },
  {
   "lib": "BL19",
   "op": "toUintDown",
   "status": "proven",
   "spec": "floor(x) as uint256",
   "checks": [
    "check_bl19_toUintDown"
   ],
   "lemmas": [],
   "seconds": 0.6,
   "paths": 29,
   "fast_checks": [
    "check_bl19_toUintDown"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toUintDown)$'"
  },
  {
   "lib": "BL19",
   "op": "toUintUp",
   "status": "proven",
   "spec": "ceil(x) as uint256",
   "checks": [
    "check_bl19_toUintUp"
   ],
   "lemmas": [],
   "seconds": 0.7,
   "paths": 27,
   "fast_checks": [
    "check_bl19_toUintUp"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toUintUp)$'"
  },
  {
   "lib": "BL19",
   "op": "toIntDown",
   "status": "proven",
   "spec": "floor(x) as int256",
   "checks": [
    "check_bl19_toIntDown"
   ],
   "lemmas": [],
   "seconds": 1.3,
   "paths": 47,
   "fast_checks": [
    "check_bl19_toIntDown"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toIntDown)$'"
  },
  {
   "lib": "BL19",
   "op": "toIntUp",
   "status": "proven",
   "spec": "ceil(x) as int256",
   "checks": [
    "check_bl19_toIntUp"
   ],
   "lemmas": [],
   "seconds": 1.3,
   "paths": 41,
   "fast_checks": [
    "check_bl19_toIntUp"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toIntUp)$'"
  },
  {
   "lib": "BL19",
   "op": "toFixed18",
   "status": "fuzzed",
   "spec": "x 10^18 to the nearest integer, halves away",
   "checks": [
    "check_bl19_toFixed18"
   ],
   "lemmas": [
    "L1"
   ],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "Halmos ran out of time (2000 s) on check_bl19_toFixed18; fuzzed against the exact spec (FuzzProofs.testFuzz_bl19_toFixed18, 50,000 runs)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toFixed18)$'"
  },
  {
   "lib": "BL19",
   "op": "toFixed18Down",
   "status": "fuzzed",
   "spec": "floor(x 10^18)",
   "checks": [
    "check_bl19_toFixed18Down"
   ],
   "lemmas": [
    "L1"
   ],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "Halmos ran out of time (2000 s) on check_bl19_toFixed18Down; fuzzed against the exact spec (FuzzProofs.testFuzz_bl19_toFixed18, 50,000 runs)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toFixed18Down)$'"
  },
  {
   "lib": "BL19",
   "op": "toFixed18Up",
   "status": "fuzzed",
   "spec": "ceil(x 10^18)",
   "checks": [
    "check_bl19_toFixed18Up"
   ],
   "lemmas": [
    "L1"
   ],
   "seconds": null,
   "paths": null,
   "fast_checks": [],
   "note": "Halmos ran out of time (2000 s) on check_bl19_toFixed18Up; fuzzed against the exact spec (FuzzProofs.testFuzz_bl19_toFixed18, 50,000 runs)",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_toFixed18Up)$'"
  },
  {
   "lib": "BL19",
   "op": "fromUint",
   "status": "proven",
   "spec": "x rounded to nearest",
   "checks": [
    "check_bl19_fromUint"
   ],
   "lemmas": [],
   "seconds": 36.0,
   "paths": 189,
   "fast_checks": [
    "check_bl19_fromUint"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_fromUint)$'"
  },
  {
   "lib": "BL19",
   "op": "fromUintDown",
   "status": "proven",
   "spec": "x truncated to 237 bits",
   "checks": [
    "check_bl19_fromUintDown"
   ],
   "lemmas": [],
   "seconds": 27.2,
   "paths": 112,
   "fast_checks": [
    "check_bl19_fromUintDown"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_fromUintDown)$'"
  },
  {
   "lib": "BL19",
   "op": "fromUintUp",
   "status": "proven",
   "spec": "x rounded up to 237 bits",
   "checks": [
    "check_bl19_fromUintUp"
   ],
   "lemmas": [],
   "seconds": 64.1,
   "paths": 554,
   "fast_checks": [
    "check_bl19_fromUintUp"
   ],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_fromUintUp)$'"
  },
  {
   "lib": "BL19",
   "op": "fromFixed18",
   "status": "proven",
   "spec": "round(round(x) / 10^18), each to nearest (one rounding below 2^237)",
   "checks": [
    "check_bl19_fromFixed18"
   ],
   "lemmas": [
    "K18",
    "L5"
   ],
   "seconds": 1661.1,
   "paths": 6325,
   "fast_checks": [],
   "note": "",
   "tool": "Halmos 0.3.3, bitwuzla 0.8.1",
   "reproduce": "python3 test/proofs/run.py --only '^(check_bl19_fromFixed18)$'"
  }
 ],
 "lemmas": [
  {
   "lemma": "L1",
   "result": "proved",
   "text": "umul: (MULMOD(a,b,2^256-1) - MUL(a,b) - borrow, MUL(a,b)) = a b"
  },
  {
   "lemma": "L2",
   "result": "proved",
   "text": "smul, signs (+, +): signed high word by the corrections"
  },
  {
   "lemma": "L2",
   "result": "proved",
   "text": "smul, signs (+, -): signed high word by the corrections"
  },
  {
   "lemma": "L2",
   "result": "proved",
   "text": "smul, signs (-, +): signed high word by the corrections"
  },
  {
   "lemma": "L2",
   "result": "proved",
   "text": "smul, signs (-, -): signed high word by the corrections"
  },
  {
   "lemma": "L3",
   "result": "proved",
   "text": "MUL of two exponent fields is zero iff one is"
  },
  {
   "lemma": "L4",
   "result": "proved",
   "text": "DIV(2^256 - u, u) + 1 = floor(2^256 / u)"
  },
  {
   "lemma": "L5",
   "result": "proved",
   "text": "(x XOR SAR(255, x)) - SAR(255, x) = |x|"
  },
  {
   "lemma": "L6",
   "result": "proved",
   "text": "ma mb in [2^472, 2^474) for significands"
  },
  {
   "lemma": "L6",
   "result": "proved",
   "text": "so its high word is in [2^216, 2^218)"
  },
  {
   "lemma": "L7",
   "result": "proved",
   "text": "floor(ma 2^255 / mb) >= 2^254"
  },
  {
   "lemma": "L7",
   "result": "proved",
   "text": "floor(2^491 / m) >= 2^254"
  },
  {
   "lemma": "L7",
   "result": "proved",
   "text": "floor(m 2^60 / 5^18) >= 2^254"
  },
  {
   "lemma": "K18",
   "result": "proved",
   "text": "q18: floor(m 2^60 / 5^18) by two word divisions, every intermediate a word"
  },
  {
   "lemma": "K127",
   "result": "proved",
   "text": "divq(a, b) = floor(a 2^128 / b): S1-S6, B1-B3"
  },
  {
   "lemma": "K19",
   "result": "proved",
   "text": "divh(a, b) = floor(a 2^255 / b): S1-S6, B1-B3"
  },
  {
   "lemma": "R1",
   "result": "proved",
   "text": "isqrtw(z) = floor(sqrt z) for 2^128 <= z < 2^256"
  },
  {
   "lemma": "R2",
   "result": "proved",
   "text": "BL127 sqrt(x) = floor(sqrt(x 2^128)) for 0 < x < 2^255"
  }
 ],
 "fuzz": [
  {
   "test": "testFuzz_K127",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_K19",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_K19_significands",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl127_sqrt",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl127_sqrt_negative",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl19_add",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl19_sqrt",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl19_sqrt_near_squares",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl19_sub",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl19_toFixed18",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "test_bl127_mulUp_regression_159",
   "result": "pass",
   "runs": 1
  },
  {
   "test": "test_bl127_sqrt_regression_159",
   "result": "pass",
   "runs": 1
  },
  {
   "test": "testFuzz_bl127_gavg",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl127_hypot",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "testFuzz_bl127_roots_near_mid",
   "result": "pass",
   "runs": 50000
  },
  {
   "test": "test_bl127_roots_edges",
   "result": "pass",
   "runs": 1
  }
 ]
}