CHC-based Automated Verification of WebAssembly Programs

2026-07-19

AI Summary

This work addresses the challenges in static verification of WebAssembly programs arising from the complexity of indirect function calls and the excessive size of panic-handling routines. To tackle these issues, the paper proposes an automated verification approach based on satisfiability solving of Constrained Horn Clauses (CHCs). The method innovatively integrates type information to prune the set of potential targets for indirect calls and employs control-flow summarization to compactly represent the semantics of large panic-handling functions, thereby substantially reducing verification complexity. Experimental results demonstrate that this technique significantly enhances analysis efficiency and scalability for programs with intricate control-flow structures while maintaining high precision.

Abstract

WebAssembly is a stack-based imperative language widely used to develop safe and efficient Web applications. In this paper, we propose an automated static verification method for a subset of WebAssembly using a constrained Horn clauses (CHCs) satisfiability solver. Our main challenges are how to handle indirect function calls effectively and how to analyze huge panic handlers. A naïve approach to the former problem would be to model a function reference table as an array of functions' entry points, but it would suffer from having too many candidates for indirect calls, resulting in a large case analysis. We address the problem by utilizing type information and filtering candidates for each indirect function call. For the latter problem, a panic handler, which is a function that is called when an error occurs, can be very large and complex. We mitigate this problem by summarizing the panic handler using control-flow analysis. We confirmed the effectiveness of our approach through preliminary experiments.

Problem

• WebAssembly
• indirect function calls
• panic handlers
• automated verification
• static analysis

Innovation

• Constrained Horn Clauses
• WebAssembly verification
• indirect function calls
• panic handler summarization
• static analysis