PolySAT: Word-level Bit-vector Reasoning in Z3

TL;DR

PolySAT introduces a word-level decision procedure integrated into Z3 for efficient bit-vector reasoning over polynomial arithmetic, enhancing scalability in model checking and smart contract verification.

Contribution

It extends SMT solving with a novel calculus supporting non-linear bit-vector polynomial reasoning, including interval extraction and on-demand lemma generation.

Findings

Successfully integrated into Z3 SMT solver.

Improves scalability over traditional bit-blasting techniques.

Applicable to model checking and smart contract verification.

Abstract

PolySAT is a word-level decision procedure supporting bit-precise SMT reasoning over polynomial arithmetic with large bit-vector operations. The PolySAT calculus extends conflict-driven clause learning modulo theories with two key components: (i) a bit-vector plugin to the equality graph, and (ii) a theory solver for bit-vector arithmetic with non-linear polynomials. PolySAT implements dedicated procedures to extract bit-vector intervals from polynomial inequalities. For the purpose of conflict analysis and resolution, PolySAT comes with on-demand lemma generation over non-linear bit-vector arithmetic. PolySAT is integrated into the SMT solver Z3 and has potential applications in model checking and smart contract verification where bit-blasting techniques on multipliers/divisions do not scale.