|
|
|
@ -3,9 +3,9 @@ methods { |
|
|
|
|
isApprovedForAll(address,address) returns bool envfree |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
/// If a method call reduces account balances, the caller should be either the |
|
|
|
|
/// owner of the account or approved by the owner to act on its behalf. |
|
|
|
|
rule onlyApprovedCanReduceBalance { |
|
|
|
|
/// If a method call reduces account balances, the caller must be either the |
|
|
|
|
/// owner of the account or approved by the owner to act on the owner's behalf. |
|
|
|
|
rule onlyHolderOrApprovedCanReduceBalance { |
|
|
|
|
address holder; uint256 token; uint256 amount; |
|
|
|
|
uint256 balanceBefore = balanceOf(holder, token); |
|
|
|
|
|
|
|
|
@ -14,7 +14,8 @@ rule onlyApprovedCanReduceBalance { |
|
|
|
|
|
|
|
|
|
uint256 balanceAfter = balanceOf(holder, token); |
|
|
|
|
|
|
|
|
|
assert balanceAfter < balanceBefore => e.msg.sender == holder || isApprovedForAll(holder, e.msg.sender); // TODO add assert message |
|
|
|
|
assert balanceAfter < balanceBefore => e.msg.sender == holder || isApprovedForAll(holder, e.msg.sender), |
|
|
|
|
"An account balance may only be reduced by the holder or a holder-approved agent"; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
/// This rule should always fail. |
|
|
|
|