diff --git a/thys/Solidity/Accounts.thy b/thys/Solidity/Accounts.thy
--- a/thys/Solidity/Accounts.thy
+++ b/thys/Solidity/Accounts.thy
@@ -1,313 +1,323 @@
 section\<open>Accounts\<close>
 theory Accounts
 imports Valuetypes
 begin
 
 type_synonym Balance = Valuetype
 type_synonym Identifier = String.literal
 
 (*
 Contract None means not initialized yet
 *)
 datatype atype =
     EOA
   | Contract Identifier
 
 record account =
   bal :: Balance
   type :: "atype option"
   contracts :: nat
 
 lemma bind_case_atype_cong [fundef_cong]:
   assumes "x = x'"
       and "x = EOA \<Longrightarrow> f s = f' s"
       and "\<And>a. x = Contract a \<Longrightarrow> g a s = g' a s"
     shows "(case x of EOA \<Rightarrow> f | Contract a \<Rightarrow> g a) s
          = (case x' of EOA \<Rightarrow> f' | Contract a \<Rightarrow> g' a) s"
   using assms by (cases x, auto)
 
 definition emptyAcc :: account
   where "emptyAcc = \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = None, contracts = 0\<rparr>"
 
+declare emptyAcc_def [solidity_symbex]
+
 type_synonym Accounts = "Address \<Rightarrow> account"
 
 definition emptyAccount :: "Accounts"
 where
   "emptyAccount _ = emptyAcc"
 
+declare emptyAccount_def [solidity_symbex]
+
 definition addBalance :: "Address \<Rightarrow> Valuetype \<Rightarrow> Accounts \<Rightarrow> Accounts option"
 where
   "addBalance ad val acc =
     (if ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0
       then (let v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val
          in if (v < 2^256)
            then Some (acc(ad := acc ad \<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>))
            else None)
       else None)"
 
+declare addBalance_def [solidity_symbex]
+
 lemma addBalance_val1:
   assumes "addBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0"
 using assms unfolding addBalance_def by (simp add:Let_def split:if_split_asm)
 
 lemma addBalance_val2:
   assumes "addBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val < 2^256"
 using assms unfolding addBalance_def by (simp add:Let_def split:if_split_asm)
 
 lemma addBalance_limit:
   assumes "addBalance ad val acc = Some acc'"
      and "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) < 2 ^ 256"
    shows "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) < 2 ^ 256"
 proof
   fix ad'
   show "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) < 2 ^ 256"
   proof (cases "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0")
     case t1: True
     define v where v_def: "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
     with assms(2) have "v \<ge>0" by (simp add: t1)
     then show ?thesis
     proof (cases "v < 2^256")
       case t2: True
       with t1 v_def have "addBalance ad val acc = Some (acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>))" unfolding addBalance_def by simp
       with t2 `v \<ge>0` show ?thesis using assms Read_ShowL_id by auto
     next
       case False
       with t1 v_def show ?thesis using assms(1) unfolding addBalance_def by simp
     qed
   next
     case False
     then show ?thesis using assms(1) unfolding addBalance_def by simp
   qed
 qed
 
 lemma addBalance_add:
   assumes "addBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding addBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms by (simp split:if_split_asm)
 qed
 
 lemma addBalance_mono:
   assumes "addBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) \<ge> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding addBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms unfolding addBalance_def by (simp split:if_split_asm)
 qed
 
 lemma addBalance_eq:
   assumes "addBalance ad val acc = Some acc'"
       and "ad \<noteq> ad'"
     shows "bal (acc ad') = bal (acc' ad')"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding addBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms by (simp split:if_split_asm)
 qed
 
 definition subBalance :: "Address \<Rightarrow> Valuetype \<Rightarrow> Accounts \<Rightarrow> Accounts option"
   where
   "subBalance ad val acc =
     (if ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0
       then (let v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val
          in if (v \<ge> 0)
            then Some (acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>))
            else None)
       else None)"
 
+declare subBalance_def [solidity_symbex]
+
 lemma subBalance_val1:
   assumes "subBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0"
 using assms unfolding subBalance_def by (simp split:if_split_asm)
 
 lemma subBalance_val2:
   assumes "subBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0"
 using assms unfolding subBalance_def by (simp split:if_split_asm)
 
 lemma subBalance_sub:
   assumes "subBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding subBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms by (simp split:if_split_asm)
 qed
 
 lemma subBalance_limit:
   assumes "subBalance ad val acc = Some acc'"
      and "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) < 2 ^ 256"
    shows "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) < 2 ^ 256"
 proof
   fix ad'
   show "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) < 2 ^ 256"
   proof (cases "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0")
     case t1: True
     define v where v_def: "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
     with assms(2) t1 have "v < 2 ^ 256" by (smt (verit))
     then show ?thesis
     proof (cases "v \<ge> 0")
       case t2: True
       with t1 v_def have "subBalance ad val acc = Some (acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>))" unfolding subBalance_def by simp
       with t2 `v < 2 ^ 256` show ?thesis using assms Read_ShowL_id by auto
     next
       case False
       with t1 v_def show ?thesis using assms(1) unfolding subBalance_def by simp
     qed
   next
     case False
     then show ?thesis using assms(1) unfolding subBalance_def by simp
   qed
 qed
 
 lemma subBalance_mono:
   assumes "subBalance ad val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) \<ge> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad))"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding subBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms unfolding subBalance_def by (simp split:if_split_asm)
 qed
 
 lemma subBalance_eq:
   assumes "subBalance ad val acc = Some acc'"
       and "ad \<noteq> ad'"
     shows "(bal (acc ad')) = (bal (acc' ad'))"
 proof -
   define v where "v = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
   with assms have "acc' = acc(ad := acc ad\<lparr>bal:=ShowL\<^sub>i\<^sub>n\<^sub>t v\<rparr>)" unfolding subBalance_def by (simp add:Let_def split:if_split_asm)
   thus ?thesis using v_def Read_ShowL_id assms by (simp split:if_split_asm)
 qed
 
 definition transfer :: "Address \<Rightarrow> Address \<Rightarrow> Valuetype \<Rightarrow> Accounts \<Rightarrow> Accounts option"
 where
   "transfer ads addr val acc =
     (case subBalance ads val acc of
       Some acc' \<Rightarrow> addBalance addr val acc'
     | None \<Rightarrow> None)"
 
+declare transfer_def [solidity_symbex]
+
 lemma transfer_val1:
   assumes "transfer ads addr val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0"
 proof -
   from assms(1) obtain acc''
     where *: "subBalance ads val acc = Some acc''"
       and **: "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split:if_split_asm)
   then show "ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0" using subBalance_val1[OF *] by simp
 qed
 
 lemma transfer_val2:
   assumes "transfer ads addr val acc = Some acc'"
       and "ads \<noteq> addr"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr)) + ReadL\<^sub>i\<^sub>n\<^sub>t val < 2^256"
 proof -
   from assms(1) obtain acc''
     where *: "subBalance ads val acc = Some acc''"
       and **: "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split:if_split_asm)
 
   have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' addr)) + ReadL\<^sub>i\<^sub>n\<^sub>t val < 2^256" using addBalance_val2[OF **] by simp
   with * show ?thesis using assms(2) subBalance_eq[OF *] by simp
 qed
 
 lemma transfer_val3:
   assumes "transfer ads addr val acc = Some acc'"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ads)) - ReadL\<^sub>i\<^sub>n\<^sub>t val \<ge> 0"
 using assms by (auto simp add: Let_def subBalance_def transfer_def split:if_split_asm)
 
 lemma transfer_add:
   assumes "transfer ads addr val acc = Some acc'"
       and "addr \<noteq> ads"
     shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' addr)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr)) + ReadL\<^sub>i\<^sub>n\<^sub>t val"
 proof -
   from assms(1) obtain acc''
     where *: "subBalance ads val acc = Some acc''"
       and **: "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split:if_split_asm)
 
   with assms(2) have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' addr))" using subBalance_eq[OF *] by simp
   moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' addr)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' addr)) + ReadL\<^sub>i\<^sub>n\<^sub>t val" using addBalance_add[OF **] by simp
   ultimately show ?thesis using Read_ShowL_id by simp
 qed
 
 lemma transfer_sub:
   assumes "transfer ads addr val acc = Some acc'"
       and "addr \<noteq> ads"
   shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ads)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ads)) - ReadL\<^sub>i\<^sub>n\<^sub>t val"
 proof -
   from assms(1) obtain acc''
     where *: "subBalance ads val acc = Some acc''"
       and **: "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split:if_split_asm)
 
   then have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' ads)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ads)) - ReadL\<^sub>i\<^sub>n\<^sub>t val" using subBalance_sub[OF *] by simp
   moreover from assms(2) have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ads)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' ads))" using addBalance_eq[OF **] by simp
   ultimately show ?thesis using Read_ShowL_id by simp
 qed
 
 lemma transfer_same:
   assumes "transfer ad ad' val acc = Some acc'"
       and "ad = ad'"
   shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad))"
 proof -
   from assms obtain acc'' where *: "subBalance ad val acc = Some acc''" by (simp add: subBalance_def transfer_def split:if_split_asm)
   with assms have **: "addBalance ad val acc'' = Some acc'" by (simp add: transfer_def split:if_split_asm)
   moreover from * have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t val" using subBalance_sub by simp
   moreover from ** have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t val" using addBalance_add by simp
   ultimately show ?thesis by simp
 qed
 
 lemma transfer_mono:
   assumes "transfer ads addr val acc = Some acc'"
   shows "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' addr)) \<ge> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr))"
 proof -
   from assms(1) obtain acc''
     where *: "subBalance ads val acc = Some acc''"
       and **: "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split:if_split_asm)
 
   show ?thesis
   proof (cases "addr = ads")
     case True
     with * have "acc'' = acc(addr:=acc addr\<lparr>bal := ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr)) - ReadL\<^sub>i\<^sub>n\<^sub>t val)\<rparr>)" by (simp add:Let_def subBalance_def split: if_split_asm)
     moreover from ** have "acc'=acc''(addr:=acc'' addr\<lparr>bal := ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' addr)) + ReadL\<^sub>i\<^sub>n\<^sub>t val)\<rparr>)" unfolding addBalance_def by (simp add:Let_def split: if_split_asm)
     ultimately show ?thesis using Read_ShowL_id by auto
   next
     case False
     then have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc addr)) \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc'' addr))" using subBalance_eq[OF *] by simp
     also have "\<dots> \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' addr))" using addBalance_mono[OF **] by simp
     finally show ?thesis .
   qed
 qed
 
 lemma transfer_eq:
   assumes "transfer ads addr val acc = Some acc'"
       and "ad \<noteq> ads"
       and "ad \<noteq> addr"
     shows "bal (acc' ad) = bal (acc ad)"
 using assms by (auto simp add: Let_def addBalance_def subBalance_def transfer_def split:if_split_asm)
 
 lemma transfer_limit:
   assumes "transfer ads addr val acc = Some acc'"
      and "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) < 2 ^ 256"
    shows "\<forall>ad. ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad)) < 2 ^ 256"
 proof
   fix ad'
   from assms(1) obtain acc'' where "subBalance ads val acc = Some acc''" and "addBalance addr val acc'' = Some acc'" by (simp add: subBalance_def transfer_def split: if_split_asm)
   with subBalance_limit[OF _ assms(2)]
   show "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc' ad')) < 2 ^ 256"
     using addBalance_limit by presburger
 qed
 
 lemma transfer_type_same:
   assumes "transfer ads addr val acc = Some acc'"
     shows "type (acc' ad) = type (acc ad)"
 using assms by (auto simp add: Let_def addBalance_def subBalance_def transfer_def split:if_split_asm)
 
 lemma transfer_contracts_same:
   assumes "transfer ads addr val acc = Some acc'"
     shows "contracts (acc' ad) = contracts (acc ad)"
 using assms by (auto simp add: Let_def addBalance_def subBalance_def transfer_def split:if_split_asm)
 
 
 end
\ No newline at end of file
diff --git a/thys/Solidity/Contracts.thy b/thys/Solidity/Contracts.thy
--- a/thys/Solidity/Contracts.thy
+++ b/thys/Solidity/Contracts.thy
@@ -1,615 +1,621 @@
 section \<open>Contracts\<close>
 theory Contracts
   imports Environment
 begin
 
 subsection \<open>Syntax of Contracts\<close>
 
 datatype L = Id Identifier
            | Ref Identifier "E list"
 and      E = INT nat int
            | UINT nat int
            | ADDRESS String.literal
            | BALANCE E
            | THIS
            | SENDER
            | VALUE
            | TRUE
            | FALSE
            | LVAL L
            | PLUS E E
            | MINUS E E
            | EQUAL E E
            | LESS E E
            | AND E E
            | OR E E
            | NOT E
            | CALL Identifier "E list"
            | ECALL E Identifier "E list"
            | CONTRACTS
 
 datatype S = SKIP
            | BLOCK "(Identifier \<times> Type) \<times> (E option)" S
            | ASSIGN L E
            | TRANSFER E E
            | COMP S S
            | ITE E S S
            | WHILE E S
            | INVOKE Identifier "E list"
            | EXTERNAL E Identifier "E list" E
            | NEW Identifier "E list" E
 
 abbreviation
   "vbits\<equiv>{8,16,24,32,40,48,56,64,72,80,88,96,104,112,120,128,
           136,144,152,160,168,176,184,192,200,208,216,224,232,240,248,256}"
 
 lemma vbits_max[simp]:
   assumes "b1 \<in> vbits"
     and "b2 \<in> vbits"
   shows "(max b1 b2) \<in> vbits"
 proof -
   consider (b1) "max b1 b2 = b1" | (b2) "max b1 b2 = b2" by (metis max_def)
   then show ?thesis
   proof cases
     case b1
     then show ?thesis using assms(1) by simp
   next
     case b2
     then show ?thesis using assms(2) by simp
   qed
 qed
 
 lemma vbits_ge_0: "(x::nat)\<in>vbits \<Longrightarrow> x>0" by auto
 
 subsection \<open>State\<close>
 
 type_synonym Gas = nat
 
 record State =   
   accounts :: Accounts
   stack :: Stack
   memory :: MemoryT
   storage :: "Address \<Rightarrow> StorageT"
   gas :: Gas
 
 lemma all_gas_le:
   assumes "gas x<(gas y::nat)"
       and "\<forall>z. gas z < gas y \<longrightarrow> P z \<longrightarrow> Q z"
     shows "\<forall>z. gas z \<le> gas x \<and> P z \<longrightarrow> Q z" using assms by simp
 
 lemma all_gas_less:
   assumes "\<forall>z. gas z < gas y \<longrightarrow> P z"
       and "gas x\<le>(gas y::nat)"
     shows "\<forall>z. gas z < gas x \<longrightarrow> P z" using assms by simp
 
 definition incrementAccountContracts :: "Address \<Rightarrow> State \<Rightarrow> State"
   where "incrementAccountContracts ad st = st \<lparr>accounts := (accounts st)(ad := (accounts st ad)\<lparr>contracts := Suc (contracts (accounts st ad))\<rparr>)\<rparr>"
 
+declare incrementAccountContracts_def [solidity_symbex]
+
 lemma incrementAccountContracts_type[simp]:
   "type (accounts (incrementAccountContracts ad st) ad') = type (accounts st ad')"
   using incrementAccountContracts_def by simp
 
 lemma incrementAccountContracts_bal[simp]:
   "bal (accounts (incrementAccountContracts ad st) ad') = bal (accounts st ad')"
   using incrementAccountContracts_def by simp
 
 lemma incrementAccountContracts_stack[simp]:
   "stack (incrementAccountContracts ad st) = stack st"
   using incrementAccountContracts_def by simp
 
 lemma incrementAccountContracts_memory[simp]:
   "memory (incrementAccountContracts ad st) = memory st"
   using incrementAccountContracts_def by simp
 
 lemma incrementAccountContracts_storage[simp]:
   "storage (incrementAccountContracts ad st) = storage st"
   using incrementAccountContracts_def by simp
 
 lemma incrementAccountContracts_gas[simp]:
   "gas (incrementAccountContracts ad st) = gas st"
   using incrementAccountContracts_def by simp
 
 lemma gas_induct:
   assumes "\<And>s. \<forall>s'. gas s' < gas s \<longrightarrow> P s' \<Longrightarrow> P s"
   shows "P s" using assms by (rule Nat.measure_induct[of "\<lambda>s. gas s"])
 
 definition emptyStorage :: "Address \<Rightarrow> StorageT"
 where
   "emptyStorage _ = {$$}"
 
+declare emptyStorage_def [solidity_symbex]
+
 abbreviation mystate::State
   where "mystate \<equiv> \<lparr>
     accounts = emptyAccount,
     stack = emptyStore,
     memory = emptyStore,
     storage = emptyStorage,
     gas = 0
   \<rparr>"
 
 datatype Ex = Gas | Err
 
 subsection \<open>Contracts\<close>
 
 text \<open>
   A contract consists of methods, functions, and storage variables.
 
   A method is a triple consisting of
   \<^item> A list of formal parameters
   \<^item> A flag to signal external methods
   \<^item> A statement
 
 
   A function is a pair consisting of
   \<^item> A list of formal parameters
   \<^item> A flag to signal external functions
   \<^item> An expression
 \<close>
 datatype(discs_sels) Member = Method "(Identifier \<times> Type) list \<times> bool \<times> S"
                 | Function "(Identifier \<times> Type) list \<times> bool \<times> E"
                 | Var STypes
 
 text \<open>
   A procedure environment assigns a contract to an address.
   A contract consists of
   \<^item> An assignment of contract to identifiers
   \<^item> A constructor
   \<^item> A fallback statement which is executed after money is beeing transferred to the contract.
 
   \url{https://docs.soliditylang.org/en/v0.8.6/contracts.html#fallback-function}
 \<close>
 
 type_synonym Contract = "(Identifier, Member) fmap \<times> ((Identifier \<times> Type) list \<times> S) \<times> S"
 
 type_synonym Environment\<^sub>P = "(Identifier, Contract) fmap"
 
 definition init::"(Identifier, Member) fmap \<Rightarrow> Identifier \<Rightarrow> Environment \<Rightarrow> Environment"
   where "init ct i e = (case fmlookup ct i of
                                 Some (Var tp) \<Rightarrow> updateEnvDup i (Storage tp) (Storeloc i) e
                                | _ \<Rightarrow> e)"
 
+declare init_def [solidity_symbex]
+
 lemma init_s11[simp]:
   assumes "fmlookup ct i = Some (Var tp)"
   shows "init ct i e = updateEnvDup i (Storage tp) (Storeloc i) e"
   using assms init_def by simp
 
 lemma init_s12[simp]:
   assumes "i |\<in>| fmdom (denvalue e)"
   shows "init ct i e = e"
 proof (cases "fmlookup ct i")
   case None
   then show ?thesis using init_def by simp
 next
   case (Some a)
   then show ?thesis
   proof (cases a)
     case (Method _)
     with Some show ?thesis using init_def by simp
   next
     case (Function _)
     with Some show ?thesis using init_def by simp
   next
     case (Var tp)
     with Some have "init ct i e = updateEnvDup i (Storage tp) (Storeloc i) e" using init_def by simp
     moreover from assms have "updateEnvDup i (Storage tp) (Storeloc i) e = e" by auto
     ultimately show ?thesis by simp
   qed
 qed
 
 lemma init_s13[simp]:
   assumes "fmlookup ct i = Some (Var tp)"
       and "\<not> i |\<in>| fmdom (denvalue e)"
   shows "init ct i e = updateEnv i (Storage tp) (Storeloc i) e"
   using assms init_def by auto
 
 lemma init_s21[simp]:
   assumes "fmlookup ct i = None"
   shows "init ct i e = e"
   using assms init_def by auto
 
 lemma init_s22[simp]:
   assumes "fmlookup ct i = Some (Method m)"
   shows "init ct i e = e"
   using assms init_def by auto
 
 lemma init_s23[simp]:
   assumes "fmlookup ct i = Some (Function f)"
   shows "init ct i e = e"
   using assms init_def by auto
 
 lemma init_commte: "comp_fun_commute (init ct)"
 proof
   fix x y
   show "init ct y \<circ> init ct x = init ct x \<circ> init ct y"
   proof
     fix e
     show "(init ct y \<circ> init ct x) e = (init ct x \<circ> init ct y) e"
     proof (cases "fmlookup ct x")
       case None
       then show ?thesis by simp
     next
       case s1: (Some a)
       then show ?thesis
       proof (cases a)
         case (Method _)
         with s1 show ?thesis by simp
       next
         case (Function _)
         with s1 show ?thesis by simp
       next
         case v1: (Var tp)
         then show ?thesis
         proof (cases "x |\<in>| fmdom (denvalue e)")
           case True
           with s1 v1 have *: "init ct x e = e" by auto
           then show ?thesis
           proof (cases "fmlookup ct y")
             case None
             then show ?thesis by simp
           next
             case s2: (Some a)
             then show ?thesis
             proof (cases a)
               case (Method _)
               with s2 show ?thesis by simp
             next
               case (Function _)
               with s2 show ?thesis by simp
             next
               case v2: (Var tp')
               then show ?thesis
               proof (cases "y |\<in>| fmdom (denvalue e)")
                 case t1: True
                 with s1 v1 True s2 v2 show ?thesis by fastforce
               next
                 define e' where "e' = updateEnv y (Storage tp') (Storeloc y) e"
                 case False
                 with s2 v2 have "init ct y e = e'" using e'_def by auto
                 with s1 v1 True e'_def * show ?thesis by auto
               qed
             qed
           qed
         next
           define e' where "e' = updateEnv x (Storage tp) (Storeloc x) e"
           case f1: False
           with s1 v1 have *: "init ct x e = e'" using e'_def by auto
           then show ?thesis
           proof (cases "fmlookup ct y")
             case None
             then show ?thesis by simp
           next
             case s3: (Some a)
             then show ?thesis
             proof (cases a)
               case (Method _)
               with s3 show ?thesis by simp
             next
               case (Function _)
               with s3 show ?thesis by simp
             next
               case v2: (Var tp')
               then show ?thesis
               proof (cases "y |\<in>| fmdom (denvalue e)")
                 case t1: True
                 with e'_def have "y |\<in>| fmdom (denvalue e')" by simp
                 with s1 s3 v1 f1 v2 show ?thesis using e'_def by fastforce
               next
                 define f' where "f' = updateEnv y (Storage tp') (Storeloc y) e"
                 define e'' where "e'' = updateEnv y (Storage tp') (Storeloc y) e'"
                 case f2: False
                 with s3 v2 have **: "init ct y e = f'" using f'_def by auto
                 show ?thesis
                 proof (cases "y = x")
                   case True
                   with s3 v2 e'_def have "init ct y e' = e'" by simp
                   moreover from s3 v2 True f'_def have "init ct x f' = f'" by simp
                   ultimately show ?thesis using True by simp
                 next
                   define f'' where "f'' = updateEnv x (Storage tp) (Storeloc x) f'"
                   case f3: False
                   with f2 have "\<not> y |\<in>| fmdom (denvalue e')" using e'_def by simp
                   with s3 v2 e''_def have "init ct y e' = e''" by auto
                   with * have "(init ct y \<circ> init ct x) e = e''" by simp
                   moreover have "init ct x f' = f''"
                   proof -
                     from s1 v1 have "init ct x f' = updateEnvDup x (Storage tp) (Storeloc x) f'" by simp
                     moreover from f1 f3 have "x |\<notin>| fmdom (denvalue f')" using f'_def by simp
                     ultimately show ?thesis using f''_def by auto
                   qed
                   moreover from f''_def e''_def f'_def e'_def f3 have "Some f'' = Some e''" using env_reorder_neq by simp
                   ultimately show ?thesis using ** by simp
                 qed
               qed
             qed
           qed
         qed
       qed
     qed
   qed
 qed
 
 lemma init_address[simp]:
   "address (init ct i e) = address e"
 proof (cases "fmlookup ct i")
   case None
   then show ?thesis by simp
 next
   case (Some a)
   show ?thesis
   proof (cases a)
     case (Method _)
     with Some show ?thesis by simp
   next
     case (Function _)
     with Some show ?thesis by simp
   next
     case (Var _)
     with Some show ?thesis using updateEnvDup_address updateEnvDup_sender by simp
   qed 
 qed
 
 lemma init_sender[simp]:
 "sender (init ct i e) = sender e"
 proof (cases "fmlookup ct i")
   case None
   then show ?thesis by simp
 next
   case (Some a)
   show ?thesis
   proof (cases a)
     case (Method _)
     with Some show ?thesis by simp
   next
     case (Function _)
     with Some show ?thesis by simp
   next
     case (Var _)
     with Some show ?thesis using updateEnvDup_sender by simp
   qed 
 qed
 
 lemma init_svalue[simp]:
 "svalue (init ct i e) = svalue e"
 proof (cases "fmlookup ct i")
   case None
   then show ?thesis by simp
 next
   case (Some a)
   show ?thesis
   proof (cases a)
     case (Method _)
     with Some show ?thesis by simp
   next
     case (Function _)
     with Some show ?thesis by simp
   next
     case (Var _)
     with Some show ?thesis using updateEnvDup_svalue by simp
   qed
 qed
 
 lemma ffold_init_ad_same[rule_format]: "\<forall>e'. ffold (init ct) e xs = e' \<longrightarrow> address e' = address e \<and> sender e' = sender e \<and> svalue e' = svalue e"
 proof (induct xs)
   case empty
   then show ?case by (simp add: ffold_def)
 next
   case (insert x xs)
   then have *: "ffold (init ct) e (finsert x xs) =
     init ct x (ffold (init ct) e xs)" using FSet.comp_fun_commute.ffold_finsert[OF init_commte] by simp
   show ?case
   proof (rule allI[OF impI])
     fix e' assume **: "ffold (init ct) e (finsert x xs) = e'"
     with * obtain e'' where ***: "ffold (init ct) e xs = e''" by simp
     with insert have "address e'' = address e \<and> sender e'' = sender e \<and> svalue e'' = svalue e" by blast
     with * ** *** show "address e' = address e \<and> sender e' = sender e \<and> svalue e' = svalue e" using init_address init_sender init_svalue by metis
   qed
 qed
 
 lemma ffold_init_ad[simp]: "address (ffold (init ct) e xs) = address e"
   using ffold_init_ad_same by simp
 
 lemma ffold_init_sender[simp]: "sender (ffold (init ct) e xs) = sender e"
   using ffold_init_ad_same by simp
 
 lemma ffold_init_dom:
   "fmdom (denvalue (ffold (init ct) e xs)) |\<subseteq>| fmdom (denvalue e) |\<union>| xs"
 proof (induct "xs")
   case empty
   then show ?case
   proof
     fix x
     assume "x |\<in>| fmdom (denvalue (ffold (init ct) e {||}))"
     moreover have "ffold (init ct) e {||} = e" using FSet.comp_fun_commute.ffold_empty[OF init_commte, of ct e] by simp
     ultimately show "x |\<in>| fmdom (denvalue e) |\<union>| {||}" by simp
   qed
 next
   case (insert x xs)
   then have *: "ffold (init ct) e (finsert x xs) =
     init ct x (ffold (init ct) e xs)" using FSet.comp_fun_commute.ffold_finsert[OF init_commte] by simp
 
   show ?case
   proof
     fix x' assume "x' |\<in>| fmdom (denvalue (ffold (init ct) e (finsert x xs)))"
     with * have **: "x' |\<in>| fmdom (denvalue (init ct x (ffold (init ct) e xs)))" by simp
     then consider "x' |\<in>| fmdom (denvalue (ffold (init ct) e xs))" | "x'=x"
     proof (cases "fmlookup ct x")
       case None
       then show ?thesis using that ** by simp
     next
       case (Some a)
       then show ?thesis
       proof (cases a)
         case (Method _)
         then show ?thesis using Some ** that by simp
       next
         case (Function _)
         then show ?thesis using Some ** that by simp
       next
         case (Var x2)
         show ?thesis
         proof (cases "x=x'")
           case True
           then show ?thesis using that by simp
         next
           case False
           then have "fmlookup (denvalue (updateEnvDup x (Storage x2) (Storeloc x) (ffold (init ct) e xs))) x' = fmlookup (denvalue (ffold (init ct) e xs)) x'" using updateEnvDup_dup by simp
           moreover from ** Some Var have ***:"x' |\<in>| fmdom (denvalue (updateEnvDup x (Storage x2) (Storeloc x) (ffold (init ct) e xs)))" by simp
           ultimately have "x' |\<in>| fmdom (denvalue (ffold (init ct) e xs))" by (simp add: fmlookup_dom_iff)
           then show ?thesis using that by simp
         qed
       qed 
     qed
     then show "x' |\<in>| fmdom (denvalue e) |\<union>| finsert x xs"
     proof cases
       case 1
       then show ?thesis using insert.hyps by auto
     next
       case 2
       then show ?thesis by simp
     qed
   qed
 qed
 
 lemma ffold_init_fmap: 
   assumes "fmlookup ct i = Some (Var tp)"
       and "i |\<notin>| fmdom (denvalue e)"
   shows "i|\<in>|xs \<Longrightarrow> fmlookup (denvalue (ffold (init ct) e xs)) i = Some (Storage tp, Storeloc i)"
 proof (induct "xs")
   case empty
   then show ?case by simp
 next
   case (insert x xs)
   then have *: "ffold (init ct) e (finsert x xs) =
     init ct x (ffold (init ct) e xs)" using FSet.comp_fun_commute.ffold_finsert[OF init_commte] by simp
 
   from insert.prems consider (a) "i |\<in>| xs" | (b) "\<not> i |\<in>| xs \<and> i = x" by auto
   then show "fmlookup (denvalue (ffold (init ct) e (finsert x xs))) i = Some (Storage tp, Storeloc i)"
   proof cases
     case a
     with insert.hyps(2) have "fmlookup (denvalue (ffold (init ct) e xs)) i = Some (Storage tp, Storeloc i)" by simp
     moreover have "fmlookup (denvalue (init ct x (ffold (init ct) e xs))) i = fmlookup (denvalue (ffold (init ct) e xs)) i"
     proof (cases "fmlookup ct x")
       case None
       then show ?thesis by simp
     next
       case (Some a)
       then show ?thesis
       proof (cases a)
         case (Method _)
         with Some show ?thesis by simp
       next
         case (Function _)
         with Some show ?thesis by simp
       next
         case (Var x2)
         with Some have "init ct x (ffold (init ct) e xs) = updateEnvDup x (Storage x2) (Storeloc x) (ffold (init ct) e xs)" using init_def[of ct x "(ffold (init ct) e xs)"] by simp
         moreover from insert a have "i\<noteq>x" by auto
         then have "fmlookup (denvalue (updateEnvDup x (Storage x2) (Storeloc x) (ffold (init ct) e xs))) i = fmlookup (denvalue (ffold (init ct) e xs)) i" using updateEnvDup_dup[of x i] by simp
         ultimately show ?thesis by simp
       qed
     qed
     ultimately show ?thesis using * by simp
   next
     case b
     with assms(1) have "fmlookup ct x = Some (Var tp)" by simp
     moreover from b assms(2) have "\<not> x |\<in>| fmdom (denvalue (ffold (init ct) e xs))" using ffold_init_dom by auto
     ultimately have "init ct x (ffold (init ct) e xs) = updateEnv x (Storage tp) (Storeloc x) (ffold (init ct) e xs)" by auto
     with b * show ?thesis by simp
   qed
 qed
 
 lemma ffold_init_fmdom: 
   assumes "fmlookup ct i = Some (Var tp)"
       and "i |\<notin>| fmdom (denvalue e)"
     shows "fmlookup (denvalue (ffold (init ct) e (fmdom ct))) i = Some (Storage tp, Storeloc i)"
 proof -
   from assms(1) have "i |\<in>| fmdom ct" by (rule Finite_Map.fmdomI)
   then show ?thesis using ffold_init_fmap[OF assms] by simp
 qed
 
-text\<open>The following definition allows for a more fine-grained configuration of the 
+text\<open>The following definition[solidity_symbex]:allows for a more fine-grained configuration of the 
      code generator.
 \<close>
 definition ffold_init::"(String.literal, Member) fmap \<Rightarrow> Environment \<Rightarrow> String.literal fset \<Rightarrow> Environment" where
           \<open>ffold_init ct a c = ffold (init ct) a c\<close>
-declare ffold_init_def [simp]
+declare ffold_init_def [simp,solidity_symbex]
 
 lemma ffold_init_code [code]:
      \<open>ffold_init ct a c = fold (init ct) (remdups (sorted_list_of_set (fset c))) a\<close>
   using  comp_fun_commute_on.fold_set_fold_remdups ffold.rep_eq 
             ffold_init_def init_commte sorted_list_of_fset.rep_eq 
             sorted_list_of_fset_simps(1)
   by (metis comp_fun_commute.comp_fun_commute comp_fun_commute_on.intro order_refl)
 
 lemma bind_case_stackvalue_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>v. x = KValue v \<Longrightarrow> f v s = f' v s"
       and "\<And>p. x = KCDptr p \<Longrightarrow> g p s = g' p s"
       and "\<And>p. x = KMemptr p \<Longrightarrow> h p s = h' p s"
       and "\<And>p. x = KStoptr p \<Longrightarrow> i p s = i' p s"
     shows "(case x of KValue v \<Rightarrow> f v | KCDptr p \<Rightarrow> g p | KMemptr p \<Rightarrow> h p | KStoptr p \<Rightarrow> i p) s
          = (case x' of KValue v \<Rightarrow> f' v | KCDptr p \<Rightarrow> g' p | KMemptr p \<Rightarrow> h' p | KStoptr p \<Rightarrow> i' p) s"
   using assms by (cases x, auto)
 
 lemma bind_case_type_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>t. x = Value t \<Longrightarrow> f t s = f' t s"
       and "\<And>t. x = Calldata t \<Longrightarrow> g t s = g' t s"
       and "\<And>t. x = Memory t \<Longrightarrow> h t s = h' t s"
       and "\<And>t. x = Storage t \<Longrightarrow> i t s = i' t s"
     shows "(case x of Value t \<Rightarrow> f t | Calldata t \<Rightarrow> g t | Memory t \<Rightarrow> h t | Storage t \<Rightarrow> i t ) s
          = (case x' of Value t \<Rightarrow> f' t | Calldata t \<Rightarrow> g' t | Memory t \<Rightarrow> h' t | Storage t \<Rightarrow> i' t) s"
   using assms by (cases x, auto)
 
 lemma bind_case_denvalue_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a. x = (Stackloc a) \<Longrightarrow> f a s = f' a s"
       and "\<And>a. x = (Storeloc a) \<Longrightarrow> g a s = g' a s"
     shows "(case x of (Stackloc a) \<Rightarrow> f a | (Storeloc a) \<Rightarrow> g a) s
          = (case x' of (Stackloc a) \<Rightarrow> f' a | (Storeloc a) \<Rightarrow> g' a) s"
   using assms by (cases x, auto)
 
 lemma bind_case_mtypes_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a t. x = (MTArray a t) \<Longrightarrow> f a t s = f' a t s"
       and "\<And>p. x = (MTValue p) \<Longrightarrow> g p s = g' p s"
     shows "(case x of (MTArray a t) \<Rightarrow> f a t | (MTValue p) \<Rightarrow> g p) s
          = (case x' of (MTArray a t) \<Rightarrow> f' a t | (MTValue p) \<Rightarrow> g' p) s"
   using assms by (cases x, auto)
 
 lemma bind_case_stypes_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a t. x = (STArray a t) \<Longrightarrow> f a t s = f' a t s"
       and "\<And>a t. x = (STMap a t) \<Longrightarrow> g a t s = g' a t s"
       and "\<And>p. x = (STValue p) \<Longrightarrow> h p s = h' p s"
     shows "(case x of (STArray a t) \<Rightarrow> f a t | (STMap a t) \<Rightarrow> g a t | (STValue p) \<Rightarrow> h p) s
          = (case x' of (STArray a t) \<Rightarrow> f' a t | (STMap a t) \<Rightarrow> g' a t | (STValue p) \<Rightarrow> h' p) s"
   using assms by (cases x, auto)
 
 lemma bind_case_types_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a. x = (TSInt a) \<Longrightarrow> f a s = f' a s"
       and "\<And>a. x = (TUInt a) \<Longrightarrow> g a s = g' a s"
       and "x = TBool \<Longrightarrow> h s = h' s"
       and "x = TAddr \<Longrightarrow> i s = i' s"
     shows "(case x of (TSInt a) \<Rightarrow> f a | (TUInt a) \<Rightarrow> g a | TBool \<Rightarrow> h | TAddr \<Rightarrow> i) s
          = (case x' of (TSInt a) \<Rightarrow> f' a | (TUInt a) \<Rightarrow> g' a | TBool \<Rightarrow> h' | TAddr \<Rightarrow> i') s"
   using assms by (cases x, auto)
 
 lemma bind_case_contract_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a. x = Method a \<Longrightarrow> f a s = f' a s"
       and "\<And>a. x = Function a \<Longrightarrow> g a s = g' a s"
       and "\<And>a. x = Var a \<Longrightarrow> h a s = h' a s"
     shows "(case x of Method a \<Rightarrow> f a | Function a \<Rightarrow> g a | Var a \<Rightarrow> h a) s
          = (case x' of Method a \<Rightarrow> f' a | Function a \<Rightarrow> g' a | Var a \<Rightarrow> h' a) s"
   using assms by (cases x, auto)
 
 lemma bind_case_memoryvalue_cong [fundef_cong]:
   assumes "x = x'"
       and "\<And>a. x = MValue a \<Longrightarrow> f a s = f' a s"
       and "\<And>a. x = MPointer a \<Longrightarrow> g a s = g' a s"
     shows "(case x of (MValue a) \<Rightarrow> f a | (MPointer a) \<Rightarrow> g a) s
          = (case x' of (MValue a) \<Rightarrow> f' a | (MPointer a) \<Rightarrow> g' a) s"
   using assms by (cases x, auto)
 
 end
diff --git a/thys/Solidity/Environment.thy b/thys/Solidity/Environment.thy
--- a/thys/Solidity/Environment.thy
+++ b/thys/Solidity/Environment.thy
@@ -1,407 +1,409 @@
 section\<open>Environment and State\<close>
 theory Environment
 imports Accounts Storage StateMonad
 begin
 
 subsection \<open>Environment\<close>
 
 datatype Type = Value Types
               | Calldata MTypes
               | Memory MTypes
               | Storage STypes
  
 datatype Denvalue = Stackloc Location
                   | Storeloc Location
 
 record Environment =
   address :: Address (*address of executing contract*)
   contract :: Identifier
   sender :: Address (*address of calling contract*)
   svalue :: Valuetype (*money send*)
   denvalue :: "(Identifier, Type \<times> Denvalue) fmap"
  
 fun identifiers :: "Environment \<Rightarrow> Identifier fset"
   where "identifiers e = fmdom (denvalue e)"
  
 definition emptyEnv :: "Address \<Rightarrow> Identifier \<Rightarrow> Address \<Rightarrow> Valuetype \<Rightarrow> Environment"
   where "emptyEnv a c s v = \<lparr>address = a, contract = c, sender = s, svalue = v, denvalue = fmempty\<rparr>"
 
+declare emptyEnv_def [solidity_symbex]
+
 lemma emptyEnv_address[simp]:
   "address (emptyEnv a c s v) = a"
   unfolding emptyEnv_def by simp
 
 lemma emptyEnv_members[simp]:
   "contract (emptyEnv a c s v) = c"
   unfolding emptyEnv_def by simp
 
 lemma emptyEnv_sender[simp]:
   "sender (emptyEnv a c s v) = s"
   unfolding emptyEnv_def by simp
 
 lemma emptyEnv_svalue[simp]:
   "svalue (emptyEnv a c s v) = v"
   unfolding emptyEnv_def by simp
 
 lemma emptyEnv_denvalue[simp]:
   "denvalue (emptyEnv a c s v) = {$$}"
   unfolding emptyEnv_def by simp
 
 definition eempty :: "Environment"
   where "eempty = emptyEnv (STR '''') (STR '''') (STR '''') (STR '''')"
 
 declare eempty_def [solidity_symbex]
 
 fun updateEnv :: "Identifier \<Rightarrow> Type \<Rightarrow> Denvalue \<Rightarrow> Environment \<Rightarrow> Environment"
   where "updateEnv i t v e = e \<lparr> denvalue := fmupd i (t,v) (denvalue e) \<rparr>"
 
 fun updateEnvOption :: "Identifier \<Rightarrow> Type \<Rightarrow> Denvalue \<Rightarrow> Environment \<Rightarrow> Environment option"
   where "updateEnvOption i t v e = (case fmlookup (denvalue e) i of 
               Some _ \<Rightarrow> None
             | None \<Rightarrow> Some (updateEnv i t v e))"
 
 lemma updateEnvOption_address: "updateEnvOption i t v e = Some e' \<Longrightarrow> address e = address e'"
 by (auto split:option.split_asm)
 
 fun updateEnvDup :: "Identifier \<Rightarrow> Type \<Rightarrow> Denvalue \<Rightarrow> Environment \<Rightarrow> Environment"
   where "updateEnvDup i t v e = (case fmlookup (denvalue e) i of 
               Some _ \<Rightarrow> e
             | None \<Rightarrow> updateEnv i t v e)"
 
 lemma updateEnvDup_address[simp]: "address (updateEnvDup i t v e) = address e"
   by (auto split:option.split)
 
 lemma updateEnvDup_sender[simp]: "sender (updateEnvDup i t v e) = sender e"
   by (auto split:option.split)
 
 lemma updateEnvDup_svalue[simp]: "svalue (updateEnvDup i t v e) = svalue e"
   by (auto split:option.split)
 
 lemma updateEnvDup_dup:
   assumes "i\<noteq>i'" shows "fmlookup (denvalue (updateEnvDup i t v e)) i' = fmlookup (denvalue e) i'"
 proof (cases "fmlookup (denvalue e) i = None")
   case True
   then show ?thesis using assms by simp
 next
   case False
   then obtain e' where "fmlookup (denvalue e) i = Some e'" by auto
   then show ?thesis using assms by simp
 qed
 
 lemma env_reorder_neq:
   assumes "x\<noteq>y"
   shows "updateEnv x t1 v1 (updateEnv y t2 v2 e) = updateEnv y t2 v2 (updateEnv x t1 v1 e)"
 proof -
   have "address (updateEnv x t1 v1 (updateEnv y t2 v2 e)) = address (updateEnv y t2 v2 (updateEnv x t1 v1 e))" by simp
   moreover from assms have "denvalue (updateEnv x t1 v1 (updateEnv y t2 v2 e)) = denvalue (updateEnv y t2 v2 (updateEnv x t1 v1 e))" using Finite_Map.fmupd_reorder_neq[of x y "(t1,v1)" "(t2,v2)"] by simp
   ultimately show ?thesis by simp
 qed
 
 lemma uEO_in:
   assumes "i |\<in>| fmdom (denvalue e)"
   shows "updateEnvOption i t v e = None"
   using assms by auto
 
 lemma uEO_n_In:
   assumes "\<not> i |\<in>| fmdom (denvalue e)"
   shows "updateEnvOption i t v e = Some (updateEnv i t v e)"
   using assms by auto
 
 fun astack :: "Identifier \<Rightarrow> Type \<Rightarrow> Stackvalue \<Rightarrow> Stack * Environment \<Rightarrow> Stack * Environment"
   where "astack i t v (s, e) = (push v s, (updateEnv i t (Stackloc (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc s))) e))"
 
 subsubsection \<open>Examples\<close>
 abbreviation "myenv::Environment \<equiv> eempty \<lparr>denvalue := fmupd STR ''id1'' (Value TBool, Stackloc STR ''0'') fmempty\<rparr>"
 abbreviation "mystack::Stack \<equiv> \<lparr>mapping = fmupd (STR ''0'') (KValue STR ''True'') fmempty, toploc = 1\<rparr>"
 
 abbreviation "myenv2::Environment \<equiv> eempty \<lparr>denvalue := fmupd STR ''id2'' (Value TBool, Stackloc STR ''1'') (fmupd STR ''id1'' (Value TBool, Stackloc STR ''0'') fmempty)\<rparr>"
 abbreviation "mystack2::Stack \<equiv> \<lparr>mapping = fmupd (STR ''1'') (KValue STR ''False'') (fmupd (STR ''0'') (KValue STR ''True'') fmempty), toploc = 2\<rparr>"
 
 lemma "astack (STR ''id1'') (Value TBool) (KValue (STR ''True'')) (emptyStore, eempty) = (mystack,myenv)" by solidity_symbex
 lemma "astack (STR ''id2'') (Value TBool) (KValue (STR ''False'')) (mystack, myenv) = (mystack2,myenv2)" by solidity_symbex
 
 subsection \<open>Declarations\<close>
 
 text \<open>This function is used to declare a new variable: decl id tp val copy cd mem sto c m k e
 \begin{description}
   \item[id] is the name of the variable
   \item[tp] is the type of the variable
   \item[val] is an optional initialization parameter. If it is None, the types default value is taken.
   \item[copy] is a flag to indicate whether memory should be copied (from mem parameter) or not (copying is required for example for external method calls).
   \item[cd] is the original calldata which is used as a source
   \item[mem] is the original memory which is used as a source
   \item[sto] is the original storage which is used as a source
   \item[c] is the new calldata which is updated
   \item[m] is the new memory which is updated
   \item[k] is the new calldata which is updated
   \item[e] is the new environment which is updated
 \end{description}\<close>
 fun decl :: "Identifier \<Rightarrow> Type \<Rightarrow> (Stackvalue * Type) option \<Rightarrow> bool \<Rightarrow> CalldataT \<Rightarrow> MemoryT \<Rightarrow> (Address \<Rightarrow> StorageT)
     \<Rightarrow> CalldataT \<times> MemoryT \<times> Stack \<times> Environment \<Rightarrow> (CalldataT \<times> MemoryT \<times> Stack \<times> Environment) option"
   where
 (* Declaring stack variables *)
   "decl i (Value t) None _ _ _ _ (c, m, k, e) = Some (c, m, (astack i (Value t) (KValue (ival t)) (k, e)))"
 | "decl i (Value t) (Some (KValue v, Value t')) _ _ _ _ (c, m, k, e) =
    Option.bind (convert t' t v)
     (\<lambda>v'. Some (c, m, astack i (Value t) (KValue v') (k, e)))"
 | "decl _ (Value _) _ _ _ _ _ _ = None"
 
 (* Declaring calldata variables *)
 | "decl i (Calldata (MTArray x t)) (Some (KCDptr p, _)) True cd _ _ (c, m, k, e) =
     (let l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc c);
          (_, c') = allocate c
      in Option.bind (cpm2m p l x t cd c')
       (\<lambda>c''. Some (c'', m, astack i (Calldata (MTArray x t)) (KCDptr l) (k, e))))"
 | "decl i (Calldata (MTArray x t)) (Some (KMemptr p, _)) True _ mem _ (c, m, k, e) =
     (let l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc c);
          (_, c') = allocate c
      in Option.bind (cpm2m p l x t mem c')
       (\<lambda>c''. Some (c'', m, astack i (Calldata (MTArray x t)) (KCDptr l) (k, e))))"
 | "decl i (Calldata _) _ _ _ _ _ _ = None"
 
 (* Declaring memory variables *)
 | "decl i (Memory (MTArray x t)) None _ _ _ _ (c, m, k, e) =
     (let m' = minit x t m
       in Some (c, m', astack i (Memory (MTArray x t)) (KMemptr (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m))) (k, e)))"
 | "decl i (Memory (MTArray x t)) (Some (KMemptr p, _)) True _ mem _ (c, m, k, e) =
    Option.bind (cpm2m p (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)) x t mem (snd (allocate m)))
     (\<lambda>m'. Some (c, m', astack i (Memory (MTArray x t)) (KMemptr (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m))) (k, e)))"
 | "decl i (Memory (MTArray x t)) (Some (KMemptr p, _)) False _ _ _ (c, m, k, e) =
    Some (c, m, astack i (Memory (MTArray x t)) (KMemptr p) (k, e))"
 | "decl i (Memory (MTArray x t)) (Some (KCDptr p, _)) _ cd _ _ (c, m, k, e) =
    Option.bind (cpm2m p (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)) x t cd (snd (allocate m)))
     (\<lambda>m'. Some (c, m', astack i (Memory (MTArray x t)) (KMemptr (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m))) (k, e)))"
 | "decl i (Memory (MTArray x t)) (Some (KStoptr p, Storage (STArray x' t'))) _ _ _ s (c, m, k, e) =
    Option.bind (cps2m p (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)) x' t' (s (address e)) (snd (allocate m)))
     (\<lambda>m''. Some (c, m'', astack i (Memory (MTArray x t)) (KMemptr (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m))) (k, e)))"
 | "decl _ (Memory _) _ _ _ _ _ _ = None"
 
 (* Declaring storage variables *)
 | "decl i (Storage (STArray x t)) (Some (KStoptr p, _)) _ _ _ _ (c, m, k, e) =
     Some (c, m, astack i (Storage (STArray x t)) (KStoptr p) (k, e))"
 | "decl i (Storage (STMap t t')) (Some (KStoptr p, _)) _ _ _ _ (c, m, k, e) =
    Some (c, m, astack i (Storage (STMap t t')) (KStoptr p) (k, e))"
 | "decl _ (Storage _) _ _ _ _ _ _ = None" (* Uninitialized storage arrays/maps not allowed *)
 
 lemma decl_env:
   assumes "decl a1 a2 a3 cp cd mem sto (c, m, k, env) = Some (c', m', k', env')"
   shows "address env = address env' \<and> sender env = sender env' \<and> svalue env = svalue env' \<and> (\<forall>x. x \<noteq> a1 \<longrightarrow> fmlookup (denvalue env') x = fmlookup (denvalue env) x)"
   using assms
 proof (cases rule:decl.elims)
   case (1 t uu uv uw ux c m k env)
   then show ?thesis by simp
 next
   case (2 t v t' uy uz va vb c m k e)
   show ?thesis
   proof (cases "convert t' t v")
     case None
     with 2 show ?thesis by simp
   next
     case s: (Some a)
     with 2 s show ?thesis by simp
   qed
 next
   case (3 vd ve vb vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (4 vd ve vb vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (5 vd ve vb vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (6 vd va ve vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (7 vd va ve vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (8 vd va ve vf vg vh vi vj)
   then show ?thesis by simp
 next
   case (9 x t p vk cd vl vm c m k env)
   define l where "l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc c)"
   obtain c' where c_def: "\<exists>x. (x, c') = allocate c" unfolding allocate_def by simp
   show ?thesis
   proof (cases "cpm2m p l x t cd c'")
     case None
     with 9 l_def c_def show ?thesis unfolding allocate_def by simp
   next
     case s2: (Some a)
     with 9 l_def c_def show ?thesis unfolding allocate_def by simp
   qed
 next
   case (10 x t p vn vo mem vp c m k env)
   define l where "l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc c)"
   obtain c' where c_def: "\<exists>x. (x, c') = allocate c" unfolding allocate_def by simp
   show ?thesis
   proof (cases "cpm2m p l x t mem c'")
     case None
     with 10 l_def c_def show ?thesis unfolding allocate_def by simp
   next
     case s2: (Some a)
     with 10 l_def c_def show ?thesis unfolding allocate_def by simp
   qed
 next
   case (11 v vr vs vt vu vv vw)
   then show ?thesis by simp
 next
   case (12 vq vs vt vu vv vw)
   then show ?thesis by simp
 next
   case (13 vq vc vb vs vt vu vv vw)
   then show ?thesis by simp
 next
   case (14 v vc vb vs vt vu vv vw)
   then show ?thesis by simp
 next
   case (15 vq vc vb vt vu vv vw)
   then show ?thesis by simp
 next
   case (16 vq vc vb vs vt vu vv vw)
   then show ?thesis by simp
 next
   case (17 vq vr vt vu vv vw)
   then show ?thesis by simp
 next
   case (18 x t vx vy vz wa c m k env)
   then show ?thesis by simp
 next
   case (19 x t p wb wc mem wd c m k env)
   show ?thesis
   proof (cases cp)
     case True
     define l where "l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)"
     obtain m' where m'_def: "\<exists>x. (x, m') = allocate m" unfolding allocate_def by simp
     then show ?thesis
     proof (cases "cpm2m p l x t mem m'")
       case None
       with 19 l_def m'_def show ?thesis unfolding allocate_def by simp
     next
       case s2: (Some a)
       with 19 l_def m'_def show ?thesis unfolding allocate_def by simp
     qed
   next
     case False
     with 19 show ?thesis by simp
   qed
 next
   case (20 x t p we wf wg wh c m k env)
   then show ?thesis by simp
 next
   case (21 x t p wi wj cd wk wl c m k env)
   define l where "l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)"
   obtain m' where m'_def: "\<exists>x. (x, m') = allocate m" unfolding allocate_def by simp
   then show ?thesis
   proof (cases "cpm2m p l x t cd m'")
     case None
     with 21 l_def m'_def show ?thesis unfolding allocate_def by simp
   next
     case s2: (Some a)
     with 21 l_def m'_def show ?thesis unfolding allocate_def by simp
   qed
 next
   case (22 x t p x' t' wm wn wo s c m k env)
   define l where "l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m)"
   obtain m' where m'_def: "\<exists>x. (x, m') = allocate m" unfolding allocate_def by simp
   show ?thesis
   proof (cases "cps2m p l x' t' (s (address env)) m'")
     case None
     with 22 l_def m'_def show ?thesis unfolding allocate_def by simp
   next
     case s2: (Some a)
     with 22 l_def m'_def show ?thesis unfolding allocate_def by simp
   qed
 next
   case (23 v wr ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (24 va v ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (25 wq vc vb ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (26 v vc vb ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (27 v vc vb ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (28 wq vc v ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (29 wq vc v ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (30 wq vc v ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (31 wq vc va vd ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (32 wq vc va ws wt wu wv ww)
   then show ?thesis by simp
 next
   case (33 va v wt wu wv ww)
   then show ?thesis by simp
 next
   case (34 wq vc vb wt wu wv ww)
   then show ?thesis by simp
 next
   case (35 v vc vb wt wu wv ww)
   then show ?thesis by simp
 next
   case (36 v vc vb wt wu wv ww)
   then show ?thesis by simp
 next
   case (37 wq vc v wt wu wv ww)
   then show ?thesis by simp
 next
   case (38 wq vc v wt wu wv ww)
   then show ?thesis by simp
 next
   case (39 wq vc v wt wu wv ww)
   then show ?thesis by simp
 next
   case (40 wq vc va vd wt wu wv ww)
   then show ?thesis by simp
 next
   case (41 wq vc va wt wu wv ww)
   then show ?thesis by simp
 next
   case (42 x t p wx wy wz xa xb c m k env)
   then show ?thesis by simp
 next
   case (43 t t' p xc xd xe xf xg c m k e)
   then show ?thesis by simp
 next
   case (44 v va xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (45 v va ve vd xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (46 v va ve vd xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (47 v va ve vd xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (48 v xj xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (49 xi xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (50 xi vc vb xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (51 xi vc vb xk xl xm xn xo)
   then show ?thesis by simp
 next
   case (52 xi vc vb xk xl xm xn xo)
   then show ?thesis by simp
 qed
 
-declare decl.simps[simp del]
+declare decl.simps[simp del, solidity_symbex add]
 end
diff --git a/thys/Solidity/Expressions.thy b/thys/Solidity/Expressions.thy
--- a/thys/Solidity/Expressions.thy
+++ b/thys/Solidity/Expressions.thy
@@ -1,1376 +1,1376 @@
 section \<open>Expressions\<close>
 theory Expressions
   imports Contracts StateMonad
 begin
 
 subsection \<open>Semantics of Expressions\<close>
 
 definition lift ::
   "(E \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Stackvalue * Type, Ex, Gas) state_monad)
   \<Rightarrow> (Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option)
   \<Rightarrow> E \<Rightarrow> E \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Stackvalue * Type, Ex, Gas) state_monad"
 where
   "lift expr f e1 e2 e cd st \<equiv>
     (do {
       kv1 \<leftarrow> expr e1 e cd st;
       (v1, t1) \<leftarrow> case kv1 of (KValue v1, Value t1) \<Rightarrow> return (v1, t1) | _ \<Rightarrow> (throw Err::(Valuetype * Types, Ex, Gas) state_monad);
       kv2 \<leftarrow> expr e2 e cd st;
       (v2, t2) \<leftarrow> case kv2 of (KValue v2, Value t2) \<Rightarrow> return (v2, t2) | _ \<Rightarrow> (throw Err::(Valuetype * Types, Ex, Gas) state_monad);
       (v, t) \<leftarrow> (option Err (\<lambda>_::Gas. f t1 t2 v1 v2))::(Valuetype * Types, Ex, Gas) state_monad;
       return (KValue v, Value t)::(Stackvalue * Type, Ex, Gas) state_monad
     })"
-declare lift_def[simp]
+declare lift_def[simp, solidity_symbex]
 
 lemma lift_cong [fundef_cong]:
   assumes "expr e1 e cd st g = expr' e1 e cd st g"
       and "\<And>v g'. expr' e1 e cd st g = Normal (v,g') \<Longrightarrow> expr e2 e cd st g' = expr' e2 e cd st g'"
   shows "lift expr f e1 e2 e cd st g = lift expr' f e1 e2 e cd st g"
   unfolding lift_def using assms by (auto split: prod.split_asm result.split option.split_asm option.split Stackvalue.split Type.split)
 
 datatype LType = LStackloc Location
                | LMemloc Location
                | LStoreloc Location
 
 locale expressions_with_gas =
   fixes costs\<^sub>e :: "E \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> Gas"
     and ep::Environment\<^sub>P
   assumes call_not_zero[termination_simp]: "\<And>e cd st i ix. 0 < (costs\<^sub>e (CALL i ix) e cd st)"
       and ecall_not_zero[termination_simp]: "\<And>e cd st a i ix. 0 < (costs\<^sub>e (ECALL a i ix) e cd st)"
 begin
 function (domintros) msel::"bool \<Rightarrow> MTypes \<Rightarrow> Location \<Rightarrow> E list \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Location * MTypes, Ex, Gas) state_monad"
      and ssel::"STypes \<Rightarrow> Location \<Rightarrow> E list \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Location * STypes, Ex, Gas) state_monad"
      and expr::"E \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Stackvalue * Type, Ex, Gas) state_monad"
      and load :: "bool \<Rightarrow> (Identifier \<times> Type) list \<Rightarrow> E list \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> Stack \<Rightarrow> MemoryT \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Environment \<times> CalldataT \<times> Stack \<times> MemoryT, Ex, Gas) state_monad"
      and rexp::"L \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (Stackvalue * Type, Ex, Gas) state_monad"
 where
   "msel _ _ _ [] _ _ _ g = throw Err g"
 | "msel _ (MTValue _) _ _ _ _ _ g = throw Err g"
 | "msel _ (MTArray al t) loc [x] env cd st g =
     (do {
       kv \<leftarrow> expr x env cd st;
       (v, t') \<leftarrow> case kv of (KValue v, Value t') \<Rightarrow> return (v, t') | _ \<Rightarrow> throw Err;
       assert Err (\<lambda>_. less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool));
       return (hash loc v, t)
     }) g"
 (*
   Note that it is indeed possible to modify the state while evaluating the expression
   to determine the index of the array to look up.
 *)
 | "msel mm (MTArray al t) loc (x # y # ys) env cd st g =
     (do {
       kv \<leftarrow> expr x env cd st;
       (v, t') \<leftarrow> case kv of (KValue v, Value t') \<Rightarrow> return (v,t') | _ \<Rightarrow> throw Err;
       assert Err (\<lambda>_. less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool));
       l \<leftarrow> case accessStore (hash loc v) (if mm then memory st else cd) of Some (MPointer l) \<Rightarrow> return l | _ \<Rightarrow> throw Err;
       msel mm t l (y#ys) env cd st
     }) g"
 | "ssel tp loc Nil _ _ _ g = return (loc, tp) g"
 | "ssel (STValue _) _ (_ # _) _ _ _ g = throw Err g"
 | "ssel (STArray al t) loc (x # xs) env cd st g =
     (do {
       kv \<leftarrow> expr x env cd st;
       (v, t') \<leftarrow> case kv of (KValue v, Value t') \<Rightarrow> return (v, t') | _ \<Rightarrow> throw Err;
       assert Err (\<lambda>_. less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool));
       ssel t (hash loc v) xs env cd st
     }) g"
 | "ssel (STMap _ t) loc (x # xs) env cd st g =
     (do {
       kv \<leftarrow> expr x env cd st;
       v \<leftarrow> case kv of (KValue v, _) \<Rightarrow> return v | _ \<Rightarrow> throw Err;
       ssel t (hash loc v) xs env cd st
     }) g"
 | "expr (E.INT b x) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (E.INT b x) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (E.INT b x) e cd st);
       assert Err (\<lambda>_. b \<in> vbits);
       return (KValue (createSInt b x), Value (TSInt b))
     }) g"
 | "expr (UINT b x) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (UINT b x) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (UINT b x) e cd st);
       assert Err (\<lambda>_. b \<in> vbits);
       return (KValue (createUInt b x), Value (TUInt b))
   }) g"
 | "expr (ADDRESS ad) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (ADDRESS ad) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e  (ADDRESS ad) e cd st);
       return (KValue ad, Value TAddr)
     }) g"
 | "expr (BALANCE ad) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (BALANCE ad) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e  (BALANCE ad) e cd st);
       kv \<leftarrow> expr ad e cd st;
       adv \<leftarrow> case kv of (KValue adv, Value TAddr) \<Rightarrow> return adv | _ \<Rightarrow> throw Err; 
       return (KValue (bal ((accounts st) adv)), Value (TUInt 256))
     }) g"
 | "expr THIS e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e THIS e cd st);
       modify (\<lambda>g. g - costs\<^sub>e THIS e cd st);
       return (KValue (address e), Value TAddr)
     }) g"
 | "expr SENDER e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e SENDER e cd st);
       modify (\<lambda>g. g - costs\<^sub>e SENDER e cd st);
       return (KValue (sender e), Value TAddr)
     }) g"
 | "expr VALUE e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e VALUE e cd st);
       modify (\<lambda>g. g - costs\<^sub>e VALUE e cd st);
       return (KValue (svalue e), Value (TUInt 256))
     }) g"
 | "expr TRUE e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e TRUE e cd st);
       modify (\<lambda>g. g - costs\<^sub>e TRUE e cd st);
       return (KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True), Value TBool)
     }) g"
 | "expr FALSE e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e FALSE e cd st);
       modify (\<lambda>g. g - costs\<^sub>e FALSE e cd st);
       return (KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False), Value TBool)
     }) g"
 | "expr (NOT x) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (NOT x) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (NOT x) e cd st);
       kv \<leftarrow> expr x e cd st;
       v \<leftarrow> case kv of (KValue v, Value TBool) \<Rightarrow> return v | _ \<Rightarrow> throw Err;
       (if v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True then expr FALSE e cd st
        else if v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False then expr TRUE e cd st
        else throw Err)
     }) g"
 | "expr (PLUS e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (PLUS e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (PLUS e1 e2) e cd st);
       lift expr add e1 e2 e cd st
     }) g"
 | "expr (MINUS e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (MINUS e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (MINUS e1 e2) e cd st);
       lift expr sub e1 e2 e cd st
     }) g"
 | "expr (LESS e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (LESS e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (LESS e1 e2) e cd st);
       lift expr less e1 e2 e cd st
     }) g"
 | "expr (EQUAL e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (EQUAL e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (EQUAL e1 e2) e cd st);
       lift expr equal e1 e2 e cd st
     }) g"
 | "expr (AND e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (AND e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (AND e1 e2) e cd st);
       lift expr vtand e1 e2 e cd st
     }) g"
 | "expr (OR e1 e2) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (OR e1 e2) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (OR e1 e2) e cd st);
       lift expr vtor e1 e2 e cd st
     }) g"
 | "expr (LVAL i) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (LVAL i) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (LVAL i) e cd st);
       rexp i e cd st
     }) g"
 (* Notes about method calls:
    - Internal method calls use a fresh environment and stack but keep the memory [1]
    - External method calls use a fresh environment and stack and memory [2]
    [1]: https://docs.soliditylang.org/en/v0.8.5/control-structures.html#internal-function-calls
    [2]: https://docs.soliditylang.org/en/v0.8.5/control-structures.html#external-function-calls
 *)
 | "expr (CALL i xe) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (CALL i xe) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (CALL i xe) e cd st);
       (ct, _) \<leftarrow> option Err (\<lambda>_. ep $$ (contract e));
       (fp, x) \<leftarrow> case ct $$ i of Some (Function (fp, False, x)) \<Rightarrow> return (fp, x) | _ \<Rightarrow> throw Err;
       let e' = ffold_init ct (emptyEnv (address e) (contract e) (sender e) (svalue e)) (fmdom ct);
       (e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l) \<leftarrow> load False fp xe e' emptyStore emptyStore (memory st) e cd st;
       expr x e\<^sub>l cd\<^sub>l (st\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>)
     }) g"
 (*It is not allowed to transfer money to external function calls*)
 | "expr (ECALL ad i xe) e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e (ECALL ad i xe) e cd st);
       modify (\<lambda>g. g - costs\<^sub>e (ECALL ad i xe) e cd st);
       kad \<leftarrow> expr ad e cd st;
       adv \<leftarrow> case kad of (KValue adv, Value TAddr) \<Rightarrow> return adv | _ \<Rightarrow> throw Err;
       assert Err (\<lambda>_. adv \<noteq> address e);
       c \<leftarrow> case type (accounts st adv) of Some (Contract c) \<Rightarrow> return c | _ \<Rightarrow> throw Err;
       (ct, _) \<leftarrow> option Err (\<lambda>_. ep $$ c);
       (fp, x) \<leftarrow> case ct $$ i of Some (Function (fp, True, x)) \<Rightarrow> return (fp, x) | _ \<Rightarrow> throw Err;
       let e' = ffold_init ct (emptyEnv adv c (address e) (ShowL\<^sub>n\<^sub>a\<^sub>t 0)) (fmdom ct);
       (e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l) \<leftarrow> load True fp xe e' emptyStore emptyStore emptyStore e cd st;
       expr x e\<^sub>l cd\<^sub>l (st\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>)
     }) g"
 | "load cp ((i\<^sub>p, t\<^sub>p)#pl) (ex#el) e\<^sub>v' cd' sck' mem' e\<^sub>v cd st g =
     (do {
       (v, t) \<leftarrow> expr ex e\<^sub>v cd st;
       (c, m, k, e) \<leftarrow> case decl i\<^sub>p t\<^sub>p (Some (v,t)) cp cd (memory st) (storage st) (cd', mem',  sck', e\<^sub>v') of Some (c, m, k, e) \<Rightarrow> return (c, m, k, e) | None \<Rightarrow> throw Err;
       load cp pl el e c k m e\<^sub>v cd st
     }) g"
 | "load _ [] (_#_) _ _ _ _ _ _ _ g = throw Err g"
 | "load _ (_#_) [] _ _ _ _ _ _ _ g = throw Err g"
 | "load _ [] [] e\<^sub>v' cd' sck' mem' e\<^sub>v cd st g = return (e\<^sub>v', cd', sck', mem') g"
 
 | "rexp (Id i) e cd st g =
     (case fmlookup (denvalue e) i of
       Some (tp, Stackloc l) \<Rightarrow>
         (case accessStore l (stack st) of
           Some (KValue v) \<Rightarrow> return (KValue v, tp)
         | Some (KCDptr p) \<Rightarrow> return (KCDptr p, tp)
         | Some (KMemptr p) \<Rightarrow> return (KMemptr p, tp)
         | Some (KStoptr p) \<Rightarrow> return (KStoptr p, tp)
         | _ \<Rightarrow> throw Err)
     | Some (Storage (STValue t), Storeloc l) \<Rightarrow> return (KValue (accessStorage t l (storage st (address e))), Value t)
     | Some (Storage (STArray x t), Storeloc l) \<Rightarrow> return (KStoptr l, Storage (STArray x t))
     | _ \<Rightarrow> throw Err) g"
 | "rexp (Ref i r) e cd st g =
     (case fmlookup (denvalue e) i of
       Some (tp, (Stackloc l)) \<Rightarrow>
         (case accessStore l (stack st) of
           Some (KCDptr l') \<Rightarrow>
             do {
               t \<leftarrow> case tp of Calldata t \<Rightarrow> return t | _ \<Rightarrow> throw Err;
               (l'', t') \<leftarrow> msel False t l' r e cd st;
               (case t' of
                 MTValue t'' \<Rightarrow>
                   do {
                     v \<leftarrow> case accessStore l'' cd of Some (MValue v) \<Rightarrow> return v | _ \<Rightarrow> throw Err;
                     return (KValue v, Value t'')
                   }
               | MTArray x t'' \<Rightarrow>
                   do {
                     p \<leftarrow> case accessStore l'' cd of Some (MPointer p) \<Rightarrow> return p | _ \<Rightarrow> throw Err;
                     return (KCDptr p, Calldata (MTArray x t''))
                   }
               )
             }
         | Some (KMemptr l') \<Rightarrow>
             do {
               t \<leftarrow> case tp of Memory t \<Rightarrow> return t | _ \<Rightarrow> throw Err;
               (l'', t') \<leftarrow> msel True t l' r e cd st;
               (case t' of
                 MTValue t'' \<Rightarrow>
                   do {
                     v \<leftarrow> case accessStore l'' (memory st) of Some (MValue v) \<Rightarrow> return v | _ \<Rightarrow> throw Err;
                     return (KValue v, Value t'')
                   }
               | MTArray x t'' \<Rightarrow>
                   do {
                     p \<leftarrow> case accessStore l'' (memory st) of Some (MPointer p) \<Rightarrow> return p | _ \<Rightarrow> throw Err;
                     return (KMemptr p, Memory (MTArray x t''))
                   }
               )
             }
         | Some (KStoptr l') \<Rightarrow>
             do {
               t \<leftarrow> case tp of Storage t \<Rightarrow> return t | _ \<Rightarrow> throw Err;
               (l'', t') \<leftarrow> ssel t l' r e cd st;
               (case t' of
                 STValue t'' \<Rightarrow> return (KValue (accessStorage t'' l'' (storage st (address e))), Value t'')
               | STArray _ _ \<Rightarrow> return (KStoptr l'', Storage t')
               | STMap _ _   \<Rightarrow> return (KStoptr l'', Storage t'))
              }
         | _ \<Rightarrow> throw Err)
     | Some (tp, (Storeloc l)) \<Rightarrow>
           do {
             t \<leftarrow> case tp of Storage t \<Rightarrow> return t | _ \<Rightarrow> throw Err;
             (l', t') \<leftarrow> ssel t l r e cd st;
             (case t' of
               STValue t'' \<Rightarrow> return (KValue (accessStorage t'' l' (storage st (address e))), Value t'')
             | STArray _ _ \<Rightarrow> return (KStoptr l', Storage t')
             | STMap _ _   \<Rightarrow> return (KStoptr l', Storage t'))
           }
     | None \<Rightarrow> throw Err) g"
 | "expr CONTRACTS e cd st g =
     (do {
       assert Gas (\<lambda>g. g > costs\<^sub>e CONTRACTS e cd st);
       modify (\<lambda>g. g - costs\<^sub>e CONTRACTS e cd st);
       prev \<leftarrow> case contracts (accounts st (address e)) of 0 \<Rightarrow> throw Err | Suc n \<Rightarrow> return n;
       return (KValue (hash (address e) (ShowL\<^sub>n\<^sub>a\<^sub>t prev)), Value TAddr)
     }) g"
   by pat_completeness auto
 
 subsection \<open>Termination\<close>
 
 text \<open>To prove termination we first need to show that expressions do not increase gas\<close>
 
 lemma lift_gas:
   assumes "lift expr f e1 e2 e cd st g = Normal (v, g')"
       and "\<And>v g'. expr e1 e cd st g = Normal (v, g') \<Longrightarrow> g' \<le> g"
       and "\<And>v g' v' t' g''. expr e1 e cd st g = Normal (v, g')
             \<Longrightarrow> expr e2 e cd st g' = Normal (v', g'')
           \<Longrightarrow> g'' \<le> g'"
       shows "g' \<le> g"
 proof (cases "expr e1 e cd st g")
   case (n a g0')
   then show ?thesis
   proof (cases a)
     case (Pair b c)
     then show ?thesis
     proof (cases b)
       case (KValue v1)
       then show ?thesis
       proof (cases c)
         case (Value t1)
         then show ?thesis
         proof (cases "expr e2 e cd st g0'")
           case r2: (n a' g0'')
           then show ?thesis
           proof (cases a')
             case p2: (Pair b c)
             then show ?thesis
             proof (cases b)
               case v2: (KValue v2)
               then show ?thesis
               proof (cases c)
                 case t2: (Value t2)
                 then show ?thesis
                 proof (cases "f t1 t2 v1 v2")
                   case None
                   with assms n Pair KValue Value r2 p2 v2 t2 show ?thesis by simp
                 next
                   case (Some a'')
                   then show ?thesis
                   proof (cases a'')
                     case p3: (Pair v t)
                     with assms n Pair KValue Value r2 p2 v2 t2 Some have "g0'\<le> g" by simp
                     moreover from assms n Pair KValue Value r2 p2 v2 t2 Some have "g0''\<le>g0'" by simp
                     moreover from assms n Pair KValue Value r2 p2 v2 t2 Some have "g'=g0''" by (simp split:prod.split_asm)
                     ultimately show ?thesis by arith
                   qed
                 qed
               next
                 case (Calldata x2)
                 with assms n Pair KValue Value r2 p2 v2 show ?thesis by simp
               next
                 case (Memory x3)
                 with assms n Pair KValue Value r2 p2 v2 show ?thesis by simp
               next
                 case (Storage x4)
                 with assms n Pair KValue Value r2 p2 v2 show ?thesis by simp
               qed
             next
               case (KCDptr x2)
               with assms n Pair KValue Value r2 p2 show ?thesis by simp
             next
               case (KMemptr x3)
               with assms n Pair KValue Value r2 p2 show ?thesis by simp
             next
               case (KStoptr x4)
               with assms n Pair KValue Value r2 p2 show ?thesis by simp
             qed
           qed
         next
           case (e x)
           with assms n Pair KValue Value show ?thesis by simp
         qed
       next
         case (Calldata x2)
         with assms n Pair KValue show ?thesis by simp
       next
         case (Memory x3)
         with assms n Pair KValue show ?thesis by simp
       next
         case (Storage x4)
         with assms n Pair KValue show ?thesis by simp
       qed
     next
       case (KCDptr x2)
       with assms n Pair show ?thesis by simp
     next
       case (KMemptr x3)
       with assms n Pair show ?thesis by simp
     next
       case (KStoptr x4)
       with assms n Pair show ?thesis by simp
     qed
   qed
 next
   case (e x)
   with assms show ?thesis by simp
 qed
 
 lemma msel_ssel_expr_load_rexp_dom_gas[rule_format]:
     "msel_ssel_expr_load_rexp_dom (Inl (Inl (c1, t1, l1, xe1, ev1, cd1, st1, g1)))
       \<Longrightarrow> (\<forall>v1' g1'. msel c1 t1 l1 xe1 ev1 cd1 st1 g1 = Normal (v1', g1') \<longrightarrow> g1' \<le> g1)"
     "msel_ssel_expr_load_rexp_dom (Inl (Inr (t2, l2, xe2, ev2, cd2, st2, g2)))
       \<Longrightarrow> (\<forall>v2' g2'. ssel t2 l2 xe2 ev2 cd2 st2 g2 = Normal (v2', g2') \<longrightarrow> g2' \<le> g2)"
     "msel_ssel_expr_load_rexp_dom (Inr (Inl (e4, ev4, cd4, st4, g4)))
       \<Longrightarrow> (\<forall>v4' g4'. expr e4 ev4 cd4 st4 g4 = Normal (v4', g4') \<longrightarrow> g4' \<le> g4)"
     "msel_ssel_expr_load_rexp_dom (Inr (Inr (Inl (lcp, lis, lxs, lev0, lcd0, lk, lm, lev, lcd, lst, lg))))
       \<Longrightarrow> (\<forall>ev cd k m g'. load lcp lis lxs lev0 lcd0 lk lm lev lcd lst lg = Normal ((ev, cd, k, m), g') \<longrightarrow> g' \<le> lg \<and> address ev = address lev0 \<and> sender ev = sender lev0 \<and> svalue ev = svalue lev0)"
     "msel_ssel_expr_load_rexp_dom (Inr (Inr (Inr (l3, ev3, cd3, st3, g3))))
       \<Longrightarrow> (\<forall>v3' g3'. rexp l3 ev3 cd3 st3 g3 = Normal (v3', g3') \<longrightarrow> g3' \<le> g3)"
 proof (induct rule: msel_ssel_expr_load_rexp.pinduct
 [where ?P1.0="\<lambda>c1 t1 l1 xe1 ev1 cd1 st1 g1. (\<forall>l1' g1'. msel c1 t1 l1 xe1 ev1 cd1 st1 g1 = Normal (l1', g1') \<longrightarrow> g1' \<le> g1)"
    and ?P2.0="\<lambda>t2 l2 xe2 ev2 cd2 st2 g2. (\<forall>v2' g2'. ssel t2 l2 xe2 ev2 cd2 st2 g2 = Normal (v2', g2') \<longrightarrow> g2' \<le> g2)"
    and ?P3.0="\<lambda>e4 ev4 cd4 st4 g4. (\<forall>v4' g4'. expr e4 ev4 cd4 st4 g4 = Normal (v4', g4') \<longrightarrow> g4' \<le> g4)"
    and ?P4.0="\<lambda>lcp lis lxs lev0 lcd0 lk lm lev lcd lst lg. (\<forall>ev cd k m g'. load lcp lis lxs lev0 lcd0 lk lm lev lcd lst lg = Normal ((ev, cd, k, m), g') \<longrightarrow> g' \<le> lg \<and> address ev = address lev0 \<and> sender ev = sender lev0 \<and> svalue ev = svalue lev0)"
    and ?P5.0="\<lambda>l3 ev3 cd3 st3 g3. (\<forall>v3' g3'. rexp l3 ev3 cd3 st3 g3 = Normal (v3', g3') \<longrightarrow> g3' \<le> g3)"
 ])
   case 1
   then show ?case using msel.psimps(1) by auto
 next
   case 2
   then show ?case using msel.psimps(2) by auto
 next                                                                                                                                                                         
   case 3
   then show ?case using msel.psimps(3) by (auto split: if_split_asm Type.split_asm Stackvalue.split_asm prod.split_asm StateMonad.result.split_asm)
 next
   case (4 mm al t loc x y ys env cd st g)
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix v1' g1' assume a1: "msel mm (MTArray al t) loc (x # y # ys) env cd st g = Normal (v1', g1')"
     show "g1' \<le> g"
     proof (cases v1')
       case (Pair l1' t1')
       then show ?thesis
       proof (cases "expr x env cd st g")
         case (n a g')
         then show ?thesis
         proof (cases a)
           case p2: (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue v)
             then show ?thesis
             proof (cases c)
               case (Value t')
               then show ?thesis
               proof (cases)
                 assume l: "less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool)"
                 then show ?thesis
                 proof (cases "accessStore (hash loc v) (if mm then memory st else cd)")
                   case None
                   with 4 a1 n p2 KValue Value l show ?thesis using msel.psimps(4) by simp
                 next
                   case (Some a)
                   then show ?thesis
                   proof (cases a)
                     case (MValue _)
                     with 4 a1 n p2 KValue Value Some l show ?thesis using msel.psimps(4) by simp
                   next
                     case (MPointer l)
                     with n p2 KValue Value l Some
                     have "msel mm (MTArray al t) loc (x # y # ys) env cd st g = msel mm t l (y # ys) env cd st g'"
                       using msel.psimps(4) 4(1) by simp
                     moreover from n have "g' \<le> g" using 4(2) by simp
                     moreover from a1 MPointer n Pair p2 KValue Value l Some
                     have "g1' \<le> g'" using msel.psimps(4) 4(3) 4(1) by simp
                     ultimately show ?thesis by simp
                   qed
                 qed
               next
                 assume "\<not> less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool)"
                 with 4 a1 n p2 KValue Value show ?thesis using msel.psimps(4) by simp
               qed
             next
               case (Calldata _)
               with 4 a1 n p2 KValue show ?thesis using msel.psimps(4) by simp
             next
               case (Memory _)
               with 4 a1 n p2 KValue show ?thesis using msel.psimps(4) by simp
             next
               case (Storage _)
               with 4 a1 n p2 KValue show ?thesis using msel.psimps(4) by simp
             qed
           next
             case (KCDptr _)
             with 4 a1 n p2 show ?thesis using msel.psimps(4) by simp
           next
             case (KMemptr _)
             with 4 a1 n p2 show ?thesis using msel.psimps(4) by simp
           next
             case (KStoptr _)
             with 4 a1 n p2 show ?thesis using msel.psimps(4) by simp
           qed
         qed
       next
         case (e _)
         with 4 a1 show ?thesis using msel.psimps(4) by simp
       qed
     qed
   qed
 next
   case 5
   then show ?case using ssel.psimps(1) by auto
 next
   case 6
   then show ?case using ssel.psimps(2) by auto
 next
   case (7 al t loc x xs env cd st g)
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix v2' g2' assume a1: "ssel (STArray al t) loc (x # xs) env cd st g = Normal (v2', g2')"
     show "g2' \<le> g"
     proof (cases v2')
       case (Pair l2' t2')
       then show ?thesis
       proof (cases "expr x env cd st g")
         case (n a g'')
         then show ?thesis
         proof (cases a)
           case p2: (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue v)
             then show ?thesis
             proof (cases c)
               case (Value t')
               then show ?thesis
               proof (cases)
                 assume l: "less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool)"
                 with n p2 KValue Value l
                 have "ssel (STArray al t) loc (x # xs) env cd st g = ssel t (hash loc v) xs env cd st g''"
                 using ssel.psimps(3) 7(1) by simp
                 moreover from n have "g'' \<le> g" using 7(2) by simp
                 moreover from a1 n Pair p2 KValue Value l
                 have "g2' \<le> g''" using ssel.psimps(3) 7(3) 7(1) by simp
                 ultimately show ?thesis by simp
               next
                 assume "\<not> less t' (TUInt 256) v (ShowL\<^sub>i\<^sub>n\<^sub>t al) = Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool)"
                 with 7 a1 n p2 KValue Value show ?thesis using ssel.psimps(3) by simp
               qed
             next
               case (Calldata _)
               with 7 a1 n p2 KValue show ?thesis using ssel.psimps(3) by simp
             next
               case (Memory _)
               with 7 a1 n p2 KValue show ?thesis using ssel.psimps(3) by simp
             next
               case (Storage _)
               with 7 a1 n p2 KValue show ?thesis using ssel.psimps(3) by simp
             qed
           next
             case (KCDptr _)
             with 7 a1 n p2 show ?thesis using ssel.psimps(3) by simp
           next
             case (KMemptr _)
             with 7 a1 n p2 show ?thesis using ssel.psimps(3) by simp
           next
             case (KStoptr x4)
             with 7 a1 n p2 show ?thesis using ssel.psimps(3) by simp
           qed
         qed
       next
         case (e _)
         with 7 a1 show ?thesis using ssel.psimps(3) by simp
       qed
     qed
   qed
 next
   case (8 vv t loc x xs env cd st g)
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix v2' g2' assume a1: "ssel (STMap vv t) loc (x # xs) env cd st g = Normal (v2', g2')"
     show "g2' \<le> g"
     proof (cases v2')
       case (Pair l2' t2')
       then show ?thesis
       proof (cases "expr x env cd st g")
         case (n a g')
         then show ?thesis
         proof (cases a)
           case p2: (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue v)
             with 8 n p2 have "ssel (STMap vv t) loc (x # xs) env cd st g = ssel t (hash loc v) xs env cd st g'" using ssel.psimps(4) by simp
             moreover from n have "g' \<le> g" using 8(2) by simp
             moreover from a1 n Pair p2 KValue
             have "g2' \<le> g'" using ssel.psimps(4) 8(3) 8(1) by simp
             ultimately show ?thesis by simp
           next
             case (KCDptr _)
             with 8 a1 n p2 show ?thesis using ssel.psimps(4) by simp
           next
             case (KMemptr _)
             with 8 a1 n p2 show ?thesis using ssel.psimps(4) by simp
           next
             case (KStoptr _)
             with 8 a1 n p2 show ?thesis using ssel.psimps(4) by simp
           qed
         qed
       next
         case (e _)
         with 8 a1 show ?thesis using ssel.psimps(4) by simp
       qed
     qed
   qed
 next
   case 9
   then show ?case using expr.psimps(1) by (simp split:if_split_asm)
 next
   case 10
   then show ?case using expr.psimps(2) by (simp split:if_split_asm)
 next
   case 11
   then show ?case using expr.psimps(3) by simp
 next
   case (12 ad e cd st g)
   define gc where "gc = costs\<^sub>e (BALANCE ad) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa
     assume *: "expr (BALANCE ad) e cd st g = Normal (xa, g4)"
     show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 12 gc_def * show ?thesis using expr.psimps(4) by simp
     next
       assume gcost: "\<not> g \<le> gc"
       then show ?thesis
       proof (cases "expr ad e cd st (g - gc)")
         case (n a s)
         show ?thesis
         proof (cases a)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue x1)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               then show ?thesis
               proof (cases x1)
                 case (TSInt _)
                 with 12 gc_def * gcost n Pair KValue Value show ?thesis using expr.psimps(4)[of ad e cd st] by simp
               next
                 case (TUInt _)
                 with 12 gc_def * gcost n Pair KValue Value show ?thesis using expr.psimps(4)[of ad e cd st] by simp
               next
                 case TBool
                 with 12 gc_def * gcost n Pair KValue Value show ?thesis using expr.psimps(4)[of ad e cd st] by simp
               next
                 case TAddr
                 with 12(2)[where ?s'a="g-costs\<^sub>e (BALANCE ad) e cd st"] gc_def * gcost n Pair KValue Value show "g4 \<le> g" using expr.psimps(4)[OF 12(1)] by simp
               qed
             next
               case (Calldata _)
               with 12 gc_def * gcost n Pair KValue show ?thesis using expr.psimps(4)[of ad e cd st] by simp
             next
               case (Memory _)
               with 12 gc_def * gcost n Pair KValue show ?thesis using expr.psimps(4)[of ad e cd st] by simp
             next
               case (Storage _)
               with 12 gc_def * gcost n Pair KValue show ?thesis using expr.psimps(4)[of ad e cd st] by simp
             qed
           next
             case (KCDptr _)
             with 12 gc_def * gcost n Pair show ?thesis using expr.psimps(4)[of ad e cd st] by simp
           next
             case (KMemptr _)
             with 12 gc_def * gcost n Pair show ?thesis using expr.psimps(4)[of ad e cd st] by simp
           next
             case (KStoptr _)
             with 12 gc_def * gcost n Pair show ?thesis using expr.psimps(4)[of ad e cd st] by simp
           qed
         qed
       next
         case (e _)
         with 12 gc_def * gcost show ?thesis using expr.psimps(4)[of ad e cd st] by simp
       qed
     qed
   qed
 next
   case 13
   then show ?case using expr.psimps(5) by simp
 next
   case 14
   then show ?case using expr.psimps(6) by simp
 next
   case 15
   then show ?case using expr.psimps(7) by simp
 next
   case 16
   then show ?case using expr.psimps(8) by simp
 next
   case 17
   then show ?case using expr.psimps(9) by simp
 next
   case (18 x e cd st g)
   define gc where "gc = costs\<^sub>e (NOT x) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix v4 g4' assume a1: "expr (NOT x) e cd st g = Normal (v4, g4')"
     show "g4' \<le> g"
     proof (cases v4)
       case (Pair l4 t4)
       show ?thesis
       proof (cases)
         assume "g \<le> gc"
         with gc_def a1 show ?thesis using expr.psimps(10)[OF 18(1)] by simp
       next
         assume gcost: "\<not> g \<le> gc"
         then show ?thesis
         proof (cases "expr x e cd st (g - gc)")
           case (n a g')
           then show ?thesis
           proof (cases a)
             case p2: (Pair b c)
             then show ?thesis
             proof (cases b)
               case (KValue v)
               then show ?thesis
               proof (cases c)
                 case (Value t)
                 then show ?thesis
                 proof (cases t)
                   case (TSInt x1)
                   with a1 gc_def gcost n p2 KValue Value show ?thesis using expr.psimps(10)[OF 18(1)] by simp
                 next
                   case (TUInt x2)
                   with a1 gc_def gcost n p2 KValue Value show ?thesis using expr.psimps(10)[OF 18(1)] by simp
                 next
                   case TBool
                   then show ?thesis
                   proof (cases)
                     assume v_def: "v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                     with 18(1) gc_def gcost n p2 KValue Value TBool have "expr (NOT x) e cd st g = expr FALSE e cd st g' " using expr.psimps(10)[OF 18(1)] by simp
                     moreover from 18(2) gc_def gcost n p2 have "g' \<le> g-gc" by simp
                     moreover from 18(3)[OF _ _ n] a1 gc_def gcost have "g4' \<le> g'" using expr.psimps(10)[OF 18(1)] n Pair p2 KValue Value TBool v_def by simp
                     ultimately show ?thesis by arith
                    next
                     assume v_def: "\<not> v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                     then show ?thesis
                     proof (cases)
                       assume v_def2: "v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                       with 18(1) gc_def gcost n p2 KValue Value v_def TBool have "expr (NOT x) e cd st g = expr TRUE e cd st g'" using expr.psimps(10) by simp
                       moreover from 18(2)[where ?s'a="g-costs\<^sub>e (NOT x) e cd st"] gc_def gcost n p2 have "g' \<le> g" by simp
                       moreover from 18(4)[OF _ _ n] a1 gc_def gcost have "g4' \<le> g'" using expr.psimps(10)[OF 18(1)] n Pair p2 KValue Value TBool v_def v_def2 by simp
                       ultimately show ?thesis by arith
                     next
                       assume "\<not> v = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                       with 18(1) a1 gc_def gcost n p2 KValue Value v_def TBool show ?thesis using expr.psimps(10) by simp
                     qed
                   qed
                 next
                   case TAddr
                   with 18(1) a1 gc_def gcost n p2 KValue Value show ?thesis using expr.psimps(10) by simp
                 qed
               next
                 case (Calldata _)
                 with 18(1) a1 gc_def gcost n p2 KValue show ?thesis using expr.psimps(10) by simp
               next
                 case (Memory _)
                 with 18(1) a1 gc_def gcost n p2 KValue show ?thesis using expr.psimps(10) by simp
               next
                 case (Storage _)
                 with 18(1) a1 gc_def gcost n p2 KValue show ?thesis using expr.psimps(10) by simp
               qed
             next
               case (KCDptr _)
               with 18(1) a1 gc_def gcost n p2 show ?thesis using expr.psimps(10) by simp
             next
               case (KMemptr _)
               with 18(1) a1 gc_def gcost n p2 show ?thesis using expr.psimps(10) by simp
             next
               case (KStoptr _)
               with 18(1) a1 gc_def gcost n p2 show ?thesis using expr.psimps(10) by simp
             qed
           qed
         next
           case (e _)
           with 18(1) a1 gc_def gcost show ?thesis using expr.psimps(10) by simp
         qed
       qed
     qed
   qed
 next
   case (19 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (PLUS e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (PLUS e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 19(1) e_def show ?thesis using expr.psimps(11) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (PLUS e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 19(1) e_def gc_def have lift:"lift expr add e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(11)[OF 19(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (PLUS e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (PLUS e1 e2) e cd st)" by simp
       with 19(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (PLUS e1 e2) e cd st) = Normal (v, g')" using expr.psimps(11)[OF 19(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 19(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (20 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (MINUS e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (MINUS e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 20(1) e_def show ?thesis using expr.psimps(12) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (MINUS e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 20(1) e_def gc_def have lift:"lift expr sub e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(12)[OF 20(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (MINUS e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (MINUS e1 e2) e cd st)" by simp
       with 20(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (MINUS e1 e2) e cd st) = Normal (v, g')" using expr.psimps(12)[OF 20(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 20(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (21 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (LESS e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (LESS e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 21(1) e_def show ?thesis using expr.psimps(13) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (LESS e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 21(1) e_def gc_def have lift:"lift expr less e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(13)[OF 21(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (LESS e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (LESS e1 e2) e cd st)" by simp
       with 21(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (LESS e1 e2) e cd st) = Normal (v, g')" using expr.psimps(13)[OF 21(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 21(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (22 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (EQUAL e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (EQUAL e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 22(1) e_def show ?thesis using expr.psimps(14) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (EQUAL e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 22(1) e_def gc_def have lift:"lift expr equal e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(14)[OF 22(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (EQUAL e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (EQUAL e1 e2) e cd st)" by simp
       with 22(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (EQUAL e1 e2) e cd st) = Normal (v, g')" using expr.psimps(14)[OF 22(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 22(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (23 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (AND e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (AND e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 23(1) e_def show ?thesis using expr.psimps(15) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (AND e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 23(1) e_def gc_def have lift:"lift expr vtand e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(15)[OF 23(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (AND e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (AND e1 e2) e cd st)" by simp
       with 23(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (AND e1 e2) e cd st) = Normal (v, g')" using expr.psimps(15)[OF 23(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 23(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (24 e1 e2 e cd st g)
   define gc where "gc = costs\<^sub>e (OR e1 e2) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa assume e_def: "expr (OR e1 e2) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 24(1) e_def show ?thesis using expr.psimps(16) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (OR e1 e2) e cd st)) g = Normal ((), g)" using gc_def by simp
       with 24(1) e_def gc_def have lift:"lift expr vtor e1 e2 e cd st (g - gc) = Normal (xa, g4)" using expr.psimps(16)[OF 24(1)] by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (OR e1 e2) e cd st) g = Normal ((), g - costs\<^sub>e (OR e1 e2) e cd st)" by simp
       with 24(2)[OF * **] have "\<And>g4' v4 t4. expr e1 e cd st (g-gc) = Normal ((v4, t4), g4') \<Longrightarrow> g4' \<le> g - gc" unfolding gc_def by simp
       moreover obtain v g' where ***: "expr e1 e cd st (g - costs\<^sub>e (OR e1 e2) e cd st) = Normal (v, g')" using expr.psimps(16)[OF 24(1)] e_def by (simp split:if_split_asm result.split_asm prod.split_asm)
       with 24(3)[OF * ** ***] have "\<And>v t g' v' t' g''. expr e1 e cd st (g-gc) = Normal ((KValue v, Value t), g') \<Longrightarrow> expr e2 e cd st g' = Normal ((v', t'), g'') \<Longrightarrow> g'' \<le> g'" unfolding gc_def by simp
       ultimately show "g4 \<le> g" using lift_gas[OF lift] `\<not> g \<le> gc` by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (25 i e cd st g)
   define gc where "gc = costs\<^sub>e (LVAL i) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4 xa xaa assume e_def: "expr (LVAL i) e cd st g = Normal (xa, g4)"
     then show "g4 \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 25(1) e_def show ?thesis using expr.psimps(17) gc_def by simp
     next
       assume "\<not> g \<le> gc"
       then have *: "assert Gas ((<) (costs\<^sub>e (LVAL i) e cd st)) g = Normal ((), g)" using gc_def by simp
       then have "expr (LVAL i) e cd st g = rexp i e cd st (g - gc)" using expr.psimps(17)[OF 25(1)] gc_def by simp
       then have "rexp i e cd st (g - gc) = Normal (xa, g4)" using e_def by simp
       moreover have **: "modify (\<lambda>g. g - costs\<^sub>e (LVAL i) e cd st) g = Normal ((), g - costs\<^sub>e (LVAL i) e cd st)" by simp
       ultimately show ?thesis using 25(2)[OF * **] unfolding gc_def by (simp split:result.split_asm Stackvalue.split_asm Type.split_asm prod.split_asm)
     qed
   qed
 next
   case (26 i xe e cd st g)
   define gc where "gc = costs\<^sub>e (CALL i xe) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4' v4 assume a1: "expr (CALL i xe) e cd st g = Normal (v4, g4')"
     then have *: "assert Gas ((<) (costs\<^sub>e (CALL i xe) e cd st)) g = Normal ((), g)" using gc_def using expr.psimps(18)[OF 26(1)] by (simp split:if_split_asm)
     have **: "modify (\<lambda>g. g - costs\<^sub>e (CALL i xe) e cd st) g = Normal ((), g - gc)" unfolding gc_def by simp
     show "g4' \<le> g"
     proof (cases)
       assume "g \<le> gc"
       with 26(1) gc_def a1 show ?thesis using expr.psimps(18) by simp
     next
       assume gcost: "\<not> g \<le> gc"
       then show ?thesis
       proof (cases v4)
         case (Pair l4 t4)
         then show ?thesis
         proof (cases "ep $$ contract e")
           case None
           with 26(1) a1 gc_def gcost show ?thesis using expr.psimps(18) by simp
         next
           case (Some a)
           then show ?thesis
           proof (cases a)
             case p2: (fields ct x0 x1)
             then have 1: "option Err (\<lambda>_. ep $$ contract e) (g - gc) = Normal ((ct, x0, x1), (g - gc))" using Some by simp
             then show ?thesis
             proof (cases "fmlookup ct i")
               case None
               with 26(1) a1 gc_def gcost Some p2 show ?thesis using expr.psimps(18) by simp
             next
               case s1: (Some a)
               then show ?thesis
               proof (cases a)
                 case (Function x1)
                 then show ?thesis
                 proof (cases x1)
                   case p1: (fields fp ext x)
                   then show ?thesis
                   proof (cases ext)
                     case True
                     with 26(1) a1 gc_def gcost Some p2 s1 Function p1 show ?thesis using expr.psimps(18)[of i xe e cd st] by (auto split:unit.split_asm)
                   next
                     case False
                     then have 2: "(case ct $$ i of None \<Rightarrow> throw Err | Some (Function (fp, True, xa)) \<Rightarrow> throw Err | Some (Function (fp, False, xa)) \<Rightarrow> return (fp, xa) | Some _ \<Rightarrow> throw Err) (g - gc) = Normal ((fp, x), (g - gc))" using s1 Function p1 by simp
                     define e' where "e' = ffold (init ct) (emptyEnv (address e) (contract e) (sender e) (svalue e)) (fmdom ct)"
                     then show ?thesis
                     proof (cases "load False fp xe e' emptyStore emptyStore (memory st) e cd st (g - gc)")
                       case s4: (n a g')
                       then show ?thesis
                       proof (cases a)
                         case f2: (fields e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l)
                         then show ?thesis
                         proof (cases "expr x e\<^sub>l cd\<^sub>l (st\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) g'")
                           case n2: (n a g'')
                           then show ?thesis
                           proof (cases a)
                             case p3: (Pair sv tp)
                             with 26(1) a1 gc_def gcost Some p2 s1 Function p1 e'_def s4 f2 n2 False
                             have "expr (CALL i xe) e cd st g = Normal ((sv, tp), g'')"
                               using expr.psimps(18)[OF 26(1)] by simp
                             with a1 have "g4' \<le> g''" by simp
                             also from 26(3)[OF * ** 1 _ 2 _ _ s4] e'_def f2 n2 p3 gcost gc_def
                               have "\<dots> \<le> g'" by auto
                             also from 26(2)[OF * ** 1 _ 2 _] False e'_def f2 s4
                               have "\<dots> \<le> g - gc" unfolding ffold_init_def gc_def by blast
                             finally show ?thesis by simp
                           qed
                         next
                           case (e _)
                           with 26(1) a1 gc_def gcost Some p2 s1 Function p1 e'_def s4 f2 False show ?thesis using expr.psimps(18)[of i xe e cd st] by (auto simp add:Let_def split:unit.split_asm)
                         qed
                       qed
                     next
                       case (e _)
                       with 26(1) a1 gc_def gcost Some p2 s1 Function p1 e'_def False show ?thesis using expr.psimps(18)[of i xe e cd st] by (auto split:unit.split_asm)
                     qed
                   qed
                 qed
               next
                 case (Method _)
                 with 26(1) a1 gc_def gcost Some p2 s1 show ?thesis using expr.psimps(18) by simp
               next
                 case (Var _)
                 with 26(1) a1 gc_def gcost Some p2 s1 show ?thesis using expr.psimps(18) by simp
               qed
             qed
           qed
         qed
       qed
     qed
   qed
 next
   case (27 ad i xe e cd st g)
   define gc where "gc = costs\<^sub>e (ECALL ad i xe) e cd st"
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix g4' v4 assume a1: "expr (ECALL ad i xe) e cd st g = Normal (v4, g4')"
     show "g4' \<le> g"
     proof (cases v4)
       case (Pair l4 t4)
       then show ?thesis
       proof (cases)
         assume "g \<le> gc"
         with gc_def a1 show ?thesis using expr.psimps(19)[OF 27(1)] by simp
       next
         assume gcost: "\<not> g \<le> gc"
         then have *: "assert Gas ((<) (costs\<^sub>e (ECALL ad i xe) e cd st)) g = Normal ((), g)" using gc_def using expr.psimps(19)[OF 27(1)] by (simp split:if_split_asm)
         have **: "modify (\<lambda>g. g - costs\<^sub>e (ECALL ad i xe) e cd st) g = Normal ((), g - gc)" unfolding gc_def by simp
         then show ?thesis
         proof (cases "expr ad e cd st (g-gc)")
           case (n a0 g')
           then show ?thesis
           proof (cases a0)
             case p0: (Pair a b)
             then show ?thesis
             proof (cases a)
               case (KValue adv)
               then show ?thesis
               proof (cases b)
                 case (Value x1)
                 then show ?thesis
                 proof (cases x1)
                   case (TSInt x1)
                   with a1 gc_def gcost n p0 KValue Value show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                 next
                   case (TUInt x2)
                   with a1 gc_def gcost n p0 KValue Value show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                 next
                   case TBool
                   with a1 gc_def gcost n p0 KValue Value show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                 next
                   case TAddr
                   then have 1: "(case a0 of (KValue adv, Value TAddr) \<Rightarrow> return adv | (KValue adv, Value _) \<Rightarrow> throw Err | (KValue adv, _) \<Rightarrow> throw Err | (_, b) \<Rightarrow> throw Err) g' = Normal (adv, g')" using p0 KValue Value by simp
                   then show ?thesis
                   proof (cases "adv = address e")
                     case True
                     with a1 gc_def gcost n p0 KValue Value TAddr show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                   next
                     case False
                     then have 2: "assert Err (\<lambda>_. adv \<noteq> address e) g' = Normal ((), g')" by simp
                     then show ?thesis
                     proof (cases "type (accounts st adv)")
                       case None
                       with a1 gc_def gcost n p0 KValue Value TAddr False show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                     next
                       case (Some x2)
                       then show ?thesis
                       proof (cases x2)
                         case EOA
                         with a1 gc_def gcost n p0 KValue Value TAddr False Some show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                       next
                         case c: (Contract c)
                         then have 3: "(case type (accounts st adv) of Some (Contract c) \<Rightarrow> return c | _ \<Rightarrow> throw Err) g' = Normal (c, g')" using Some by simp
                         then show ?thesis
                         proof (cases "ep $$ c")
                           case None
                           with a1 gc_def gcost n p0 KValue Value TAddr False Some c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                         next
                           case s0: (Some a)
                           then show ?thesis
                           proof (cases a)
                             case p1: (fields ct xa xb)
                             then have 4: "option Err (\<lambda>_. ep $$ c) g' = Normal ((ct, xa, xb), g')" using Some s0 by simp
                             then show ?thesis
                             proof (cases "ct $$ i")
                               case None
                               with a1 gc_def gcost n p0 KValue Value TAddr Some p1 False c s0 show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                             next
                               case s1: (Some a)
                               then show ?thesis
                               proof (cases a)
                                 case (Function x1)
                                 then show ?thesis
                                 proof (cases x1)
                                   case p2: (fields fp ext x)
                                   then show ?thesis
                                   proof (cases ext)
                                     case True
                                     then have 5: "(case ct $$ i of None \<Rightarrow> throw Err | Some (Function (fp, True, xa)) \<Rightarrow> return (fp, xa) | Some (Function (fp, False, xa)) \<Rightarrow> throw Err | Some _ \<Rightarrow> throw Err) g' = Normal ((fp, x), g')" using s1 Function p2 by simp
                                     define e' where "e' = ffold (init ct) (emptyEnv adv c (address e) (ShowL\<^sub>n\<^sub>a\<^sub>t 0)) (fmdom ct)"
                                     then show ?thesis
                                     proof (cases "load True fp xe e' emptyStore emptyStore emptyStore e cd st g'")
                                       case n1: (n a g'')
                                       then show ?thesis
                                       proof (cases a)
                                         case f2: (fields e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l)
                                         show ?thesis
                                         proof (cases "expr x e\<^sub>l cd\<^sub>l (st\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) g''")
                                           case n2: (n a g''')
                                           then show ?thesis
                                           proof (cases a)
                                             case p3: (Pair sv tp)
                                             with a1 gc_def gcost n p2 KValue Value TAddr Some p1 s1 Function p0 e'_def n1 f2 n2 True False s0 c
                                             have "expr (ECALL ad i xe) e cd st g = Normal ((sv, tp), g''')"
                                                 using expr.psimps(19)[OF 27(1)] by auto
                                             with a1 have "g4' \<le> g'''" by auto
                                             also from 27(4)[OF * ** n 1 2 3 4 _ 5 _ _ n1] p3 f2 e'_def n2
                                               have "\<dots> \<le> g''" by simp
                                             also from 27(3)[OF * ** n 1 2 3 4 _ 5, of "(xa, xb)" fp x e'] e'_def n1 f2
                                               have "\<dots> \<le> g'" by auto
                                             also from 27(2)[OF * **] n
                                               have "\<dots> \<le> g" by simp
                                             finally show ?thesis by simp
                                           qed
                                         next
                                           case (e _)
                                           with a1 gc_def gcost n p0 KValue Value TAddr False Some p1 s1 Function p2 e'_def n1 f2 True s0 c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                                         qed
                                       qed
                                     next
                                       case (e _)
                                       with a1 gc_def gcost n p0 KValue Value TAddr False Some p1 s1 Function p2 e'_def True s0 c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                                     qed
                                   next
                                     case f: False
                                     with a1 gc_def gcost n p0 KValue Value TAddr Some p1 s1 Function p2 False s0 c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                                   qed
                                 qed
                               next
                                 case (Method _)
                                 with a1 gc_def gcost n p0 KValue Value TAddr Some p1 s1 False s0 c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                               next
                                 case (Var _)
                                 with a1 gc_def gcost n p0 KValue Value TAddr Some p1 s1 False s0 c show ?thesis using expr.psimps(19)[OF 27(1)] by simp
                               qed
                             qed
                           qed
                         qed
                       qed
                     qed
                   qed
                 qed
               next
                 case (Calldata _)
                 with a1 gc_def gcost n p0 KValue show ?thesis using expr.psimps(19)[OF 27(1)] by simp
               next
                 case (Memory _)
                 with a1 gc_def gcost n p0 KValue show ?thesis using expr.psimps(19)[OF 27(1)] by simp
               next
                 case (Storage _)
                 with a1 gc_def gcost n p0 KValue show ?thesis using expr.psimps(19)[OF 27(1)] by simp
               qed
             next
               case (KCDptr _)
               with a1 gc_def gcost n p0 show ?thesis using expr.psimps(19)[OF 27(1)] by simp
             next
               case (KMemptr _)
               with a1 gc_def gcost n p0 show ?thesis using expr.psimps(19)[OF 27(1)] by simp
             next
               case (KStoptr _)
               with a1 gc_def gcost n p0 show ?thesis using expr.psimps(19)[OF 27(1)] by simp
             qed
           qed
         next
           case (e _)
           with a1 gc_def gcost show ?thesis using expr.psimps(19)[OF 27(1)] by simp
         qed
       qed
     qed
   qed
 next
   case (28 cp i\<^sub>p t\<^sub>p pl e el e\<^sub>v' cd' sck' mem' e\<^sub>v cd st g)
   then show ?case
   proof (cases "expr e e\<^sub>v cd st g")
     case (n a g'')
     then show ?thesis
     proof (cases a)
       case (Pair v t)
       then show ?thesis
       proof (cases "decl i\<^sub>p t\<^sub>p (Some (v,t)) cp cd (memory st) (storage st) (cd', mem',  sck', e\<^sub>v')")
         case None
         with 28(1) n Pair show ?thesis using load.psimps(1) by simp
       next
         case (Some a)
         show ?thesis
         proof (cases a)
           case (fields cd'' m'' k'' e\<^sub>v'')
           then have 1: "(case decl i\<^sub>p t\<^sub>p (Some (v, t)) cp cd (memory st) (storage st) (cd', mem', sck', e\<^sub>v') of None \<Rightarrow> throw Err | Some (c, m, k, e) \<Rightarrow> return (c, m, k, e)) g'' = Normal ((cd'',m'',k'',e\<^sub>v''), g'')" using Some by simp
           show ?thesis
           proof ((rule allI)+,(rule impI))
             fix ev cda k m g' assume load_def: "load cp ((i\<^sub>p, t\<^sub>p) # pl) (e # el) e\<^sub>v' cd' sck' mem' e\<^sub>v cd st g = Normal ((ev, cda, k, m), g')"
             with n Pair Some fields have "load cp ((i\<^sub>p, t\<^sub>p) # pl) (e # el) e\<^sub>v' cd' sck' mem' e\<^sub>v cd st g = load cp pl el e\<^sub>v'' cd'' k'' m'' e\<^sub>v cd st g''" using load.psimps(1)[OF 28(1)] by simp
             with load_def have "load cp pl el e\<^sub>v'' cd'' k'' m'' e\<^sub>v cd st g'' = Normal ((ev, cda, k, m), g')" by simp
             with Pair fields have "g' \<le> g'' \<and> address ev = address e\<^sub>v'' \<and> sender ev = sender e\<^sub>v'' \<and> svalue ev = svalue e\<^sub>v''" using 28(3)[OF n Pair 1, of cd'' _ m''] by simp
             moreover from n have "g'' \<le> g" using 28(2) by simp
             moreover from Some fields have "address e\<^sub>v'' =  address e\<^sub>v' \<and> sender e\<^sub>v'' = sender e\<^sub>v' \<and> svalue e\<^sub>v'' = svalue e\<^sub>v'" using decl_env by auto
             ultimately show "g' \<le> g \<and> address ev = address e\<^sub>v' \<and> sender ev = sender e\<^sub>v' \<and> svalue ev = svalue e\<^sub>v'" by auto
           qed
         qed
       qed
     qed
   next
     case (e _)
     with 28(1) show ?thesis using load.psimps(1) by simp
   qed
 next
   case 29
   then show ?case using load.psimps(2) by auto
 next
   case 30
   then show ?case using load.psimps(3) by auto
 next
   case 31
   then show ?case using load.psimps(4) by auto
 next
   case (32 i e cd st g)
   show ?case
   proof (rule allI[THEN allI, OF impI])
     fix xa xaa assume "rexp (L.Id i) e cd st g = Normal (xa, xaa)"
     then show "xaa \<le> g" using 32(1) rexp.psimps(1) by (simp split: option.split_asm Denvalue.split_asm Stackvalue.split_asm prod.split_asm Type.split_asm STypes.split_asm)
   qed
 next
   case (33 i r e cd st g)
   show ?case
   proof (rule allI[THEN allI,OF impI])
     fix xa xaa assume rexp_def: "rexp (Ref i r) e cd st g = Normal (xa, xaa)"
     show "xaa \<le> g"
     proof (cases "fmlookup (denvalue e) i")
       case None
       with 33(1) show ?thesis using rexp.psimps rexp_def by simp
     next
       case (Some a)
       then show ?thesis
       proof (cases a)
         case (Pair tp b)
         then show ?thesis
         proof (cases b)
           case (Stackloc l)
           then show ?thesis
           proof (cases "accessStore l (stack st)")
             case None
             with 33(1) Some Pair Stackloc show ?thesis using rexp.psimps(2) rexp_def by simp
           next
             case s1: (Some a)
             then show ?thesis
             proof (cases a)
               case (KValue x1)
               with 33(1) Some Pair Stackloc s1 show ?thesis using rexp.psimps(2) rexp_def by simp
             next
               case (KCDptr l')
               with 33 Some Pair Stackloc s1 show ?thesis using rexp.psimps(2)[of i r e cd st] rexp_def by (simp split: option.split_asm Memoryvalue.split_asm MTypes.split_asm prod.split_asm Type.split_asm StateMonad.result.split_asm)
             next
               case (KMemptr x3)
               with 33 Some Pair Stackloc s1 show ?thesis using rexp.psimps(2)[of i r e cd st] rexp_def by (simp split: option.split_asm Memoryvalue.split_asm MTypes.split_asm prod.split_asm Type.split_asm StateMonad.result.split_asm)
             next
               case (KStoptr x4)
               with 33 Some Pair Stackloc s1 show ?thesis using rexp.psimps(2)[of i r e cd st] rexp_def by (simp split: option.split_asm STypes.split_asm prod.split_asm Type.split_asm StateMonad.result.split_asm)
             qed
           qed
         next
           case (Storeloc x2)
           with 33 Some Pair show ?thesis using rexp.psimps rexp_def by (simp split: option.split_asm STypes.split_asm prod.split_asm Type.split_asm  StateMonad.result.split_asm)
         qed
       qed
     qed
   qed
 next
   case (34 e cd st g)
   then show ?case using expr.psimps(20) by (simp split:nat.split)
 qed
 
 text \<open>Now we can define the termination function\<close>
 
 fun mgas
   where "mgas (Inr (Inr (Inr l))) = snd (snd (snd (snd l)))" (*rexp*)
         | "mgas (Inr (Inr (Inl l))) = snd (snd (snd (snd (snd (snd (snd (snd (snd (snd l)))))))))" (*load*)
         | "mgas (Inr (Inl l)) = snd (snd (snd (snd l)))" (*expr*)
         | "mgas (Inl (Inr l)) = snd (snd (snd (snd (snd (snd l)))))"  (*ssel*)
         | "mgas (Inl (Inl l)) = snd (snd (snd (snd (snd (snd (snd l))))))" (*msel*)
 
 fun msize
   where "msize (Inr (Inr (Inr l))) = size (fst l)"
         | "msize (Inr (Inr (Inl l))) = size_list size (fst (snd (snd l)))"
         | "msize (Inr (Inl l)) = size (fst l)"
         | "msize (Inl (Inr l)) = size_list size (fst (snd (snd l)))"
         | "msize (Inl (Inl l)) = size_list size (fst (snd (snd (snd l))))"
 
 method msel_ssel_expr_load_rexp_dom =
   match premises in e: "expr _ _ _ _ _ = Normal (_,_)" and d[thin]: "msel_ssel_expr_load_rexp_dom (Inr (Inl _))" \<Rightarrow> \<open>insert msel_ssel_expr_load_rexp_dom_gas(3)[OF d e]\<close> |
   match premises in l: "load _ _ _ _ _ _ _ _ _ _ _ = Normal (_,_)" and d[thin]: "msel_ssel_expr_load_rexp_dom (Inr (Inr (Inl _)))" \<Rightarrow> \<open>insert msel_ssel_expr_load_rexp_dom_gas(4)[OF d l, THEN conjunct1]\<close>
 
 method costs =
   match premises in "costs\<^sub>e (CALL i xe) e cd st < _" for i xe and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert call_not_zero[of (unchecked) i xe e cd st]\<close> |
   match premises in "costs\<^sub>e (ECALL ad i xe) e cd st < _" for ad i xe and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert ecall_not_zero[of (unchecked) ad i xe e cd st]\<close>
 
 termination msel
   apply (relation "measures [mgas, msize]")
   apply (auto split:Member.split_asm prod.split_asm bool.split_asm if_split_asm Stackvalue.split_asm option.split_asm Type.split_asm Types.split_asm Memoryvalue.split_asm atype.split_asm)
   apply (msel_ssel_expr_load_rexp_dom+, costs?, arith)+
   done
 
 subsection \<open>Gas Reduction\<close>
 
 text \<open>
   The following corollary is a generalization of @{thm [source] msel_ssel_expr_load_rexp_dom_gas}.
   We first prove that the function is defined for all input values and then obtain the final result as a corollary.
 \<close>
 
 lemma msel_ssel_expr_load_rexp_dom:
     "msel_ssel_expr_load_rexp_dom (Inl (Inl (c1, t1, l1, xe1, ev1, cd1, st1, g1)))"
     "msel_ssel_expr_load_rexp_dom (Inl (Inr (t2, l2, xe2, ev2, cd2, st2, g2)))"
     "msel_ssel_expr_load_rexp_dom (Inr (Inl (e4, ev4, cd4, st4, g4)))"
     "msel_ssel_expr_load_rexp_dom (Inr (Inr (Inl (lcp, lis, lxs, lev0, lcd0, lk, lm, lev, lcd, lst, lg))))"
     "msel_ssel_expr_load_rexp_dom (Inr (Inr (Inr (l3, ev3, cd3, st3, g3))))"
 by (induct rule: msel_ssel_expr_load_rexp.induct
 [where ?P1.0="\<lambda>c1 t1 l1 xe1 ev1 cd1 st1 g1. msel_ssel_expr_load_rexp_dom (Inl (Inl (c1, t1, l1, xe1, ev1, cd1, st1, g1)))"
    and ?P2.0="\<lambda>t2 l2 xe2 ev2 cd2 st2 g2. msel_ssel_expr_load_rexp_dom (Inl (Inr (t2, l2, xe2, ev2, cd2, st2, g2)))"
    and ?P3.0="\<lambda>e4 ev4 cd4 st4 g4. msel_ssel_expr_load_rexp_dom (Inr (Inl (e4, ev4, cd4, st4, g4)))"
    and ?P4.0="\<lambda>lcp lis lxs lev0 lcd0 lk lm lev lcd lst lg. msel_ssel_expr_load_rexp_dom (Inr (Inr (Inl (lcp, lis, lxs, lev0, lcd0, lk, lm, lev, lcd, lst, lg))))"
    and ?P5.0="\<lambda>l3 ev3 cd3 st3 g3. msel_ssel_expr_load_rexp_dom (Inr (Inr (Inr (l3, ev3, cd3, st3, g3))))"
 ], simp_all add: msel_ssel_expr_load_rexp.domintros)
 
 lemmas msel_ssel_expr_load_rexp_gas =
   msel_ssel_expr_load_rexp_dom_gas(1)[OF msel_ssel_expr_load_rexp_dom(1)]
   msel_ssel_expr_load_rexp_dom_gas(2)[OF msel_ssel_expr_load_rexp_dom(2)]
   msel_ssel_expr_load_rexp_dom_gas(3)[OF msel_ssel_expr_load_rexp_dom(3)]
   msel_ssel_expr_load_rexp_dom_gas(4)[OF msel_ssel_expr_load_rexp_dom(4)]
   msel_ssel_expr_load_rexp_dom_gas(5)[OF msel_ssel_expr_load_rexp_dom(5)]
 
 lemma expr_sender:
   assumes "expr SENDER e cd st g = Normal ((KValue adv, Value TAddr), g')"
   shows "adv = sender e" using assms by (simp split:if_split_asm)
 
-declare expr.simps[simp del]
-declare load.simps[simp del]
-declare ssel.simps[simp del]
-declare msel.simps[simp del]
-declare rexp.simps[simp del]
+declare expr.simps[simp del, solidity_symbex add]
+declare load.simps[simp del, solidity_symbex add]
+declare ssel.simps[simp del, solidity_symbex add]
+declare msel.simps[simp del, solidity_symbex add]
+declare rexp.simps[simp del, solidity_symbex add]
 
 end
 
 end
diff --git a/thys/Solidity/Reentrancy.thy b/thys/Solidity/Reentrancy.thy
--- a/thys/Solidity/Reentrancy.thy
+++ b/thys/Solidity/Reentrancy.thy
@@ -1,838 +1,838 @@
 section\<open>Reentrancy\<close>
 
 text \<open>
   In the following we use our calculus to verify a contract implementing a simple token.
-  The contract is defined by definition *bank* and consist of one state variable and two methods:
+  The contract is defined by definition[solidity_symbex]:*bank* and consist of one state variable and two methods:
   \<^item> The state variable "balance" is a mapping which assigns a balance to each address.
   \<^item> Method "deposit" allows to send money to the contract which is then added to the sender's balance.
   \<^item> Method "withdraw" allows to withdraw the callers balance.
 \<close>
 
 text \<open>
   We then verify that the following invariant (defined by *BANK*) is preserved by both methods:
   The difference between
   \<^item> the contracts own account-balance and
   \<^item> the sum of all the balances kept in the contracts state variable
   is larger than a certain threshold.
 \<close>
 
 text \<open>
   There are two things to note here:
   First, Solidity implicitly triggers the call of a so-called fallback method whenever we transfer money to a contract.
   In particular if another contract calls "withdraw", this triggers an implicit call to the callee's fallback method.
   This functionality was exploited in the infamous DAO attack which we demonstrate it in terms of an example later on.
   Since we do not know all potential contracts which call "withdraw", we need to verify our invariant for all possible Solidity programs.
 \<close>
 
 text \<open>
   The second thing to note is that we were not able to verify that the difference is indeed constant.
   During verification it turned out that this is not the case since in the fallback method a contract could just send us additional money without calling "deposit".
   In such a case the difference would change. In particular it would grow. However, we were able to verify that the difference does never shrink which is what we actually want to ensure.
 \<close>
 
 theory Reentrancy
   imports Weakest_Precondition Solidity_Evaluator
   "HOL-Eisbach.Eisbach_Tools"
 begin
 
 subsection\<open>Example of Re-entrancy\<close>
 
-definition "example_env \<equiv>
+definition[solidity_symbex]:"example_env \<equiv>
               loadProc (STR ''Attacker'')
                 ([],
                 ([], SKIP),
                  ITE (LESS (BALANCE THIS) (UINT 256 125))
                    (EXTERNAL (ADDRESS (STR ''BankAddress'')) (STR ''withdraw'') [] (UINT 256 0))
                    SKIP)
               (loadProc (STR ''Bank'')
                 ([(STR ''balance'', Var (STMap TAddr (STValue (TUInt 256)))),
                 (STR ''deposit'', Method ([], True,
                   ASSIGN
                     (Ref (STR ''balance'') [SENDER])
                     (PLUS (LVAL (Ref (STR ''balance'') [SENDER])) VALUE))),
                 (STR ''withdraw'', Method ([], True,
                   ITE (LESS (UINT 256 0) (LVAL (Ref (STR ''balance'') [SENDER])))
                     (COMP
                       (TRANSFER SENDER (LVAL (Ref (STR ''balance'') [SENDER])))
                       (ASSIGN (Ref (STR ''balance'') [SENDER]) (UINT 256 0)))
                     SKIP))],
                 ([], SKIP),
                 SKIP)
                 fmempty)"
 
 global_interpretation reentrancy: statement_with_gas costs_ex example_env costs_min
   defines stmt = "reentrancy.stmt"
       and lexp = reentrancy.lexp 
       and expr = reentrancy.expr
       and ssel = reentrancy.ssel
       and rexp = reentrancy.rexp
       and msel = reentrancy.msel
       and load = reentrancy.load
       and eval = reentrancy.eval
   by unfold_locales auto
 
 lemma "eval 1000
           (COMP
             (EXTERNAL (ADDRESS (STR ''BankAddress'')) (STR ''deposit'') [] (UINT 256 10))
             (EXTERNAL (ADDRESS (STR ''BankAddress'')) (STR ''withdraw'') [] (UINT 256 0)))
           (STR ''AttackerAddress'')
           (STR ''Attacker'')
           (STR '''')
           (STR ''0'')
           [(STR ''BankAddress'', STR ''100'', Contract (STR ''Bank''), 0), (STR ''AttackerAddress'', STR ''100'', Contract (STR ''Attacker''), 0)]
           []
   = STR ''BankAddress: balance==70 - Bank(balance[AttackerAddress]==0\<newline>)\<newline>AttackerAddress: balance==130 - Attacker()''"
   by eval
 
 subsection\<open>Definition of Contract\<close>
 
 abbreviation myrexp::L
   where "myrexp \<equiv> Ref (STR ''balance'') [SENDER]"
 
 abbreviation mylval::E
   where "mylval \<equiv> LVAL myrexp"
 
 abbreviation assign::S
   where "assign \<equiv> ASSIGN (Ref (STR ''balance'') [SENDER]) (UINT 256 0)"
 
 abbreviation transfer::S
   where "transfer \<equiv> TRANSFER SENDER (LVAL (Id (STR ''bal'')))"
 
 abbreviation comp::S
   where "comp \<equiv> COMP assign transfer"
 
 abbreviation keep::S
   where "keep \<equiv> BLOCK ((STR ''bal'', Value (TUInt 256)), Some mylval) comp"
 
 abbreviation deposit::S
   where "deposit \<equiv> ASSIGN (Ref (STR ''balance'') [SENDER]) (PLUS (LVAL (Ref (STR ''balance'') [SENDER])) VALUE)"
 
 abbreviation "banklist \<equiv> [
           (STR ''balance'', Var (STMap TAddr (STValue (TUInt 256)))),
           (STR ''deposit'', Method ([], True, deposit)),
           (STR ''withdraw'', Method ([], True, keep))]"
 
 definition bank::"(Identifier, Member) fmap"
   where "bank \<equiv> fmap_of_list banklist"
 
 subsection\<open>Verification\<close>
 
 locale Reentrancy = Calculus +
   assumes r0: "cname = STR ''Bank''"
       and r1: "members = bank"
       and r2: "fb = SKIP"
       and r3: "const = ([], SKIP)"
 begin
 
 subsubsection\<open>Method lemmas\<close>
 text \<open>
   These lemmas are required by @{term vcg_external}.
 \<close>
 
 lemma mwithdraw[mcontract]:
   "members $$ STR ''withdraw'' = Some (Method ([], True, keep))"
   using r1 unfolding bank_def by simp
 
 lemma mdeposit[mcontract]:
   "members $$ STR ''deposit'' = Some (Method ([], True, deposit))"
   using r1 unfolding bank_def by simp
 
 subsubsection\<open>Variable lemma\<close>
 
 lemma balance:
   "members $$ (STR ''balance'') = Some (Var (STMap TAddr (STValue (TUInt 256))))"
   using r1 bank_def fmlookup_of_list[of "[(STR ''balance'', Var (STMap TAddr (STValue (TUInt 256)))), (STR ''deposit'', Method ([], True, ASSIGN myrexp (PLUS mylval VALUE))),
       (STR ''withdraw'', Method ([], True, BLOCK ((STR ''bal'', Value (TUInt 256)), Some mylval) (COMP (ASSIGN myrexp (UINT 256 0)) Reentrancy.transfer)))]"] by simp
 
 subsubsection\<open>Case lemmas\<close>
 text \<open>
   These lemmas are required by @{term vcg_transfer}.
 \<close>
 lemma cases_ext: 
   assumes "members $$ mid = Some (Method (fp,True,f))"
       and "fp = [] \<Longrightarrow> P deposit"
       and "fp = [] \<Longrightarrow> P keep"
     shows "P f"
 proof -
   from assms(1) r1 consider (withdraw) "mid = STR ''withdraw''" | (deposit) "mid = STR ''deposit''" using bank_def fmap_of_list_SomeD[of "[(STR ''balance'', Var (STMap TAddr (STValue (TUInt 256)))), (STR ''deposit'', Method ([], True, deposit)), (STR ''withdraw'', Method ([], True, keep))]"] by auto
   then show ?thesis
   proof (cases)
     case withdraw
     then have "f = keep" and "fp = []" using assms(1) bank_def r1 fmlookup_of_list[of banklist] by simp+
     then show ?thesis using assms(3) by simp
   next
     case deposit
     then have "f = deposit" and "fp = []" using assms(1) bank_def r1 fmlookup_of_list[of banklist] by simp+
     then show ?thesis using assms(2) by simp
   qed
 qed
 
 lemma cases_int: 
   assumes "members $$ mid = Some (Method (fp,False,f))"
     shows "P fp f"
   using assms r1 bank_def fmap_of_list_SomeD[of "[(STR ''balance'', Var (STMap TAddr (STValue (TUInt 256)))), (STR ''deposit'', Method ([], True, deposit)), (STR ''withdraw'', Method ([], True, keep))]"] by auto
 
 lemma cases_fb: 
   assumes "P SKIP"
   shows "P fb"
 using assms bank_def r2 by simp
 
 lemma cases_cons: 
   assumes "fst const = [] \<Longrightarrow> P (fst const, SKIP)"
   shows "P const"
 using assms bank_def r3 by simp
 
 subsubsection\<open>Definition of Invariant\<close>
 
 abbreviation "SUMM s \<equiv> \<Sum>(ad,x)|fmlookup s (ad + (STR ''.'' + STR ''balance'')) = Some x. ReadL\<^sub>i\<^sub>n\<^sub>t x"
 
 abbreviation "POS s \<equiv> \<forall>ad x. fmlookup s (ad + (STR ''.'' + STR ''balance'')) = Some x \<longrightarrow> ReadL\<^sub>i\<^sub>n\<^sub>t x \<ge> 0"
 
 definition "iv s a \<equiv> a \<ge> SUMM s \<and> POS s"
 
 lemma weaken:
   assumes "iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)"
       and "ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge>0"
     shows "iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)))"
 using assms unfolding iv_def by simp
 
 subsubsection\<open>Additional lemmas\<close>
 
 lemma expr_0:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
       and "decl STR ''bal'' (Value (TUInt 256)) (Some (lv, lt)) False cd\<^sub>l m\<^sub>l s (cd\<^sub>l, m\<^sub>l, k\<^sub>l, e\<^sub>l) =  Some (cd', mem', sck', e')"
       and "expr (UINT 256 0) ev0 cd0 st0 g0 = Normal ((rv, rt),g''a)"
     shows "rv= KValue (ShowL\<^sub>i\<^sub>n\<^sub>t 0)" and "rt=Value (TUInt 256)"
   using assms(3) by (simp add:expr.simps createUInt_def split:if_split_asm)+
 
 lemma load_empty_par:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
     shows "load True [] [] (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
 proof -
   have "xe=[]"
   proof (rule ccontr)
     assume "\<not> xe=[]"
     then obtain x and xa where "xe=x # xa" by (meson list.exhaust)
     then have "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = throw Err g1" by (simp add:load.simps)
     with assms show False by simp
   qed
   then show ?thesis using assms(1) by simp
 qed
 
 lemma lexp_myrexp_decl:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
       and "decl STR ''bal'' (Value (TUInt 256)) (Some (lv, lt)) False cd\<^sub>l m\<^sub>l s (cd\<^sub>l, m\<^sub>l, k\<^sub>l, e\<^sub>l) =  Some (cd', mem', sck', e')"
       and "lexp myrexp e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'a\<rparr>) g'a = Normal ((rv,rt), g''a)"
     shows "rv= LStoreloc (address env + (STR ''.'' + STR ''balance''))" and "rt=Storage (STValue (TUInt 256))"
 proof -
   have "fmlookup (denvalue (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" unfolding emptyEnv_def using ffold_init_fmdom balance by simp
   moreover have el_def: "e\<^sub>l = (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using load_empty_par[OF assms(1)] by (simp add:load.simps)
   ultimately have "fmlookup (denvalue e\<^sub>l) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" using assms by auto
   then have *: "fmlookup (denvalue e') (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" using decl_env[OF assms(2)] by simp
 
   moreover obtain g'' where "ssel (STMap TAddr (STValue (TUInt 256))) (STR ''balance'') [SENDER] e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'a\<rparr>) g'a = Normal (((address env) + (STR ''.'' + STR ''balance''), STValue (TUInt 256)), g'')"
   proof -
     have "g'a > costs\<^sub>e SENDER e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'a\<rparr>)" using assms(3) * by (simp add:expr.simps ssel.simps lexp.simps split:if_split_asm)
     then obtain g'' where "expr SENDER e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'a\<rparr>) g'a = Normal ((KValue (sender e'), Value TAddr), g'')" by (simp add:expr.simps)
     moreover have "sender e\<^sub>l = address env" using el_def ffold_init_ad_same[of members "(emptyEnv ad cname (address env) v)" "fmdom members" e\<^sub>l] unfolding emptyEnv_def by simp
     then have "sender e' = address env" using decl_env[OF assms(2)] by simp
     ultimately show ?thesis using that hash_def by (simp add:ssel.simps)
   qed
   ultimately show "rv= LStoreloc (address env + (STR ''.'' + STR ''balance''))" and "rt=Storage (STValue (TUInt 256))" using assms(3) by (simp add:lexp.simps)+
 qed
 
 lemma expr_bal: 
   assumes "expr (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>) g'' = Normal ((KValue lv, Value t), g''')"
       and "(sck', e') = astack STR ''bal'' (Value (TUInt 256)) (KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s')) (k\<^sub>l, e\<^sub>l)"
     shows "(\<lceil>accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'\<rceil>::int) = ReadL\<^sub>i\<^sub>n\<^sub>t lv" (is ?G1) and "t = TUInt 256"
 proof -
   from assms(1)
   have "expr (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>) g'' = rexp ((L.Id STR ''bal'')) e' cd' ((st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>)) (g'' - costs\<^sub>e (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>))" by (simp add:expr.simps split:if_split_asm)
   moreover have "rexp ((L.Id STR ''bal'')) e' cd' ((st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>)) (g'' - costs\<^sub>e (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>)) = Normal ((KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'), (Value (TUInt 256))),(g'' - costs\<^sub>e (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>)) )"
   proof -
     from assms(2) have "fmlookup (denvalue e') (STR ''bal'') = Some (Value (TUInt 256), Stackloc \<lfloor>toploc k\<^sub>l\<rfloor>)" by (simp add:push_def allocate_def updateStore_def )
     moreover have "accessStore (\<lfloor>toploc k\<^sub>l\<rfloor>) sck' = Some (KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'))" using assms(2) by (simp add:push_def allocate_def updateStore_def accessStore_def)
     ultimately show ?thesis by (simp add:rexp.simps)
   qed
   ultimately have "expr (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>) g'' = Normal ((KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'), (Value (TUInt 256))),(g'' - costs\<^sub>e (LVAL (L.Id STR ''bal'')) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := fmupd l v' s'), gas := g''\<rparr>)))" and "t = TUInt 256" using assms(1) by simp+
   then have "lv = accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'" using assms(1) by (auto)
   with `t = TUInt 256` show ?G1 and "t = TUInt 256" by simp+
 qed
 
 lemma lexp_myrexp:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
       and "lexp myrexp e\<^sub>l cd\<^sub>l (st'\<lparr>gas := g2\<rparr>) g2 = Normal ((rv,rt), g2')"
     shows "rv= LStoreloc (address env + (STR ''.'' + STR ''balance''))" and "rt=Storage (STValue (TUInt 256))"
 proof -
   have "fmlookup (denvalue (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" unfolding emptyEnv_def using ffold_init_fmdom balance by simp
   moreover have el_def: "e\<^sub>l = (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using load_empty_par[OF assms(1)] by (simp add:load.simps)
   ultimately have *: "fmlookup (denvalue e\<^sub>l) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" using assms by auto
 
   moreover obtain g'' where "ssel (STMap TAddr (STValue (TUInt 256))) (STR ''balance'') [SENDER] e\<^sub>l cd\<^sub>l (st'\<lparr>gas := g2\<rparr>) g2 = Normal (((address env) + (STR ''.'' + STR ''balance''), STValue (TUInt 256)), g'')"
   proof -
     have "g2 > costs\<^sub>e SENDER e\<^sub>l cd\<^sub>l (st'\<lparr>gas := g2\<rparr>)" using assms(2) * by (simp add:expr.simps ssel.simps lexp.simps split:if_split_asm)
     then obtain g'' where "expr SENDER e\<^sub>l cd\<^sub>l (st'\<lparr>gas := g2\<rparr>) g2 = Normal ((KValue (sender e\<^sub>l), Value TAddr), g'')" by (simp add: expr.simps)
     moreover have "sender e\<^sub>l = address env" using el_def ffold_init_ad_same[of members "(emptyEnv ad cname (address env) v)" "fmdom members" e\<^sub>l] unfolding emptyEnv_def by simp
     ultimately show ?thesis using that hash_def by (simp add:ssel.simps)
   qed
   ultimately show "rv= LStoreloc (address env + (STR ''.'' + STR ''balance''))" and "rt=Storage (STValue (TUInt 256))" using assms(2) by (simp add: lexp.simps)+
 qed
 
 lemma expr_balance:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g1\<rparr>) g1 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g1')"
       and "expr (LVAL (Ref (STR ''balance'') [SENDER])) e\<^sub>l cd\<^sub>l (st\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g2\<rparr>) g2 = Normal ((va, ta), g'a)"
     shows "va= KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) (storage st ad))"
       and "ta = Value (TUInt 256)"
 proof -
   have "fmlookup (denvalue (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" unfolding emptyEnv_def using ffold_init_fmdom balance by simp
   moreover have el_def: "e\<^sub>l = (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using load_empty_par[OF assms(1)] by (simp add:load.simps)
   ultimately have *: "fmlookup (denvalue e\<^sub>l) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" using assms by auto
 
   moreover obtain g'' where "ssel (STMap TAddr (STValue (TUInt 256))) (STR ''balance'') [SENDER] e\<^sub>l cd\<^sub>l (st\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g2\<rparr>) g2 = Normal (((address env) + (STR ''.'' + STR ''balance''), STValue (TUInt 256)), g'')"
   proof -
     have "g2 > costs\<^sub>e SENDER e\<^sub>l cd\<^sub>l (st\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g2\<rparr>)" using assms(2) * by (simp add: expr.simps ssel.simps rexp.simps split:if_split_asm)
     then obtain g'' where "expr SENDER e\<^sub>l cd\<^sub>l (st\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g2\<rparr>) g2 = Normal ((KValue (sender e\<^sub>l), Value TAddr), g'')" by (simp add:expr.simps ssel.simps rexp.simps)
     moreover have "sender e\<^sub>l = address env" using el_def ffold_init_ad_same[of members "(emptyEnv ad cname (address env) v)" "fmdom members" e\<^sub>l] unfolding emptyEnv_def by simp
     ultimately show ?thesis using that hash_def by (simp add:expr.simps ssel.simps rexp.simps)
   qed
   moreover have "ad = address e\<^sub>l" using el_def ffold_init_ad_same[of members "(emptyEnv ad cname (address env) v)" "fmdom members" e\<^sub>l] unfolding emptyEnv_def by simp
   ultimately show "va= KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) (storage st ad))" and "ta = Value (TUInt 256)" using assms(2) by (simp add:expr.simps ssel.simps rexp.simps split:if_split_asm)+
 qed
 
 lemma balance_inj: "inj_on (\<lambda>(ad, x). (ad + (STR ''.'' + STR ''balance''),x)) {(ad, x). (fmlookup y \<circ> f) ad = Some x}"
 proof
   fix v v' assume asm1: "v \<in> {(ad, x). (fmlookup y \<circ> f) ad = Some x}" and asm2: "v' \<in> {(ad, x). (fmlookup y \<circ> f) ad = Some x}"
   and *:"(case v of (ad, x) \<Rightarrow> (ad + (STR ''.'' + STR ''balance''),x)) = (case v' of (ad, x) \<Rightarrow> (ad + (STR ''.'' + STR ''balance''),x))"
   then obtain ad ad' x x' where **: "v = (ad,x)" and ***: "v'=(ad',x')" by auto
   moreover from * ** *** have "ad + (STR ''.'' + STR ''balance'') = ad' + (STR ''.'' + STR ''balance'')" by simp
   with * ** have "ad = ad'" using String_Cancel[of ad "STR ''.'' + STR ''balance''" ad' ] by simp
   moreover from asm1 asm2 ** *** have "(fmlookup y \<circ> f) ad = Some x" and "(fmlookup y \<circ> f) ad' = Some x'" by auto
   with calculation(3) have "x=x'" by simp
   ultimately show "v=v'" by simp
 qed
 
 lemma fmfinite: "finite ({(ad, x). fmlookup y ad = Some x})"
 proof -
   have "{(ad, x). fmlookup y ad = Some x} \<subseteq> dom (fmlookup y) \<times> ran (fmlookup y)"
   proof
     fix x assume "x \<in> {(ad, x). fmlookup y ad = Some x}"
     then have "fmlookup y (fst x) = Some (snd x)" by auto
     then have "fst x \<in> dom (fmlookup y)" and "snd x \<in> ran (fmlookup y)" using Map.ranI by (blast,metis)
     then show "x \<in> dom (fmlookup y) \<times> ran (fmlookup y)" by (simp add: mem_Times_iff)
   qed
   thus ?thesis by (simp add: finite_ran finite_subset)
 qed
 
 lemma fmlookup_finite:
   fixes f :: "'a \<Rightarrow> 'a"
     and y :: "('a, 'b) fmap"
   assumes "inj_on (\<lambda>(ad, x). (f ad, x)) {(ad, x). (fmlookup y \<circ> f) ad = Some x}"
   shows "finite {(ad, x). (fmlookup y \<circ> f) ad = Some x}"
 proof (cases rule: inj_on_finite[OF assms(1), of "{(ad, x)|ad x. (fmlookup y) ad = Some x}"])
   case 1
   then show ?case by auto
 next
   case 2
   then have *: "finite {(ad, x) |ad x. fmlookup y ad = Some x}" using fmfinite[of y] by simp
   show ?case using finite_image_set[OF *, of "\<lambda>(ad, x). (ad, x)"] by simp
 qed
 
 lemma expr_plus:
   assumes "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st\<lparr>gas := g3\<rparr>) g3 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g3')"
       and "expr (PLUS a0 b0) ev0 cd0 st0 g0 = Normal ((xs, t'0), g'0)"
     shows "\<exists>s. xs = KValue (s)"
   using assms by (auto simp add:expr.simps split:if_split_asm result.split_asm prod.split_asm Stackvalue.split_asm Type.split_asm option.split_asm)
 
 lemma summ_eq_sum:
   "SUMM s' = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr. ReadL\<^sub>i\<^sub>n\<^sub>t x)
            + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (adr + (STR ''.'' + STR ''balance'')) s')"
 proof (cases "fmlookup s' (adr + (STR ''.'' + STR ''balance'')) = None")
   case True
   then have "accessStorage (TUInt 256) (adr + (STR ''.'' + STR ''balance'')) s' = ShowL\<^sub>i\<^sub>n\<^sub>t 0" unfolding accessStorage_def by simp
   moreover have "{(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x} = {(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
   proof
     show "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x} \<subseteq> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
     proof
       fix x
       assume "x \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}"
       then show "x \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}" using True by auto
     qed
   next
     show "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr} \<subseteq> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x }"
     proof
       fix x
       assume "x \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
       then show "x \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}" using True by auto
     qed
   qed
   then have "SUMM s' = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr. ReadL\<^sub>i\<^sub>n\<^sub>t x)" by simp
   ultimately show ?thesis using Read_ShowL_id by simp
 next
   case False
   then obtain val where val_def: "fmlookup s' (adr + (STR ''.'' + STR ''balance'')) = Some val" by auto
 
   have "inj_on (\<lambda>(ad, x). (ad + (STR ''.'' + STR ''balance''), x)) {(ad, x). (fmlookup s' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using balance_inj by simp
   then have "finite {(ad, x). (fmlookup s' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using fmlookup_finite[of "\<lambda>ad. (ad + (STR ''.'' + STR ''balance''))" s'] by simp
   then have sum1: "finite ({(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr})" using finite_subset[of "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}" "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}"] by auto
   moreover have sum2: "(adr,val) \<notin> {(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}" by simp
   moreover from sum1 val_def have "insert (adr,val) {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr} = {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}" by auto
   ultimately show ?thesis using sum.insert[OF sum1 sum2, of "\<lambda>(ad,x). ReadL\<^sub>i\<^sub>n\<^sub>t x"] val_def unfolding accessStorage_def by simp
 qed
 
 lemma sum_eq_update:
   assumes s''_def: "s'' = fmupd (adr + (STR ''.'' + STR ''balance'')) v' s'"
     shows "(\<Sum>(ad,x)|fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr. ReadL\<^sub>i\<^sub>n\<^sub>t x)
           =(\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr. ReadL\<^sub>i\<^sub>n\<^sub>t x)"
 proof -
   have "{(ad,x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr} = {(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
   proof
     show "{(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}
        \<subseteq> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
     proof
       fix xx
       assume "xx \<in> {(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
       then obtain ad x where "xx = (ad,x)" and "fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x" and "ad \<noteq> adr" by auto
       then have "fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x" using String_Cancel[of ad "(STR ''.'' + STR ''balance'')" "adr"] s''_def by (simp split:if_split_asm)
       with `ad \<noteq> adr` `xx = (ad,x)` show "xx \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}" by simp
     qed
   next
     show "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}
        \<subseteq> {(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
     proof
       fix xx
       assume "xx \<in> {(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}"
       then obtain ad x where "xx = (ad,x)" and "fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x" and "ad \<noteq> adr" by auto
       then have "fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x" using String_Cancel[of ad "(STR ''.'' + STR ''balance'')" "adr"] s''_def by (auto split:if_split_asm)
       with `ad \<noteq> adr` `xx = (ad,x)` show "xx \<in> {(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> adr}" by simp
     qed
   qed
   thus ?thesis by simp
 qed
 
 lemma adapt_deposit:
   assumes "address env \<noteq> ad"
       and "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore emptyStore emptyStore env cd (st0\<lparr>gas := g3\<rparr>) g3 = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g3')"
       and "Accounts.transfer (address env) ad v a = Some acc"
       and "iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)"
       and "lexp myrexp e\<^sub>l cd\<^sub>l (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g'\<rparr>) g' = Normal ((LStoreloc l, Storage (STValue t')), g''a)"
       and "expr (PLUS mylval VALUE) e\<^sub>l cd\<^sub>l (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l, gas := g\<rparr>) g = Normal ((KValue va, Value ta), g')"
       and "Valuetypes.convert ta t' va = Some v'"
     shows "(ad = address e\<^sub>l \<longrightarrow> iv (storage st0 (address e\<^sub>l)(l $$:= v')) \<lceil>bal (acc (address e\<^sub>l))\<rceil>) \<and>
            (ad \<noteq> address e\<^sub>l \<longrightarrow> iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))))"
 proof (rule conjI; rule impI)
   assume "ad = address e\<^sub>l"
   define s' s'' where "s' = storage st0 (address e\<^sub>l)" and "s'' = storage st0 (address e\<^sub>l)(l $$:= v')"
   then have "s'' = fmupd l v' s'" by simp
   moreover from lexp_myrexp[OF assms(2) assms(5)] have "l = address env + (STR ''.'' + STR ''balance'')" and "t'=TUInt 256" by simp+
   ultimately have s''_s': "s'' = s' (address env + (STR ''.'' + STR ''balance'') $$:= v')" by simp
 
   have "fmlookup (denvalue (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" unfolding emptyEnv_def using ffold_init_fmdom balance by simp
   moreover have "e\<^sub>l = (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using load_empty_par[OF assms(2)] by (simp add:load.simps)
   ultimately have "fmlookup (denvalue e\<^sub>l) (STR ''balance'') = Some (Storage (STMap TAddr (STValue (TUInt 256))), Storeloc (STR ''balance''))" by simp
   then have va_def: "va = (createUInt 256 ((ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) ((sender e\<^sub>l) + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t (svalue e\<^sub>l))))" 
    and "ta = (TUInt 256)" 
   using assms(6) Read_ShowL_id unfolding s'_def by (auto split:if_split_asm simp add: expr.simps ssel.simps rexp.simps add_def olift.simps hash_def)
 
   have "svalue e\<^sub>l = v" and "sender e\<^sub>l = address env" and "address e\<^sub>l = ad" using ffold_init_ad_same msel_ssel_expr_load_rexp_gas(4)[OF assms(2)] unfolding emptyEnv_def by simp+
   then have a_frame: "iv s' (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)" using assms(4) unfolding s'_def by simp
 
   from assms(1) have  "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (a ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t v < 2^256" using transfer_val2[OF assms(3)] by simp
   moreover from `address env \<noteq> ad` have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) = ReadL\<^sub>i\<^sub>n\<^sub>t (bal (a ad)) + ReadL\<^sub>i\<^sub>n\<^sub>t v" using transfer_add[OF assms(3)] by simp
   ultimately have a_bal: "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) < 2^256" by simp
 
   moreover have a_bounds:
       "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s')  + \<lceil>svalue e\<^sub>l\<rceil> < 2 ^ 256 \<and>
       ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s')  + \<lceil>svalue e\<^sub>l\<rceil> \<ge> 0"
   proof (cases "fmlookup s' (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) = None")
     case True
     hence "(accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s') = ShowL\<^sub>i\<^sub>n\<^sub>t 0" unfolding accessStorage_def by simp
     moreover have "(\<lceil>svalue e\<^sub>l\<rceil>::int) < 2 ^ 256"
     proof -
       from a_frame have "\<lceil>svalue e\<^sub>l\<rceil> + SUMM s' \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))" unfolding iv_def using `svalue e\<^sub>l = v` by simp
       moreover have "0 \<le> SUMM s'"
       using a_frame sum_nonneg[of "{(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}" "\<lambda>(ad,x). ReadL\<^sub>i\<^sub>n\<^sub>t x"] unfolding iv_def by auto
       ultimately have "\<lceil>svalue e\<^sub>l\<rceil> \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))" by simp
       then show "(\<lceil>svalue e\<^sub>l\<rceil>::int) < 2 ^ 256" using a_bal by simp
     qed
     moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge> 0" using transfer_val1[OF assms(3)] by simp
     with `svalue e\<^sub>l = v` have "(\<lceil>svalue e\<^sub>l\<rceil>::int) \<ge> 0" by simp
     ultimately show ?thesis using Read_ShowL_id by simp
   next
     case False
     then obtain x where x_def: "fmlookup s'  (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) = Some x" by auto
     moreover from a_frame have "\<lceil>svalue e\<^sub>l\<rceil> + SUMM s' \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))" unfolding iv_def using `svalue e\<^sub>l = v` by simp
     moreover have "(case (sender e\<^sub>l, x) of (ad, x) \<Rightarrow> \<lceil>x\<rceil>) \<le> (\<Sum>(ad, x)\<in>{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}. ReadL\<^sub>i\<^sub>n\<^sub>t x)"
     proof (cases rule: member_le_sum[of "(sender e\<^sub>l,x)" "{(ad,x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}" "\<lambda>(ad,x). ReadL\<^sub>i\<^sub>n\<^sub>t x"])
       case 1
       then show ?case using x_def by simp
     next
       case (2 x)
       with a_frame show ?case unfolding iv_def by auto
     next
       case 3
       have "inj_on (\<lambda>(ad, x). (ad + (STR ''.'' + STR ''balance''), x)) {(ad, x). (fmlookup s' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using balance_inj by simp
       then have "finite {(ad, x). (fmlookup s' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using fmlookup_finite[of "\<lambda>ad. (ad + (STR ''.'' + STR ''balance''))" s'] by simp
       then show ?case using finite_subset[of "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}" "{(ad, x). fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x}"] by auto
     qed
     then have "ReadL\<^sub>i\<^sub>n\<^sub>t x \<le> SUMM s'" by simp
     ultimately have "\<lceil>svalue e\<^sub>l\<rceil> + ReadL\<^sub>i\<^sub>n\<^sub>t x \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))" by simp
     then have "\<lceil>svalue e\<^sub>l\<rceil> + ReadL\<^sub>i\<^sub>n\<^sub>t x \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad))" by simp
     with a_bal have "\<lceil>svalue e\<^sub>l\<rceil> + ReadL\<^sub>i\<^sub>n\<^sub>t x < 2^256" by simp
     then have "\<lceil>svalue e\<^sub>l\<rceil> \<le> \<lceil>bal (acc ad)\<rceil> - SUMM s'" and lck: "fmlookup s' (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) = Some x"  and "ReadL\<^sub>i\<^sub>n\<^sub>t x + \<lceil>svalue e\<^sub>l\<rceil> < 2 ^ 256" using a_frame x_def `svalue e\<^sub>l = v` unfolding iv_def by auto
     moreover from lck have "(accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s') = x" unfolding accessStorage_def by simp
     moreover have "\<lceil>svalue e\<^sub>l\<rceil> + ReadL\<^sub>i\<^sub>n\<^sub>t x \<ge> 0"
     proof -
       have "ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge> 0" using transfer_val1[OF assms(3)] by simp
       with `svalue e\<^sub>l = v` have "(\<lceil>svalue e\<^sub>l\<rceil>::int) \<ge> 0" by simp
       moreover from a_frame have "ReadL\<^sub>i\<^sub>n\<^sub>t x \<ge> 0" unfolding iv_def using x_def by simp
       ultimately show ?thesis by simp
     qed
     ultimately show ?thesis using Read_ShowL_id by simp
   qed
   ultimately have "va = ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t (svalue e\<^sub>l))" using createUInt_id[where ?v="ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e\<^sub>l + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t (svalue e\<^sub>l)"] va_def by simp
   then have v'_def: "v' = ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v)" using `sender e\<^sub>l = address env` `svalue e\<^sub>l = v` `t'=TUInt 256` `ta = (TUInt 256)` using assms(7) by auto
 
   have "SUMM s'' \<le> \<lceil>bal (acc ad)\<rceil>"
   proof -
     have "SUMM s' \<le> ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v" using a_frame unfolding iv_def by simp
     moreover have "SUMM s'' = SUMM s' + ReadL\<^sub>i\<^sub>n\<^sub>t v"
     proof -
       from summ_eq_sum have s1: "SUMM s' = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s')" by simp
       have s2: "SUMM s'' = (\<Sum>(ad,x)|fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v"
       proof -
         have "inj_on (\<lambda>(ad, x). (ad + (STR ''.'' + STR ''balance''), x)) {(ad, x). (fmlookup s'' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using balance_inj by simp
         then have "finite {(ad, x). (fmlookup s'' \<circ> (\<lambda>ad. ad + (STR ''.'' + STR ''balance''))) ad = Some x}" using fmlookup_finite[of "\<lambda>ad. (ad + (STR ''.'' + STR ''balance''))" s''] by simp
         then have sum1: "finite ({(ad,x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env})" using finite_subset[of "{(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env}" "{(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x}"] by auto
         moreover have sum2: "(address env, ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v)) \<notin> {(ad,x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env}" by simp
         moreover from v'_def s''_s' have "insert (address env, ShowL\<^sub>i\<^sub>n\<^sub>t (ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v)) {(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env} = {(ad, x). fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x}" by auto
         then show ?thesis using sum.insert[OF sum1 sum2, of "\<lambda>(ad,x). ReadL\<^sub>i\<^sub>n\<^sub>t x"] Read_ShowL_id by simp
       qed
       from sum_eq_update[OF s''_s'] have s3: "(\<Sum>(ad,x)|fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x)
                     =(\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x)" by simp
       moreover from s''_s' v'_def have "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s'') = ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v" using Read_ShowL_id unfolding accessStorage_def by simp
       ultimately have "SUMM s''= SUMM s' + ReadL\<^sub>i\<^sub>n\<^sub>t v"
       proof -
         from s2 have "SUMM s'' = (\<Sum>(ad,x)|fmlookup s'' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v" by simp
         also from s3 have "\<dots> = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> address env. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v" by simp
         also from s1 have "\<dots> = SUMM s' - ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') + ReadL\<^sub>i\<^sub>n\<^sub>t v" by simp
         finally show ?thesis by simp
       qed
       then show ?thesis by simp
     qed
     ultimately show ?thesis by simp
   qed
   moreover have "POS s''"
   proof (rule allI[OF allI])
     fix x xa
     show "fmlookup s'' (x + (STR ''.'' + STR ''balance'')) = Some xa \<longrightarrow> 0 \<le> (\<lceil>xa\<rceil>::int)"
     proof
       assume a_lookup: "fmlookup s'' (x + (STR ''.'' + STR ''balance'')) = Some xa"
       show "0 \<le> (\<lceil>xa\<rceil>::int)"
       proof (cases "x = address env")
         case True
         then show ?thesis using s''_s' a_lookup using Read_ShowL_id v'_def a_bounds `sender e\<^sub>l = address env` `svalue e\<^sub>l = v` by auto
       next
         case False
         then have "fmlookup s' (x + (STR ''.'' + STR ''balance'')) = Some xa" using s''_s' a_lookup String_Cancel[of "address env" "(STR ''.'' + STR ''balance'')" x] by (simp split:if_split_asm)
         then show ?thesis using a_frame unfolding iv_def by simp
       qed
     qed
   qed
   ultimately show "iv (storage st0 (address e\<^sub>l)(l $$:= v')) \<lceil>bal (acc (address e\<^sub>l))\<rceil>" unfolding iv_def s''_def using `ad = address e\<^sub>l` by simp
 next
   assume "ad \<noteq> address e\<^sub>l"
   moreover have "ad = address e\<^sub>l" using ffold_init_ad_same msel_ssel_expr_load_rexp_gas(4)[OF assms(2)] unfolding emptyEnv_def by simp
   ultimately show "iv (storage st0 ad) \<lceil>bal (acc ad)\<rceil>" by simp
 qed
 
 lemma adapt_withdraw:
   fixes st acc sck' mem' g''a e' l v' xe
   defines "st' \<equiv> st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a, storage := (storage st) (address e' := (storage st (address e')) (l $$:= v'))\<rparr>"
   assumes "iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)"
       and "load True [] xe (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members)) emptyStore
            emptyStore emptyStore env cd (st\<lparr>gas := g'\<rparr>) g' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')"
       and "decl STR ''bal'' (Value (TUInt 256)) (Some (va, ta)) False cd\<^sub>l m\<^sub>l (storage st) (cd\<^sub>l, m\<^sub>l, k\<^sub>l, e\<^sub>l) =
            Some (cd', mem', sck', e')"
       and "expr (UINT 256 0) e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := ga\<rparr>) ga =
            Normal ((KValue vb, Value tb), g'b)"
       and "Valuetypes.convert tb t' vb = Some v'"
       and "lexp myrexp e' cd' (st\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'b\<rparr>) g'b =
            Normal ((LStoreloc l, Storage (STValue t')), g''a)"
       and "expr mylval e\<^sub>l cd\<^sub>l (st\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l,
            gas := g'' - costs keep e\<^sub>l cd\<^sub>l (st\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)\<rparr>)
            (g'' - costs keep e\<^sub>l cd\<^sub>l (st\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)) = Normal ((va, ta), g'a)"
       and "Accounts.transfer (address env) ad v (accounts st) = Some acc"
       and "expr SENDER e' cd' (st' \<lparr>gas := g\<rparr>) g =  Normal ((KValue adv, Value TAddr), g'x)"
       and adv_def: "adv \<noteq> ad"
       and bal: "expr (LVAL (L.Id STR ''bal'')) e' cd' (st'\<lparr>gas := g''b\<rparr>) g''b = Normal ((KValue lv, Value t), g''')"
       and con: "Valuetypes.convert t (TUInt 256) lv = Some lv'"
     shows "iv (storage st' ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st' ad)) - (ReadL\<^sub>i\<^sub>n\<^sub>t lv'))"
 proof -
   define acca where "acca = accounts st' ad"
   define s' where "s' = storage st (address e')"
   define s'a where "s'a = storage st' ad"
   moreover have "address e' = ad"
   proof -
     have "address e' = address e\<^sub>l" using decl_env[OF assms(4)] by simp
     also have "address e\<^sub>l = address (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using msel_ssel_expr_load_rexp_gas(4)[OF assms(3)] by simp
     also have "\<dots> = ad" unfolding emptyEnv_def using ffold_init_ad_same by simp
     finally show ?thesis .
   qed
   ultimately have s'a_def: "s'a = fmupd l v' s'" unfolding s'_def st'_def by simp
 
   have "sender e' = address env"
   proof -
     have "sender e' = sender e\<^sub>l" using decl_env[OF assms(4)] by simp
     also have "sender e\<^sub>l = sender (ffold (init members) (emptyEnv ad cname (address env) v) (fmdom members))" using msel_ssel_expr_load_rexp_gas(4)[OF assms(3)] by simp
     also have "\<dots> = address env" unfolding emptyEnv_def using ffold_init_ad_same by simp
     finally show ?thesis .
   qed
 
   have "iv s'a (\<lceil>bal acca\<rceil> - \<lceil>lv'\<rceil>)" unfolding iv_def
   proof intros
     have "SUMM s' \<le> \<lceil>bal acca\<rceil>"
     proof -
       from `address e' = ad` have "iv s' (ReadL\<^sub>i\<^sub>n\<^sub>t (bal acca) - ReadL\<^sub>i\<^sub>n\<^sub>t v)" using assms(2,5) unfolding s'_def st'_def acca_def by simp
       then have "SUMM s' \<le> \<lceil>bal (acca)\<rceil> - \<lceil>v\<rceil>" unfolding iv_def by simp
       moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge> 0" using transfer_val1[OF assms(9)] by simp
       ultimately show ?thesis by simp
     qed
     moreover have "SUMM s'a = SUMM s' - ReadL\<^sub>i\<^sub>n\<^sub>t lv'"
     proof -
       from summ_eq_sum have "SUMM s'a = (\<Sum>(ad,x)|fmlookup s'a (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> sender e'. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s'a)" by simp
       moreover from summ_eq_sum have "SUMM s' = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> sender e'. ReadL\<^sub>i\<^sub>n\<^sub>t x) + ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s')" by simp
       moreover from s'a_def lexp_myrexp_decl(1)[OF assms(3,4) assms(7)] have " s'a = s'((sender e' + (STR ''.'' + STR ''balance''))$$:= v')" using `sender e' = address env` by simp
       with sum_eq_update have "(\<Sum>(ad,x)|fmlookup s'a (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> sender e'. ReadL\<^sub>i\<^sub>n\<^sub>t x) = (\<Sum>(ad,x)|fmlookup s' (ad + (STR ''.'' + STR ''balance'')) = Some x \<and> ad \<noteq> sender e'. ReadL\<^sub>i\<^sub>n\<^sub>t x)"  by simp
       moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s'a) = ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s') - ReadL\<^sub>i\<^sub>n\<^sub>t lv'"
       proof -
         have "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s') = ReadL\<^sub>i\<^sub>n\<^sub>t lv'"
         proof -
           from expr_balance[OF assms(3) assms(8)] have "va= KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s')" and "ta = Value (TUInt 256)" using `address e' = ad` unfolding s'_def by simp+
           then have "(sck',e') =  astack STR ''bal'' (Value (TUInt 256)) (KValue (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s')) (k\<^sub>l, e\<^sub>l)" using decl.simps(2) assms(4) by simp
           then have "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (address env + (STR ''.'' + STR ''balance'')) s') = ReadL\<^sub>i\<^sub>n\<^sub>t lv" and "t = TUInt 256" using expr_bal bal unfolding s'_def st'_def by auto
           moreover from `t = TUInt 256` have "lv = lv'" using con by simp
           ultimately show ?thesis using `sender e' = address env` by simp
         qed
         moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t (accessStorage (TUInt 256) (sender e' + (STR ''.'' + STR ''balance'')) s'a) = ReadL\<^sub>i\<^sub>n\<^sub>t (ShowL\<^sub>i\<^sub>n\<^sub>t 0)"
         proof -
           have "v' = ShowL\<^sub>i\<^sub>n\<^sub>t 0"
           proof -
             have "vb = createUInt 256 0" and "tb=TUInt 256" using assms(5) by (simp add: expr.simps load.simps split:if_split_asm)+
             moreover have "t'=TUInt 256" using lexp_myrexp_decl(2)[OF assms(3,4) assms(7)] by simp
             ultimately show ?thesis using assms(6) by (simp add: createUInt_id)
           qed
           moreover have "l= (sender e' + (STR ''.'' + STR ''balance''))" using lexp_myrexp_decl(1)[OF assms(3,4) assms(7)] `sender e' = address env` by simp
           ultimately show ?thesis using s'a_def accessStorage_def by simp
         qed
         ultimately show ?thesis using Read_ShowL_id by simp
       qed
       ultimately show ?thesis by simp
     qed
     ultimately show "SUMM s'a \<le> \<lceil>bal acca\<rceil> - \<lceil>lv'\<rceil>" by simp
   next
     fix ad' x
     assume *: "fmlookup s'a (ad' + (STR ''.'' + STR ''balance'')) = Some x"
     show "0 \<le> ReadL\<^sub>i\<^sub>n\<^sub>t x"
     proof (cases "ad' = sender e'")
       case True
       moreover have "v' = ShowL\<^sub>i\<^sub>n\<^sub>t 0"
       proof -
         have "vb = createUInt 256 0" and "tb=TUInt 256" using assms(5) by (simp add:expr.simps split:if_split_asm)+
         moreover have "t'=TUInt 256" using lexp_myrexp_decl(2)[OF assms(3,4) assms(7)] by simp
         ultimately show ?thesis using assms(6) by (simp add: createUInt_id)
       qed
       moreover have "l= (sender e' + (STR ''.'' + STR ''balance''))" using lexp_myrexp_decl(1)[OF assms(3,4) assms(7)] `sender e' = address env` by simp
       ultimately show ?thesis using Read_ShowL_id s'a_def * by auto
     next
       case False
       moreover from `address e' = ad` have "iv s' (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)" using assms(2) unfolding s'_def by simp
       then have "POS s'" unfolding iv_def by simp
       moreover have "l= (sender e' + (STR ''.'' + STR ''balance''))" using lexp_myrexp_decl(1)[OF assms(3,4) assms(7)] `sender e' = address env` by simp
       ultimately show ?thesis using s'a_def * String_Cancel by (auto split:if_split_asm)
     qed
   qed
   then show ?thesis unfolding s'a_def s'_def acca_def st'_def `address e' = ad` by simp
 qed
 
 lemma wp_deposit[external]:
   assumes "address ev \<noteq> ad"
       and "expr adex ev cd (st\<lparr>gas := gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0\<rparr>) (gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0) = Normal ((KValue ad, Value TAddr), g)"
       and "expr val ev cd (st0\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "Valuetypes.convert t (TUInt 256) v = Some v'"
       and "load True [] xe (ffold (init members) (emptyEnv ad cname (address ev) v') (fmdom members)) emptyStore emptyStore emptyStore ev cd (st0\<lparr>gas := g'\<rparr>) g' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')"
       and "Accounts.transfer (address ev) ad v' (accounts st0) = Some acc"
       and "iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v')"
     shows "wpS (stmt (ASSIGN myrexp (PLUS mylval VALUE)) e\<^sub>l cd\<^sub>l)
            (\<lambda>st. (iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st ad))))) (\<lambda>e. e = Gas \<or> e = Err)
            (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)"
   apply (vcg_assign expr_rule: expr_plus[OF assms(5)] lexp_rule: lexp_myrexp(1)[OF assms(5)])
   by (simp add: adapt_deposit[OF assms(1,5,6,7)])
 
 lemma wptransfer:
   fixes st0 acc sck' mem' g''a e' l v'
   defines "st' \<equiv> st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g''a,
         storage := (storage st0)(address e' := storage st0 (address e')(l $$:= v'))\<rparr>"
   assumes "Pfe ad iv st'"
       and "address ev \<noteq> ad"
       and "g'' \<le> gas st"
       and "type (acc ad) = Some (Contract cname)"
       and "expr adex ev cd (st0\<lparr>gas := gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0\<rparr>)
            (gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0) =
            Normal ((KValue ad, Value TAddr), g)"
       and "expr val ev cd (st0\<lparr>gas := g\<rparr>) g = Normal ((KValue gv, Value gt), g')"
       and "Valuetypes.convert gt (TUInt 256) gv = Some gv'"
       and "load True [] xe (ffold (init members) (emptyEnv ad cname (address ev) gv') (fmdom members)) emptyStore
            emptyStore emptyStore ev cd (st0\<lparr>gas := g'\<rparr>) g' =
           Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')"
       and "Accounts.transfer (address ev) ad gv' (accounts st0) = Some acc"
       and "iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t gv')"
       and "decl STR ''bal'' (Value (TUInt 256)) (Some (v, t)) False cd\<^sub>l m\<^sub>l (storage st0)
            (cd\<^sub>l, m\<^sub>l, k\<^sub>l, e\<^sub>l) =  Some (cd', mem', sck', e')"
       and "Valuetypes.convert ta t' va = Some v'"
       and "lexp myrexp e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := g'a\<rparr>) g'a =
            Normal ((LStoreloc l, Storage (STValue t')), g''a)"
       and "expr mylval e\<^sub>l cd\<^sub>l (st0\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l,
            gas := g'' - costs (BLOCK ((STR ''bal'', Value (TUInt 256)), Some mylval)
            (COMP (ASSIGN myrexp (UINT 256 0)) Reentrancy.transfer)) e\<^sub>l cd\<^sub>l (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)\<rparr>)
            (g'' - costs (BLOCK ((STR ''bal'', Value (TUInt 256)), Some mylval) (COMP (ASSIGN myrexp (UINT 256 0)) Reentrancy.transfer)) e\<^sub>l
            cd\<^sub>l (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)) =
            Normal ((v, t), g''')"
       and "expr (UINT 256 0) e' cd' (st0\<lparr>accounts := acc, stack := sck', memory := mem', gas := ga\<rparr>) ga = Normal ((KValue va, Value ta), g'a)"
     shows "wpS (stmt Reentrancy.transfer e' cd') (\<lambda>st. iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st ad))))
         (\<lambda>e. e = Gas \<or> e = Err) st'"
 proof (rule meta_eq_to_obj_eq[THEN iffD1, OF Pfe_def assms(2),rule_format], (rule conjI; (rule conjI)?))
   show "address e' = ad"
   proof -
     have "address e' = address e\<^sub>l" using decl_env[OF assms(12)] by simp
     also have "address e\<^sub>l = address (ffold (init members) (emptyEnv ad cname (address ev) gv') (fmdom members))" using msel_ssel_expr_load_rexp_gas(4)[OF assms(9)] by simp
     also have "\<dots> = ad" unfolding emptyEnv_def using ffold_init_ad_same by simp
     finally show ?thesis .
   qed
 next
   show "\<forall>adv g. expr SENDER e' cd' (st'\<lparr>gas := gas st' - costs Reentrancy.transfer e' cd' st'\<rparr>) (gas st' - costs Reentrancy.transfer e' cd' st') = Normal ((KValue adv, Value TAddr), g)
     \<longrightarrow> adv \<noteq> ad"
   proof (intros)
     fix adv g
     assume "expr SENDER e' cd' (st'\<lparr>gas := gas st' - costs Reentrancy.transfer e' cd' st'\<rparr>) (gas st' - costs Reentrancy.transfer e' cd' st') = Normal ((KValue adv, Value TAddr), g)"
     moreover have "sender e' \<noteq> ad"
     proof -
       have "sender e' = sender e\<^sub>l" using decl_env[OF assms(12)] by simp
       also have "sender e\<^sub>l = sender (ffold (init members) (emptyEnv ad cname (address ev) gv') (fmdom members))" using msel_ssel_expr_load_rexp_gas(4)[OF assms(9)] by simp
       also have "\<dots> = address ev" unfolding emptyEnv_def using ffold_init_ad_same by simp
       finally show ?thesis using assms(3) by simp
     qed
     ultimately show "adv \<noteq> ad" by (simp add:expr.simps split:result.split_asm if_split_asm prod.split_asm)
   qed
 next
   show "\<forall>adv g v t g' v'.
        local.expr SENDER e' cd' (st'\<lparr>gas := gas st' - costs Reentrancy.transfer e' cd' st'\<rparr>)
         (gas st' - costs Reentrancy.transfer e' cd' st') = Normal ((KValue adv, Value TAddr), g) \<and>
        adv \<noteq> ad \<and>
        local.expr (LVAL (L.Id STR ''bal'')) e' cd' (st'\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g') \<and>
        Valuetypes.convert t (TUInt 256) v = Some v' \<longrightarrow>
        iv (storage st' ad) (\<lceil>bal (accounts st' ad)\<rceil> - ReadL\<^sub>i\<^sub>n\<^sub>t v')"
   proof elims
      fix adv lg lv lt lg' lv'
   assume a1:"expr SENDER e' cd' (st'\<lparr>gas := gas st' - costs Reentrancy.transfer e' cd' st'\<rparr>) (gas st' - costs Reentrancy.transfer e' cd' st') =
           Normal ((KValue adv, Value TAddr), lg)"
      and adv_def: "adv \<noteq> ad"
      and bal: "expr (LVAL (L.Id STR ''bal'')) e' cd' (st'\<lparr>gas := lg\<rparr>) lg = Normal ((KValue lv, Value lt), lg')"
      and con: "Valuetypes.convert lt (TUInt 256) lv = Some lv'"
     show "iv (storage st' ad) (\<lceil>bal (accounts st' ad)\<rceil> - ReadL\<^sub>i\<^sub>n\<^sub>t lv')"
      using adapt_withdraw[where ?acc=acc, OF assms(11) load_empty_par[OF assms(9)] assms(12,16,13,14,15,10) _ adv_def _] a1 bal con unfolding st'_def by simp
   qed
 qed
 
 lemma wp_withdraw[external]:
   assumes "\<And>st'. gas st' \<le> gas st \<and> type (accounts st' ad) = Some (Contract cname) \<Longrightarrow> Pe ad iv st' \<and> Pi ad (\<lambda>_ _. True) (\<lambda>_ _. True) st' \<and> Pfi ad (\<lambda>_. True) (\<lambda>_. True) st' \<and> Pfe ad iv st'"
       and "address ev \<noteq> ad"
       and "g'' \<le> gas st"
       and "type (acc ad) = Some (Contract cname)"
       and "expr adex ev cd (st0\<lparr>gas := gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0\<rparr>)
            (gas st0 - costs (EXTERNAL adex mid xe val) ev cd st0) = Normal ((KValue ad, Value TAddr), g)"
       and "expr val ev cd (st0\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "Valuetypes.convert t (TUInt 256) v = Some v'"
       and "load True [] xe (ffold (init members) (emptyEnv ad cname (address ev) v') (fmdom members))
            emptyStore emptyStore emptyStore ev cd (st0\<lparr>gas := g'\<rparr>) g' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')"
       and "Accounts.transfer (address ev) ad v' (accounts st0) = Some acc"
       and "iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v')"
     shows "wpS (stmt keep e\<^sub>l cd\<^sub>l)
            (\<lambda>st. iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st ad)))) (\<lambda>e. e = Gas \<or> e = Err)
            (st0\<lparr>gas := g'', accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)"
   apply vcg_block_some
   apply vcg_comp
   apply (vcg_assign expr_rule: expr_0[OF assms(8)] lexp_rule: lexp_myrexp_decl[OF assms(8)])
   apply (rule wptransfer[OF _ assms(2-10)])
   apply (rule_tac assms(1)[THEN conjunct2,THEN conjunct2,THEN conjunct2])
     using assms(3,4) by simp
 
 lemma wp_fallback:
   assumes "Accounts.transfer (address ev) ad v (accounts st0) = Some acca"
       and "iv (storage st0 ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acca ad)) - ReadL\<^sub>i\<^sub>n\<^sub>t v)"
     shows "wpS (stmt SKIP (ffold (init members) (emptyEnv ad cname (address ev) vc) (fmdom members)) emptyStore)
           (\<lambda>st. iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st ad)))) (\<lambda>e. e = Gas \<or> e = Err)
           (st0\<lparr>gas := g'c, accounts := acca, stack := emptyStore, memory := emptyStore\<rparr>)"
   apply vcg_skip
   using weaken[where ?acc=acca, OF assms(2) transfer_val1[OF assms(1)]] by auto
 
 lemma wp_construct:
   assumes "Accounts.transfer (address ev) (hash (address ev) \<lfloor>contracts (accounts st (address ev))\<rfloor>) v
         ((accounts st) (hash (address ev) \<lfloor>contracts (accounts st (address ev))\<rfloor> := \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = Some (Contract i), contracts = 0\<rparr>)) =
        Some acc"
     shows "iv fmempty \<lceil>bal (acc (hash (address ev) \<lfloor>contracts (accounts st (address ev))\<rfloor>))\<rceil>"
 proof -
   define adv where "adv = (hash (address ev) \<lfloor>contracts (accounts st (address ev))\<rfloor>)"
   moreover have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (((accounts st) (adv := \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = Some (Contract i), contracts = 0\<rparr>)) adv)) = 0" using Read_ShowL_id[of 0] by simp
   ultimately have "ReadL\<^sub>i\<^sub>n\<^sub>t (bal (acc (hash (address ev) \<lfloor>contracts (accounts st (address ev))\<rfloor>))) \<ge> 0" using transfer_mono[OF assms(1)] by simp
   then show ?thesis unfolding iv_def by simp
 qed
 
 lemma wp_true[external]:
   assumes "E Gas"
       and "E Err"
   shows "wpS (stmt f e cd) (\<lambda>st. True) E st"
   unfolding wpS_def wp_def
 proof ((split result.split, (split prod.split)?); rule conjI; (rule allI)+; (rule impI)+)
   fix x1 x1a s
   assume "x1 = (x1a, s)" and "stmt f e cd st = Normal x1"
   then show "gas s \<le> gas st \<and> True" using stmt_gas by simp
 next
   fix x2
   assume "stmt f e cd st = Exception x2"
   show "E x2" using assms Ex.nchotomy by metis
 qed
 
 subsubsection\<open>Final results\<close>
 
 interpretation vcg:VCG costs\<^sub>e ep costs cname members const fb "\<lambda>_. True" "\<lambda>_. True" "\<lambda>_ _. True" "\<lambda>_ _. True"
 by (simp add: VCG.intro Calculus_axioms)
 
 lemma safe_external: "Qe ad iv (st::State)"
   apply (external cases: cases_ext)
   apply (rule wp_deposit;assumption)
   apply vcg_block_some
   apply vcg_comp
   apply (vcg_assign expr_rule: expr_0 lexp_rule: lexp_myrexp_decl)
   apply (vcg.vcg_transfer_ext ad fallback_int: wp_true fallback_ext: wp_fallback cases_ext:cases_ext cases_int:cases_fb cases_fb:cases_int invariant:adapt_withdraw)
   done
 
 lemma safe_fallback: "Qfe ad iv st"
   apply (fallback cases: cases_fb)
   apply (rule wp_fallback; assumption)
   done
 
 lemma safe_constructor: "constructor iv"
   apply (constructor cases: cases_cons)
   apply vcg_skip
   apply (simp add:wp_construct)
   done
 
 theorem safe:
   assumes "\<forall>ad. address ev \<noteq> ad \<and> type (accounts st ad) = Some (Contract cname) \<longrightarrow> iv (storage st ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st ad)))"
     shows "\<forall>(st'::State) ad. stmt f ev cd st = Normal ((), st') \<and> type (accounts st' ad) = Some (Contract cname) \<and> address ev \<noteq> ad
             \<longrightarrow> iv (storage st' ad) (ReadL\<^sub>i\<^sub>n\<^sub>t (bal (accounts st' ad)))"
   apply (rule invariant) using assms safe_external safe_fallback safe_constructor by auto
 
 end
 
 end
diff --git a/thys/Solidity/Solidity_Evaluator.thy b/thys/Solidity/Solidity_Evaluator.thy
--- a/thys/Solidity/Solidity_Evaluator.thy
+++ b/thys/Solidity/Solidity_Evaluator.thy
@@ -1,694 +1,708 @@
 section\<open> Solidty Evaluator and Code Generator Setup\<close>
 
 theory
   Solidity_Evaluator
 imports
   Solidity_Main
   "HOL-Library.Code_Target_Numeral"
   "HOL-Library.Sublist"
   "HOL-Library.Finite_Map"
 begin
 
 paragraph\<open>Generalized Unit Tests\<close>
 
 lemma  "createSInt 8 500 = STR ''-12''"
   by(eval)
 
 lemma "STR ''-92134039538802366542421159375273829975'' 
       = createSInt 128 45648483135649456465465452123894894554654654654654646999465"
   by(eval)
 
 lemma "STR ''-128'' = createSInt 8 (-128)"
   by(eval)
 
 lemma "STR ''244'' = (createUInt 8 500)"
   by(eval)
 
 lemma "STR ''220443428915524155977936330922349307608'' 
       = (createUInt 128 4564848313564945646546545212389489455465465465465464699946544654654654654168)"
   by(eval)
 
 lemma "less (TUInt 144) (TSInt 160) (STR ''5'') (STR ''8'') = Some(STR ''True'', TBool) "
   by(eval)
 
 subsection\<open>Code Generator Setup and Local Tests\<close>
 
 subsubsection\<open>Utils\<close>
 
 definition EMPTY::"String.literal" where "EMPTY = STR ''''"
 
 definition FAILURE::"String.literal" where "FAILURE = STR ''Failure''"
 
 fun intersperse :: "String.literal \<Rightarrow> String.literal list \<Rightarrow> String.literal" where
   "intersperse s [] = EMPTY"
 | "intersperse s [x] = x"
 | "intersperse s (x # xs) = x + s + intersperse s xs"
 
 definition splitAt::"nat \<Rightarrow> String.literal \<Rightarrow> String.literal \<times> String.literal" where
 "splitAt n xs = (String.implode(take n (String.explode xs)), String.implode(drop n (String.explode xs)))"
 
 fun splitOn':: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list \<Rightarrow> 'a list list" where  
    "splitOn' x [] acc = [rev acc]"
  | "splitOn' x (y#ys) acc = (if x = y then (rev acc)#(splitOn' x ys [])
                                       else splitOn' x ys (y#acc))"
 
 fun splitOn::"'a  \<Rightarrow> 'a list \<Rightarrow> 'a list list" where
 "splitOn x xs = splitOn' x xs []"
 
 definition isSuffixOf::"String.literal \<Rightarrow> String.literal \<Rightarrow> bool" where
 "isSuffixOf s x = suffix (String.explode s) (String.explode x)"
 
 definition tolist :: "Location \<Rightarrow> String.literal list" where 
 "tolist s = map String.implode (splitOn (CHR ''.'') (String.explode s))"
 
 abbreviation convert :: "Location \<Rightarrow> Location"
   where "convert loc \<equiv> (if loc= STR ''True'' then STR ''true'' else
     if loc=STR ''False'' then STR ''false'' else loc)"
 
 definition \<open>sorted_list_of_set' \<equiv> map_fun id id (folding_on.F insort [])\<close>
 
 lemma sorted_list_of_fset'_def': \<open>sorted_list_of_set' = sorted_list_of_set\<close>
   apply(rule ext)
   by (simp add: sorted_list_of_set'_def sorted_list_of_set_def sorted_key_list_of_set_def)
 
 lemma sorted_list_of_set_sort_remdups' [code]:
   \<open>sorted_list_of_set' (set xs) = sort (remdups xs)\<close>
   using sorted_list_of_fset'_def' sorted_list_of_set_sort_remdups                      
   by metis
 
 definition  locations_map :: "Location \<Rightarrow> (Location, 'v) fmap \<Rightarrow> Location list" where
 "locations_map loc = (filter (isSuffixOf ((STR ''.'')+loc))) \<circ>  sorted_list_of_set' \<circ> fset \<circ> fmdom"
 
 definition  locations :: "Location \<Rightarrow> 'v Store \<Rightarrow> Location list" where
 "locations loc = locations_map loc \<circ> mapping"
 
 subsubsection\<open>Valuetypes\<close>
 
 fun dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s::"Types \<Rightarrow> Valuetype \<Rightarrow> String.literal" where
    "dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s (TSInt _) n = n"
  | "dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s (TUInt _) n = n"
  | "dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s TBool b = (if b = (STR ''True'') then  STR ''true'' else STR ''false'')"
  | "dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s TAddr ad = ad"
 
 subsubsection\<open>Memory\<close>
 
 datatype Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y = MArray "Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y list"
                    | MBool bool
                    | MInt int
                    | MAddress Address
 
 fun loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y :: "Location \<Rightarrow> Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y \<Rightarrow> MemoryT \<Rightarrow> MemoryT" and
         iterateM :: "Location \<Rightarrow> MemoryT \<times> nat \<Rightarrow> Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y \<Rightarrow> MemoryT \<times> nat" where
   "loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc (MArray dat) mem = fst (foldl (iterateM loc) (updateStore loc (MPointer loc) mem,0) dat)"
 | "loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc (MBool b) mem = updateStore loc ((MValue \<circ> ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l) b) mem "
 | "loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc (MInt i) mem = updateStore loc ((MValue \<circ> ShowL\<^sub>i\<^sub>n\<^sub>t) i) mem "
 | "loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc (MAddress ad) mem = updateStore loc (MValue ad) mem"
 | "iterateM loc (mem,x) d = (loadRec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y (hash loc (ShowL\<^sub>n\<^sub>a\<^sub>t x)) d mem, Suc x)"
 
 definition load\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y :: "Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y list \<Rightarrow> MemoryT \<Rightarrow> MemoryT" where
 "load\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y dat mem = (let loc   = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc mem);
                          (m, _) = foldl (iterateM loc) (mem, 0) dat
                        in (snd \<circ> allocate) m)"
                           
 fun dumprec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y:: "Location \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> String.literal \<Rightarrow> String.literal \<Rightarrow> String.literal" where
 "dumprec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc tp mem ls str =
   (case accessStore loc mem of
     Some (MPointer l) \<Rightarrow>
       (case tp of
         (MTArray x t) \<Rightarrow> iter (\<lambda>i str' . dumprec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y ((hash l o ShowL\<^sub>i\<^sub>n\<^sub>t) i) t mem 
                               (ls + (STR ''['') + (ShowL\<^sub>i\<^sub>n\<^sub>t i) + (STR '']'')) str') str x
                   | _ \<Rightarrow> FAILURE)
   | Some (MValue v) \<Rightarrow>
       (case tp of
         MTValue t \<Rightarrow> str + ls + (STR ''=='') + dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s t v + (STR ''\<newline>'')
               | _ \<Rightarrow> FAILURE)
   | None \<Rightarrow> FAILURE)"
 
 definition dump\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y :: "Location \<Rightarrow> int \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> String.literal \<Rightarrow>String.literal \<Rightarrow>String.literal" where
 "dump\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y loc x t mem ls str = iter (\<lambda>i. dumprec\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y ((hash loc (ShowL\<^sub>i\<^sub>n\<^sub>t i))) t mem (ls + STR ''['' + (ShowL\<^sub>i\<^sub>n\<^sub>t i + STR '']''))) str x"
 
 subsubsection\<open>Storage\<close>
 
 datatype Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e =
     SArray "Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e list"
   | SMap "(String.literal \<times> Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e) list"
   | SBool bool
   | SInt int
   | SAddress Address
 
 fun go\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e :: "Location \<Rightarrow> (String.literal \<times>  STypes) \<Rightarrow> (String.literal \<times> STypes)" where
   "go\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e l (s, STArray _ t) = (s + (STR ''['') + (convert l) + (STR '']''), t)"
 | "go\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e l (s, STMap _ t) = (s + (STR ''['') + (convert l) + (STR '']''), t)"
 | "go\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e l (s, STValue t) = (s + (STR ''['') + (convert l) + (STR '']''), STValue t)"
 
 fun dumpSingle\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e :: "StorageT \<Rightarrow> String.literal \<Rightarrow> STypes \<Rightarrow> (Location \<times> Location) \<Rightarrow> String.literal \<Rightarrow> String.literal" where
 "dumpSingle\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e sto id' tp (loc,l) str =
     (case foldr go\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e (tolist loc) (str + id', tp) of
       (s, STValue t) \<Rightarrow>
         (case sto $$ (loc + l) of
            Some v \<Rightarrow> s + (STR ''=='') + dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s t v
          | None \<Rightarrow> FAILURE)
      | _ \<Rightarrow> FAILURE)"
 
 definition iterate where
 "iterate loc t id' sto s l = dumpSingle\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e sto id' t (splitAt (length (String.explode l) - length (String.explode loc) - 1) l) s + (STR ''\<newline>'')"
 
 fun dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e ::  "StorageT \<Rightarrow> Location \<Rightarrow> String.literal \<Rightarrow> STypes \<Rightarrow> String.literal \<Rightarrow> String.literal" where
   "dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e sto loc id' (STArray _ t) str = foldl (iterate loc t id' sto) str (locations_map loc sto)"
 | "dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e sto loc id' (STMap _ t) str = foldl (iterate loc t id' sto) str (locations_map loc sto)"
 | "dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e sto loc id' (STValue t) str =
     (case sto $$ loc of
       Some v \<Rightarrow> str + id' + (STR ''=='') + dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s t v + (STR ''\<newline>'')
     | _ \<Rightarrow> str)"
 
 fun loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e :: "Location \<Rightarrow> Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e \<Rightarrow> StorageT \<Rightarrow> StorageT" and
     iterateSA :: "Location \<Rightarrow> StorageT \<times> nat \<Rightarrow> Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e \<Rightarrow> StorageT \<times> nat" and
     iterateSM :: "Location \<Rightarrow> String.literal \<times> Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e \<Rightarrow> StorageT \<Rightarrow> StorageT" where
   "loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e loc (SArray dat) sto = fst (foldl (iterateSA loc) (sto,0) dat)"
 | "loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e loc (SMap dat) sto  = foldr (iterateSM loc) dat sto"
 | "loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e loc (SBool b) sto = fmupd loc (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l b) sto"
 | "loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e loc (SInt i)  sto = fmupd loc (ShowL\<^sub>i\<^sub>n\<^sub>t i) sto"
 | "loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e loc (SAddress ad) sto = fmupd loc ad sto"
 | "iterateSA loc (s', x) d = (loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e (hash loc (ShowL\<^sub>n\<^sub>a\<^sub>t x)) d s', Suc x)"
 | "iterateSM loc (k, v) s' = loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e (hash loc k) v s'"
 
 subsubsection\<open>Environment\<close>
 
 datatype Data\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t =
     Memarr "Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y list" |
     CDarr "Data\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y list" |
     Stoarr "Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e list"|
     Stomap "(String.literal \<times> Data\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e) list" |
     Stackbool bool |
     Stobool bool |
     Stackint int |
     Stoint int |
     Stackaddr Address |
     Stoaddr Address
 
 fun astore :: "Identifier \<Rightarrow> Type \<Rightarrow> Valuetype \<Rightarrow> StorageT * Environment \<Rightarrow> StorageT * Environment"
   where "astore i t v (s, e) = (fmupd i v s, (updateEnv i t (Storeloc i) e))"
 
 fun loadsimple\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(Stack \<times> CalldataT \<times> MemoryT \<times> StorageT \<times> Environment) 
                     \<Rightarrow> (Identifier \<times> Type \<times> Data\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t) \<Rightarrow> (Stack \<times> CalldataT \<times> MemoryT \<times> StorageT \<times> Environment)"
   where
 "loadsimple\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t (k, c, m, s, e) (id', tp, d) = (case d of
     Stackbool b \<Rightarrow>
         let (k', e') = astack id' tp (KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l b)) (k, e)
         in (k', c, m, s, e')
   | Stobool b \<Rightarrow>
         let (s', e') = astore id' tp (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l b) (s, e)
         in (k, c, m, s', e')
   |  Stackint n \<Rightarrow>
         let (k', e') = astack id' tp (KValue (ShowL\<^sub>i\<^sub>n\<^sub>t n)) (k, e)
         in (k', c, m, s, e')
   |  Stoint n \<Rightarrow>
         let (s', e') = astore id' tp (ShowL\<^sub>i\<^sub>n\<^sub>t n) (s, e)
         in (k, c, m, s', e')
   |  Stackaddr ad \<Rightarrow>
         let (k', e') = astack id' tp (KValue ad) (k, e)
         in (k', c, m, s, e')
   |  Stoaddr ad \<Rightarrow>
         let (s', e') = astore id' tp ad (s, e)
         in (k, c, m, s', e')
   |  CDarr a \<Rightarrow>
         let l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc c);
             c' = load\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y a c;
             (k', e') = astack id' tp (KCDptr l) (k, e)
         in (k', c', m, s, e')
   |  Memarr a \<Rightarrow>
         let l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc m);
             m' = load\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y a m;
             (k', e') = astack id' tp (KMemptr l) (k, e)
         in (k', c, m', s, e')
   |  Stoarr a \<Rightarrow>
         let s' = loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e id' (SArray a) s;
             e' = updateEnv id' tp (Storeloc id') e
         in (k, c, m, s', e')
   |  Stomap mp \<Rightarrow>
         let s' = loadRec\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e id' (SMap mp) s;
             e' = updateEnv id' tp (Storeloc id') e
         in (k, c, m, s', e')
 )"
 
 definition getValue\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "Stack \<Rightarrow> CalldataT \<Rightarrow> MemoryT \<Rightarrow> StorageT \<Rightarrow> Environment \<Rightarrow> Identifier \<Rightarrow> String.literal \<Rightarrow> String.literal"
   where 
 "getValue\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t k c m s e i txt = (case fmlookup (denvalue e) i of
     Some (tp, Stackloc l) \<Rightarrow> (case accessStore l k of
         Some (KValue v) \<Rightarrow> (case tp of
             Value t \<Rightarrow> (txt + i + (STR ''=='') + dump\<^sub>V\<^sub>a\<^sub>l\<^sub>u\<^sub>e\<^sub>t\<^sub>y\<^sub>p\<^sub>e\<^sub>s t v + (STR ''\<newline>''))
           |  _ \<Rightarrow> FAILURE)
       | Some (KCDptr p) \<Rightarrow> (case tp of
             Calldata (MTArray x t) \<Rightarrow> dump\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y p x t c i txt
             | _ \<Rightarrow> FAILURE)
       | Some (KMemptr p) \<Rightarrow> (case tp of
             Memory (MTArray x t) \<Rightarrow> dump\<^sub>M\<^sub>e\<^sub>m\<^sub>o\<^sub>r\<^sub>y p x t m i txt
             | _ \<Rightarrow> FAILURE)
       | Some (KStoptr p) \<Rightarrow> (case tp of
             Storage t \<Rightarrow> dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e s p i t txt
             | _ \<Rightarrow> FAILURE))
    | Some (Storage t, Storeloc l) \<Rightarrow> dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e s l i t txt
    | _ \<Rightarrow> FAILURE
 )"
 
 definition dump\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "Stack  \<Rightarrow> CalldataT \<Rightarrow> MemoryT \<Rightarrow> StorageT \<Rightarrow> Environment \<Rightarrow> Identifier list \<Rightarrow> String.literal" 
   where "dump\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t k c m s e sl = foldr (getValue\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t k c m s e) sl EMPTY"
 
 subsubsection\<open>Accounts\<close>
 
 fun load\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s :: "Accounts \<Rightarrow> (Address \<times> Balance \<times> atype \<times> nat) list \<Rightarrow> Accounts" where 
    "load\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s acc []             = acc"
  | "load\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s acc ((ad, b, t, c)#as) = load\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s (acc (ad:=\<lparr>bal=b, type=Some t, contracts=c\<rparr>)) as"
 
 fun dumpStorage::"StorageT \<Rightarrow> (Identifier \<times> Member) \<Rightarrow> String.literal" where
   "dumpStorage s (i, Var x) = dump\<^sub>S\<^sub>t\<^sub>o\<^sub>r\<^sub>a\<^sub>g\<^sub>e s i i x EMPTY"
 | "dumpStorage s (i, Function x) = FAILURE"
 | "dumpStorage s (i, Method x) = FAILURE"
 
 fun dumpMembers :: "atype option \<Rightarrow> Environment\<^sub>P \<Rightarrow> StorageT \<Rightarrow> String.literal" where
   "dumpMembers None ep s = FAILURE"
 | "dumpMembers (Some EOA) _ _ = STR ''EOA''"
 | "dumpMembers (Some (Contract name)) ep s =
     (case ep $$ name of
       Some (ct, _) \<Rightarrow> name + STR ''('' + (intersperse (STR '','') (map (dumpStorage s) (filter (is_Var \<circ> snd) (sorted_list_of_fmap ct)))) + STR '')''
     | None \<Rightarrow> FAILURE)"
 
 (*
   The first parameter is just to guarantee termination
 *)
 fun dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t :: "nat \<Rightarrow> Environment\<^sub>P \<Rightarrow> State \<Rightarrow> Address \<Rightarrow> String.literal"
   where "dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t 0 _ _ _ = FAILURE"
   | "dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t (Suc c) ep st a = a + STR '': '' +
         STR ''balance=='' + bal (accounts st a) +
         STR '' - '' + dumpMembers (type (accounts st a)) ep (storage st a) +
         iter (\<lambda>x s. s + STR ''\<newline>'' + dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t c ep st (hash a (ShowL\<^sub>i\<^sub>n\<^sub>t x))) EMPTY (int (contracts (accounts st a)))"
 
 definition dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s :: "Environment\<^sub>P \<Rightarrow> State \<Rightarrow> Address list \<Rightarrow> String.literal"
   where "dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s ep st al = intersperse (STR ''\<newline>'') (map (dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t 1000 ep st) al)"
 
 definition init\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t::"(Address \<times> Balance \<times> atype \<times> nat) list => Accounts" where 
   "init\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t = load\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s emptyAccount"
 
 type_synonym Data\<^sub>P = "(Identifier \<times> Member) list \<times> ((Identifier \<times> Type) list \<times> S) \<times> S"
 
 fun loadProc::"Identifier \<Rightarrow> Data\<^sub>P \<Rightarrow> Environment\<^sub>P \<Rightarrow> Environment\<^sub>P"
   where "loadProc i (xs, fb) = fmupd i (fmap_of_list xs, fb)"
 
 subsection\<open>Test Setup\<close>
 
 definition(in statement_with_gas) eval::"Gas \<Rightarrow> S \<Rightarrow> Address \<Rightarrow> Identifier \<Rightarrow> Address \<Rightarrow> Valuetype \<Rightarrow> (Address \<times> Balance \<times> atype \<times> nat) list 
                  \<Rightarrow> (String.literal \<times> Type \<times> Data\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t) list
           \<Rightarrow> String.literal"
   where "eval g stm addr name adest aval acc dat
         = (let (k,c,m,s,e) = foldl loadsimple\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t (emptyStore, emptyStore, emptyStore, fmempty, emptyEnv addr name adest aval) dat;
                a         = init\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t acc;
                s'        = emptyStorage (addr := s);
                z         = \<lparr>accounts=a,stack=k,memory=m,storage=s',gas=g\<rparr> 
            in (
              case (stmt stm e c z) of
               Normal ((), z') \<Rightarrow> (dump\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t (stack z') c (memory z') (storage z' addr) e (map (\<lambda> (a,b,c). a) dat))
                              + (dump\<^sub>A\<^sub>c\<^sub>c\<^sub>o\<^sub>u\<^sub>n\<^sub>t\<^sub>s ep z' (map fst acc))
              | Exception Err   \<Rightarrow> STR ''Exception''
              | Exception Gas   \<Rightarrow> STR ''OutOfGas''))"
 
 global_interpretation soliditytest0: statement_with_gas costs_ex "fmap_of_list []" costs_min
   defines stmt0 = "soliditytest0.stmt"
       and lexp0 = soliditytest0.lexp 
       and expr0 = soliditytest0.expr
       and ssel0 = soliditytest0.ssel
       and rexp0 = soliditytest0.rexp
       and msel0 = soliditytest0.msel
       and load0 = soliditytest0.load
       and eval0 = soliditytest0.eval
   by unfold_locales auto
 
 lemma "eval0 1000
             SKIP 
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''115f6e2F70210C14f7DB1AC69737a3CC78435d49'', STR ''100'', EOA, 0)] 
             [(STR ''v1'', (Value TBool, Stackbool True))]
      = STR ''v1==true\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA\<newline>115f6e2F70210C14f7DB1AC69737a3CC78435d49: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             SKIP 
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''115f6e2F70210C14f7DB1AC69737a3CC78435d49'', STR ''100'', EOA, 0)] 
             [(STR ''v1'',(Memory (MTArray 5 (MTValue TBool)), Memarr [MBool True, MBool False, MBool True, MBool False, MBool True]))]
        = STR ''v1[0]==true\<newline>v1[1]==false\<newline>v1[2]==true\<newline>v1[3]==false\<newline>v1[4]==true\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA\<newline>115f6e2F70210C14f7DB1AC69737a3CC78435d49: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             (ITE FALSE (ASSIGN (Id (STR ''x'')) TRUE) (ASSIGN (Id (STR ''y'')) TRUE)) 
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''115f6e2F70210C14f7DB1AC69737a3CC78435d49'', STR ''100'', EOA, 0)] 
             [(STR ''x'', (Value TBool, Stackbool False)), (STR ''y'', (Value TBool, Stackbool False))]
        = STR ''y==true\<newline>x==false\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA\<newline>115f6e2F70210C14f7DB1AC69737a3CC78435d49: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             (BLOCK ((STR ''v2'', Value TBool), None) (ASSIGN (Id (STR ''v1'')) (LVAL (Id (STR ''v2'')))))
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''115f6e2F70210C14f7DB1AC69737a3CC78435d49'', STR ''100'', EOA, 0)]
             [(STR ''v1'', (Value TBool, Stackbool True))]
         = STR ''v1==false\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA\<newline>115f6e2F70210C14f7DB1AC69737a3CC78435d49: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             (ASSIGN (Id (STR ''a_s120_21_m8'')) (LVAL (Id (STR ''a_s120_21_s8''))))
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0)]
             [((STR ''a_s120_21_s8''), Storage (STArray 1 (STArray 2 (STValue (TSInt 120)))), Stoarr [SArray [SInt 347104507864064359095275590289383142, SInt 565831699297331399489670920129618233]]),
              ((STR ''a_s120_21_m8''), Memory (MTArray 1 (MTArray 2 (MTValue (TSInt 120)))), Memarr [MArray [MInt (290845675805142398428016622247257774), MInt ((-96834026877269277170645294669272226))]])]
   = STR ''a_s120_21_m8[0][0]==347104507864064359095275590289383142\<newline>a_s120_21_m8[0][1]==565831699297331399489670920129618233\<newline>a_s120_21_s8[0][0]==347104507864064359095275590289383142\<newline>a_s120_21_s8[0][1]==565831699297331399489670920129618233\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             (ASSIGN (Ref (STR ''a_s8_32_m0'') [UINT 8 1]) (LVAL (Ref (STR ''a_s8_31_s7'') [UINT 8 0]))) 
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0)]
             [(STR ''a_s8_31_s7'', (Storage (STArray 1 (STArray 3 (STValue (TSInt 8)))), Stoarr [SArray [SInt ((98)), SInt ((-23)), SInt (36)]])),
              (STR ''a_s8_32_m0'', (Memory (MTArray 2 (MTArray 3 (MTValue (TSInt 8)))), Memarr [MArray [MInt ((-64)), MInt ((39)), MInt ((-125))], MArray [MInt ((-32)), MInt ((-82)), MInt ((-105))]]))]
        = STR ''a_s8_32_m0[0][0]==-64\<newline>a_s8_32_m0[0][1]==39\<newline>a_s8_32_m0[0][2]==-125\<newline>a_s8_32_m0[1][0]==98\<newline>a_s8_32_m0[1][1]==-23\<newline>a_s8_32_m0[1][2]==36\<newline>a_s8_31_s7[0][0]==98\<newline>a_s8_31_s7[0][1]==-23\<newline>a_s8_31_s7[0][2]==36\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA''"
   by(eval)
 
 lemma "eval0 1000
             SKIP
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''115f6e2F70210C14f7DB1AC69737a3CC78435d49'', STR ''100'', EOA, 0)]
             [(STR ''v1'', (Storage (STMap (TUInt 32) (STValue (TUInt 8))), Stomap [(STR ''2129136830'', SInt (247))]))]
        = STR ''v1[2129136830]==247\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==100 - EOA\<newline>115f6e2F70210C14f7DB1AC69737a3CC78435d49: balance==100 - EOA''"
   by(eval)
 
 definition "testenv1 \<equiv> loadProc (STR ''mycontract'')
               ([(STR ''v1'', Var (STValue TBool)),
                 (STR ''m1'', Method ([], True, (ASSIGN (Id (STR ''v1'')) FALSE)))],
                 ([], SKIP),
                 SKIP)
             fmempty"
 
 global_interpretation soliditytest1: statement_with_gas costs_ex testenv1 costs_min
   defines stmt1 = "soliditytest1.stmt"
       and lexp1 = soliditytest1.lexp 
       and expr1 = soliditytest1.expr
       and ssel1 = soliditytest1.ssel
       and rexp1 = soliditytest1.rexp
       and msel1 = soliditytest1.msel
       and load1 = soliditytest1.load
       and eval1 = soliditytest1.eval
   by unfold_locales auto
 
 lemma "eval1 1000
             (EXTERNAL (ADDRESS (STR ''myaddr'')) (STR ''m1'') [] (UINT 256 0))
             (STR ''local'')
             EMPTY
             (STR ''mycontract'')
             (STR ''0'')
             [(STR ''local'', STR ''100'', EOA, 0), (STR ''myaddr'', STR ''100'', Contract (STR ''mycontract''), 0)]
             []
         = STR ''local: balance==100 - EOA\<newline>myaddr: balance==100 - mycontract(v1==false\<newline>)''"
   by (eval)
 
 lemma "eval1 1000
             (NEW (STR ''mycontract'') [] (UINT 256 10))
             (STR ''local'')
             EMPTY
             (STR ''mycontract'')
             (STR ''0'')
             [(STR ''local'', STR ''100'', EOA, 0), (STR ''myaddr'', STR ''100'', Contract (STR ''mycontract''), 0)]
             []
         = STR ''local: balance==90 - EOA\<newline>0.local: balance==10 - mycontract()\<newline>myaddr: balance==100 - mycontract()''"
   by eval
 
 lemma "eval1 1000
             (
               COMP
                 (NEW (STR ''mycontract'') [] (UINT 256 10))
                 (EXTERNAL CONTRACTS (STR ''m1'') [] (UINT 256 0))
             )
             (STR ''local'')
             EMPTY
             (STR ''mycontract'')
             (STR ''0'')
             [(STR ''local'', STR ''100'', EOA, 0), (STR ''myaddr'', STR ''100'', Contract (STR ''mycontract''), 0)]
             []
         = STR ''local: balance==90 - EOA\<newline>0.local: balance==10 - mycontract(v1==false\<newline>)\<newline>myaddr: balance==100 - mycontract()''"
   by eval
 
 definition "testenv2 \<equiv> loadProc (STR ''mycontract'')
               ([(STR ''m1'', Function ([], False, UINT 8 5))],
               ([], SKIP),
               SKIP)
             fmempty"
 
 global_interpretation soliditytest2: statement_with_gas costs_ex testenv2 costs_min
   defines stmt2 = "soliditytest2.stmt"
       and lexp2 = soliditytest2.lexp 
       and expr2 = soliditytest2.expr
       and ssel2 = soliditytest2.ssel
       and rexp2 = soliditytest2.rexp
       and msel2 = soliditytest2.msel
       and load2 = soliditytest2.load
       and eval2 = soliditytest2.eval
   by unfold_locales auto
 
 lemma "eval2 1000
             (ASSIGN (Id (STR ''v1'')) (CALL (STR ''m1'') []))
             (STR ''myaddr'')
             (STR ''mycontract'')
             EMPTY
             (STR ''0'')
             [(STR ''myaddr'', STR ''100'', EOA, 0)]
             [(STR ''v1'', (Value (TUInt 8), Stackint 0))]
        = STR ''v1==5\<newline>myaddr: balance==100 - EOA''"
   by (eval)
 
 definition "testenv3 \<equiv> loadProc (STR ''mycontract'')
               ([(STR ''m1'',
                 Function ([(STR ''v2'', Value (TSInt 8)), (STR ''v3'', Value (TSInt 8))],
                 False,
                 PLUS (LVAL (Id (STR ''v2''))) (LVAL (Id (STR ''v3'')))))],
                 ([], SKIP),
               SKIP)
             fmempty"
 
 global_interpretation soliditytest3: statement_with_gas costs_ex testenv3 costs_min
   defines stmt3 = "soliditytest3.stmt"
       and lexp3 = soliditytest3.lexp 
       and expr3 = soliditytest3.expr
       and ssel3 = soliditytest3.ssel
       and rexp3 = soliditytest3.rexp
       and msel3 = soliditytest3.msel
       and load3 = soliditytest3.load
       and eval3 = soliditytest3.eval
   by unfold_locales auto
 
 lemma "eval3 1000
             (ASSIGN (Id (STR ''v1'')) (CALL (STR ''m1'') [E.INT 8 3, E.INT 8 4]))
             (STR ''myaddr'')
             (STR ''mycontract'')
             EMPTY
             (STR ''0'')
             [(STR ''myaddr'', STR ''100'', EOA, 0),(STR ''mya'', STR ''100'', EOA, 0)]
             [(STR ''v1'', (Value (TSInt 8), Stackint 0))]
        = STR ''v1==7\<newline>myaddr: balance==100 - EOA\<newline>mya: balance==100 - EOA''"
   by (eval)
 
 definition "testenv4 \<equiv> loadProc (STR ''mycontract'')
               ([(STR ''m1'', Function ([(STR ''v2'', Value (TSInt 8)), (STR ''v3'', Value (TSInt 8))], True, PLUS (LVAL (Id (STR ''v2''))) (LVAL (Id (STR ''v3'')))))],
                 ([], SKIP),
                 SKIP)
             fmempty"
 
 global_interpretation soliditytest4: statement_with_gas costs_ex testenv4 costs_min
   defines stmt4 = "soliditytest4.stmt"
       and lexp4 = soliditytest4.lexp 
       and expr4 = soliditytest4.expr
       and ssel4 = soliditytest4.ssel
       and rexp4 = soliditytest4.rexp
       and msel4 = soliditytest4.msel
       and load4 = soliditytest4.load
       and eval4 = soliditytest4.eval
   by unfold_locales auto
 
 lemma "eval4 1000
             (ASSIGN (Id (STR ''v1'')) (ECALL (ADDRESS (STR ''extaddr'')) (STR ''m1'') [E.INT 8 3, E.INT 8 4]))
             (STR ''myaddr'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''myaddr'', STR ''100'', EOA, 0), (STR ''extaddr'', STR ''100'', Contract (STR ''mycontract''), 0)]
             [(STR ''v1'', (Value (TSInt 8), Stackint 0))]
        = STR ''v1==7\<newline>myaddr: balance==100 - EOA\<newline>extaddr: balance==100 - mycontract()''"
   by (eval)
 
 definition "testenv5 \<equiv> loadProc (STR ''mycontract'')
               ([], ([], SKIP), SKIP)
             fmempty"
 
 global_interpretation soliditytest5: statement_with_gas costs_ex testenv5 costs_min
   defines stmt5 = "soliditytest5.stmt"
       and lexp5 = soliditytest5.lexp 
       and expr5 = soliditytest5.expr
       and ssel5 = soliditytest5.ssel
       and rexp5 = soliditytest5.rexp
       and msel5 = soliditytest5.msel
       and load5 = soliditytest5.load
       and eval5 = soliditytest5.eval
   by unfold_locales auto
 
 lemma "eval5 1000
             (TRANSFER (ADDRESS (STR ''myaddr'')) (UINT 256 10))
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'') 
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''myaddr'', STR ''100'', Contract (STR ''mycontract''), 0)] 
             []
        = STR ''089Be5381FcEa58aF334101414c04F993947C733: balance==90 - EOA\<newline>myaddr: balance==110 - mycontract()''"
   by (eval)
 
 definition "testenv6 \<equiv> loadProc (STR ''Receiver'')
               ([(STR ''hello'', Var (STValue TBool))],
               ([], SKIP),
               ASSIGN (Id (STR ''hello'')) TRUE)
             fmempty"
 
 global_interpretation soliditytest6: statement_with_gas costs_ex testenv6 costs_min
   defines stmt6 = "soliditytest6.stmt"
       and lexp6 = soliditytest6.lexp 
       and expr6 = soliditytest6.expr
       and ssel6 = soliditytest6.ssel
       and rexp6 = soliditytest6.rexp
       and msel6 = soliditytest6.msel
       and load6 = soliditytest6.load
       and eval6 = soliditytest6.eval
   by unfold_locales auto
 
 lemma "eval6 1000
           (TRANSFER (ADDRESS (STR ''ReceiverAd'')) (UINT 256 10))
           (STR ''SenderAd'')
           EMPTY
           EMPTY
           (STR ''0'')
           [(STR ''ReceiverAd'', STR ''100'', Contract (STR ''Receiver''), 0), (STR ''SenderAd'', STR ''100'', EOA, 0)]
           []
        = STR ''ReceiverAd: balance==110 - Receiver(hello==true\<newline>)\<newline>SenderAd: balance==90 - EOA''"
   by (eval)
 
 definition "testenv7 \<equiv> loadProc (STR ''mycontract'')
              ([], ([], SKIP), SKIP)
              fmempty"
 
 global_interpretation soliditytest7: statement_with_gas costs_ex testenv7 costs_min
   defines stmt7 = "soliditytest7.stmt"
       and lexp7 = soliditytest7.lexp 
       and expr7 = soliditytest7.expr
       and ssel7 = soliditytest7.ssel
       and rexp7 = soliditytest7.rexp
       and msel7 = soliditytest7.msel
       and load7 = soliditytest7.load
       and eval7 = soliditytest7.eval
   by unfold_locales auto
 
 lemma "eval7 1000
             (COMP(COMP(((ASSIGN (Id (STR ''x''))  (E.UINT 8 0))))(TRANSFER (ADDRESS (STR ''myaddr'')) (UINT 256 5)))(SKIP))
             (STR ''089Be5381FcEa58aF334101414c04F993947C733'')
             EMPTY
             EMPTY
             (STR ''0'')
             [(STR ''089Be5381FcEa58aF334101414c04F993947C733'', STR ''100'', EOA, 0), (STR ''myaddr'', STR ''100'', Contract (STR ''mycontract''),0)]
             [(STR ''x'', (Value (TUInt 8), Stackint 9))]
        = STR ''x==0\<newline>089Be5381FcEa58aF334101414c04F993947C733: balance==95 - EOA\<newline>myaddr: balance==105 - mycontract()''"
   by (eval)
 
 subsection\<open>The Final Code Export\<close>
 
 consts ReadL\<^sub>S   :: "String.literal \<Rightarrow> S"
 consts ReadL\<^sub>a\<^sub>c\<^sub>c :: "String.literal \<Rightarrow> (String.literal \<times> String.literal \<times> atype \<times> nat) list"
 consts ReadL\<^sub>d\<^sub>a\<^sub>t :: "String.literal \<Rightarrow> (String.literal \<times> Type \<times> Data\<^sub>E\<^sub>n\<^sub>v\<^sub>i\<^sub>r\<^sub>o\<^sub>n\<^sub>m\<^sub>e\<^sub>n\<^sub>t) list"
 consts ReadL\<^sub>P :: "String.literal \<Rightarrow> Data\<^sub>P list"
 
 code_printing 
    constant ReadL\<^sub>S  \<rightharpoonup> (Haskell) "Prelude.read"
  | constant ReadL\<^sub>a\<^sub>c\<^sub>c \<rightharpoonup> (Haskell) "Prelude.read"
  | constant ReadL\<^sub>d\<^sub>a\<^sub>t \<rightharpoonup> (Haskell) "Prelude.read"
  | constant ReadL\<^sub>P \<rightharpoonup> (Haskell) "Prelude.read"
 
 fun main_stub :: "String.literal list \<Rightarrow> (int \<times> String.literal)"
   where
    "main_stub [stm, saddr, name, raddr, val, acc, dat]
         = (0, eval0 1000 (ReadL\<^sub>S stm) saddr name raddr val (ReadL\<^sub>a\<^sub>c\<^sub>c acc) (ReadL\<^sub>d\<^sub>a\<^sub>t dat))"
  | "main_stub _ = (2, 
           STR ''solidity-evaluator [credit] \"Statement\" \"ContractAddress\" \"OriginAddress\" \"Value\"\<newline>''
         + STR ''  \"(Address * Balance) list\" \"(Address * ((Identifier * Member) list) * Statement)\" \"(Variable * Type * Value) list\"\<newline>''
         + STR ''\<newline>'')"
 
 generate_file "code/solidity-evaluator/app/Main.hs" = \<open>
 module Main where
 import System.Environment
 import Solidity_Evaluator
 import Prelude
 
 main :: IO ()
 main = do
   args <- getArgs
   Prelude.putStr(snd $ Solidity_Evaluator.main_stub args) 
 \<close>
 
 export_generated_files _
 
 export_code eval0 SKIP main_stub
             in Haskell module_name "Solidity_Evaluator" file_prefix "solidity-evaluator/src"  (string_classes)   
 
 subsection\<open>Demonstrating the Symbolic Execution of Solidity\<close>
 
+subsubsection\<open>Simple Examples  \<close> 
+lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 3] eempty emptyStore (mystate\<lparr>gas:=1\<rparr>) 1
+= Normal ((STR ''3.2'', MTArray 6 (MTValue TBool)), 1)"  by Solidity_Symbex.solidity_symbex
+
+lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 3, UINT 8 4] eempty emptyStore (mystate\<lparr>gas:=1,memory:=mymemory2\<rparr>) 1
+= Normal ((STR ''4.5'', MTValue TBool), 1)" by Solidity_Symbex.solidity_symbex
+
+lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 5] eempty emptyStore (mystate\<lparr>gas:=1,memory:=mymemory2\<rparr>) 1
+= Exception (Err)" by Solidity_Symbex.solidity_symbex
+
+subsubsection\<open>A More Complex Example Including Memory Copy\<close> 
+
 abbreviation P1::S
   where "P1 \<equiv> COMP (ASSIGN (Id (STR ''sa'')) (LVAL (Id (STR ''ma''))))
                    (ASSIGN (Ref (STR ''sa'') [UINT (8::nat) 0]) TRUE)"
 abbreviation myenv::Environment
   where "myenv \<equiv> updateEnv (STR ''ma'') (Memory (MTArray 1 (MTValue TBool))) (Stackloc (STR ''1''))
                  (updateEnv (STR ''sa'') (Storage (STArray 1 (STValue TBool))) (Storeloc (STR ''1''))
                  (emptyEnv (STR ''ad'') EMPTY (STR ''ad'') (STR ''0'')))"
  
 abbreviation mystack::Stack
-  where "mystack \<equiv> updateStore (STR ''1'') (KMemptr (STR ''1 '')) emptyStore"
+  where "mystack \<equiv> updateStore (STR ''1'') (KMemptr (STR ''1'')) emptyStore"
  
-abbreviation mystore::StorageT
-  where "mystore \<equiv> fmempty"
+abbreviation mystore::"Address \<Rightarrow> StorageT"
+  where "mystore \<equiv> \<lambda> _ . fmempty"
  
 abbreviation mymemory::MemoryT
-  where "mymemory \<equiv> updateStore (STR ''0.1'') (MValue (STR ''false'')) emptyStore"
+  where "mymemory \<equiv> updateStore (STR ''0.1'') (MValue (STR ''False'')) emptyStore"
  
 abbreviation mystorage::StorageT
   where "mystorage \<equiv> fmupd (STR ''0.1'') (STR ''True'') fmempty"
 
-(*
-  FIXME:
+declare[[ML_print_depth = 10000]]
+value \<open>(stmt P1 myenv emptyStore \<lparr>accounts=emptyAccount, stack=mystack, memory=mymemory, storage=(mystore ((STR ''ad''):= mystorage)), gas=1000\<rparr>)\<close>  
 
-lemma "( stmt P1 myenv emptyStore \<lparr>accounts=emptyAccount, stack=mystack, memory=mymemory, storage=fmupd (STR ''ad'') mystorage fmempty, gas=1000\<rparr> ) =
-  (Normal ((), \<lparr>accounts=emptyAccount, stack=mystack, memory=mymemory, storage=fmupd (STR ''ad'') mystorage fmempty, gas=1000\<rparr> ))"
-  by(solidity_symbex)
-*)
+
+lemma \<open>(stmt P1 myenv emptyStore \<lparr>accounts=emptyAccount, stack=mystack, memory=mymemory, storage=(mystore ((STR ''ad''):= mystorage)), gas=1000\<rparr>)
+      = Normal ((), \<lparr>accounts = emptyAccount, stack = \<lparr>mapping = fmap_of_list [(STR ''1'', KMemptr STR ''1'')], toploc = 0\<rparr>,
+                   memory = \<lparr>mapping = fmap_of_list [(STR ''0.1'', MValue STR ''False'')], toploc = 0\<rparr>, storage = (mystore ((STR ''ad''):= mystorage)), gas = 1000\<rparr>) \<close>  
+    by(solidity_symbex)
+
 end
diff --git a/thys/Solidity/StateMonad.thy b/thys/Solidity/StateMonad.thy
--- a/thys/Solidity/StateMonad.thy
+++ b/thys/Solidity/StateMonad.thy
@@ -1,435 +1,437 @@
 theory StateMonad
-imports Main "HOL-Library.Monad_Syntax" Utils
+imports Main "HOL-Library.Monad_Syntax" Utils Solidity_Symbex
 begin
 
 section "State Monad with Exceptions"
 
 datatype ('n, 'e) result = Normal (normal: 'n) | Exception (exception: 'e)
 
 type_synonym ('a, 'e, 's) state_monad = "'s \<Rightarrow> ('a \<times> 's, 'e) result"
 
 lemma result_cases[cases type: result]:
   fixes x :: "('a \<times> 's, 'e) result"
   obtains (n) a s where "x = Normal (a, s)"
         | (e) e where "x = Exception e"
 proof (cases x)
     case (Normal n)
     then show ?thesis
       by (metis n prod.swap_def swap_swap)
   next
     case (Exception e)
     then show ?thesis ..
 qed
 
 subsection \<open>Fundamental Definitions\<close>
 
 fun return :: "'a \<Rightarrow> ('a, 'e, 's) state_monad"
 where "return a s = Normal (a, s)"
 
 fun throw :: "'e \<Rightarrow> ('a, 'e, 's) state_monad"
 where "throw e s = Exception e"
 
 fun bind :: "('a, 'e, 's) state_monad \<Rightarrow> ('a \<Rightarrow> ('b, 'e, 's) state_monad) \<Rightarrow> ('b, 'e, 's) state_monad" (infixl ">>=" 60)
 where "bind f g s = (case f s of
                       Normal (a, s') \<Rightarrow> g a s'
                     | Exception e \<Rightarrow> Exception e)"
 
 adhoc_overloading Monad_Syntax.bind bind
 
 lemma throw_left[simp]: "throw x \<bind> y = throw x" by auto
 
 subsection \<open>The Monad Laws\<close>
 
 text \<open>@{term return} is absorbed at the left of a @{term bind},
   applying the return value directly:\<close>
 lemma return_bind [simp]: "(return x \<bind> f) = f x"
   by auto
 
 text \<open>@{term return} is absorbed on the right of a @{term bind}\<close>
 lemma bind_return [simp]: "(m \<bind> return) = m"
 proof -
   have "\<forall>s. bind m return s = m s"
   proof
     fix s
     show "bind m return s = m s"
     proof (cases "m s" rule: result_cases)
       case (n a s)
       then show ?thesis by auto
     next
       case (e e)
       then show ?thesis by auto
     qed
   qed
   thus ?thesis by auto
 qed
 
 text \<open>@{term bind} is associative\<close>
 lemma bind_assoc:
   fixes m :: "('a,'e,'s) state_monad"
   fixes f :: "'a \<Rightarrow> ('b,'e,'s) state_monad"
   fixes g :: "'b \<Rightarrow> ('c,'e,'s) state_monad"
   shows "(m \<bind> f) \<bind> g  =  m \<bind> (\<lambda>x. f x\<bind> g)"
 proof
   fix s
   show "bind (bind m f) g s = bind m (\<lambda>x. bind (f x) g) s"
     by (cases "m s" rule: result_cases, simp+)
 qed
 
 subsection \<open>Basic Conguruence Rules\<close>
 
 (*
   This lemma is needed for termination proofs.
 
   Function sub1 , for example, requires it.
 *)
 lemma monad_cong[fundef_cong]:
   fixes m1 m2 m3 m4
   assumes "m1 s = m2 s"
       and "\<And>v s'. m2 s = Normal (v, s') \<Longrightarrow> m3 v s' = m4 v s'"
     shows "(bind m1 m3) s = (bind m2 m4) s"
   apply(insert assms, cases "m1 s")
   apply (metis StateMonad.bind.simps old.prod.case result.simps(5))
   by (metis bind.elims result.simps(6))
 
 (*
   Lemma bind_case_nat_cong is required if a bind operand is a case analysis over nat.
 
   Function sub2, for example, requires it.
 *)
 lemma bind_case_nat_cong [fundef_cong]:
   assumes "x = x'" and "\<And>a. x = Suc a \<Longrightarrow> f a h = f' a h"
   shows "(case x of Suc a \<Rightarrow> f a | 0 \<Rightarrow> g) h = (case x' of Suc a \<Rightarrow> f' a | 0 \<Rightarrow> g) h"
   by (metis assms(1) assms(2) old.nat.exhaust old.nat.simps(4) old.nat.simps(5))
 
 lemma if_cong[fundef_cong]:
   assumes "b = b'"
     and "b' \<Longrightarrow> m1 s = m1' s"
     and "\<not> b' \<Longrightarrow> m2 s = m2' s"
   shows "(if b then m1 else m2) s = (if b' then m1' else m2') s"
   using assms(1) assms(2) assms(3) by auto
 
 lemma bind_case_pair_cong [fundef_cong]:
   assumes "x = x'" and "\<And>a b. x = (a,b) \<Longrightarrow> f a b s = f' a b s"
   shows "(case x of (a,b) \<Rightarrow> f a b) s = (case x' of (a,b) \<Rightarrow> f' a b) s"
   by (simp add: assms(1) assms(2) prod.case_eq_if)
 
 lemma bind_case_let_cong [fundef_cong]:
   assumes "M = N"
       and "(\<And>x. x = N \<Longrightarrow> f x s = g x s)"
     shows "(Let M f) s = (Let N g) s"
   by (simp add: assms(1) assms(2))
 
 lemma bind_case_some_cong [fundef_cong]:
   assumes "x = x'" and "\<And>a. x = Some a \<Longrightarrow> f a s = f' a s" and "x = None \<Longrightarrow> g s = g' s"
   shows "(case x of Some a \<Rightarrow> f a | None \<Rightarrow> g) s = (case x' of Some a \<Rightarrow> f' a | None \<Rightarrow> g') s"
   by (simp add: assms(1) assms(2) assms(3) option.case_eq_if)
 
 lemma bind_case_bool_cong [fundef_cong]:
   assumes "x = x'" and "x = True \<Longrightarrow> f s = f' s" and "x = False \<Longrightarrow> g s = g' s"
   shows "(case x of True \<Rightarrow> f | False \<Rightarrow> g) s = (case x' of True \<Rightarrow> f' | False \<Rightarrow> g') s"
   using assms(1) assms(2) assms(3) by auto
 
 subsection \<open>Other functions\<close>
 
 text \<open>
   The basic accessor functions of the state monad. \<open>get\<close> returns
   the current state as result, does not fail, and does not change the state.
   \<open>put s\<close> returns unit, changes the current state to \<open>s\<close> and does not fail.
 \<close>
 fun get :: "('s, 'e, 's) state_monad" where
   "get s = Normal (s, s)"
 
 fun put :: "'s \<Rightarrow> (unit, 'e, 's) state_monad" where
   "put s _ = Normal ((), s)"
 
 text \<open>Apply a function to the current state and return the result
 without changing the state.\<close>
 fun
   applyf :: "('s \<Rightarrow> 'a) \<Rightarrow> ('a, 'e, 's) state_monad" where
  "applyf f = get \<bind> (\<lambda>s. return (f s))"
 
 text \<open>Modify the current state using the function passed in.\<close>
 fun
   modify :: "('s \<Rightarrow> 's) \<Rightarrow> (unit, 'e, 's) state_monad"
 where "modify f = get \<bind> (\<lambda>s::'s. put (f s))"
 
 fun
   assert :: "'e \<Rightarrow> ('s \<Rightarrow> bool) \<Rightarrow> (unit, 'e, 's) state_monad" where
  "assert x t = (\<lambda>s. if (t s) then return () s else throw x s)"
 
 fun
   option :: "'e \<Rightarrow> ('s \<Rightarrow> 'a option) \<Rightarrow> ('a, 'e, 's) state_monad" where
  "option x f = (\<lambda>s. (case f s of
     Some y \<Rightarrow> return y s
   | None \<Rightarrow> throw x s))"
 
 subsection \<open>Some basic examples\<close>
 
 lemma "do {
         x \<leftarrow> return 1;
         return (2::nat);
         return x
        } =
        return 1 \<bind> (\<lambda>x. return (2::nat) \<bind> (\<lambda>_. (return x)))" ..
 
 lemma "do {
         x \<leftarrow> return 1;
           return 2;
           return x
        } = return 1"
   by auto
 
 fun sub1 :: "(unit, nat, nat) state_monad" where
     "sub1 0 = put 0 0"
   | "sub1 (Suc n) = (do {
                      x \<leftarrow> get;
                      put x;
                      sub1
                     }) n"
 
 fun sub2 :: "(unit, nat, nat) state_monad" where
   "sub2 s =
      (do {
         n \<leftarrow> get;
         (case n of
           0 \<Rightarrow> put 0
         | Suc n' \<Rightarrow> (do {
                   put n';
                   sub2
                 }))
      }) s"
 
 section "Hoare Logic"
 
 named_theorems wprule
 
 definition
   valid :: "('s \<Rightarrow> bool) \<Rightarrow> ('a,'e,'s) state_monad \<Rightarrow> 
              ('a \<Rightarrow> 's \<Rightarrow> bool) \<Rightarrow> 
              ('e \<Rightarrow> bool) \<Rightarrow> bool" 
   ("\<lbrace>_\<rbrace>/ _ /(\<lbrace>_\<rbrace>,/ \<lbrace>_\<rbrace>)")
 where
   "\<lbrace>P\<rbrace> f \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace> \<equiv> \<forall>s. P s \<longrightarrow> (case f s of
                    Normal (r,s') \<Rightarrow> Q r s'
                  | Exception e \<Rightarrow> E e)"
 
 lemma weaken:
   assumes "\<lbrace>Q\<rbrace> f \<lbrace>R\<rbrace>, \<lbrace>E\<rbrace>"
       and "\<forall>s. P s \<longrightarrow> Q s"
     shows "\<lbrace>P\<rbrace> f \<lbrace>R\<rbrace>, \<lbrace>E\<rbrace>"
   using assms by (simp add: valid_def)
 
 lemma strengthen:
   assumes "\<lbrace>P\<rbrace> f \<lbrace>Q\<rbrace>, \<lbrace>E\<rbrace>"
       and "\<forall>a s. Q a s \<longrightarrow> R a s"
     shows "\<lbrace>P\<rbrace> f \<lbrace>R\<rbrace>, \<lbrace>E\<rbrace>"
   unfolding valid_def
 proof(rule allI[OF impI])
   fix s
   assume "P s"
   show "case f s of Normal (r, s') \<Rightarrow> R r s' | Exception e \<Rightarrow> E e"
   proof (cases "f s")
     case (n a s')
     then show ?thesis using assms valid_def \<open>P s\<close>
       by (metis case_prod_conv result.simps(5))
   next
     case (e e)
     then show ?thesis using assms valid_def \<open>P s\<close>
       by (metis result.simps(6))
   qed
 qed
 
 definition wp
   where "wp f P E s \<equiv> (case f s of
                    Normal (r,s') \<Rightarrow> P r s'
                  | Exception e \<Rightarrow> E e)"
 
+declare wp_def [solidity_symbex]
+
 lemma wp_valid: assumes "\<And>s. P s \<Longrightarrow> (wp f Q E s)" shows "\<lbrace>P\<rbrace> f \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace>"
   unfolding valid_def by (metis assms wp_def)
 
 lemma valid_wp: assumes "\<lbrace>P\<rbrace> f \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace>" shows "\<And>s. P s \<Longrightarrow> (wp f Q E s)"
   by (metis assms valid_def wp_def)
 
 lemma put: "\<lbrace>\<lambda>s. P () x\<rbrace> put x \<lbrace>P\<rbrace>,\<lbrace>E\<rbrace>"
   using valid_def by fastforce
 
 lemma put':
   assumes "\<forall>s. P s \<longrightarrow> Q () x"
   shows "\<lbrace>\<lambda>s. P s\<rbrace> put x \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace>"
   using assms weaken[OF put, of P Q x E] by blast
 
 lemma wpput[wprule]: 
   assumes "P () x"
   shows "wp (put x) P E s"
   unfolding wp_def using assms by simp
 
 lemma get: "\<lbrace>\<lambda>s. P s s\<rbrace> get \<lbrace>P\<rbrace>,\<lbrace>E\<rbrace>"
   using valid_def by fastforce
 
 lemma get':
   assumes "\<forall>s. P s \<longrightarrow> Q s s"
   shows "\<lbrace>\<lambda>s. P s\<rbrace> get \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace>"
   using assms weaken[OF get] by blast
 
 lemma wpget[wprule]: 
   assumes "P s s"
   shows "wp get P E s"
   unfolding wp_def using assms by simp
 
 lemma return: "\<lbrace>\<lambda>s. P x s\<rbrace> return x \<lbrace>P\<rbrace>,\<lbrace>E\<rbrace>"
   using valid_def by fastforce
 
 lemma return':
   assumes "\<forall>s. P s \<longrightarrow> Q x s"
   shows "\<lbrace>\<lambda>s. P s\<rbrace> return x \<lbrace>Q\<rbrace>,\<lbrace>E\<rbrace>"
   using assms weaken[OF return, of P Q x E] by blast
 
 lemma wpreturn[wprule]: 
   assumes "P x s"
   shows "wp (return x) P E s"
   unfolding wp_def using assms by simp
 
 lemma bind:
   assumes "\<forall>x. \<lbrace>B x\<rbrace> g x \<lbrace>C\<rbrace>,\<lbrace>E\<rbrace>"
       and "\<lbrace>A\<rbrace> f \<lbrace>B\<rbrace>,\<lbrace>E\<rbrace>"
     shows "\<lbrace>A\<rbrace> f \<bind> g \<lbrace>C\<rbrace>,\<lbrace>E\<rbrace>"
   unfolding valid_def
 proof (rule allI[OF impI])
   fix s assume a: "A s"
   show "case (f \<bind> g) s of Normal (r, s') \<Rightarrow> C r s' | Exception e \<Rightarrow> E e"
   proof (cases "f s" rule:result_cases)
     case nf: (n a s')
     with assms(2) a have b: "B a s'" using valid_def[where ?f=f] by auto
     then show ?thesis
     proof (cases "g a s'" rule:result_cases)
       case ng: (n a' s'')
       with assms(1) b have c: "C a' s''" using valid_def[where ?f="g a"] by fastforce
       moreover from ng nf have "(f \<bind> g) s = Normal (a', s'')" by simp
       ultimately show ?thesis by simp
     next
       case eg: (e e)
       with assms(1) b have c: "E e" using valid_def[where ?f="g a"] by fastforce
       moreover from eg nf have "(f \<bind> g) s = Exception e" by simp
       ultimately show ?thesis by simp
     qed
   next
     case (e e)
     with a assms(2) have "E e" using valid_def[where ?f=f] by auto
     moreover from e have "(f \<bind> g) s = Exception e" by simp
     ultimately show ?thesis by simp
   qed
 qed
 
 lemma wpbind[wprule]:
   assumes "wp f (\<lambda>a. (wp (g a) P E)) E s"
   shows "wp (f \<bind> g) P E s"
 proof (cases "f s" rule:result_cases)
   case nf: (n a s')
   then have **:"wp (g a) P E s'" using wp_def[of f "\<lambda>a. wp (g a) P E"] assms by simp
   show ?thesis
   proof (cases "g a s'" rule:result_cases)
     case ng: (n a' s'')
     then have "P a' s''" using wp_def[of "g a" P] ** by simp
     moreover from nf ng have "(f \<bind> g) s = Normal (a', s'')" by simp
     ultimately show ?thesis using wp_def by fastforce
   next
     case (e e)
     then have "E e" using wp_def[of "g a" P] ** by simp
     moreover from nf e have "(f \<bind> g) s = Exception e" by simp
     ultimately show ?thesis using wp_def by fastforce
   qed
 next
   case (e e)
   then have "E e" using wp_def[of f "\<lambda>a. wp (g a) P E"] assms by simp
   moreover from e have "(f \<bind> g) s = Exception e" by simp
   ultimately show ?thesis using wp_def by fastforce
 qed
 
 lemma wpassert[wprule]:
   assumes "t s \<Longrightarrow> wp (return ()) P E s"
       and "\<not> t s \<Longrightarrow> wp (throw x) P E s"
     shows "wp (assert x t) P E s"
   using assms unfolding wp_def by simp
 
 lemma throw:
   assumes "E x"
   shows "\<lbrace>P\<rbrace> throw x \<lbrace>Q\<rbrace>, \<lbrace>E\<rbrace>"
   using valid_def assms by fastforce
 
 lemma wpthrow[wprule]:
   assumes "E x"
   shows "wp (throw x) P E s"
   unfolding wp_def using assms by simp
 
 lemma applyf:
     "\<lbrace>\<lambda>s. P (f s) s\<rbrace> applyf f \<lbrace>\<lambda>a s. P a s\<rbrace>,\<lbrace>E\<rbrace>"
   by (simp add: valid_def)
 
 lemma applyf':
   assumes "\<forall>s. P s \<longrightarrow> Q (f s) s"
   shows "\<lbrace>\<lambda>s. P s\<rbrace> applyf f \<lbrace>\<lambda>a s. Q a s\<rbrace>,\<lbrace>E\<rbrace>"
   using assms weaken[OF applyf] by blast
 
 lemma wpapplyf[wprule]:
   assumes "P (f s) s"
   shows "wp (applyf f) P E s"
   unfolding wp_def using assms by simp
 
 lemma modify:
   "\<lbrace>\<lambda>s. P () (f s)\<rbrace> modify f \<lbrace>P\<rbrace>, \<lbrace>E\<rbrace>"
   apply simp
   apply (rule bind,rule allI)
   apply (rule put)
   apply (rule get)
   done
 
 lemma modify':
   assumes "\<forall>s. P s \<longrightarrow> Q () (f s)"
   shows "\<lbrace>\<lambda>s. P s\<rbrace> modify f \<lbrace>Q\<rbrace>, \<lbrace>E\<rbrace>"
   using assms weaken[OF modify, of P Q _ E] by blast
 
 lemma wpmodify[wprule]:
   assumes "P () (f s)"
   shows "wp (modify f) P E s"
   unfolding wp_def using assms by simp
 
 lemma wpcasenat[wprule]:
   assumes "(y=(0::nat) \<Longrightarrow> wp (f y) P E s)"
       and "\<And>x. y=Suc x \<Longrightarrow> wp (g x) P E s"
   shows "wp (case y::nat of 0 \<Rightarrow> f y | Suc x \<Rightarrow> g x) P E s"
   by (metis assms(1) assms(2) not0_implies_Suc old.nat.simps(4) old.nat.simps(5))
 
 lemma wpif[wprule]:
   assumes "c \<Longrightarrow> wp f P E s"
       and "\<not>c \<Longrightarrow> wp g P E s"
   shows "wp (if c then f else g) P E s"
   using assms by simp
 
 lemma wpsome[wprule]:
   assumes "\<And>y. x = Some y \<Longrightarrow> wp (f y) P E s"
       and "x = None \<Longrightarrow> wp g P E s"
   shows "wp (case x of Some y \<Rightarrow> f y | None \<Rightarrow> g) P E s"
   using assms unfolding wp_def by (simp split: option.split)
 
 lemma wpoption[wprule]:
   assumes "\<And>y. f s = Some y \<Longrightarrow> wp (return y) P E s"
       and "f s = None \<Longrightarrow> wp (throw x) P E s"
   shows "wp (option x f) P E s"
   using assms unfolding wp_def by (auto split:option.split)
 
 lemma wpprod[wprule]:
   assumes "\<And>x y. a = (x,y) \<Longrightarrow> wp (f x y) P E s"
   shows "wp (case a of (x, y) \<Rightarrow> f x y) P E s"
   using assms unfolding wp_def
   by (simp split: prod.split)
 
 method wp = rule wprule; wp?
 method wpvcg = rule wp_valid, wp
 
 lemma "\<lbrace>\<lambda>s. s=5\<rbrace> do {
         put (5::nat);
         x \<leftarrow> get;
         return x
        } \<lbrace>\<lambda>a s. s=5\<rbrace>,\<lbrace>\<lambda>e. False\<rbrace>"
   by (wpvcg, simp)
 end
diff --git a/thys/Solidity/Statements.thy b/thys/Solidity/Statements.thy
--- a/thys/Solidity/Statements.thy
+++ b/thys/Solidity/Statements.thy
@@ -1,2647 +1,2647 @@
 section \<open>Statements\<close>
 theory Statements
   imports Expressions StateMonad
 begin
 
 locale statement_with_gas = expressions_with_gas +
   fixes costs :: "S \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> Gas"
   assumes while_not_zero[termination_simp]: "\<And>e cd st ex s0. 0 < (costs (WHILE ex s0) e cd st) "
       and invoke_not_zero[termination_simp]: "\<And>e cd st i xe. 0 < (costs (INVOKE i xe) e cd st)"
       and external_not_zero[termination_simp]: "\<And>e cd st ad i xe val. 0 < (costs (EXTERNAL ad i xe val) e cd st)"
       and transfer_not_zero[termination_simp]: "\<And>e cd st ex ad. 0 < (costs (TRANSFER ad ex) e cd st)"
       and new_not_zero[termination_simp]: "\<And>e cd st i xe val. 0 < (costs (NEW i xe val) e cd st)"
 begin
 
 subsection \<open>Semantics of left expressions\<close>
 
 text \<open>We first introduce lexp.\<close>
 
 fun lexp :: "L \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> (LType * Type, Ex, Gas) state_monad"
   where "lexp (Id i) e _ st g =
     (case (denvalue e) $$ i of
       Some (tp, (Stackloc l)) \<Rightarrow> return (LStackloc l, tp)
     | Some (tp, (Storeloc l)) \<Rightarrow> return (LStoreloc l, tp)
     | _ \<Rightarrow> throw Err) g"
 | "lexp (Ref i r) e cd st g =
     (case (denvalue e) $$ i of
       Some (tp, Stackloc l) \<Rightarrow>
         (case accessStore l (stack st) of
           Some (KCDptr _) \<Rightarrow> throw Err
         | Some (KMemptr l') \<Rightarrow>
           do {
             t \<leftarrow> (case tp of Memory t \<Rightarrow> return t | _ \<Rightarrow> throw Err);
             (l'', t') \<leftarrow> msel True t l' r e cd st;
             return (LMemloc l'', Memory t')
           }
         | Some (KStoptr l') \<Rightarrow>
           do {
             t \<leftarrow> (case tp of Storage t \<Rightarrow> return t | _ \<Rightarrow> throw Err);
             (l'', t') \<leftarrow> ssel t l' r e cd st;
             return (LStoreloc l'', Storage t')
           }
         | Some (KValue _) \<Rightarrow> throw Err
         | None \<Rightarrow> throw Err)
     | Some (tp, Storeloc l) \<Rightarrow>
         do {
           t \<leftarrow> (case tp of Storage t \<Rightarrow> return t | _ \<Rightarrow> throw Err);
           (l', t') \<leftarrow> ssel t l r e cd st;
           return (LStoreloc l', Storage t')
         }
     | None \<Rightarrow> throw Err) g"
 
 lemma lexp_gas[rule_format]:
     "\<forall>l5' t5' g5'. lexp l5 ev5 cd5 st5 g5 = Normal ((l5', t5'), g5') \<longrightarrow> g5' \<le> g5"
 proof (induct rule: lexp.induct[where ?P="\<lambda>l5 ev5 cd5 st5 g5. (\<forall>l5' t5' g5'. lexp l5 ev5 cd5 st5 g5 = Normal ((l5', t5'), g5') \<longrightarrow> g5' \<le> g5)"])
   case (1 i e uv st g)
   then show ?case using lexp.simps(1) by (simp split: option.split Denvalue.split prod.split)
 next
   case (2 i r e cd st g)
   show ?case
   proof (rule allI[THEN allI, THEN allI, OF impI])
     fix st5' xa xaa
     assume a1: "lexp (Ref i r) e cd st g = Normal ((st5', xa), xaa)"
     then show "xaa \<le> g"
     proof (cases "fmlookup (denvalue e) i")
       case None
       with a1 show ?thesis using lexp.simps(2) by simp
     next
       case (Some a)
       then show ?thesis
       proof (cases a)
         case (Pair tp b)
         then show ?thesis
         proof (cases b)
           case (Stackloc l)
           then show ?thesis
           proof (cases "accessStore l (stack st)")
             case None
             with a1 Some Pair Stackloc show ?thesis using lexp.psimps(2) by simp
           next
             case s2: (Some a)
             then show ?thesis
             proof (cases a)
               case (KValue x1)
               with a1 Some Pair Stackloc s2 show ?thesis using lexp.psimps(2) by simp
             next
               case (KCDptr x2)
               with a1 Some Pair Stackloc s2 show ?thesis using lexp.psimps(2) by simp
             next
               case (KMemptr l')
               then show ?thesis
               proof (cases tp)
                 case (Value _)
                 with a1 Some Pair Stackloc s2 KMemptr show ?thesis using lexp.simps(2) by simp
               next
                 case (Calldata _)
                 with a1 Some Pair Stackloc s2 KMemptr show ?thesis using lexp.simps(2) by simp
               next
                 case (Memory t)
                 then show ?thesis
                 proof (cases "msel True t l' r e cd st g")
                   case (n _ _)
                   with 2 a1 Some Pair Stackloc s2 KMemptr Memory show ?thesis using msel_ssel_expr_load_rexp_gas(1) by (simp split: prod.split_asm)
                 next
                   case (e _)
                   with a1 Some Pair Stackloc s2 KMemptr Memory show ?thesis using lexp.psimps(2) by simp
                 qed
               next
                 case (Storage _)
                 with a1 Some Pair Stackloc s2 KMemptr show ?thesis using lexp.psimps(2) by simp
               qed
             next
               case (KStoptr l')
               then show ?thesis
               proof (cases tp)
                 case (Value _)
                 with a1 Some Pair Stackloc s2 KStoptr show ?thesis using lexp.psimps(2) by simp
               next
                 case (Calldata _)
                 with a1 Some Pair Stackloc s2 KStoptr show ?thesis using lexp.psimps(2) by simp
               next
                 case (Memory _)
                 with a1 Some Pair Stackloc s2 KStoptr show ?thesis using lexp.psimps(2) by simp
               next
                 case (Storage t)
                 then show ?thesis
                 proof (cases "ssel t l' r e cd st g")
                   case (n _ _)
                   with a1 Some Pair Stackloc s2 KStoptr Storage show ?thesis using msel_ssel_expr_load_rexp_gas(2) by (auto split: prod.split_asm)
                 next
                   case (e _)
                   with a1 Some Pair Stackloc s2 KStoptr Storage show ?thesis using lexp.psimps(2) by simp
                 qed
               qed
             qed
           qed
         next
           case (Storeloc l)
           then show ?thesis
           proof (cases tp)
             case (Value _)
             with a1 Some Pair Storeloc show ?thesis using lexp.psimps(2) by simp
           next
             case (Calldata _)
             with  a1 Some Pair Storeloc show ?thesis using lexp.psimps(2) by simp
           next
             case (Memory _)
             with a1 Some Pair Storeloc show ?thesis using lexp.psimps(2) by simp
           next
             case (Storage t)
             then show ?thesis
             proof (cases "ssel t l r e cd st g")
               case (n _ _)
               with a1 Some Pair Storeloc Storage show ?thesis using msel_ssel_expr_load_rexp_gas(2) by (auto split: prod.split_asm)
             next
               case (e _)
               with a1 Some Pair Storeloc Storage show ?thesis using lexp.psimps(2) by simp
             qed
           qed
         qed
       qed
     qed
   qed
 qed
 
 subsection \<open>Semantics of statements\<close>
 
 text \<open>The following is a helper function to connect the gas monad with the state monad.\<close>
 
 fun
   toState :: "(State \<Rightarrow> ('a, 'e, Gas) state_monad) \<Rightarrow> ('a, 'e, State) state_monad" where
  "toState gm = (\<lambda>s. case gm s (gas s) of
                      Normal (a,g) \<Rightarrow> Normal(a,s\<lparr>gas:=g\<rparr>)
                     | Exception e \<Rightarrow> Exception e)"
 
 lemma wptoState[wprule]:
   assumes "\<And>a g. gm s (gas s) = Normal (a, g) \<Longrightarrow> P a (s\<lparr>gas:=g\<rparr>)"
       and "\<And>e. gm s (gas s) = Exception e \<Longrightarrow> E e"
     shows "wp (toState gm) P E s"
   using assms unfolding wp_def by (simp split:result.split result.split_asm)
 
 text \<open>Now we define the semantics of statements.\<close>
 function (domintros) stmt :: "S \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> (unit, Ex, State) state_monad"
   where "stmt SKIP e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs SKIP e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs SKIP e cd st\<rparr>)
     }) st"
 | "stmt (ASSIGN lv ex) env cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (ASSIGN lv ex) env cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (ASSIGN lv ex) env cd st\<rparr>);
       re \<leftarrow> toState (expr ex env cd);
       case re of
         (KValue v, Value t) \<Rightarrow>
           do {
             rl \<leftarrow> toState (lexp lv env cd);
             case rl of
               (LStackloc l, Value t') \<Rightarrow>
                 do {
                   v' \<leftarrow> option Err (\<lambda>_. convert t t' v);
                   modify (\<lambda>st. st \<lparr>stack := updateStore l (KValue v') (stack st)\<rparr>)
                 }
             | (LStoreloc l, Storage (STValue t')) \<Rightarrow>
                 do {
                   v' \<leftarrow> option Err (\<lambda>_. convert t t' v);
                   modify (\<lambda>st. st\<lparr>storage := (storage st) (address env := fmupd l v' (storage st (address env)))\<rparr>)
                 }
             | (LMemloc l, Memory (MTValue t')) \<Rightarrow>
                 do {
                   v' \<leftarrow> option Err (\<lambda>_. convert t t' v);
                   modify (\<lambda>st. st\<lparr>memory := updateStore l (MValue v') (memory st)\<rparr>)
                 }
             | _ \<Rightarrow> throw Err
           }
       | (KCDptr p, Calldata (MTArray x t)) \<Rightarrow>
           do {
             rl \<leftarrow> toState (lexp lv env cd);
             case rl of
               (LStackloc l, Memory _) \<Rightarrow>
                 do {
                   sv \<leftarrow> applyf (\<lambda>st. accessStore l (stack st));
                   p' \<leftarrow> case sv of Some (KMemptr p') \<Rightarrow> return p' | _ \<Rightarrow> throw Err;
                   m \<leftarrow> option Err (\<lambda>st. cpm2m p p' x t cd (memory st));
                   modify (\<lambda>st. st\<lparr>memory := m\<rparr>)
                 }
             | (LStackloc l, Storage _) \<Rightarrow>
                 do {
                   sv \<leftarrow> applyf (\<lambda>st. accessStore l (stack st));
                   p' \<leftarrow> case sv of Some (KStoptr p') \<Rightarrow> return p' | _ \<Rightarrow> throw Err;
                   s \<leftarrow> option Err (\<lambda>st. cpm2s p p' x t cd (storage st (address env)));
                   modify (\<lambda>st. st \<lparr>storage := (storage st) (address env := s)\<rparr>)
                 }
             | (LStoreloc l, _) \<Rightarrow>
                 do {
                   s \<leftarrow> option Err (\<lambda>st. cpm2s p l x t cd (storage st (address env)));
                   modify (\<lambda>st. st \<lparr>storage := (storage st) (address env := s)\<rparr>)
                 }
             | (LMemloc l, _) \<Rightarrow>
                 do {
                   m \<leftarrow> option Err (\<lambda>st. cpm2m p l x t cd (memory st));
                   modify (\<lambda>st. st \<lparr>memory := m\<rparr>)
                 }
             | _ \<Rightarrow> throw Err
           }
       | (KMemptr p, Memory (MTArray x t)) \<Rightarrow>
           do {
             rl \<leftarrow> toState (lexp lv env cd);
             case rl of
               (LStackloc l, Memory _) \<Rightarrow> modify (\<lambda>st. st\<lparr>stack := updateStore l (KMemptr p) (stack st)\<rparr>)
             | (LStackloc l, Storage _) \<Rightarrow>
                 do {
                   sv \<leftarrow> applyf (\<lambda>st. accessStore l (stack st));
                   p' \<leftarrow> case sv of Some (KStoptr p') \<Rightarrow> return p' | _ \<Rightarrow> throw Err;
                   s \<leftarrow> option Err (\<lambda>st. cpm2s p p' x t (memory st) (storage st (address env)));
                   modify (\<lambda>st. st \<lparr>storage := (storage st) (address env := s)\<rparr>)
                 }
             | (LStoreloc l, _) \<Rightarrow>
                 do {
                   s \<leftarrow> option Err (\<lambda>st. cpm2s p l x t (memory st) (storage st (address env)));
                   modify (\<lambda>st. st \<lparr>storage := (storage st) (address env := s)\<rparr>)
                 }
             | (LMemloc l, _) \<Rightarrow> modify (\<lambda>st. st \<lparr>memory := updateStore l (MPointer p) (memory st)\<rparr>)
             | _ \<Rightarrow> throw Err
           }
       | (KStoptr p, Storage (STArray x t)) \<Rightarrow>
           do {
             rl \<leftarrow> toState (lexp lv env cd);
             case rl of
               (LStackloc l, Memory _) \<Rightarrow>
                 do {
                   sv \<leftarrow> applyf (\<lambda>st. accessStore l (stack st));
                   p' \<leftarrow> case sv of Some (KMemptr p') \<Rightarrow> return p' | _ \<Rightarrow> throw Err;
                   m \<leftarrow> option Err (\<lambda>st. cps2m p p' x t (storage st (address env)) (memory st));
                   modify (\<lambda>st. st\<lparr>memory := m\<rparr>)
                 }
             | (LStackloc l, Storage _) \<Rightarrow> modify (\<lambda>st. st\<lparr>stack := updateStore l (KStoptr p) (stack st)\<rparr>)
             | (LStoreloc l, _) \<Rightarrow>
                 do {
                   s \<leftarrow> option Err (\<lambda>st. copy p l x t (storage st (address env)));
                   modify (\<lambda>st. st \<lparr>storage := (storage st) (address env := s)\<rparr>)
                 }
             | (LMemloc l, _) \<Rightarrow>
                 do {
                   m \<leftarrow> option Err (\<lambda>st. cps2m p l x t (storage st (address env)) (memory st));
                   modify (\<lambda>st. st\<lparr>memory := m\<rparr>)
                 }
             | _ \<Rightarrow> throw Err
           }
       | (KStoptr p, Storage (STMap t t')) \<Rightarrow>
           do {
             rl \<leftarrow> toState (lexp lv env cd);
             l \<leftarrow> case rl of (LStackloc l, _) \<Rightarrow> return l | _ \<Rightarrow> throw Err;
             modify (\<lambda>st. st\<lparr>stack := updateStore l (KStoptr p) (stack st)\<rparr>)
           }
       | _ \<Rightarrow> throw Err
     }) st"
 | "stmt (COMP s1 s2) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (COMP s1 s2) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (COMP s1 s2) e cd st\<rparr>);
       stmt s1 e cd;
       stmt s2 e cd
     }) st"
 | "stmt (ITE ex s1 s2) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (ITE ex s1 s2) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (ITE ex s1 s2) e cd st\<rparr>);
       v \<leftarrow> toState (expr ex e cd);
       b \<leftarrow> (case v of (KValue b, Value TBool) \<Rightarrow> return b | _ \<Rightarrow> throw Err);
       if b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True then stmt s1 e cd
       else if b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False then stmt s2 e cd
       else throw Err
     }) st"
 | "stmt (WHILE ex s0) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (WHILE ex s0) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (WHILE ex s0) e cd st\<rparr>);
       v \<leftarrow> toState (expr ex e cd);
       b \<leftarrow> (case v of (KValue b, Value TBool) \<Rightarrow> return b | _ \<Rightarrow> throw Err);
       if b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True then
         do {
           stmt s0 e cd;
           stmt (WHILE ex s0) e cd
         }
       else if b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False then return ()
       else throw Err
     }) st"
 | "stmt (INVOKE i xe) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (INVOKE i xe) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (INVOKE i xe) e cd st\<rparr>);
       (ct, _) \<leftarrow> option Err (\<lambda>_. ep $$ contract e);
       (fp, f) \<leftarrow> case ct $$ i of Some (Method (fp, False, f)) \<Rightarrow> return (fp, f) | _ \<Rightarrow> throw Err;
       let e' = ffold_init ct (emptyEnv (address e) (contract e) (sender e) (svalue e)) (fmdom ct);
       m\<^sub>o \<leftarrow> applyf memory;
       (e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l) \<leftarrow> toState (load False fp xe e' emptyStore emptyStore m\<^sub>o e cd);
       k\<^sub>o \<leftarrow> applyf stack;
       modify (\<lambda>st. st\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>);
       stmt f e\<^sub>l cd\<^sub>l;
       modify (\<lambda>st. st\<lparr>stack:=k\<^sub>o\<rparr>)
     }) st"
 (*External Method calls allow to send some money val with it*)
 (*However this transfer does NOT trigger a fallback*)
 (*External methods can only be called from externally*)
 | "stmt (EXTERNAL ad i xe val) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (EXTERNAL ad i xe val) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (EXTERNAL ad i xe val) e cd st\<rparr>);
       kad \<leftarrow> toState (expr ad e cd);
       adv \<leftarrow> case kad of (KValue adv, Value TAddr) \<Rightarrow> return adv | _ \<Rightarrow> throw Err;
       assert Err (\<lambda>_. adv \<noteq> address e);
       c \<leftarrow> (\<lambda>st. case type (accounts st adv) of Some (Contract c) \<Rightarrow> return c st | _ \<Rightarrow> throw Err st);
       (ct, _, fb) \<leftarrow> option Err (\<lambda>_. ep $$ c);
       kv \<leftarrow> toState (expr val e cd);
       (v, t) \<leftarrow> case kv of (KValue v, Value t) \<Rightarrow> return (v, t) | _ \<Rightarrow> throw Err;
       v' \<leftarrow> option Err (\<lambda>_. convert t (TUInt 256) v);
       let e' = ffold_init ct (emptyEnv adv c (address e) v') (fmdom ct);
       case ct $$ i of
         Some (Method (fp, True, f)) \<Rightarrow>
           do {
             (e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l) \<leftarrow> toState (load True fp xe e' emptyStore emptyStore emptyStore e cd);
             acc \<leftarrow> option Err (\<lambda>st. transfer (address e) adv v' (accounts st));
             (k\<^sub>o, m\<^sub>o) \<leftarrow> applyf (\<lambda>st. (stack st, memory st));
             modify (\<lambda>st. st\<lparr>accounts := acc, stack:=k\<^sub>l,memory:=m\<^sub>l\<rparr>);
             stmt f e\<^sub>l cd\<^sub>l;
             modify (\<lambda>st. st\<lparr>stack:=k\<^sub>o, memory := m\<^sub>o\<rparr>)
           }
       | None \<Rightarrow>
           do {
             acc \<leftarrow> option Err (\<lambda>st. transfer (address e) adv v' (accounts st));
             (k\<^sub>o, m\<^sub>o) \<leftarrow> applyf (\<lambda>st. (stack st, memory st));
             modify (\<lambda>st. st\<lparr>accounts := acc,stack:=emptyStore, memory:=emptyStore\<rparr>);
             stmt fb e' emptyStore;
             modify (\<lambda>st. st\<lparr>stack:=k\<^sub>o, memory := m\<^sub>o\<rparr>)
           }
       | _ \<Rightarrow> throw Err
     }) st"
 | "stmt (TRANSFER ad ex) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (TRANSFER ad ex) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (TRANSFER ad ex) e cd st\<rparr>);
       kv \<leftarrow> toState (expr ad e cd);
       adv \<leftarrow> case kv of (KValue adv, Value TAddr) \<Rightarrow> return adv | _ \<Rightarrow> throw Err;
       kv' \<leftarrow> toState (expr ex e cd);
       (v, t) \<leftarrow> case kv' of (KValue v, Value t) \<Rightarrow> return (v, t) | _ \<Rightarrow> throw Err;
       v' \<leftarrow> option Err (\<lambda>_. convert t (TUInt 256) v);
       acc \<leftarrow> applyf accounts;
       case type (acc adv) of
         Some (Contract c) \<Rightarrow>
           do {
             (ct, _, f) \<leftarrow> option Err (\<lambda>_. ep $$ c);
             let e' = ffold_init ct (emptyEnv adv c (address e) v') (fmdom ct);
             (k\<^sub>o, m\<^sub>o) \<leftarrow> applyf (\<lambda>st. (stack st, memory st));
             acc' \<leftarrow> option Err (\<lambda>st. transfer (address e) adv v' (accounts st));
             modify (\<lambda>st. st\<lparr>accounts := acc', stack:=emptyStore, memory:=emptyStore\<rparr>);
             stmt f e' emptyStore;
             modify (\<lambda>st. st\<lparr>stack:=k\<^sub>o, memory := m\<^sub>o\<rparr>)
           }
       | Some EOA \<Rightarrow>
           do {
             acc' \<leftarrow> option Err (\<lambda>st. transfer (address e) adv v' (accounts st));
             modify (\<lambda>st. (st\<lparr>accounts := acc'\<rparr>))
           }
       | None \<Rightarrow> throw Err
     }) st"
 | "stmt (BLOCK ((id0, tp), None) s) e\<^sub>v cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (BLOCK ((id0, tp), None) s) e\<^sub>v cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) e\<^sub>v cd st\<rparr>);
       (cd', mem', sck', e') \<leftarrow> option Err (\<lambda>st. decl id0 tp None False cd (memory st) (storage st) (cd, memory st, stack st, e\<^sub>v));
       modify (\<lambda>st. st\<lparr>stack := sck', memory := mem'\<rparr>);
       stmt s e' cd'
     }) st"
 | "stmt (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs(BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st\<rparr>);
       (v, t) \<leftarrow> toState (expr ex' e\<^sub>v cd);
       (cd', mem', sck', e') \<leftarrow> option Err (\<lambda>st. decl id0 tp (Some (v, t)) False cd (memory st) (storage st) (cd, memory st, stack st, e\<^sub>v));
       modify (\<lambda>st. st\<lparr>stack := sck', memory := mem'\<rparr>);
       stmt s e' cd'
     }) st"
 (*
   Note: We cannot use (ct, (fp, cn), fb) <- option Err (\<lambda>_. ep $$ i)
 *)
 | "stmt (NEW i xe val) e cd st =
     (do {
       assert Gas (\<lambda>st. gas st > costs (NEW i xe val) e cd st);
       modify (\<lambda>st. st\<lparr>gas := gas st - costs (NEW i xe val) e cd st\<rparr>);
       adv \<leftarrow> applyf (\<lambda>st. hash (address e) (ShowL\<^sub>n\<^sub>a\<^sub>t (contracts (accounts st (address e)))));
       assert Err (\<lambda>st. type (accounts st adv) = None);
       kv \<leftarrow> toState (expr val e cd);
       (v, t) \<leftarrow> case kv of (KValue v, Value t) \<Rightarrow> return (v, t) | _ \<Rightarrow> throw Err;
       (ct, cn, _) \<leftarrow> option Err (\<lambda>_. ep $$ i);
       let e' = ffold_init ct (emptyEnv adv i (address e) v) (fmdom ct);
       (e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l) \<leftarrow> toState (load True (fst cn) xe e' emptyStore emptyStore emptyStore e cd);
       modify (\<lambda>st. st\<lparr>accounts := (accounts st)(adv := \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = Some (Contract i), contracts = 0\<rparr>), storage:=(storage st)(adv := {$$})\<rparr>);
       acc \<leftarrow> option Err (\<lambda>st. transfer (address e) adv v (accounts st));
       (k\<^sub>o, m\<^sub>o) \<leftarrow> applyf (\<lambda>st. (stack st, memory st));
       modify (\<lambda>st. st\<lparr>accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>);
       stmt (snd cn) e\<^sub>l cd\<^sub>l;
       modify (\<lambda>st. st\<lparr>stack:=k\<^sub>o, memory := m\<^sub>o\<rparr>);
       modify (incrementAccountContracts (address e))
     }) st"
 by pat_completeness auto
 
 subsection \<open>Termination\<close>
 
 text \<open>Again, to prove termination we need a lemma regarding gas consumption.\<close>
 
 lemma stmt_dom_gas[rule_format]:
     "stmt_dom (s6, ev6, cd6, st6) \<Longrightarrow> (\<forall>st6'. stmt s6 ev6 cd6 st6 = Normal((), st6') \<longrightarrow> gas st6' \<le> gas st6)"
 proof (induct rule: stmt.pinduct[where ?P="\<lambda>s6 ev6 cd6 st6. (\<forall>st6'. stmt s6 ev6 cd6 st6 = Normal ((), st6') \<longrightarrow> gas st6' \<le> gas st6)"])
   case (1 e cd st)
   then show ?case using stmt.psimps(1) by simp
 next
   case (2 lv ex env cd st)
   define g where "g = costs (ASSIGN lv ex) env cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6'
     assume stmt_def: "stmt (ASSIGN lv ex) env cd st = Normal ((), st6')"
     then show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 2(1) stmt_def show ?thesis using stmt.psimps(2) g_def by simp
     next
       assume "\<not> gas st \<le> g"
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       show ?thesis
       proof (cases "expr ex env cd st' (gas st - g)")
         case (n a g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         then show ?thesis
         proof (cases a)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue v)
             then show ?thesis
             proof (cases c)
               case (Value t)
               then show ?thesis
               proof (cases "lexp lv env cd st'' g'")
                 case n2: (n a g'')
                 then show ?thesis
                 proof (cases a)
                   case p1: (Pair a b)
                   then show ?thesis
                   proof (cases a)
                     case (LStackloc l)
                     then show ?thesis
                     proof (cases b)
                       case v2: (Value t')
                       then show ?thesis
                       proof (cases "convert t t' v ")
                         case None
                         with stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStackloc v2 show ?thesis using stmt.psimps(2)[OF 2(1)] g_def st'_def st''_def by simp
                       next
                         case s3: (Some v')
                         with 2(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStackloc v2 s3
                         have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''\<lparr>gas := g'', stack := updateStore l (KValue v') (stack st)\<rparr>)"
                           using stmt.psimps(2) g_def st'_def st''_def by simp
                         with stmt_def have "st6'= st''\<lparr>gas := g'', stack := updateStore l (KValue v') (stack st)\<rparr>" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n2 p1 have "gas (st''\<lparr>gas := g'', stack := updateStore l (KValue v') (stack st)\<rparr>) \<le> gas (st'\<lparr>gas := g'\<rparr>)" using g_def st'_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value have "gas (st'\<lparr>gas := g'\<rparr>) \<le> gas (st\<lparr>gas := gas st - g\<rparr>)" using g_def by simp
                         ultimately show ?thesis by simp
                       qed
                     next
                       case (Calldata x2)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Memory x3)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Storage x4)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     qed
                   next
                     case (LMemloc l)
                     then show ?thesis
                     proof (cases b)
                       case v2: (Value t')
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Calldata x2)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Memory x3)
                       then show ?thesis
                       proof (cases x3)
                         case (MTArray x11 x12)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc Memory show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case (MTValue t')
                         then show ?thesis
                         proof (cases "convert t t' v ")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc Memory MTValue show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                         next
                           case s3: (Some v')
                           with 2(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc Memory MTValue s3
                           have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''\<lparr>gas := g'', memory := updateStore l (MValue v') (memory st'')\<rparr>)"
                             using stmt.psimps(2) g_def st'_def st''_def by simp
                           with stmt_def have "st6'= (st''\<lparr>gas := g'', memory := updateStore l (MValue v') (memory st'')\<rparr>)" by simp
                           moreover from lexp_gas `\<not> gas st \<le> g` n2 p1 have "gas (st''\<lparr>gas := g'', stack := updateStore l (KValue v') (stack st)\<rparr>) \<le> gas (st'\<lparr>gas := g'\<rparr>)" using g_def st'_def by simp
                           moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value n2 p1 have "gas (st'\<lparr>gas := g'\<rparr>) \<le> gas (st\<lparr>gas := gas st - g\<rparr>)" using g_def by simp
                           ultimately show ?thesis by simp
                         qed
                       qed
                     next
                       case (Storage x4)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LMemloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     qed
                   next
                     case (LStoreloc l)
                     then show ?thesis
                     proof (cases b)
                       case v2: (Value t')
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Calldata x2)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Memory x3)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (Storage x4)
                       then show ?thesis
                       proof (cases x4)
                         case (STArray x11 x12)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc Storage show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case (STMap x21 x22)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc Storage show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case (STValue t')
                         then show ?thesis
                         proof (cases "convert t t' v ")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc Storage STValue show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                         next
                           case s3: (Some v')
                           with 2(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p1 LStoreloc Storage STValue s3
                           have "stmt (ASSIGN lv ex) env cd st = Normal ((), st'' \<lparr>gas := g'', storage := (storage st'') (address env := fmupd l v' (storage st'' (address env)))\<rparr>)"
                             using stmt.psimps(2) g_def st'_def st''_def by simp
                           with stmt_def have "st6'= st'' \<lparr>gas := g'', storage := (storage st'') (address env := fmupd l v' (storage st'' (address env)))\<rparr>" by simp
                           moreover from lexp_gas `\<not> gas st \<le> g` n Pair KValue Value n2 p1 have "gas (st''\<lparr>gas := g'', stack := updateStore l (KValue v') (stack st)\<rparr>) \<le> gas (st'\<lparr>gas := g'\<rparr>)" using g_def by simp
                           moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value n2 p1 have "gas (st'\<lparr>gas := g'\<rparr>) \<le> gas (st\<lparr>gas := gas st - g\<rparr>)" using g_def by simp
                           ultimately show ?thesis by simp
                         qed
                       qed
                     qed
                   qed
                 qed
               next
                 case (e x)
                 with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
               qed
             next
               case (Calldata x2)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(2) g_def st'_def by simp
             next
               case (Memory x3)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(2) g_def st'_def by simp
             next
               case (Storage x4)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(2) g_def st'_def by simp
             qed
           next
             case (KCDptr p)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr show ?thesis using stmt.psimps(2) g_def st'_def by simp
             next
               case (Calldata x2)
               then show ?thesis
               proof (cases x2)
                 case (MTArray x t)
                 then show ?thesis
                 proof (cases "lexp lv env cd st'' g'")
                   case n2: (n a g'')
                   define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                   then show ?thesis
                   proof (cases a)
                     case p2: (Pair a b)
                     then show ?thesis
                     proof (cases a)
                       case (LStackloc l)
                       then show ?thesis
                       proof (cases b)
                         case v2: (Value t')
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case c2: (Calldata x2)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case (Memory x3)
                         then show ?thesis
                         proof (cases "accessStore l (stack st''')")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         next
                           case s3: (Some a)
                           then show ?thesis
                           proof (cases a)
                             case (KValue x1)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case c3: (KCDptr x2)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case (KMemptr p')
                             then show ?thesis
                             proof (cases "cpm2m p p' x t cd (memory st''')")
                               case None
                               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory s3 KMemptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by (simp split:if_split_asm)
                             next
                               case (Some m')
                               with `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory s3 KMemptr
                               have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''' \<lparr>memory := m'\<rparr>)"
                                 using stmt.psimps(2)[OF 2(1)] g_def st'_def st''_def st'''_def by simp
                               with stmt_def have "st6'= st''' \<lparr>memory := m'\<rparr>" by simp
                               moreover from lexp_gas `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 have "gas (st'''\<lparr>memory := m'\<rparr>) \<le> gas st''" using st''_def st'''_def by simp
                               moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                               ultimately show ?thesis using st'_def by simp
                             qed
                           next
                             case (KStoptr p')
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           qed
                         qed
                       next
                         case (Storage x4)
                         then show ?thesis
                         proof (cases "accessStore l (stack st'')")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         next
                           case s3: (Some a)
                           then show ?thesis
                           proof (cases a)
                             case (KValue x1)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case c3: (KCDptr x2)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case (KMemptr x3)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case (KStoptr p')
                             then show ?thesis
                             proof (cases "cpm2s p p' x t cd (storage st'' (address env))")
                               case None
                               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage s3 KStoptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                             next
                               case (Some s')
                               with 2(1) `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStackloc Storage s3 KStoptr
                               have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''' \<lparr>storage := (storage st'') (address env := s')\<rparr>)"
                                 using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                               with stmt_def have "st6'= st''' \<lparr>storage := (storage st'') (address env := s')\<rparr>" by simp
                               moreover from lexp_gas `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 have "gas st''' \<le> gas st''" using g_def st''_def st'''_def by simp
                               moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using g_def st'_def st''_def by simp
                               ultimately show ?thesis using st'_def by simp
                             qed
                           qed
                         qed
                       qed
                     next
                       case (LMemloc l)
                       then show ?thesis
                       proof (cases "cpm2m p l x t cd (memory st''')")
                         case None
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LMemloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by (simp split:if_split_asm)
                       next
                         case (Some m)
                         with `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LMemloc
                         have "stmt (ASSIGN lv ex) env cd st = Normal ((), st'''\<lparr>memory := m\<rparr>)"
                           using stmt.psimps(2)[OF 2(1)] g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= (st'''\<lparr>memory := m\<rparr>)" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 have "gas st''' \<le> gas st''" using st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     next
                       case (LStoreloc l)
                       then show ?thesis
                       proof (cases "cpm2s p l x t cd (storage st'' (address env))")
                         case None
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStoreloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                       next
                         case (Some s)
                         with `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 LStoreloc
                         have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''' \<lparr>storage := (storage st'') (address env := s)\<rparr>)"
                           using stmt.psimps(2)[OF 2(1)] g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= (st'''\<lparr>storage := (storage st'') (address env := s)\<rparr>)" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray n2 p2 have "gas st''' \<le> gas st''" using st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     qed
                   qed
                 next
                   case (e x)
                   with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata MTArray show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                 qed
               next
                 case (MTValue x2)
                 with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr Calldata show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
               qed
             next
               case (Memory x3)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Storage x4)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KCDptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             qed
           next
             case (KMemptr p)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Calldata x2)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Memory x3)
               then show ?thesis
               proof (cases x3)
                 case (MTArray x t)
                 then show ?thesis
                 proof (cases "lexp lv env cd st'' g'")
                   case n2: (n a g'')
                   define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                   then show ?thesis
                   proof (cases a)
                     case p2: (Pair a b)
                     then show ?thesis
                     proof (cases a)
                       case (LStackloc l)
                       then show ?thesis
                       proof (cases b)
                         case v2: (Value t')
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case c2: (Calldata x2)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case m2: (Memory x3)
                         with 2(1) `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc
                         have "stmt (ASSIGN lv ex) env cd st = Normal ((), st'''\<lparr>stack := updateStore l (KMemptr p) (stack st'')\<rparr>)"
                           using stmt.psimps(2)[OF 2(1)] g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= st'''\<lparr>stack := updateStore l (KMemptr p) (stack st'')\<rparr>" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 have "gas st''' \<le> gas st''" using st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       next
                         case (Storage x4)
                         then show ?thesis
                         proof (cases "accessStore l (stack st''')")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         next
                           case s3: (Some a)
                           then show ?thesis
                           proof (cases a)
                             case (KValue x1)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case c3: (KCDptr x2)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case m3: (KMemptr x3)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case (KStoptr p')
                             then show ?thesis
                             proof (cases "cpm2s p p' x t (memory st''') (storage st''' (address env))")
                               case None
                               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage s3 KStoptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                             next
                               case (Some s)
                               with 2(1) `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStackloc Storage s3 KStoptr
                               have "stmt (ASSIGN lv ex) env cd st = Normal ((), st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>)"
                                 using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                               with stmt_def have "st6'= st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>" by simp
                               moreover from lexp_gas `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 have "gas st''' \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                               moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                               ultimately show ?thesis using st'_def by simp
                             qed
                           qed
                         qed
                       qed
                     next
                       case (LMemloc l)
                       with 2(1) `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LMemloc
                       have "stmt (ASSIGN lv ex) env cd st =  Normal ((), st'''\<lparr>memory := updateStore l (MPointer p) (memory st''')\<rparr>)"
                         using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                       with stmt_def have "st6'= st'''\<lparr>memory := updateStore l (MPointer p) (memory st''')\<rparr>" by simp
                       moreover from lexp_gas `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 have "gas st''' \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                       moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                       ultimately show ?thesis using st'_def by simp
                     next
                       case (LStoreloc l)
                       then show ?thesis
                       proof (cases "cpm2s p l x t (memory st''') (storage st'' (address env))")
                         case None
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStoreloc show ?thesis using stmt.psimps(2) g_def using st'_def st''_def st'''_def by simp
                       next
                         case (Some s)
                         with 2(1) `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 LStoreloc
                         have "stmt (ASSIGN lv ex) env cd st =  Normal ((), st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>)"
                           using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray n2 p2 have "gas st''' \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     qed
                   qed
                 next
                   case (e _)
                   with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory MTArray show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                 qed
               next
                 case (MTValue _)
                 with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr Memory show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
               qed
             next
               case (Storage x4)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KMemptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             qed
           next
             case (KStoptr p)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Calldata x2)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Memory x3)
               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
             next
               case (Storage x4)
               then show ?thesis
               proof (cases x4)
                 case (STArray x t)
                 then show ?thesis
                 proof (cases "lexp lv env cd st'' g'")
                   case n2: (n a g'')
                   define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                   then show ?thesis
                   proof (cases a)
                     case p2: (Pair a b)
                     then show ?thesis
                     proof (cases a)
                       case (LStackloc l)
                       then show ?thesis
                       proof (cases b)
                         case v2: (Value t')
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case c2: (Calldata x2)
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                       next
                         case (Memory x3)
                         then show ?thesis
                         proof (cases "accessStore l (stack st''')")
                           case None
                           with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         next
                           case s3: (Some a)
                           then show ?thesis
                           proof (cases a)
                             case (KValue x1)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case c3: (KCDptr x2)
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           next
                             case (KMemptr p')
                             then show ?thesis
                             proof (cases "cps2m p p' x t (storage st''' (address env)) (memory st''')")
                               case None
                               with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory s3 KMemptr show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                             next
                               case (Some m)
                               with 2(1) `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory s3 KMemptr
                               have "stmt (ASSIGN lv ex) env cd st =  Normal ((), st'''\<lparr>memory := m\<rparr>)"
                                 using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                               with stmt_def have "st6'= st'''\<lparr>memory := m\<rparr>" by simp
                               moreover from lexp_gas `\<not> gas st \<le> g` n Pair KMemptr Storage STArray n2 p2 have "gas (st'''\<lparr>memory := m\<rparr>) \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                               moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                               ultimately show ?thesis using st'_def by simp
                             qed
                           next
                             case sp2: (KStoptr p')
                             with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc Memory s3 show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                           qed
                         qed
                       next
                         case st2: (Storage x4)
                         with 2(1) `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStackloc
                         have "stmt (ASSIGN lv ex) env cd st =  Normal ((), st'''\<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>)"
                           using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= st'''\<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 have "gas (st'''\<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>) \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     next
                       case (LMemloc l)
                       then show ?thesis
                       proof (cases "cps2m p l x t (storage st'' (address env)) (memory st'')")
                         case None
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LMemloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                       next
                         case (Some m)
                         with 2(1) `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LMemloc
                         have "stmt (ASSIGN lv ex) env cd st =  Normal ((), st'''\<lparr>memory := m\<rparr>)"
                           using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= (st'''\<lparr>memory := m\<rparr>)" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 have "gas (st'''\<lparr>memory := m\<rparr>) \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     next
                       case (LStoreloc l)
                       then show ?thesis
                       proof (cases "copy p l x t (storage st'' (address env))")
                         case None
                         with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStoreloc show ?thesis using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                       next
                         case (Some s)
                         with 2(1) `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 LStoreloc
                         have "stmt (ASSIGN lv ex) env cd st = Normal ((), st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>)"
                           using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                         with stmt_def have "st6'= st'''\<lparr>storage := (storage st''') (address env := s)\<rparr>" by simp
                         moreover from lexp_gas `\<not> gas st \<le> g` n Pair KStoptr Storage STArray n2 p2 have "gas (st'''\<lparr>storage := (storage st''') (address env := s')\<rparr>) \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                         moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                         ultimately show ?thesis using st'_def by simp
                       qed
                     qed
                   qed
                 next
                   case (e x)
                   with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STArray show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                 qed
               next
                 case (STMap t t')
                 then show ?thesis
                 proof (cases "lexp lv env cd st'' g'")
                   case n2: (n a g'')
                   define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                   then show ?thesis
                   proof (cases a)
                     case p2: (Pair a b)
                     then show ?thesis
                     proof (cases a)
                       case (LStackloc l)
                       with 2(1) `\<not> gas st \<le> g` n Pair KStoptr Storage STMap n2 p2
                       have "stmt (ASSIGN lv ex) env cd st = Normal ((), st''' \<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>)"
                         using stmt.psimps(2) g_def st'_def st''_def st'''_def by simp
                       with stmt_def have "st6'= st'''\<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>" by simp
                       moreover from lexp_gas `\<not> gas st \<le> g` n Pair KStoptr Storage STMap n2 p2 have "gas (st'''\<lparr>stack := updateStore l (KStoptr p) (stack st''')\<rparr>) \<le> gas st''" using g_def st'_def st''_def st'''_def by simp
                       moreover from msel_ssel_expr_load_rexp_gas(3)[of ex env cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                       ultimately show ?thesis using st'_def by simp
                     next
                       case (LMemloc x2)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STMap n2 p2 show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     next
                       case (LStoreloc x3)
                       with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STMap n2 p2 show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                     qed
                   qed
                 next
                   case (e x)
                   with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage STMap show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
                 qed
               next
                 case (STValue x3)
                 with 2(1) stmt_def `\<not> gas st \<le> g` n Pair KStoptr Storage show ?thesis using stmt.psimps(2) g_def st'_def st''_def by simp
               qed
             qed
           qed
         qed
       next
         case (e x)
         with 2(1) stmt_def `\<not> gas st \<le> g` show ?thesis using stmt.psimps(2) g_def st'_def by simp
       qed
     qed
   qed
 next
   case (3 s1 s2 e cd st)
   define g where "g = costs (COMP s1 s2) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6'
     assume stmt_def: "stmt (COMP s1 s2) e cd st = Normal ((), st6')"
     then show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 3(1) stmt_def g_def show ?thesis using stmt.psimps(3) by simp
     next
       assume "\<not> gas st \<le> g"
       show ?thesis
       proof (cases "stmt s1 e cd (st\<lparr>gas := gas st - g\<rparr>)")
         case (n a st')
         with 3(1) stmt_def `\<not> gas st \<le> g` have "stmt (COMP s1 s2) e cd st = stmt s2 e cd st'" using stmt.psimps(3)[of s1 s2 e cd st] g_def by (simp add:Let_def split:unit.split_asm)
         with 3(3) stmt_def \<open>\<not> gas st \<le> g\<close> n have "gas st6' \<le> gas st'" using g_def by simp
         moreover from 3(2)[where ?s'a="st\<lparr>gas := gas st - g\<rparr>"] \<open>\<not> gas st \<le> g\<close> n have "gas st' \<le> gas st" using g_def by simp
         ultimately show ?thesis by simp
       next
         case (e x)
         with 3 stmt_def `\<not> gas st \<le> g` show ?thesis using stmt.psimps(3)[of s1 s2 e cd st] g_def by (simp split: Ex.split_asm)
       qed
     qed
   qed
 next
   case (4 ex s1 s2 e cd st)
   define g where "g = costs (ITE ex s1 s2) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6'
     assume stmt_def: "stmt (ITE ex s1 s2) e cd st = Normal ((), st6')"
     then show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 4(1) stmt_def show ?thesis using stmt.psimps(4) g_def by simp
     next
       assume "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (ITE ex s1 s2) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: " modify (\<lambda>st. st\<lparr>gas := gas st - costs (ITE ex s1 s2) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       show ?thesis
       proof (cases "expr ex e cd st' (gas st - g)")
         case (n a g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         with n have l3: "toState (expr ex e cd) st' = Normal (a, st'')" using st'_def by simp
         then show ?thesis
         proof (cases a)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue b)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               then show ?thesis
               proof (cases x1)
                 case (TSInt x1)
                 with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value show ?thesis using stmt.psimps(4) g_def st'_def by simp
               next
                 case (TUInt x2)
                 with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value show ?thesis using stmt.psimps(4) g_def st'_def by simp
               next
                 case TBool
                 then show ?thesis
                 proof cases
                   assume "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                   with 4(1) `\<not> gas st \<le> g` n Pair KValue Value TBool have "stmt (ITE ex s1 s2) e cd st = stmt s1 e cd st''" using stmt.psimps(4) g_def st'_def st''_def by simp
                   with 4(2)[OF l1 l2 l3] stmt_def `\<not> gas st \<le> g` n Pair KValue Value TBool `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True` have "gas st6' \<le> gas st''" using g_def by simp
                   moreover from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value TBool have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                   ultimately show ?thesis using st'_def by simp
                 next
                   assume nt: "\<not> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                   show ?thesis
                   proof cases
                     assume "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                     with 4(1) `\<not> gas st \<le> g` n Pair KValue Value TBool nt have "stmt (ITE ex s1 s2) e cd st = stmt s2 e cd st''" using stmt.psimps(4) g_def st'_def st''_def by simp
                     with 4(3)[OF l1 l2 l3] stmt_def `\<not> gas st \<le> g` n Pair KValue Value TBool nt `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False` have "gas st6' \<le> gas st''" using g_def by simp
                     moreover from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value TBool have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                     ultimately show ?thesis using st'_def by simp
                   next
                     assume "\<not> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                     with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TBool nt show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
                   qed
                 qed
               next
                 case TAddr
                 with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
               qed
             next
               case (Calldata x2)
               with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
             next
               case (Memory x3)
               with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
             next
               case (Storage x4)
               with 4(1) stmt_def `\<not> gas st \<le> g` n Pair KValue show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
             qed
           next
             case (KCDptr x2)
             with 4(1) stmt_def `\<not> gas st \<le> g` n Pair show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
           next
             case (KMemptr x3)
             with 4(1) stmt_def `\<not> gas st \<le> g` n Pair show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
           next
             case (KStoptr x4)
             with 4(1) stmt_def `\<not> gas st \<le> g` n Pair show ?thesis using stmt.psimps(4) g_def st'_def st''_def by simp
           qed
         qed
       next
         case (e e)
         with 4(1) stmt_def `\<not> gas st \<le> g` show ?thesis using stmt.psimps(4) g_def st'_def by simp
       qed
     qed
   qed
 next
   case (5 ex s0 e cd st)
   define g where "g = costs (WHILE ex s0) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6'
     assume stmt_def: "stmt (WHILE ex s0) e cd st = Normal ((), st6')"
     then show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 5(1) stmt_def show ?thesis using stmt.psimps(5) g_def by simp
     next
       assume gcost: "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (WHILE ex s0) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: " modify (\<lambda>st. st\<lparr>gas := gas st - costs (WHILE ex s0) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       show ?thesis
       proof (cases "expr ex e cd st' (gas st - g)")
         case (n a g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         with n have l3: "toState (expr ex e cd) st' = Normal (a, st'')" using st'_def by simp
         then show ?thesis
         proof (cases a)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue b)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               then show ?thesis
               proof (cases x1)
                 case (TSInt x1)
                 with 5(1) stmt_def gcost n Pair KValue Value show ?thesis using stmt.psimps(5) g_def st'_def by simp
               next
                 case (TUInt x2)
                 with 5(1) stmt_def gcost n Pair KValue Value show ?thesis using stmt.psimps(5) g_def st'_def by simp
               next
                 case TBool
                 then show ?thesis
                 proof cases
                   assume "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                   then show ?thesis
                   proof (cases "stmt s0 e cd st''")
                     case n2: (n a st''')
                     with 5(1) gcost n Pair KValue Value TBool `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True` have "stmt (WHILE ex s0) e cd st = stmt (WHILE ex s0) e cd st'''" using stmt.psimps(5)[of ex s0 e cd st] g_def st'_def st''_def by (simp add: Let_def split:unit.split_asm)
                     with 5(3) stmt_def gcost n2 Pair KValue Value TBool `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True` n have "gas st6' \<le> gas st'''" using g_def st'_def st''_def by simp
                     moreover from 5(2)[OF l1 l2 l3] gcost n2 Pair KValue Value TBool `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True` n have "gas st''' \<le> gas st''" using g_def by simp
                     moreover from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value TBool have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                     ultimately show ?thesis using st'_def by simp
                   next
                     case (e x)
                     with 5(1) stmt_def gcost n Pair KValue Value TBool `b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True` show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
                   qed
                 next
                   assume nt: "\<not> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True"
                   show ?thesis
                   proof cases
                     assume "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                     with 5(1) gcost n Pair KValue Value TBool nt have "stmt (WHILE ex s0) e cd st = return () st''" using stmt.psimps(5) g_def st'_def st''_def by simp
                     with stmt_def have "gas st6' \<le> gas st''" by simp
                     moreover from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st' "gas st - g"] `\<not> gas st \<le> g` n Pair KValue Value TBool have "gas st'' \<le> gas st'" using st'_def st''_def by simp
                     ultimately show ?thesis using g_def st'_def st''_def by simp
                   next
                     assume "\<not> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
                     with 5(1) stmt_def gcost n Pair KValue Value TBool nt show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
                   qed
                 qed
               next
                 case TAddr
                 with 5(1) stmt_def gcost n Pair KValue Value show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
               qed
             next
               case (Calldata x2)
               with 5(1) stmt_def gcost n Pair KValue show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
             next
               case (Memory x3)
               with 5(1) stmt_def gcost n Pair KValue show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
             next
               case (Storage x4)
               with 5(1) stmt_def gcost n Pair KValue show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
             qed
           next
             case (KCDptr x2)
             with 5(1) stmt_def gcost n Pair show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
           next
             case (KMemptr x3)
             with 5(1) stmt_def gcost n Pair show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
           next
             case (KStoptr x4)
             with 5(1) stmt_def gcost n Pair show ?thesis using stmt.psimps(5) g_def st'_def st''_def by simp
           qed
         qed
       next
         case (e e)
         with 5(1) stmt_def gcost show ?thesis using stmt.psimps(5) g_def st'_def by simp
       qed
     qed
   qed
 next
   case (6 i xe e cd st)
   define g where "g = costs (INVOKE i xe) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume a1: "stmt (INVOKE i xe) e cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof (cases)
       assume "gas st \<le> g"
       with 6(1) a1 show ?thesis using stmt.psimps(6) g_def by simp
     next
       assume gcost: "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (INVOKE i xe) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: "modify (\<lambda>st. st\<lparr>gas := gas st - costs (INVOKE i xe) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       then show ?thesis
       proof (cases "ep $$ contract e")
         case None
         with 6(1) a1 gcost show ?thesis using stmt.psimps(6) g_def by simp
       next
         case (Some x)
         then have l3: "option Err (\<lambda>_. ep $$ contract e) st' = Normal (x, st')" by simp
         then show ?thesis
         proof (cases x)
           case (fields ct _ _)
           then show ?thesis
           proof (cases "fmlookup ct i")
             case None
             with 6(1) g_def a1 gcost Some fields show ?thesis using stmt.psimps(6) by simp
           next
             case s1: (Some a)
             then show ?thesis
             proof (cases a)
               case (Method x1)
               then show ?thesis
               proof (cases x1)
                 case p1: (fields fp ext f)
                 then show ?thesis
                 proof (cases ext)
                   case True
                   with 6(1) a1 g_def gcost Some fields s1 Method p1 show ?thesis using stmt.psimps(6) st'_def by auto
                 next
                   case False
                   then have l4: "(case ct $$ i of None \<Rightarrow> throw Err | Some (Method (fp, True, f)) \<Rightarrow> throw Err
                        | Some (Method (fp, False, f)) \<Rightarrow> return (fp, f) | Some _ \<Rightarrow> throw Err) st' = Normal ((fp,f),st')" using s1 Method p1 by simp
                   define m\<^sub>o e'
                   where "m\<^sub>o = memory st'"
                     and "e' = ffold (init ct) (emptyEnv (address e) (contract e) (sender e) (svalue e)) (fmdom ct)"
                   then show ?thesis
                   proof (cases "load False fp xe e' emptyStore emptyStore m\<^sub>o e cd st' (gas st - g)")
                     case s4: (n a g')
                     define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
                     then show ?thesis
                     proof (cases a)
                       case f2: (fields e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l)
                       then have l5: "toState (load False fp xe e' emptyStore emptyStore m\<^sub>o e cd) st' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), st'')" using st'_def st''_def s4 by simp
                       define k\<^sub>o where "k\<^sub>o = stack st'"
                       then show ?thesis
                       proof (cases "stmt f e\<^sub>l cd\<^sub>l (st''\<lparr>stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>)")
                         case n2: (n a st''')
                         with  a1 g_def gcost Some fields s1 Method p1 m\<^sub>o_def e'_def s4 f2 k\<^sub>o_def False
                         have "stmt (INVOKE i xe) e cd st = Normal ((), st'''\<lparr>stack:=k\<^sub>o\<rparr>)"
                           using stmt.psimps(6)[OF 6(1)] st'_def st''_def by auto
                         with a1 have "gas st6' \<le> gas st'''" by auto
                         also from 6(2)[OF l1 l2 l3 fields l4 _ _ _ l5, where ?s'g="st''\<lparr>stack := k\<^sub>l, memory := m\<^sub>l\<rparr>"] n2 m\<^sub>o_def e'_def
                           have "\<dots> \<le> gas st''" by auto
                         also from msel_ssel_expr_load_rexp_gas(4)[of False fp xe e' emptyStore emptyStore m\<^sub>o e cd st' "(gas st - g)"] have "\<dots> \<le> gas st'" using s4 st'_def st''_def f2 by auto
                         finally show ?thesis using st'_def by simp
                       next
                         case (e x)
                         with 6(1) a1 g_def gcost Some fields s1 Method p1 m\<^sub>o_def e'_def s4 f2 show ?thesis using stmt.psimps(6) st'_def st''_def False by auto
                       qed
                     qed
                   next
                     case (e x)
                     with 6(1) a1 g_def gcost Some fields s1 Method p1 m\<^sub>o_def e'_def show ?thesis using stmt.psimps(6) st'_def False by auto
                   qed
                 qed
               qed
             next
               case (Function _)
               with 6(1) g_def a1 gcost Some fields s1 show ?thesis using stmt.psimps(6) by simp
             next
               case (Var _)
               with 6(1) g_def a1 gcost Some fields s1 show ?thesis using stmt.psimps(6) by simp
             qed
           qed
         qed
       qed
     qed
   qed
 next
   case (7 ad i xe val e cd st)
   define g where "g = costs (EXTERNAL ad i xe val) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume a1: "stmt (EXTERNAL ad i xe val) e cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof (cases)
       assume "gas st \<le> g"
       with 7(1) a1 show ?thesis using stmt.psimps(7) g_def by simp
     next
       assume gcost: "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (EXTERNAL ad i xe val) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: " modify (\<lambda>st. st\<lparr>gas := gas st - costs (EXTERNAL ad i xe val) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       then show ?thesis
       proof (cases "expr ad e cd st' (gas st - g)")
         case (n a0 g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         with n have l3: "toState (expr ad e cd) st' = Normal (a0, st'')" using st'_def by simp
         then show ?thesis
         proof (cases a0)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue adv)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               then show ?thesis
               proof (cases x1)
                 case (TSInt x1)
                 with 7(1) g_def a1 gcost n Pair KValue Value show ?thesis using stmt.psimps(7) st'_def by auto
               next
                 case (TUInt x2)
                 with 7(1) g_def a1 gcost n Pair KValue Value show ?thesis using stmt.psimps(7) st'_def by auto
               next
                 case TBool
                 with 7(1) g_def a1 gcost n Pair KValue Value show ?thesis using stmt.psimps(7) st'_def by auto
               next
                 case TAddr
                 then have l4: "(case a0 of (KValue adv, Value TAddr) \<Rightarrow> return adv | (KValue adv, Value _) \<Rightarrow> throw Err | (KValue adv, _) \<Rightarrow> throw Err
                        | (_, b) \<Rightarrow> throw Err) st'' = Normal (adv, st'')" using Pair KValue Value by simp
                 then show ?thesis
                 proof (cases "adv = address e")
                   case True
                   with 7(1) g_def a1 gcost n Pair KValue Value TAddr show ?thesis using stmt.psimps(7) st'_def by auto
                 next
                   case False
                   then have l5: "assert Err (\<lambda>_. adv \<noteq> address e) st'' = Normal ((), st'')" by simp
                   then show ?thesis
                   proof (cases "type (accounts st'' adv)")
                     case None
                     with 7(1) g_def a1 gcost n Pair KValue Value TAddr False show ?thesis using stmt.psimps(7) st'_def st''_def by auto
                   next
                     case (Some x2)
                     then show ?thesis
                     proof (cases x2)
                       case EOA
                       with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some show ?thesis using stmt.psimps(7) st'_def st''_def by auto
                     next
                       case (Contract c)
                       then have l6: "(\<lambda>st. case type (accounts st adv) of Some (Contract c) \<Rightarrow> return c st | _ \<Rightarrow> throw Err st) st'' = Normal (c, st'')" using Some by (simp split:atype.split option.split)
                       then show ?thesis
                       proof (cases "ep $$ c")
                         case None
                         with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Contract Some show ?thesis using stmt.psimps(7) st'_def st''_def by auto
                       next
                         case s2: (Some x)
                         then show ?thesis
                         proof (cases x)
                           case p2: (fields ct x0 fb)
                           then have l7: "option Err (\<lambda>_. ep $$ c) st'' = Normal ((ct, x0, fb), st'')" using s2 by simp
                           then show ?thesis
                           proof (cases "expr val e cd st'' (gas st'')")
                             case n1: (n kv g'')
                             define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                             with n1 have l8: "toState (expr val e cd) st'' = Normal (kv, st''')" by simp
                             then show ?thesis
                             proof (cases kv)
                               case p3: (Pair a b)
                               then show ?thesis
                               proof (cases a)
                                 case k2: (KValue v)
                                 then show ?thesis
                                 proof (cases b)
                                   case v: (Value t)
                                   then have l9: "(case kv of (KValue v, Value t) \<Rightarrow> return (v, t) | (KValue v, _) \<Rightarrow> throw Err | (_, b) \<Rightarrow> throw Err) st''' = Normal ((v,t), st''')" using n1 p3 k2 by simp
                                   show ?thesis
                                   proof (cases "convert t (TUInt 256) v")
                                     case None
                                     with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Contract Some s2 p2 None n1 p3 k2 v False show ?thesis using stmt.psimps(7)[OF 7(1)] st'_def st''_def st'''_def by simp
                                   next
                                     case s3: (Some v')
                                     define e' where "e' = ffold (init ct) (emptyEnv adv c (address e) v') (fmdom ct)"
                                     show ?thesis
                                     proof (cases "fmlookup ct i")
                                       case None
                                       show ?thesis
                                       proof (cases "transfer (address e) adv v' (accounts st''')")
                                         case n2: None
                                         with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Contract Some s2 p2 None n1 p3 k2 v False s3 show ?thesis using stmt.psimps(7)[OF 7(1)] st'_def st''_def st'''_def by simp
                                       next
                                         case s4: (Some acc)
                                         then have l10: "option Err (\<lambda>st. transfer (address e) adv v' (accounts st)) st''' = Normal (acc, st''')" by simp
                                         define k\<^sub>o m\<^sub>o
                                           where "k\<^sub>o = stack st'''"
                                             and "m\<^sub>o = memory st'''"
                                         show ?thesis
                                         proof (cases "stmt fb e' emptyStore (st'''\<lparr>accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>)")
                                           case n2: (n a st'''')
                                           with g_def a1 gcost n Pair KValue Value TAddr False Contract Some s2 p2 None n1 p3 k2 v s4
                                           have "stmt (EXTERNAL ad i xe val) e cd st = Normal ((), st''''\<lparr>stack:=stack st''', memory := memory st'''\<rparr>)"
                                             using stmt.psimps(7)[OF 7(1)] st'_def st''_def st'''_def e'_def False s3 by simp
                                           with a1 have "gas st6' \<le> gas st''''" by auto
                                           also from 7(3)[OF l1 l2 l3 l4 l5 l6 l7 _ _ l8 l9 _ _ _ None l10, where ?s'k="st'''" and ?s'l="st'''\<lparr>accounts := acc,stack:=emptyStore, memory:=emptyStore\<rparr>" and ?x=e', of "(x0,fb)" x0 fb] n2 
                                             have "\<dots> \<le> gas (st'''\<lparr>accounts := acc,stack:=emptyStore, memory:=emptyStore\<rparr>)" using e'_def s3 by simp
                                           also from msel_ssel_expr_load_rexp_gas(3)[of val e cd st'' "gas st''"]
                                             have "\<dots> \<le> gas st''" using n1 st'_def st''_def st'''_def p3 by simp
                                           also from msel_ssel_expr_load_rexp_gas(3)[of  ad e cd st' "gas st - g"]
                                             have "\<dots> \<le> gas st'" using n st'_def st''_def st'''_def p3 by fastforce
                                           finally show ?thesis using st'_def by simp
                                         next
                                           case (e x)
                                           with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 None n1 p3 k2 v s4 s3 show ?thesis using stmt.psimps(7)[of ad i xe val e cd st] st'_def st''_def st'''_def e'_def by simp
                                         qed
                                       qed
                                     next
                                       case s1: (Some a)
                                       then show ?thesis
                                       proof (cases a)
                                         case (Method x1)
                                         then show ?thesis
                                         proof (cases x1)
                                           case p4: (fields fp ext f)
                                           then show ?thesis
                                           proof (cases ext)
                                             case True
                                             then show ?thesis
                                             proof (cases "load True fp xe e' emptyStore emptyStore emptyStore e cd st''' (gas st''')")
                                               case s4: (n a g''')
                                               define st'''' where "st'''' = st'''\<lparr>gas := g'''\<rparr>"
                                               then show ?thesis
                                               proof (cases a)
                                                 case f1: (fields e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l)
                                                 then have l10: "toState (load True fp xe e' emptyStore emptyStore emptyStore e cd) st''' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), st'''')" using s4 st''''_def by simp
                                                 show ?thesis
                                                 proof (cases "transfer (address e) adv v' (accounts st'''')")
                                                   case n2: None
                                                   with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 Method p4 n1 p3 k2 v s3 f1 e'_def True s4 show ?thesis using stmt.psimps(7)[of ad i xe val e cd st] st'_def st''_def st'''_def st''''_def by simp
                                                 next
                                                   case s5: (Some acc)
                                                   then have l11: "option Err (\<lambda>st. transfer (address e) adv v' (accounts st)) st'''' = Normal (acc, st'''')" by simp
                                                   define k\<^sub>o where "k\<^sub>o = accounts st''''"
                                                   define m\<^sub>o where "m\<^sub>o = accounts st''''"
                                                   show ?thesis
                                                   proof (cases "stmt f e\<^sub>l cd\<^sub>l (st''''\<lparr>accounts := acc, stack:=k\<^sub>l,memory:=m\<^sub>l\<rparr>)")
                                                     case n2: (n a st''''')
                                                     with 7(1) g_def a1 gcost n Pair KValue Value TAddr Some s2 Contract p2 s1 Method p4 n1 p3 k2 v k\<^sub>o_def m\<^sub>o_def e'_def s3 f1 s4 s5
                                                     have "stmt (EXTERNAL ad i xe val) e cd st = Normal ((), st'''''\<lparr>stack:=stack st'''', memory := memory st''''\<rparr>)"
                                                       using stmt.psimps(7)[of ad i xe val e cd st] st'_def st''_def st'''_def st''''_def True False by simp
                                                     with a1 have "gas st6' \<le> gas st'''''" by auto
                                                     also from 7(2)[OF l1 l2 l3 l4 l5 l6 l7 _ _ l8 l9 _ _ _ s1 Method _ _ _ l10 _ _ _ l11, where ?s'm="st''''\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>" and ?s'l=st''''] p4 n2 e'_def True s3
                                                       have "\<dots> \<le> gas (st''''\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>)" by simp
                                                     also from msel_ssel_expr_load_rexp_gas(4)[of True fp xe e' emptyStore emptyStore emptyStore e cd st''' "gas st'''"]
                                                       have "\<dots> \<le> gas st'''" using s3 st'_def st''_def st'''_def st''''_def f1 s4 by simp
                                                     also from msel_ssel_expr_load_rexp_gas(3)[of val e cd st'' "gas st''"]
                                                       have "\<dots> \<le> gas st''" using n1 st'_def st''_def st'''_def by fastforce
                                                     also from msel_ssel_expr_load_rexp_gas(3)[of ad e cd st' "gas st - g"]
                                                       have "\<dots> \<le> gas st'" using n st'_def st''_def st'''_def by fastforce
                                                     finally show ?thesis using st'_def by simp
                                                   next
                                                     case (e x)
                                                     with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 Method p4 n1 p3 k2 v k\<^sub>o_def m\<^sub>o_def e'_def s3 f1 s4 s5 True show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def st''''_def by simp
                                                   qed
                                                 qed
                                               qed
                                             next
                                               case (e x)
                                               with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 Method p4 n1 p3 k2 v e'_def True s3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                             qed
                                           next
                                             case f: False
                                             with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 Method p4 n1 p3 k2 v s3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                           qed
                                         qed
                                       next
                                         case (Function _)
                                         with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 n1 p3 k2 v s3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                       next
                                         case (Var _)
                                         with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 s1 n1 p3 k2 v s3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                       qed
                                     qed
                                   qed
                                 next
                                   case (Calldata x2)
                                   with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 k2 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                 next
                                   case (Memory x3)
                                   with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 k2 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                 next
                                   case (Storage x4)
                                   with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 k2 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                                 qed
                               next
                                 case (KCDptr x2)
                                 with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                               next
                                 case (KMemptr x3)
                                 with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                               next
                                 case (KStoptr x4)
                                 with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 n1 p3 show ?thesis using stmt.psimps(7) st'_def st''_def st'''_def by simp
                               qed
                             qed
                           next
                             case n2: (e x)
                             with 7(1) g_def a1 gcost n Pair KValue Value TAddr False Some s2 Contract p2 show ?thesis using stmt.psimps(7) st'_def st''_def by simp
                           qed
                         qed
                       qed
                     qed
                   qed
                 qed
               qed
             next
               case (Calldata x2)
               with 7(1) g_def a1 gcost n Pair KValue show ?thesis using stmt.psimps(7) st'_def st''_def by simp
             next
               case (Memory x3)
               with 7(1) g_def a1 gcost n Pair KValue show ?thesis using stmt.psimps(7) st'_def st''_def by simp
             next
               case (Storage x4)
               with 7(1) g_def a1 gcost n Pair KValue show ?thesis using stmt.psimps(7) st'_def st''_def by simp
             qed
           next
             case (KCDptr x2)
             with 7(1) g_def a1 gcost n Pair show ?thesis using stmt.psimps(7) st'_def st''_def by simp
           next
             case (KMemptr x3)
             with 7(1) g_def a1 gcost n Pair show ?thesis using stmt.psimps(7) st'_def st''_def by simp
           next
             case (KStoptr x4)
             with 7(1) g_def a1 gcost n Pair show ?thesis using stmt.psimps(7) st'_def st''_def by simp
           qed
         qed
       next
         case (e _)
         with 7(1) g_def a1 gcost show ?thesis using stmt.psimps(7) st'_def by simp
       qed
     qed
   qed
 next
   case (8 ad ex e cd st)
   define g where "g = costs (TRANSFER ad ex) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume stmt_def: "stmt (TRANSFER ad ex) e cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 8 stmt_def g_def show ?thesis using stmt.psimps(8)[of ad ex e cd st] by simp
     next
       assume "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (TRANSFER ad ex) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: " modify (\<lambda>st. st\<lparr>gas := gas st - costs (TRANSFER ad ex) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       show ?thesis
       proof (cases "expr ad e cd st' (gas st - g)")
         case (n a0 g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         with n have l3: "toState (expr ad e cd) st' = Normal (a0, st'')" using st'_def by simp
         then show ?thesis
         proof (cases a0)
           case (Pair b c)
           then show ?thesis
           proof (cases b)
             case (KValue adv)
             then show ?thesis
             proof (cases c)
               case (Value x1)
               then show ?thesis
               proof (cases x1)
                 case (TSInt x1)
                 with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
               next
                 case (TUInt x2)
                 with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
               next
                 case TBool
                 with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
               next
                 case TAddr
                 then have l4: "(case a0 of (KValue adv, Value TAddr) \<Rightarrow> return adv | (KValue adv, Value _) \<Rightarrow> throw Err | (KValue adv, _) \<Rightarrow> throw Err
                        | (_, b) \<Rightarrow> throw Err) st'' = Normal (adv, st'')" using Pair KValue Value by simp
                 then show ?thesis
                 proof (cases "expr ex e cd st'' (gas st'')")
                   case n2: (n a1 g'')
                   define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                   with n2 have l5: "toState (expr ex e cd) st'' = Normal (a1, st''')" by simp
                   then show ?thesis
                   proof (cases a1)
                     case p2: (Pair b c)
                     then show ?thesis
                     proof (cases b)
                       case k2: (KValue v)
                       then show ?thesis
                       proof (cases c)
                         case v2: (Value t)
                         then have l6: "(case a1 of (KValue v, Value t) \<Rightarrow> return (v, t) | (KValue v, _) \<Rightarrow> throw Err | (_, b) \<Rightarrow> throw Err) st''' = Normal ((v,t), st''')" using p2 k2 by simp
                         then show ?thesis
                         proof (cases "convert t (TUInt 256) v")
                           case None
                           with 8(1) stmt_def g_def `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                         next
                           case (Some v')
                           then show ?thesis
                           proof (cases "type (accounts st''' adv)")
                             case None
                             with 8(1) stmt_def g_def `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Some show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                           next
                             case s0: (Some a)
                             then show ?thesis
                             proof (cases a)
                               case EOA
                               then show ?thesis
                               proof (cases "transfer (address e) adv v' (accounts st''')")
                                 case None
                                 with 8(1) stmt_def g_def `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Some EOA s0 show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                               next
                                 case s1: (Some acc)
                                 then have l7: "option Err (\<lambda>st. transfer (address e) adv v' (accounts st)) st''' = Normal (acc, st''')" using st'''_def by simp
                                 with 8(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Some EOA g_def s0
                                   have "stmt (TRANSFER ad ex) e cd st = Normal ((),st'''\<lparr>accounts:=acc\<rparr>)" using stmt.psimps(8)[of ad ex e cd st] st'_def st''_def st'''_def by simp
                                 with stmt_def have "gas st6' = gas (st'''\<lparr>accounts:=acc\<rparr>)" by auto
                                 also from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st'' "gas st''"]
                                   have "\<dots> \<le> gas st''" using st'_def st''_def st'''_def n2 by fastforce
                                 also from msel_ssel_expr_load_rexp_gas(3)[of ad e cd st' "gas st - g"]
                                   have "\<dots> \<le> gas st'" using st'_def st''_def n by fastforce
                                   finally show ?thesis using st'_def by simp
                               qed
                             next
                               case (Contract c)
                               then show ?thesis
                               proof (cases "ep $$ c")
                                 case None
                                 with 8(1) stmt_def g_def `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Contract Some s0 show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                               next
                                 case s2: (Some a)
                                 then show ?thesis
                                 proof (cases a)
                                   case p3: (fields ct cn f)
                                   with s2 have l7: "option Err (\<lambda>_. ep $$ c) st''' = Normal ((ct, cn, f), st''')" by simp
                                   define e' where "e' = ffold_init ct (emptyEnv adv c (address e) v') (fmdom ct)"
                                   show ?thesis
                                   proof (cases "transfer (address e) adv v' (accounts st''')")
                                     case None
                                     with 8(1) stmt_def g_def `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Contract Some s2 p3 s0 show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                                   next
                                     case s3: (Some acc)
                                     then have l8: "option Err (\<lambda>st. transfer (address e) adv v' (accounts st)) st''' = Normal (acc, st''')" by simp
                                     then show ?thesis
                                     proof (cases "stmt f e' emptyStore (st'''\<lparr>accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>)")
                                       case n3: (n a st'''')
                                       with 8(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Some s2 p3 g_def Contract s3 s0
                                       have "stmt (TRANSFER ad ex) e cd st = Normal ((),st''''\<lparr>stack:=stack st''', memory := memory st'''\<rparr>)" using e'_def stmt.psimps(8)[of ad ex e cd st] st'_def st''_def st'''_def by simp
                                       with stmt_def have "gas st6' \<le> gas st''''" by auto
                                       also from 8(2)[OF l1 l2 l3 l4 l5 l6, of v t _ _ "accounts st'''" "st'''", OF _ _ _ s0 Contract l7 _ _ _ _ _ l8, where ?s'k="st'''\<lparr>accounts := acc, stack := emptyStore, memory := emptyStore\<rparr>"] `\<not> gas st \<le> g` e'_def n3 Some
                                         have "\<dots> \<le> gas (st'''\<lparr>accounts := acc, stack := emptyStore, memory := emptyStore\<rparr>)" by simp
                                       also from msel_ssel_expr_load_rexp_gas(3)[of ex e cd st'' "gas st''"]
                                         have "\<dots> \<le> gas st''" using st'_def st''_def st'''_def n2 by fastforce
                                       also from msel_ssel_expr_load_rexp_gas(3)[of ad e cd st' "gas st - g"]
                                         have "\<dots> \<le> gas st'" using st'_def st''_def n by fastforce
                                       finally show ?thesis using st'_def by simp
                                     next
                                       case (e x)
                                       with 8(1) `\<not> gas st \<le> g` n Pair KValue Value n2 p2 k2 v2 TAddr Some s2 p3 g_def e'_def stmt_def Contract s3 s0 show ?thesis using stmt.psimps(8)[of ad ex e cd st] st'_def st''_def st'''_def by simp
                                     qed
                                   qed
                                 qed
                               qed
                             qed
                           qed
                         qed
                       next
                         case (Calldata x2)
                         with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 k2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                       next
                         case (Memory x3)
                         with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 k2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                       next
                         case (Storage x4)
                         with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 k2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                       qed
                     next
                       case (KCDptr x2)
                       with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                     next
                       case (KMemptr x3)
                       with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                     next
                       case (KStoptr x4)
                       with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr n2 p2 g_def show ?thesis using stmt.psimps(8) st'_def st''_def st'''_def by simp
                     qed
                   qed
                 next
                   case (e e)
                   with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue Value TAddr g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
                 qed
               qed
             next
               case (Calldata x2)
               with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
             next
               case (Memory x3)
               with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
             next
               case (Storage x4)
               with 8(1) stmt_def `\<not> gas st \<le> g` n Pair KValue g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
             qed
           next
             case (KCDptr x2)
             with 8(1) stmt_def `\<not> gas st \<le> g` n Pair g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
           next
             case (KMemptr x3)
             with 8(1) stmt_def `\<not> gas st \<le> g` n Pair g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
           next
             case (KStoptr x4)
             with 8(1) stmt_def `\<not> gas st \<le> g` n Pair g_def show ?thesis using stmt.psimps(8) st'_def st''_def by simp
           qed
         qed
       next
         case (e e)
         with 8(1) stmt_def `\<not> gas st \<le> g` g_def show ?thesis using stmt.psimps(8) st'_def by simp
       qed
     qed
   qed
 next
   case (9 id0 tp s e\<^sub>v cd st)
   define g where "g = costs (BLOCK ((id0, tp), None) s) e\<^sub>v cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume stmt_def: "stmt (BLOCK ((id0, tp), None) s) e\<^sub>v cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 9 stmt_def g_def show ?thesis using stmt.psimps(9) by simp
     next
       assume "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (BLOCK ((id0, tp), None) s) e\<^sub>v cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: "modify (\<lambda>st. st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) e\<^sub>v cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       show ?thesis
       proof (cases "decl id0 tp None False cd (memory st') (storage st') (cd, (memory st'), (stack st'), e\<^sub>v)")
         case n2: None
         with 9 stmt_def `\<not> gas st \<le> g` g_def show ?thesis using stmt.psimps(9) st'_def by simp
       next
         case (Some a)
         then have l3: "option Err (\<lambda>st. decl id0 tp None False cd (memory st) (storage st) (cd, memory st, stack st, e\<^sub>v)) st' = Normal (a, st')" by simp
         then show ?thesis
         proof (cases a)
           case (fields cd' mem' sck' e')
           with 9(1) stmt_def `\<not> gas st \<le> g` g_def have "stmt (BLOCK ((id0, tp), None) s) e\<^sub>v cd st = stmt s e' cd' (st\<lparr>gas := gas st - g, stack := sck', memory := mem'\<rparr>)" using stmt.psimps(9)[OF 9(1)] Some st'_def by simp
           with 9(2)[OF l1 l2 l3] stmt_def `\<not> gas st \<le> g` fields g_def have "gas st6' \<le> gas (st\<lparr>gas := gas st - g, stack := sck', memory := mem'\<rparr>)" using st'_def by fastforce
           then show ?thesis by simp
         qed
       qed
     qed
   qed
 next
   case (10 id0 tp ex' s e\<^sub>v cd st)
   define g where "g = costs (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume stmt_def: "stmt (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof cases
       assume "gas st \<le> g"
       with 10 stmt_def g_def show ?thesis using stmt.psimps(10) by simp
     next
       assume "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: "modify (\<lambda>st. st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       show ?thesis
       proof (cases "expr ex' e\<^sub>v cd st' (gas st - g)")
         case (n a g')
         define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
         with n have l3: "toState (expr ex' e\<^sub>v cd) st' = Normal (a, st'')" using st''_def st'_def by simp
         then show ?thesis
         proof (cases a)
           case (Pair v t)
           then show ?thesis
           proof (cases "decl id0 tp (Some (v, t)) False cd (memory st'') (storage st'') (cd, memory st'', stack st'', e\<^sub>v)")
             case None
             with 10(1) stmt_def `\<not> gas st \<le> g` n Pair g_def show ?thesis using stmt.psimps(10) st'_def st''_def by simp
           next
             case s2: (Some a)
             then have l4: "option Err (\<lambda>st. decl id0 tp (Some (v, t)) False cd (memory st) (storage st) (cd, memory st, stack st, e\<^sub>v)) st'' = Normal (a, st'')" by simp
             then show ?thesis
             proof (cases a)
               case (fields cd' mem' sck' e')
               with 10(1) stmt_def `\<not> gas st \<le> g` n Pair s2 g_def have "stmt (BLOCK ((id0, tp), Some ex') s) e\<^sub>v cd st = stmt s e' cd' (st''\<lparr>stack := sck', memory := mem'\<rparr>)" using stmt.psimps(10)[of id0 tp ex' s e\<^sub>v cd st] st'_def st''_def by simp
               with 10(2)[OF l1 l2 l3 Pair l4 fields, where s'd="st''\<lparr>stack := sck', memory := mem'\<rparr>"] n stmt_def `\<not> gas st \<le> g` s2 fields g_def have "gas st6' \<le> gas st''" by simp
               moreover from msel_ssel_expr_load_rexp_gas(3)[of ex' e\<^sub>v cd st' "gas st - g"] n have "gas st'' \<le> gas st'" using st'_def st''_def by fastforce
               ultimately show ?thesis using st'_def by simp
             qed
           qed
         qed
       next
         case (e e)
         with 10 stmt_def `\<not> gas st \<le> g` g_def show ?thesis using stmt.psimps(10) st'_def by simp
       qed
     qed
   qed
 next
   case (11 i xe val e cd st)
   define g where "g = costs (NEW i xe val) e cd st"
   show ?case
   proof (rule allI[OF impI])
     fix st6' assume a1: "stmt (NEW i xe val) e cd st = Normal ((), st6')"
     show "gas st6' \<le> gas st"
     proof (cases)
       assume "gas st \<le> g"
       with 11(1) a1 show ?thesis using stmt.psimps(11) g_def by simp
     next
       assume gcost: "\<not> gas st \<le> g"
       then have l1: "assert Gas (\<lambda>st. costs (NEW i xe val) e cd st < gas st) st = Normal ((), st) " using g_def by simp
       define st' where "st' = st\<lparr>gas := gas st - g\<rparr>"
       then have l2: "modify (\<lambda>st. st\<lparr>gas := gas st - costs (NEW i xe val) e cd st\<rparr>) st = Normal ((), st')" using g_def by simp
       define adv where "adv = hash (address e) (ShowL\<^sub>n\<^sub>a\<^sub>t (contracts (accounts st' (address e))))"
       then show ?thesis
       proof (cases "type (accounts st' adv) = None")
         case True
         then show ?thesis
         proof (cases "expr val e cd st' (gas st')")
           case n0: (n kv g')
           define st'' where "st'' = st'\<lparr>gas := g'\<rparr>"
           then have l4: "toState (expr val e cd) st' = Normal (kv, st'')" using n0 by simp
           then show ?thesis
           proof (cases kv)
             case p0: (Pair a b)
             then show ?thesis
             proof (cases a)
               case k0: (KValue v)
               then show ?thesis
               proof (cases b)
                 case v0: (Value t)
                 then show ?thesis
                 proof (cases "ep $$ i")
                   case None
                   with a1 gcost g_def True n0 p0 k0 v0
                   show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def st''_def by simp
                 next
                   case s0: (Some a)
                   then have l5: "option Err (\<lambda>_. ep $$ i) st'' = Normal (a, st'')" by simp
                   then show ?thesis
                   proof (cases a)
                     case f0: (fields ct cn _)
                     define e' where "e' = ffold_init ct (emptyEnv adv i (address e) v) (fmdom ct)"
                     then show ?thesis
                     proof (cases "load True (fst cn) xe e' emptyStore emptyStore emptyStore e cd st'' (gas st'')")
                       case n1: (n a g'')
                       define st''' where "st''' = st''\<lparr>gas := g''\<rparr>"
                       then have l6: "toState (load True (fst cn) xe e' emptyStore emptyStore emptyStore e cd) st'' = Normal (a, st''')" using n1 by simp
                       then show ?thesis
                       proof (cases a)
                         case f1: (fields e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l)
                         define st'''' where "st'''' = st'''\<lparr>accounts:=(accounts st''')(adv := \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = Some (Contract i), contracts = 0\<rparr>), storage:=(storage st''')(adv := {$$})\<rparr>"
                         then show ?thesis
                         proof (cases "transfer (address e) adv v (accounts st'''')")
                           case None
                           with a1 gcost g_def True n0 p0 k0 v0 s0 f0 n1 f1
                           show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def e'_def st'_def st''_def st'''_def st''''_def by (simp add:Let_def)
                         next
                           case s1: (Some acc)
                           define st''''' where "st''''' = st''''\<lparr>accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>"
                           then show ?thesis
                           proof (cases "stmt (snd cn) e\<^sub>l cd\<^sub>l st'''''")
                             case (n a st'''''')
                             define st''''''' where "st''''''' = st''''''\<lparr>stack:=stack st'''', memory := memory st''''\<rparr>"
                             define st'''''''' where "st'''''''' = incrementAccountContracts (address e) st'''''''"
                             from a1 gcost g_def True n0 p0 k0 v0 s0 f0 n1 f1 s1 n have "st6' = st''''''''"
                               using st'_def st''_def st'''_def st''''_def st'''''_def st'''''''_def st''''''''_def
                               stmt.psimps(11)[OF 11(1)] adv_def e'_def by (simp add:Let_def)
                             then have "gas st6' = gas st''''''''" by simp
                             also have "\<dots> \<le> gas st'''''''" using st''''''''_def incrementAccountContracts_def by simp
                             also have "\<dots> \<le> gas st''''''" using st'''''''_def by simp
                             also have "\<dots> \<le> gas st'''''" using 11(2)[OF l1 l2 _ _ l4 _ _ l5 _ _ e'_def l6, where ?s'h="st''''" and ?s'i="st''''" and ?s'j="st''''" and ?s'k="st''''\<lparr>accounts := acc, stack := k\<^sub>l, memory := m\<^sub>l\<rparr>", of st' "()"] p0 k0 v0 f0 f1 s1 n True st''''_def st'''''_def adv_def by simp
                             also have "\<dots> \<le> gas st''''" using st'''''_def by simp
                             also have "\<dots> \<le> gas st'''" using st''''_def by simp
                             also have "\<dots> \<le> gas st''" using st'''_def msel_ssel_expr_load_rexp_gas(4) n1 f1 by simp
                             also have "\<dots> \<le> gas st'" using st''_def msel_ssel_expr_load_rexp_gas(3) n0 p0 by simp
                             also have "\<dots> \<le> gas st" using st'_def by simp
                             finally show ?thesis .
                           next
                             case (e e)
                             with a1 gcost g_def n0 True p0 k0 v0 s0 f0 n1 f1 s1
                             show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def e'_def st'_def st''_def st'''_def st''''_def st'''''_def by (simp add:Let_def)
                           qed
                         qed
                       qed
                     next
                       case (e e)
                       with a1 gcost g_def n0 True p0 k0 v0 s0 f0
                       show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def e'_def st'_def st''_def by (simp add:Let_def)
                     qed
                   qed
                 qed
               next
                 case (Calldata x2)
                 with a1 gcost g_def n0 True p0 k0
                 show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
               next
                 case (Memory x3)
                 with a1 gcost g_def n0 True p0 k0
                 show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
               next
                 case (Storage x4)
                 with a1 gcost g_def n0 True p0 k0
                 show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
               qed
             next
               case (KCDptr x2)
               with a1 gcost g_def n0 True p0
               show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
             next
               case (KMemptr x3)
               with a1 gcost g_def n0 True p0
               show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
             next
               case (KStoptr x4)
               with a1 gcost g_def n0 True p0
               show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
             qed
           qed
         next
           case (e e)
           with a1 gcost g_def True
           show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by simp
         qed
       next
         case False
         with a1 gcost g_def
         show ?thesis using stmt.psimps(11)[OF 11(1)] adv_def st'_def by (simp split:if_split_asm)
       qed
     qed
   qed
 qed
 
 subsection \<open>Termination function\<close>
 
 text \<open>Now we can prove termination using the lemma above.\<close>
 
 fun sgas
   where "sgas l = gas (snd (snd (snd l)))"
 
 fun ssize
   where "ssize l = size (fst l)"
 
 method stmt_dom_gas =
   match premises in s: "stmt _ _ _ _ = Normal (_,_)" and d[thin]: "stmt_dom _" \<Rightarrow> \<open>insert stmt_dom_gas[OF d s]\<close>
 method msel_ssel_expr_load_rexp =
   match premises in e[thin]: "expr _ _ _ _ _ = Normal (_,_)" \<Rightarrow> \<open>insert msel_ssel_expr_load_rexp_gas(3)[OF e]\<close> |
   match premises in l[thin]: "load _ _ _ _ _ _ _ _ _ _ _ = Normal (_,_)" \<Rightarrow> \<open>insert msel_ssel_expr_load_rexp_gas(4)[OF l, THEN conjunct1]\<close>
 method costs =
   match premises in "costs (WHILE ex s0) e cd st < _" for ex s0 and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert while_not_zero[of (unchecked) ex s0 e cd st]\<close> |
   match premises in "costs (INVOKE i xe) e cd st < _" for i xe and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert invoke_not_zero[of (unchecked) i xe e cd st]\<close> |
   match premises in "costs (EXTERNAL ad i xe val) e cd st < _" for ad i xe val and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert external_not_zero[of (unchecked) ad i xe val e cd st]\<close> |
   match premises in "costs (TRANSFER ad ex) e cd st < _" for ad ex and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert transfer_not_zero[of (unchecked) ad ex e cd st]\<close> |
   match premises in "costs (NEW i xe val) e cd st < _" for i xe val and e::Environment and cd::CalldataT and st::State \<Rightarrow> \<open>insert new_not_zero[of (unchecked) i xe val e cd st]\<close>
 
 termination stmt
   apply (relation "measures [sgas, ssize]")
   apply (auto split: if_split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm bool.split_asm atype.split_asm)
   apply ((stmt_dom_gas | msel_ssel_expr_load_rexp)+, costs?, simp)+
   done
 
 subsection \<open>Gas Reduction\<close>
 
 text \<open>
   The following corollary is a generalization of @{thm [source] msel_ssel_expr_load_rexp_dom_gas}.
   We first prove that the function is defined for all input values and then obtain the final result as a corollary.
 \<close>
 lemma stmt_dom: "stmt_dom (s6, ev6, cd6, st6)"
   apply (induct rule: stmt.induct[where ?P="\<lambda>s6 ev6 cd6 st6. stmt_dom (s6, ev6, cd6, st6)"])
   apply (simp_all add: stmt.domintros(1-10))
   apply (rule stmt.domintros(11), force)
   done
 
 lemmas stmt_gas = stmt_dom_gas[OF stmt_dom]
 
 lemma skip:
   assumes "stmt SKIP ev cd st = Normal (x, st')"
     shows "gas st > costs SKIP ev cd st"
       and "st' = st\<lparr>gas := gas st - costs SKIP ev cd st\<rparr>"
   using assms by (auto split:if_split_asm)
 
 lemma assign:
   assumes "stmt (ASSIGN lv ex) ev cd st  = Normal (xx, st')"
   obtains (1) v t g l t' g' v'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KValue v, Value t), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Value t'),g')"
       and "convert t t' v = Some v'"
       and "st' = st\<lparr>gas := g', stack := updateStore l (KValue v') (stack st)\<rparr>"
   | (2) v t g l t' g' v'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KValue v, Value t), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, Storage (STValue t')),g')"
       and "convert t t' v = Some v'"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := (fmupd l v' (storage st (address ev))))\<rparr>"
   | (3) v t g l t' g' v'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KValue v, Value t), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, Memory (MTValue t')),g')"
       and "convert t t' v = Some v'"
       and "st' = st\<lparr>gas := g', memory := updateStore l (MValue v') (memory st)\<rparr>"
   | (4) p x t g l t' g' p' m
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KCDptr p, Calldata (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
       and "accessStore l (stack st) = Some (KMemptr p')"
       and "cpm2m p p' x t cd (memory st) = Some m"
       and "st' = st\<lparr>gas := g', memory := m\<rparr>"
   | (5) p x t g l t' g' p' s
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KCDptr p, Calldata (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
       and "accessStore l (stack st) = Some (KStoptr p')"
       and "cpm2s p p' x t cd (storage st (address ev)) = Some s"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := s)\<rparr>"
   | (6) p x t g l t' g' s
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KCDptr p, Calldata (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
       and "cpm2s p l x t cd (storage st (address ev)) = Some s"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := s)\<rparr>"
   | (7) p x t g l t' g' m
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KCDptr p, Calldata (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       and "cpm2m p l x t cd (memory st) = Some m"
       and "st' = st\<lparr>gas := g', memory := m\<rparr>"
   | (8) p x t g l t' g'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KMemptr p, Memory (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
       and "st' = st\<lparr>gas := g', stack := updateStore l (KMemptr p) (stack st)\<rparr>"
   | (9) p x t g l t' g' p' s
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KMemptr p, Memory (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
       and "accessStore l (stack st) = Some (KStoptr p')"
       and "cpm2s p p' x t (memory st) (storage st (address ev)) = Some s"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := s)\<rparr>"
   | (10) p x t g l t' g' s
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KMemptr p, Memory (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
       and "cpm2s p l x t (memory st) (storage st (address ev)) = Some s"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := s)\<rparr>"
   | (11) p x t g l t' g'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KMemptr p, Memory (MTArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       and "st' = st\<lparr>gas := g', memory := updateStore l (MPointer p) (memory st)\<rparr>"
   | (12) p x t g l t' g' p' m
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
       and "accessStore l (stack st) = Some (KMemptr p')"
       and "cps2m p p' x t (storage st (address ev)) (memory st) = Some m"
       and "st' = st\<lparr>gas := g', memory := m\<rparr>"
   | (13) p x t g l t' g'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
       and "st' = st\<lparr>gas := g', stack := updateStore l (KStoptr p) (stack st)\<rparr>"
   | (14) p x t g l t' g' s
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
       and "copy p l x t (storage st (address ev)) = Some s"
       and "st' = st\<lparr>gas := g', storage := (storage st) (address ev := s)\<rparr>"
   | (15) p x t g l t' g' m
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STArray x t)), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       and "cps2m p l x t (storage st (address ev)) (memory st) = Some m"
       and "st' = st\<lparr>gas := g', memory := m\<rparr>"
   | (16) p t t' g l t'' g'
     where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STMap t t')), g)"
       and "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, t''),g')"
       and "st' = st\<lparr>gas := g', stack := updateStore l (KStoptr p) (stack st)\<rparr>"
 proof -
   from assms consider
     (1) v t g where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KValue v, Value t), g)"
   | (2) p x t g where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KCDptr p, Calldata (MTArray x t)), g)"
   | (3) p x t g where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KMemptr p, Memory (MTArray x t)), g)"
   | (4) p x t g where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STArray x t)), g)"
   | (5) p t t' g where "expr ex ev cd (st\<lparr>gas := gas st - costs  (ASSIGN lv ex) ev cd st\<rparr>) (gas st - costs  (ASSIGN lv ex) ev cd st) = Normal ((KStoptr p, Storage (STMap t t')), g)"
     by (auto split:if_split_asm result.split_asm Stackvalue.split_asm Type.split_asm MTypes.split_asm STypes.split_asm)
   then show ?thesis
   proof cases
     case 1
     with assms consider
       (11) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Value t'),g')"
     | (12) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, Storage (STValue t')),g')"
     | (13) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, Memory (MTValue t')),g')"
       by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm)
     then show ?thesis
     proof cases
       case 11
       with 1 assms show ?thesis using that(1) by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm)
     next
       case 12
       with 1 assms show ?thesis using that(2) by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm)
     next
       case 13
       with 1 assms show ?thesis using that(3) by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm)
     qed
   next
     case 2
     with assms consider
       (21) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
     | (22) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
     | (23) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
     | (24) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm)
     then show ?thesis
     proof cases
       case 21
       moreover from assms 2 21 obtain p' where 3: "accessStore l (stack st) = Some (KMemptr p')"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       moreover from assms 2 21 3 obtain m where "cpm2m p p' x t cd (memory st) = Some m"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(4) assms 2 21
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 22
       moreover from assms 2 22 obtain p' where 3: "accessStore l (stack st) = Some (KStoptr p')"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       moreover from assms 2 22 3 4 obtain s where "cpm2s p p' x t cd (storage st (address ev)) = Some s"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(5) assms 2 22
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 23
       moreover from assms 2 23 3 4 obtain s where "cpm2s p l x t cd (storage st (address ev)) = Some s"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(6) assms 2
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 24
       moreover from assms 2 24 obtain m where "cpm2m p l x t cd (memory st) = Some m"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(7) assms 2
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     qed
   next
     case 3
     with assms consider
       (31) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
     | (32) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
     | (33) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
     | (34) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm)
     then show ?thesis
     proof cases
       case 31
       then show ?thesis using that(8) assms 3 by (auto split:if_split_asm)
     next
       case 32
       moreover from assms 3 32 obtain p' where 4: "accessStore l (stack st) = Some (KStoptr p')"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       moreover from assms 3 32 4 5 obtain s where "cpm2s p p' x t (memory st) (storage st (address ev)) = Some s"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(9) assms 3
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 33
       moreover from assms 3 33 3 4 obtain s where "cpm2s p l x t (memory st) (storage st (address ev)) = Some s"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(10) assms 3
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 34
       then show ?thesis using that(11) assms 3
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     qed
   next
     case 4
     with assms consider
       (41) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Memory t'),g')"
     | (42) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStackloc l, Storage t'),g')"
     | (43) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LStoreloc l, t'),g')"
     | (44) l t' g' where "lexp lv ev cd (st\<lparr>gas := g\<rparr>) g = Normal((LMemloc l, t'),g')"
       by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm)
     then show ?thesis
     proof cases
       case 41
       moreover from assms 4 41 obtain p' where 5: "accessStore l (stack st) = Some (KMemptr p')"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       moreover from assms 4 41 5 6 obtain m where "cps2m p p' x t (storage st (address ev)) (memory st) = Some m"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(12) assms 4
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 42
       then show ?thesis using that(13) assms 4
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 43
       moreover from assms 4 43 5 obtain s where "copy p l x t (storage st (address ev)) = Some s"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(14) assms 4
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     next
       case 44
       moreover from assms 4 44 5 obtain m where "cps2m p l x t (storage st (address ev)) (memory st) = Some m"
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
       ultimately show ?thesis using that(15) assms 4
         by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
     qed
   next
     case 5
     then show ?thesis using that(16) assms
       by (auto split:if_split_asm result.split_asm Type.split_asm LType.split_asm MTypes.split_asm STypes.split_asm option.split_asm Stackvalue.split_asm)
   qed
 qed
 
 lemma comp:
   assumes "stmt (COMP s1 s2) ev cd st = Normal (x, st')"
   obtains (1) st''
   where "gas st > costs (COMP s1 s2) ev cd st"
     and "stmt s1 ev cd (st\<lparr>gas := gas st - costs (COMP s1 s2) ev cd st\<rparr>) = Normal((), st'')"
     and "stmt s2 ev cd st'' = Normal((), st')"
   using assms by (simp split:if_split_asm result.split_asm prod.split_asm)
 
 lemma ite:
   assumes "stmt (ITE ex s1 s2) ev cd st = Normal (x, st')"
   obtains (True) g
   where "gas st > costs (ITE ex s1 s2) ev cd st"
     and "expr ex ev cd (st\<lparr>gas := gas st - costs (ITE ex s1 s2) ev cd st\<rparr>) (gas st - costs (ITE ex s1 s2) ev cd st) = Normal((KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True), Value TBool), g)"
     and "stmt s1 ev cd (st\<lparr>gas := g\<rparr>) = Normal((), st')"
 | (False) g
   where "gas st > costs (ITE ex s1 s2) ev cd st"
     and "expr ex ev cd (st\<lparr>gas := gas st - costs (ITE ex s1 s2) ev cd st\<rparr>) (gas st - costs (ITE ex s1 s2) ev cd st) = Normal((KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False), Value TBool), g)"
     and "stmt s2 ev cd (st\<lparr>gas := g\<rparr>) = Normal((), st')"
   using assms by (simp split:if_split_asm result.split_asm prod.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm)
 
 lemma while:           
   assumes "stmt (WHILE ex s0) ev cd st = Normal (x, st')"
   obtains (True) g st''
     where "gas st > costs (WHILE ex s0) ev cd st"
       and "expr ex ev cd (st\<lparr>gas := gas st - costs (WHILE ex s0) ev cd st\<rparr>) (gas st - costs (WHILE ex s0) ev cd st) = Normal((KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True), Value TBool), g)"
       and "stmt s0 ev cd (st\<lparr>gas := g\<rparr>) = Normal((), st'')"
       and "stmt (WHILE ex s0) ev cd st'' = Normal ((), st')"
     | (False) g
   where "gas st > costs (WHILE ex s0) ev cd st"
     and "expr ex ev cd (st\<lparr>gas := gas st - costs (WHILE ex s0) ev cd st\<rparr>) (gas st - costs (WHILE ex s0) ev cd st) = Normal((KValue (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False), Value TBool), g)"
     and "st' = st\<lparr>gas := g\<rparr>"
   using assms
 proof -
   from assms have 1: "gas st > costs (WHILE ex s0) ev cd st" by (simp split:if_split_asm)
   moreover from assms 1 have 2: "modify (\<lambda>st. st\<lparr>gas := gas st - costs (WHILE ex s0) ev cd st\<rparr>) st = Normal ((), st\<lparr>gas := gas st - costs (WHILE ex s0) ev cd st\<rparr>)" by simp
   moreover from assms 1 2 obtain b g where 3: "expr ex ev cd (st\<lparr>gas := gas st - costs (WHILE ex s0) ev cd st\<rparr>) (gas st - costs (WHILE ex s0) ev cd st) = Normal ((KValue b, Value TBool), g)" by (simp split:result.split_asm prod.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm)
   ultimately consider (True) "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True" | (False) "b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False" | (None) "b \<noteq> ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True \<and> b \<noteq> ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False" by auto
   then show ?thesis
   proof cases
     case True
     moreover from assms 1 2 3 True obtain st' where 4: "stmt s0 ev cd (st\<lparr>gas := g\<rparr>) = Normal ((), st')" by (simp split:result.split_asm prod.split_asm)
     moreover from assms 1 2 3 4 True obtain st'' where 5: "stmt (WHILE ex s0) ev cd st' = Normal ((), st'')" by (simp split:result.split_asm prod.split_asm)
     ultimately show ?thesis using 1 2 3 that(1) assms by simp
   next
     case False
     then show ?thesis using 1 2 3 that(2) assms true_neq_false by simp
   next
     case None
     then show ?thesis using 1 2 3 assms by simp
   qed
 qed  
 
 lemma invoke:
   fixes ev
   defines "e' members \<equiv> ffold (init members) (emptyEnv (address ev) (contract ev) (sender ev) (svalue ev)) (fmdom members)"
   assumes "stmt (INVOKE i xe) ev cd st = Normal (x, st')"
   obtains ct fb fp f e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g st''
     where "gas st > costs (INVOKE i xe) ev cd st"
       and "ep $$ contract ev = Some (ct, fb)"
       and "ct $$ i = Some (Method (fp, False, f))"
       and "load False fp xe (e' ct) emptyStore emptyStore (memory (st\<lparr>gas := gas st - costs (INVOKE i xe) ev cd st\<rparr>)) ev cd (st\<lparr>gas := gas st - costs (INVOKE i xe) ev cd st\<rparr>) (gas st - costs (INVOKE i xe) ev cd st) = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g)"
       and "stmt f e\<^sub>l cd\<^sub>l (st\<lparr>gas:= g, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')"
       and "st' = st''\<lparr>stack:=stack st\<rparr>"
 proof -
   from assms have 1: "gas st > costs (INVOKE i xe) ev cd st" by (simp split:if_split_asm)
   moreover from assms 1 obtain ct fb where 2: "ep $$ (contract ev) = Some (ct, fb)" by (simp split: prod.split_asm result.split_asm option.split_asm)
   moreover from assms 1 2 obtain fp f where 3: "ct $$ i = Some (Method (fp, False, f))" by (simp split: prod.split_asm result.split_asm option.split_asm Member.split_asm bool.split_asm)
   moreover from assms 1 2 3 obtain e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g where 4: "load False fp xe (e' ct) emptyStore emptyStore (memory (st\<lparr>gas := gas st - costs (INVOKE i xe) ev cd st\<rparr>)) ev cd (st\<lparr>gas := gas st - costs (INVOKE i xe) ev cd st\<rparr>) (gas st - costs (INVOKE i xe) ev cd st) = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g)" by (simp split: prod.split_asm result.split_asm)
   moreover from assms 1 2 3 4 obtain st'' where 5: "stmt f e\<^sub>l cd\<^sub>l (st\<lparr>gas:= g, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')" by (simp split: prod.split_asm result.split_asm)
   moreover from assms 1 2 3 4 5 have "st' = st''\<lparr>stack:=stack st\<rparr>" by (simp split: prod.split_asm result.split_asm)
   ultimately show ?thesis using that by simp
 qed
 
 lemma external:
   fixes ev
   defines "e' members adv c v \<equiv> ffold (init members) (emptyEnv adv c (address ev) v) (fmdom members)"
   assumes "stmt (EXTERNAL ad' i xe val) ev cd st = Normal (x, st')"
   obtains (Some) adv c g ct cn fb' v t g' v' fp f e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g'' acc st''
     where "gas st > costs (EXTERNAL ad' i xe val) ev cd st"
       and "expr ad' ev cd (st\<lparr>gas := gas st - costs (EXTERNAL ad' i xe val) ev cd st\<rparr>) (gas st - costs  (EXTERNAL ad' i xe val) ev cd st) = Normal ((KValue adv, Value TAddr), g)"
       and "adv \<noteq> address ev"
       and "type (accounts (st\<lparr>gas := g\<rparr>) adv) = Some (Contract c)"
       and "ep $$ c = Some (ct, cn, fb')"
       and "expr val ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "convert t (TUInt 256) v = Some v'"
       and "fmlookup ct i = Some (Method (fp, True, f))"
       and "load True fp xe (e' ct adv c v') emptyStore emptyStore emptyStore ev cd (st\<lparr>gas := g'\<rparr>) g' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')"
       and "transfer (address ev) adv v' (accounts (st\<lparr>gas := g''\<rparr>)) = Some acc"
       and "stmt f e\<^sub>l cd\<^sub>l (st\<lparr>gas := g'', accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')"
       and "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>"
     | (None) adv c g ct cn fb' v t g' v' acc st''
     where "gas st > costs (EXTERNAL ad' i xe val) ev cd st"
       and "expr ad' ev cd (st\<lparr>gas := gas st - costs  (EXTERNAL ad' i xe val) ev cd st\<rparr>) (gas st - costs  (EXTERNAL ad' i xe val) ev cd st) = Normal ((KValue adv, Value TAddr), g)"
       and "adv \<noteq> address ev"
       and "type (accounts (st\<lparr>gas := g\<rparr>) adv) = Some (Contract c)"
       and "ep $$ c = Some (ct, cn, fb')"
       and "expr val ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "convert t (TUInt 256) v = Some v'"
       and "ct $$ i = None"
       and "transfer (address ev) adv v' (accounts st) = Some acc"
       and "stmt fb' (e' ct adv c v') emptyStore (st\<lparr>gas := g', accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>) = Normal ((), st'')"
       and "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>"
 proof -
   from assms have 1: "gas st > costs (EXTERNAL ad' i xe val) ev cd st" by (simp split:if_split_asm)
   moreover from assms 1 obtain adv g where 2: "expr ad' ev cd (st\<lparr>gas := gas st - costs  (EXTERNAL ad' i xe val) ev cd st\<rparr>) (gas st - costs  (EXTERNAL ad' i xe val) ev cd st) = Normal ((KValue adv, Value TAddr), g)" by (simp split: prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm)
   moreover from assms 1 2 obtain c where 3: "type (accounts (st\<lparr>gas := g\<rparr>) adv) = Some (Contract c)" by (simp split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm atype.split_asm)
   moreover from assms 1 2 3 obtain ct cn fb' where 4: "ep $$ c = Some (ct, cn, fb')" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm)
   moreover from assms 1 2 3 4 obtain v t g' where 5: "expr val ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')" using 1 2 by (simp split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm)
   moreover from assms 1 2 3 4 5 have 6: "adv \<noteq> address ev" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm)
   moreover from assms 1 2 3 4 5 6 obtain v' where 7: "convert t (TUInt 256) v = Some v'" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm)
   ultimately consider (Some) fp f where "ct $$ i = Some (Method (fp, True, f))" | (None) "fmlookup ct i = None" using assms by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm bool.split_asm)
   then show ?thesis
   proof cases
     case (Some fp f)
     moreover from assms 1 2 3 4 5 6 7 Some obtain e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g'' where 8: "load True fp xe (e' ct adv c v') emptyStore emptyStore emptyStore ev cd (st\<lparr>gas := g'\<rparr>) g' = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g'')" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 5 6 7 Some 8 obtain acc where 9: "transfer (address ev) adv v' (accounts st) = Some acc" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 5 6 7 Some 8 9 obtain st'' where 10: "stmt f e\<^sub>l cd\<^sub>l (st\<lparr>gas := g'', accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')" by (simp add: Let_def transfer_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 5 6 7 Some 8 9 10 have "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>" by (simp add: Let_def transfer_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     ultimately show ?thesis using 1 2 3 4 5 6 7 that(1) by simp
   next
     case None
     moreover from assms 1 2 3 4 5 6 7 None obtain acc where 8: "transfer (address ev) adv v' (accounts st) = Some acc" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 5 6 7 None 8 obtain st'' where 9: "stmt fb' (e' ct adv c v') emptyStore (st\<lparr>gas := g', accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>) = Normal ((), st'')" by (simp add: Let_def transfer_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 5 6 7 None 8 9 have "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>" by (simp add: Let_def transfer_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     ultimately show ?thesis using 1 2 3 4 5 6 7 that(2) by simp
   qed
 qed
 
 lemma transfer:
   fixes ev
   defines "e' members adv c st v \<equiv> ffold (init members) (emptyEnv adv c (address ev) v) (fmdom members)"
   assumes "stmt (TRANSFER ad ex) ev cd st = Normal (x, st')"
   obtains (Contract) v t g adv c g' v' acc ct cn f st''
     where "gas st > costs (TRANSFER ad ex) ev cd st"
       and "expr ad ev cd (st\<lparr>gas := gas st - costs (TRANSFER ad ex) ev cd st\<rparr>) (gas st - costs (TRANSFER ad ex) ev cd st) = Normal ((KValue adv, Value TAddr), g)"
       and "expr ex ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "convert t (TUInt 256) v = Some v'"
       and "type (accounts (st\<lparr>gas := g\<rparr>) adv) = Some (Contract c)"
       and "ep $$ c = Some (ct, cn, f)"
       and "transfer (address ev) adv v' (accounts st) = Some acc"
       and "stmt f (e' ct adv c (st\<lparr>gas := g'\<rparr>) v') emptyStore (st\<lparr>gas := g', accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>) = Normal ((), st'')"
       and "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>"
     | (EOA) v t g adv g' v' acc
     where "gas st > costs (TRANSFER ad ex) ev cd st"
       and "expr ad ev cd (st\<lparr>gas := gas st - costs  (TRANSFER ad ex) ev cd st\<rparr>) (gas st - costs (TRANSFER ad ex) ev cd st) = Normal ((KValue adv, Value TAddr), g)"
       and "expr ex ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')"
       and "convert t (TUInt 256) v = Some v'"
       and "type (accounts (st\<lparr>gas := g\<rparr>) adv) = Some EOA"
       and "transfer (address ev) adv v' (accounts st) = Some acc"
       and "st' = st\<lparr>gas:=g', accounts:=acc\<rparr>"
 proof -
   from assms have 1: "gas st > costs (TRANSFER ad ex) ev cd st" by (simp split:if_split_asm)
   moreover from assms 1 obtain adv g where 2: "expr ad ev cd (st\<lparr>gas := gas st - costs  (TRANSFER ad ex) ev cd st\<rparr>) (gas st - costs (TRANSFER ad ex) ev cd st) = Normal ((KValue adv, Value TAddr), g)" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm)
   moreover from assms 1 2 obtain v t g' where 3: "expr ex ev cd (st\<lparr>gas := g\<rparr>) g = Normal ((KValue v, Value t), g')" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm)
   moreover from assms 1 2 3 obtain v' where 4: "convert t (TUInt 256) v = Some v'" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm)
   ultimately consider (Contract) c where "type (accounts (st\<lparr>gas := g'\<rparr>) adv) = Some (Contract c)" | (EOA) "type (accounts (st\<lparr>gas := g'\<rparr>) adv) = Some EOA" using assms by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm atype.split_asm)
   then show ?thesis
   proof cases
     case (Contract c)
     moreover from assms 1 2 3 4 Contract obtain ct cn f where 5: "ep $$ c = Some (ct, cn, f)" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm atype.split_asm atype.split_asm)
     moreover from assms 1 2 3 4 Contract 5 obtain acc where 6: "transfer (address ev) adv v' (accounts st) = Some acc" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 Contract 5 6 obtain st'' where 7: "stmt f (e' ct adv c (st\<lparr>gas := g'\<rparr>) v') emptyStore (st\<lparr>gas := g', accounts := acc, stack:=emptyStore, memory:=emptyStore\<rparr>) = Normal ((), st'')" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 Contract 5 6 7 have "st' = st''\<lparr>stack:=stack st, memory := memory st\<rparr>" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     ultimately show ?thesis using 1 2 3 4 that(1) by simp
   next
     case EOA
     moreover from assms 1 2 3 4 EOA obtain acc where 5: "transfer (address ev) adv v' (accounts st) = Some acc" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     moreover from assms 1 2 3 4 EOA 5 have "st' = st\<lparr>gas:=g', accounts:=acc\<rparr>" by (simp add: Let_def split: if_split_asm prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm Types.split_asm option.split_asm Member.split_asm)
     ultimately show ?thesis using 1 2 3 4 that(2) by simp
   qed
 qed
 
 lemma blockNone:
   fixes ev
   assumes "stmt (BLOCK ((id0, tp), None) s) ev cd st = Normal (x, st')"
   obtains cd' mem' sck' e'
     where "gas st > costs (BLOCK ((id0, tp), None) s) ev cd st"
       and "decl id0 tp None False cd (memory (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) ev cd st\<rparr>)) (storage (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) ev cd st\<rparr>)) (cd, memory (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) ev cd st\<rparr>), stack (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) ev cd st\<rparr>), ev) = Some (cd', mem', sck', e')"
       and "stmt s e' cd' (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), None) s) ev cd st, stack := sck', memory := mem'\<rparr>) = Normal ((), st')"
   using assms by (simp split:if_split_asm prod.split_asm option.split_asm)
 
 lemma blockSome:
   fixes ev
   assumes "stmt (BLOCK ((id0, tp), Some ex') s) ev cd st = Normal (x, st')"
   obtains v t g cd' mem' sck' e'
     where "gas st > costs (BLOCK ((id0, tp), Some ex') s) ev cd st"
       and "expr ex' ev cd (st\<lparr>gas := gas st - costs (BLOCK ((id0, tp), Some ex') s) ev cd st\<rparr>) (gas st - costs (BLOCK ((id0, tp), Some ex') s) ev cd st) = Normal((v,t),g)"
       and "decl id0 tp (Some (v, t)) False cd (memory (st\<lparr>gas := g\<rparr>)) (storage (st\<lparr>gas := g\<rparr>)) (cd, memory (st\<lparr>gas := g\<rparr>), stack (st\<lparr>gas := g\<rparr>), ev) = Some (cd', mem', sck', e')"
       and "stmt s e' cd' (st\<lparr>gas := g, stack := sck', memory := mem'\<rparr>) = Normal ((), st')"
   using assms by (auto split:if_split_asm result.split_asm prod.split_asm option.split_asm)
 
 lemma new:
   fixes i xe val ev cd st
   defines "st0 \<equiv> st\<lparr>gas := gas st - costs (NEW i xe val) ev cd st\<rparr>"
   defines "adv0 \<equiv> hash (address ev) (ShowL\<^sub>n\<^sub>a\<^sub>t (contracts (accounts st0 (address ev))))"
   defines "st1 g \<equiv> st\<lparr>gas := g, accounts := (accounts st)(adv0 := \<lparr>bal = ShowL\<^sub>i\<^sub>n\<^sub>t 0, type = Some (Contract i), contracts = 0\<rparr>), storage:=(storage st)(adv0 := {$$})\<rparr>"
   defines "e' members c v \<equiv> ffold (init members) (emptyEnv adv0 c (address ev) v) (fmdom members)"
   assumes "stmt (NEW i xe val) ev cd st = Normal (x, st')"
   obtains v t g ct cn fb e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g' acc st''
     where "gas st > costs (NEW i xe val) ev cd st"
       and "type (accounts st adv0) = None"
       and "expr val ev cd st0 (gas st0) = Normal((KValue v, Value t),g)"
       and "ep $$ i = Some (ct, cn, fb)"
       and "load True (fst cn) xe (e' ct i v) emptyStore emptyStore emptyStore ev cd (st0\<lparr>gas := g\<rparr>) g = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g')"
       and "transfer (address ev) adv0 v (accounts (st1 g')) = Some acc"
       and "stmt (snd cn) e\<^sub>l cd\<^sub>l (st1 g'\<lparr>accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')"
       and "st' = incrementAccountContracts (address ev) (st''\<lparr>stack:=stack st, memory := memory st\<rparr>)"
 proof -
   from assms have 1: "gas st > costs (NEW i xe val) ev cd st" by (simp split:if_split_asm)
   moreover from st0_def assms 1 have 2: "type (accounts st adv0) = None" by (simp split: if_split_asm)
   moreover from st0_def assms 1 2 obtain v t g where 3: "expr val ev cd st0 (gas st0) = Normal((KValue v, Value t),g)" by (simp split: prod.split_asm result.split_asm Stackvalue.split_asm Type.split_asm)
   moreover from assms 1 st0_def 2 3 obtain ct cn fb where 4: "ep $$ i = Some(ct, cn, fb)" by (simp split: prod.split_asm result.split_asm option.split_asm)
   moreover from st0_def adv0_def e'_def assms 1 2 3 4 obtain e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g' where 5: "load True (fst cn) xe (e' ct i v) emptyStore emptyStore emptyStore ev cd (st0\<lparr>gas := g\<rparr>) g = Normal ((e\<^sub>l, cd\<^sub>l, k\<^sub>l, m\<^sub>l), g')" by (simp add:Let_def split: prod.split_asm result.split_asm option.split_asm)
   moreover from st0_def adv0_def e'_def assms 1 2 3 4 5 obtain acc where 6: "transfer (address ev) adv0 v (accounts (st1 g')) = Some acc" by (simp add:Let_def split: prod.split_asm result.split_asm option.split_asm)
   moreover from st0_def st1_def adv0_def e'_def assms 1 2 3 4 5 6 obtain st'' where "stmt (snd cn) e\<^sub>l cd\<^sub>l (st1 g'\<lparr>accounts := acc, stack:=k\<^sub>l, memory:=m\<^sub>l\<rparr>) = Normal ((), st'')" by (simp add:Let_def split: prod.split_asm result.split_asm option.split_asm)
   ultimately show ?thesis using that assms by simp
 qed
 
 lemma atype_same:
   assumes "stmt stm ev cd st = Normal (x, st')"
       and "type (accounts st ad) = Some ctype"
     shows "type (accounts st' ad) = Some ctype"
 using assms
 proof (induction arbitrary: st' rule: stmt.induct)
   case (1 e cd st)
   then show ?case using skip[OF 1(1)] by auto    
 next
   case (2 lv ex env cd st)
   show ?case by (cases rule: assign[OF 2(1)]; simp add: 2(2))
 next
   case (3 s1 s2 e cd st)
   show ?case
   proof (cases rule: comp[OF 3(3)])
     case (1 st'')
     then show ?thesis using 3 by simp
   qed
 next
   case (4 ex s1 s2 e cd st)
   show ?case
   proof (cases rule: ite[OF 4(3)])
     case (1 g)
     then show ?thesis using 4 by simp
   next
     case (2 g)
     then show ?thesis using 4 by (simp split: if_split_asm)
   qed
 next
   case (5 ex s0 e cd st)
   show ?case
   proof (cases rule: while[OF 5(3)])
     case (1 g st'')
     then show ?thesis using 5 by simp
   next
     case (2 g)
     then show ?thesis using 5 by simp
   qed
 next
   case (6 i xe e cd st)
   show ?case
   proof (cases rule: invoke[OF 6(2)])
     case (1 ct fb fp f e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g st'')
     then show ?thesis using 6 by simp
   qed
 next
   case (7 ad' i xe val e cd st)
   show ?case
   proof (cases rule: external[OF 7(3)])
     case (1 adv c g ct cn fb' v t g' v' fp f e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g'' acc st'')
     moreover from 7(4) have "type (acc ad) = Some ctype" using transfer_type_same[OF 1(10)] by simp
     ultimately show ?thesis using 7(1) by simp
   next
     case (2 adv c g ct cn fb' v t g' v' acc st'')
     moreover from 7(4) have "type (acc ad) = Some ctype" using transfer_type_same[OF 2(9)] by simp
     ultimately show ?thesis using 7(2) by simp
   qed
 next
   case (8 ad' ex e cd st)
   show ?case
   proof (cases rule: transfer[OF 8(2)])
     case (1 v t g adv c g' v' acc ct cn f st'')
     moreover from 8(3) have "type (acc ad) = Some ctype" using transfer_type_same[OF 1(7)] by simp
     ultimately show ?thesis using 8(1) by simp
   next
     case (2 v t g adv g' v' acc)
     moreover from 8(3) have "type (acc ad) = Some ctype" using transfer_type_same[OF 2(6)] by simp
     ultimately show ?thesis by simp
   qed
 next
   case (9 id0 tp s e\<^sub>v cd st)
   show ?case
   proof (cases rule: blockNone[OF 9(2)])
     case (1 cd' mem' sck' e')
     then show ?thesis using 9 by simp
   qed
 next
   case (10 id0 tp ex' s e\<^sub>v cd st)
   show ?case
   proof (cases rule: blockSome[OF 10(2)])
     case (1 v t g cd' mem' sck' e')
     then show ?thesis using 10 by simp
   qed
 next
   case (11 i xe val e cd st)
   show ?case
   proof (cases rule: new[OF 11(2)])
     case (1 v t g ct cn fb e\<^sub>l cd\<^sub>l k\<^sub>l m\<^sub>l g' acc st'')
     moreover have "hash (address e) \<lfloor>contracts (accounts st (address e))\<rfloor> \<noteq> ad" using 11(3) 1(2) by auto
     ultimately show ?thesis
       using 11 transfer_type_same[OF 1(6)] incrementAccountContracts_type by simp
   qed
 qed
 
-declare lexp.simps[simp del]
-declare stmt.simps[simp del]
+declare lexp.simps[simp del, solidity_symbex add]
+declare stmt.simps[simp del, solidity_symbex add]
 
 end
 
 subsection \<open>A minimal cost model\<close>
 
 fun costs_min :: "S \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> Gas"
   where
   "costs_min SKIP e cd st = 0"
 | "costs_min (ASSIGN lv ex) e cd st = 0"
 | "costs_min (COMP s1 s2) e cd st = 0"
 | "costs_min (ITE ex s1 s2) e cd st = 0"
 | "costs_min (WHILE ex s0) e cd st = 1"
 | "costs_min (TRANSFER ad ex) e cd st = 1"
 | "costs_min (BLOCK ((id0, tp), ex) s) e cd st =0"
 | "costs_min (INVOKE _ _) e cd st = 1"
 | "costs_min (EXTERNAL _ _ _ _) e cd st = 1"
 | "costs_min (NEW _ _ _) e cd st = 1"
 
 fun costs_ex :: "E \<Rightarrow> Environment \<Rightarrow> CalldataT \<Rightarrow> State \<Rightarrow> Gas"
   where
   "costs_ex (E.INT _ _) e cd st = 0"
 | "costs_ex (UINT _ _) e cd st = 0"
 | "costs_ex (ADDRESS _) e cd st = 0"
 | "costs_ex (BALANCE _) e cd st = 0"
 | "costs_ex THIS e cd st = 0"
 | "costs_ex SENDER e cd st = 0"
 | "costs_ex VALUE e cd st = 0"
 | "costs_ex (TRUE) e cd st = 0"
 | "costs_ex (FALSE) e cd st = 0"
 | "costs_ex (LVAL _) e cd st = 0"
 | "costs_ex (PLUS _ _) e cd st = 0"
 | "costs_ex (MINUS _ _) e cd st = 0"
 | "costs_ex (EQUAL _ _) e cd st = 0"
 | "costs_ex (LESS _ _) e cd st = 0"
 | "costs_ex (AND _ _) e cd st = 0"
 | "costs_ex (OR _ _) e cd st = 0"
 | "costs_ex (NOT _) e cd st = 0"
 | "costs_ex (CALL _ _) e cd st = 1"
 | "costs_ex (ECALL _ _ _) e cd st = 1"
 | "costs_ex CONTRACTS e cd st = 0"
 
 global_interpretation solidity: statement_with_gas costs_ex fmempty costs_min
   defines stmt = "solidity.stmt" 
       and lexp = solidity.lexp
       and expr = solidity.expr
       and ssel = solidity.ssel
       and rexp = solidity.rexp
       and msel = solidity.msel
       and load = solidity.load
   by unfold_locales auto
 
 section \<open>Examples\<close>
 
 subsection \<open>msel\<close>
 
 abbreviation mymemory2::MemoryT
   where "mymemory2 \<equiv>
     \<lparr>mapping = fmap_of_list
       [(STR ''3.2'', MPointer STR ''5'')],
      toploc = 1\<rparr>"
 
 lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 3] eempty emptyStore (mystate\<lparr>gas:=1\<rparr>) 1
 = Normal ((STR ''3.2'', MTArray 6 (MTValue TBool)), 1)"  by Solidity_Symbex.solidity_symbex
 
 lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 3, UINT 8 4] eempty emptyStore (mystate\<lparr>gas:=1,memory:=mymemory2\<rparr>) 1
 = Normal ((STR ''4.5'', MTValue TBool), 1)" by Solidity_Symbex.solidity_symbex
 
 lemma "msel True (MTArray 5 (MTArray 6 (MTValue TBool))) (STR ''2'') [UINT 8 5] eempty emptyStore (mystate\<lparr>gas:=1,memory:=mymemory2\<rparr>) 1
 = Exception (Err)" by Solidity_Symbex.solidity_symbex
 
 end
diff --git a/thys/Solidity/Storage.thy b/thys/Solidity/Storage.thy
--- a/thys/Solidity/Storage.thy
+++ b/thys/Solidity/Storage.thy
@@ -1,301 +1,324 @@
 section\<open>Storage\<close>
 
 theory Storage
 imports Valuetypes "Finite-Map-Extras.Finite_Map_Extras"
 
 begin
 
 subsection \<open>Hashing\<close>
 
 definition hash :: "Location \<Rightarrow> String.literal \<Rightarrow> Location"
   where "hash loc ix = ix + (STR ''.'' + loc)"
 
+declare hash_def [solidity_symbex]
+
 lemma example: "hash (STR ''1.0'') (STR ''2'') = hash (STR ''0'') (STR ''2.1'')" by eval
 
 lemma hash_explode:
   "String.explode (hash l i) = String.explode i @ (String.explode (STR ''.'') @ String.explode l)"
   unfolding hash_def by (simp add: plus_literal.rep_eq)
 
 lemma hash_dot:
   "String.explode (hash l i) ! length (String.explode i) = CHR ''.''"
   unfolding hash_def by (simp add: Literal.rep_eq plus_literal.rep_eq)
 
 lemma hash_injective:
   assumes "hash l i = hash l' i'"
     and "CHR ''.'' \<notin> set (String.explode i)"
     and "CHR ''.'' \<notin> set (String.explode i')"
   shows "l = l' \<and> i = i'"
 proof (rule ccontr)
   assume "\<not> (l = l' \<and> i = i')" 
   then consider (1) "i\<noteq>i'" | (2) "i=i' \<and> l\<noteq>l'" by auto
   then have "String.explode (hash l i) \<noteq> String.explode (hash l' i')"
   proof cases
     case 1
     then have neq: "(String.explode i) \<noteq> (String.explode i')" by (metis literal.explode_inverse)
 
     consider (1) "length (String.explode i) = length (String.explode i')" | (2) "length (String.explode i) < length (String.explode i')" | (3) "length (String.explode i) > length (String.explode i')" by linarith
     then show ?thesis
     proof (cases)
       case 1
       then obtain j where "String.explode i ! j \<noteq> String.explode i' ! j" using neq nth_equalityI by auto
       then show ?thesis using 1 plus_literal.rep_eq unfolding hash_def by force
     next
       case 2
       then have "String.explode i' ! length (String.explode i) \<noteq> CHR ''.''" using assms(3) by (metis nth_mem)
       then have "String.explode (hash l' i') ! length (String.explode i) \<noteq> CHR ''.''" using 2 hash_explode[of l' i'] by (simp add: nth_append)
       moreover have "String.explode (hash l i) ! length (String.explode i) = CHR ''.''" using hash_dot by simp
       ultimately show ?thesis by auto
     next
       case 3
       then have "String.explode i ! length (String.explode i') \<noteq> CHR ''.''" using assms(2) by (metis nth_mem)
       then have "String.explode (hash l i) ! length (String.explode i') \<noteq> CHR ''.''" using 3 hash_explode[of l i] by (simp add: nth_append)
       moreover have "String.explode (hash l' i') ! length (String.explode i') = CHR ''.''" using hash_dot by simp
       ultimately show ?thesis by auto
     qed
   next
     case 2
     then show ?thesis using hash_explode literal.explode_inject by force
   qed
   then show False using assms(1) by simp
 qed
 
 subsection \<open>General Store\<close>
 
 record 'v Store =
   mapping :: "(Location,'v) fmap"
   toploc :: nat 
 
 definition accessStore :: "Location \<Rightarrow> 'v Store \<Rightarrow> 'v option"
 where "accessStore loc st = fmlookup (mapping st) loc"
 
+declare accessStore_def[solidity_symbex]
+
 definition emptyStore :: "'v Store"
 where "emptyStore = \<lparr> mapping=fmempty, toploc=0 \<rparr>"
 
 declare emptyStore_def [solidity_symbex]
 
 definition allocate :: "'v Store \<Rightarrow> Location * ('v Store)"
 where "allocate s = (let ntop = Suc(toploc s) in (ShowL\<^sub>n\<^sub>a\<^sub>t ntop, s \<lparr>toploc := ntop\<rparr>))"
 
+
+
 definition updateStore :: "Location \<Rightarrow> 'v \<Rightarrow> 'v Store \<Rightarrow> 'v Store"
 where "updateStore loc val s = s \<lparr> mapping := fmupd loc val (mapping s)\<rparr>"
 
+declare updateStore_def [solidity_symbex]
+
 definition push :: "'v \<Rightarrow> 'v Store \<Rightarrow> 'v Store"
   where "push val sto = (let s = updateStore (ShowL\<^sub>n\<^sub>a\<^sub>t (toploc sto)) val sto in snd (allocate s))"
 
+declare push_def [solidity_symbex]
+
 subsection \<open>Stack\<close>
 
 datatype Stackvalue = KValue Valuetype
                     | KCDptr Location
                     | KMemptr Location
                     | KStoptr Location
 
 type_synonym Stack = "Stackvalue Store"
 
 subsection \<open>Storage\<close>
 
 subsubsection \<open>Definition\<close>
 
 type_synonym Storagevalue = Valuetype
 
 type_synonym StorageT = "(Location,Storagevalue) fmap"
 
 datatype STypes = STArray int STypes
                 | STMap Types STypes
                 | STValue Types
 
 subsubsection \<open>Example\<close>
 
 abbreviation mystorage::StorageT
 where "mystorage \<equiv> (fmap_of_list
   [(STR ''0.0.0'', STR ''False''),
    (STR ''1.1.0'', STR ''True'')])"
 
 subsubsection \<open>Access storage\<close>
 
 definition accessStorage :: "Types \<Rightarrow> Location \<Rightarrow> StorageT \<Rightarrow> Storagevalue"
 where
   "accessStorage t loc sto =
     (case sto $$ loc of
       Some v \<Rightarrow> v
     | None \<Rightarrow> ival t)"
 
+declare accessStorage_def [solidity_symbex]
+
 subsubsection \<open>Copy from storage to storage\<close>
 
 primrec copyRec :: "Location \<Rightarrow> Location \<Rightarrow> STypes \<Rightarrow> StorageT \<Rightarrow> StorageT option"
 where
   "copyRec l\<^sub>s l\<^sub>d (STArray x t) sto =
     iter' (\<lambda>i s'. copyRec (hash l\<^sub>s (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash l\<^sub>d (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t s') sto x"
 | "copyRec l\<^sub>s l\<^sub>d (STValue t) sto =
     (let e = accessStorage t l\<^sub>s sto in Some (fmupd l\<^sub>d e sto))"
 | "copyRec _ _ (STMap _ _) _ = None"
  
 definition copy :: "Location \<Rightarrow> Location \<Rightarrow> int \<Rightarrow> STypes \<Rightarrow> StorageT \<Rightarrow> StorageT option"
 where
   "copy l\<^sub>s l\<^sub>d x t sto =
     iter' (\<lambda>i s'. copyRec (hash l\<^sub>s (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash l\<^sub>d (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t s') sto x"
 
+declare copy_def [solidity_symbex]
+
+
 abbreviation mystorage2::StorageT
 where "mystorage2 \<equiv> (fmap_of_list
   [(STR ''0.0.0'', STR ''False''),
    (STR ''1.1.0'', STR ''True''),
    (STR ''0.5'', STR ''False''),
    (STR ''1.5'', STR ''True'')])"
 
 lemma "copy (STR ''1.0'') (STR ''5'') 2 (STValue TBool) mystorage = Some mystorage2"
   by eval
 
 subsection \<open>Memory and Calldata\<close>
 
 subsubsection \<open>Definition\<close>
 
 datatype Memoryvalue =
   MValue Valuetype
   | MPointer Location
 
 type_synonym MemoryT = "Memoryvalue Store"
 
 type_synonym CalldataT = MemoryT
 
 datatype MTypes =
   MTArray int MTypes
   | MTValue Types
 
 subsubsection \<open>Example\<close>
 
 abbreviation mymemory::MemoryT
   where "mymemory \<equiv>
     \<lparr>mapping = fmap_of_list
       [(STR ''1.1.0'', MValue STR ''False''),
        (STR ''0.1.0'', MValue STR ''True''),
        (STR ''1.0'', MPointer STR ''1.0''),
        (STR ''1.0.0'', MValue STR ''False''),
        (STR ''0.0.0'', MValue STR ''True''),
        (STR ''0.0'', MPointer STR ''0.0'')],
      toploc = 1\<rparr>"
 
 subsubsection \<open>Initialization\<close>
 
 subsubsection \<open>Definition\<close>
 
 primrec minitRec :: "Location \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> MemoryT"
 where
   "minitRec loc (MTArray x t) = (\<lambda>mem.
     let m = updateStore loc (MPointer loc) mem
     in iter (\<lambda>i m' . minitRec (hash loc (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t m') m x)"
 | "minitRec loc (MTValue t) = updateStore loc (MValue (ival t))"
 
 definition minit :: "int \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> MemoryT"
 where
   "minit x t mem =
     (let l = ShowL\<^sub>n\<^sub>a\<^sub>t (toploc mem);
          m = iter (\<lambda>i m' . minitRec (hash l (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t m') mem x
      in snd (allocate m))"
 
+declare minit_def [solidity_symbex]
+
 subsubsection \<open>Example\<close>
 
 lemma "minit 2 (MTArray 2 (MTValue TBool)) emptyStore =
 \<lparr>mapping = fmap_of_list
   [(STR ''0.0'', MPointer STR ''0.0''), (STR ''0.0.0'', MValue STR ''False''),
    (STR ''1.0.0'', MValue STR ''False''), (STR ''1.0'', MPointer STR ''1.0''),
    (STR ''0.1.0'', MValue STR ''False''), (STR ''1.1.0'', MValue STR ''False'')],
   toploc = 1\<rparr>" by eval
 
 subsubsection \<open>Copy from memory to memory\<close>
 
 subsubsection \<open>Definition\<close>
 
 primrec cpm2mrec :: "Location \<Rightarrow> Location \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> MemoryT \<Rightarrow> MemoryT option"
 where
   "cpm2mrec l\<^sub>s l\<^sub>d (MTArray x t) m\<^sub>s m\<^sub>d =
     (case accessStore l\<^sub>s m\<^sub>s of
       Some (MPointer l) \<Rightarrow>
         (let m = updateStore l\<^sub>d (MPointer l\<^sub>d) m\<^sub>d
           in iter' (\<lambda>i m'. cpm2mrec (hash l\<^sub>s (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash l\<^sub>d (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t m\<^sub>s m') m x)
     | _ \<Rightarrow> None)"
 | "cpm2mrec l\<^sub>s l\<^sub>d (MTValue t) m\<^sub>s m\<^sub>d =
     (case accessStore l\<^sub>s m\<^sub>s of
       Some (MValue v) \<Rightarrow> Some (updateStore l\<^sub>d (MValue v) m\<^sub>d)
     | _ \<Rightarrow> None)"
 
 definition cpm2m :: "Location \<Rightarrow> Location \<Rightarrow> int \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> MemoryT \<Rightarrow> MemoryT option"
 where
   "cpm2m l\<^sub>s l\<^sub>d x t m\<^sub>s m\<^sub>d = iter' (\<lambda>i m. cpm2mrec (hash l\<^sub>s (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash l\<^sub>d (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t m\<^sub>s m) m\<^sub>d x"
 
+declare cpm2m_def [solidity_symbex]
+
 subsubsection \<open>Example\<close>
 
 lemma "cpm2m (STR ''0'') (STR ''0'') 2 (MTArray 2 (MTValue TBool)) mymemory (snd (allocate emptyStore)) = Some mymemory"
   by eval
 
 abbreviation mymemory2::MemoryT
   where "mymemory2 \<equiv>
     \<lparr>mapping = fmap_of_list
       [(STR ''0.5'', MValue STR ''True''),
        (STR ''1.5'', MValue STR ''False'')],
      toploc = 0\<rparr>"
 
 lemma "cpm2m (STR ''1.0'') (STR ''5'') 2 (MTValue TBool) mymemory emptyStore = Some mymemory2" by eval
 
 subsection \<open>Copy from storage to memory\<close>
 
 subsubsection \<open>Definition\<close>
 
 primrec cps2mrec :: "Location \<Rightarrow> Location \<Rightarrow> STypes \<Rightarrow> StorageT \<Rightarrow> MemoryT \<Rightarrow> MemoryT option"
 where
   "cps2mrec locs locm (STArray x t) sto mem =
     (let m = updateStore locm (MPointer locm) mem
     in iter' (\<lambda>i m'. cps2mrec (hash locs (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash locm (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t sto m') m x)"
 | "cps2mrec locs locm (STValue t) sto mem =
     (let v = accessStorage t locs sto
     in Some (updateStore locm (MValue v) mem))"
 | "cps2mrec _ _ (STMap _ _) _ _ = None"
 
 definition cps2m :: "Location \<Rightarrow> Location \<Rightarrow> int \<Rightarrow> STypes \<Rightarrow> StorageT \<Rightarrow> MemoryT \<Rightarrow> MemoryT option"
 where
   "cps2m locs locm x t sto mem =
     iter' (\<lambda>i m'. cps2mrec (hash locs (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash locm (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t sto m') mem x"
 
+declare cps2m_def [solidity_symbex]
+
 subsubsection \<open>Example\<close>
 
 abbreviation mystorage3::StorageT
 where "mystorage3 \<equiv> (fmap_of_list
   [(STR ''0.0.1'', STR ''True''),
    (STR ''1.0.1'', STR ''False''),
    (STR ''0.1.1'', STR ''True''),
    (STR ''1.1.1'', STR ''False'')])"
 
 lemma "cps2m (STR ''1'') (STR ''0'') 2 (STArray 2 (STValue TBool)) mystorage3 (snd (allocate emptyStore)) = Some mymemory"
   by eval
 
 subsection \<open>Copy from memory to storage\<close>
 
 subsubsection \<open>Definition\<close>
 
 primrec cpm2srec :: "Location \<Rightarrow> Location \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> StorageT \<Rightarrow> StorageT option"
 where
   "cpm2srec locm locs (MTArray x t) mem sto =
     (case accessStore locm mem of
       Some (MPointer l) \<Rightarrow>
         iter' (\<lambda>i s'. cpm2srec (hash locm (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash locs (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t mem s') sto x
     | _ \<Rightarrow> None)"
 | "cpm2srec locm locs (MTValue t) mem sto =
     (case accessStore locm mem of
       Some (MValue v) \<Rightarrow> Some (fmupd locs v sto)
     | _ \<Rightarrow> None)"
 
 definition cpm2s :: "Location \<Rightarrow> Location \<Rightarrow> int \<Rightarrow> MTypes \<Rightarrow> MemoryT \<Rightarrow> StorageT \<Rightarrow> StorageT option"
 where
   "cpm2s locm locs x t mem sto =
     iter' (\<lambda>i s'. cpm2srec (hash locm (ShowL\<^sub>i\<^sub>n\<^sub>t i)) (hash locs (ShowL\<^sub>i\<^sub>n\<^sub>t i)) t mem s') sto x"
 
+declare cpm2s_def [solidity_symbex]
+
 subsubsection \<open>Example\<close>
 
 lemma "cpm2s (STR ''0'') (STR ''1'') 2 (MTArray 2 (MTValue TBool)) mymemory fmempty = Some mystorage3"
   by eval
 
-declare copyRec.simps [simp del]
-declare minitRec.simps [simp del]
-declare cpm2mrec.simps [simp del]
-declare cps2mrec.simps [simp del]
-declare cpm2srec.simps [simp del]
+declare copyRec.simps [simp del, solidity_symbex add]
+declare minitRec.simps [simp del, solidity_symbex add]
+declare cpm2mrec.simps [simp del, solidity_symbex add]
+declare cps2mrec.simps [simp del, solidity_symbex add]
+declare cpm2srec.simps [simp del, solidity_symbex add]
 
 end
diff --git a/thys/Solidity/Valuetypes.thy b/thys/Solidity/Valuetypes.thy
--- a/thys/Solidity/Valuetypes.thy
+++ b/thys/Solidity/Valuetypes.thy
@@ -1,278 +1,294 @@
 section\<open>Value Types\<close>
 
 theory Valuetypes
 imports ReadShow
 begin
 
 fun iter :: "(int \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'b \<Rightarrow> int \<Rightarrow> 'b"
 where
   "iter f v x = (if x \<le> 0 then v  
                  else f (x-1) (iter f v (x-1)))"
 
 fun iter' :: "(int \<Rightarrow> 'b \<Rightarrow> 'b option) \<Rightarrow> 'b \<Rightarrow> int \<Rightarrow> 'b option"
 where
   "iter' f v x = (if x \<le> 0 then Some v
                   else case iter' f v (x-1) of
                           Some v' \<Rightarrow> f (x-1) v'
                         | None \<Rightarrow> None)"
 
 type_synonym Address = String.literal
 type_synonym Location = String.literal
 type_synonym Valuetype = String.literal
 
 (*Covered*)
 datatype Types = TSInt nat
                | TUInt nat
                | TBool
                | TAddr
 
 (*Covered*)
 definition createSInt :: "nat \<Rightarrow> int \<Rightarrow> Valuetype"
 where
   "createSInt b v =
     (if v \<ge> 0
       then ShowL\<^sub>i\<^sub>n\<^sub>t (-(2^(b-1)) + (v+2^(b-1)) mod (2^b))
       else ShowL\<^sub>i\<^sub>n\<^sub>t (2^(b-1) - (-v+2^(b-1)-1) mod (2^b) - 1))"
 
+declare createSInt_def [solidity_symbex]
+
 lemma upper_bound:
   fixes b::nat
     and c::int
   assumes "b > 0"
       and "c < 2^(b-1)"
     shows "c + 2^(b-1) < 2^b"
 proof -
   have a1: "\<And>P. (\<forall>b::nat. P b) \<Longrightarrow> (\<forall>b>0. P ((b-1)::nat))" by simp
   have b2: "\<forall>b::nat. (\<forall>(c::int)<2^b. (c + 2^b) < 2^(Suc b))" by simp
   show ?thesis using a1[OF b2] assms by simp
 qed
 
 lemma upper_bound2:
   fixes b::nat
       and c::int
     assumes "b > 0"
       and "c < 2^b"
       and "c \<ge> 0"
     shows "c - (2^(b-1)) < 2^(b-1)"
 proof -
   have a1: "\<And>P. (\<forall>b::nat. P b) \<Longrightarrow> (\<forall>b>0. P ((b-1)::nat))" by simp
   have b2: "\<forall>b::nat. (\<forall>(c::int)<2^(Suc b). c\<ge>0 \<longrightarrow> (c - 2^b) < 2^b)" by simp
   show ?thesis using a1[OF b2] assms by simp
 qed
 
 lemma upper_bound3:
   fixes b::nat
     and v::int
       defines "x \<equiv> - (2 ^ (b - 1)) + (v + 2 ^ (b - 1)) mod 2 ^ b"
     assumes "b>0"
     shows "x < 2^(b-1)"
   using upper_bound2 assms by auto
 
 lemma lower_bound:
     fixes b::nat
   assumes "b>0"
     shows "\<forall>(c::int) \<ge> -(2^(b-1)). (-c + 2^(b-1) - 1 < 2^b)"
 proof -
   have a1: "\<And>P. (\<forall>b::nat. P b) \<Longrightarrow> (\<forall>b>0. P ((b-1)::nat))" by simp
   have b2: "\<forall>b::nat. \<forall>(c::int) \<ge> -(2^b). (-c + (2^b) - 1) < 2^(Suc b)" by simp
   show ?thesis using a1[OF b2] assms by simp
 qed
 
 lemma lower_bound2:
   fixes b::nat
     and v::int
       defines "x \<equiv> 2^(b - 1) - (-v+2^(b-1)-1) mod 2^b - 1"
     assumes "b>0"
     shows "x \<ge> - (2 ^ (b - 1))"
   using upper_bound2 assms by auto
 
 lemma createSInt_id_g0:
     fixes b::nat
       and v::int
   assumes "v \<ge> 0"
       and "v < 2^(b-1)"
       and "b > 0"
     shows "createSInt b v = ShowL\<^sub>i\<^sub>n\<^sub>t v"
 proof -
   from assms have "v + 2^(b-1) \<ge> 0" by simp
   moreover from assms have "v + (2^(b-1)) < 2^b" using upper_bound[of b] by auto
   ultimately have "(v + 2^(b-1)) mod (2^b) = v + 2^(b-1)" by simp
   moreover from assms have "createSInt b v=ShowL\<^sub>i\<^sub>n\<^sub>t (-(2^(b-1)) + (v+2^(b-1)) mod (2^b))" unfolding createSInt_def by simp
   ultimately show ?thesis by simp
 qed
 
 lemma createSInt_id_l0:
     fixes b::nat
       and v::int
   assumes "v < 0"
       and "v \<ge> -(2^(b-1))"
       and "b > 0"
     shows "createSInt b v = ShowL\<^sub>i\<^sub>n\<^sub>t v"
 proof -
   from assms have "-v + 2^(b-1) - 1 \<ge> 0" by simp
   moreover from assms have "-v + 2^(b-1) - 1 < 2^b" using lower_bound[of b] by auto 
   ultimately have "(-v + 2^(b-1) - 1) mod (2^b) = (-v + 2^(b-1) - 1)" by simp
   moreover from assms have "createSInt b v= ShowL\<^sub>i\<^sub>n\<^sub>t (2^(b-1) - (-v+2^(b-1)-1) mod (2^b) - 1)" unfolding createSInt_def by simp
   ultimately show ?thesis by simp
 qed
 
 lemma createSInt_id:
     fixes b::nat
       and v::int
   assumes "v < 2^(b-1)"
       and "v \<ge> -(2^(b-1))"
       and "b > 0"
     shows "createSInt b v = ShowL\<^sub>i\<^sub>n\<^sub>t v" using createSInt_id_g0 createSInt_id_l0 assms unfolding createSInt_def by simp
 
 (*Covered*)
 definition createUInt :: "nat \<Rightarrow> int \<Rightarrow> Valuetype"
   where "createUInt b v = ShowL\<^sub>i\<^sub>n\<^sub>t (v mod (2^b))"
 
+declare createUInt_def[solidity_symbex]
+
 lemma createUInt_id:
   assumes "v \<ge> 0"
       and "v < 2^b"
     shows "createUInt b v =  ShowL\<^sub>i\<^sub>n\<^sub>t v"
 unfolding createUInt_def by (simp add: assms(1) assms(2))
 
 definition createBool :: "bool \<Rightarrow> Valuetype"
 where
   "createBool b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l b"
 
+declare createBool_def [solidity_symbex]
+
 definition createAddress :: "Address \<Rightarrow> Valuetype"
 where
   "createAddress ad = ad"
 
+declare createAddress_def [solidity_symbex]
+
 definition checkSInt :: "nat \<Rightarrow> Valuetype \<Rightarrow> bool"
 where
   "checkSInt b v = ((foldr (\<and>) (map is_digit (String.explode v)) True) \<and>(ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge> -(2^(b-1)) \<and> ReadL\<^sub>i\<^sub>n\<^sub>t v < 2^(b-1)))"
 
+declare checkSInt_def [solidity_symbex]
+
 definition checkUInt :: "nat \<Rightarrow> Valuetype \<Rightarrow> bool"
 where
   "checkUInt b v = ((foldr (\<and>) (map is_digit (String.explode v)) True) \<and> (ReadL\<^sub>i\<^sub>n\<^sub>t v \<ge> 0 \<and> ReadL\<^sub>i\<^sub>n\<^sub>t v < 2^b))"
+declare checkUInt_def  [solidity_symbex]
 
 fun convert :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype option"
 where
   "convert (TSInt b1) (TSInt b2) v =
     (if b1 \<le> b2
       then Some v
       else None)"
 | "convert (TUInt b1) (TUInt b2) v =
     (if b1 \<le> b2
       then Some v
       else None)"
 | "convert (TUInt b1) (TSInt b2) v =
     (if b1 < b2
       then Some v
       else None)"
 | "convert TBool TBool v = Some v"
 | "convert TAddr TAddr v = Some v"
 | "convert _ _ _ = None"
 
 lemma convert_id[simp]:
   "convert tp tp kv = Some kv"
     by (metis Types.exhaust convert.simps(1) convert.simps(2) convert.simps(4) convert.simps(5) order_refl)
 
 (*Covered informally*)
 fun olift ::
   "(int \<Rightarrow> int \<Rightarrow> int) \<Rightarrow> Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "olift op (TSInt b1) (TSInt b2) v1 v2 =
     Some (createSInt (max b1 b2) (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TSInt (max b1 b2))"
 | "olift op (TUInt b1) (TUInt b2) v1 v2 =
     Some (createUInt (max b1 b2) (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TUInt (max b1 b2))"
 | "olift op (TSInt b1) (TUInt b2) v1 v2 =
     (if b2 < b1
       then Some (createSInt b1 (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TSInt b1)
       else None)"
 | "olift op (TUInt b1) (TSInt b2) v1 v2 =
     (if b1 < b2
       then Some (createSInt b2 (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TSInt b2)
       else None)"
 | "olift _ _ _ _ _ = None"
 
 (*Covered*)
 fun plift ::
   "(int \<Rightarrow> int \<Rightarrow> bool) \<Rightarrow> Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "plift op (TSInt b1) (TSInt b2) v1 v2 = Some (createBool (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TBool)"
 | "plift op (TUInt b1) (TUInt b2) v1 v2 = Some (createBool (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TBool)"
 | "plift op (TSInt b1) (TUInt b2) v1 v2 =
     (if b2 < b1
       then Some (createBool (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TBool)
       else None)"
 | "plift op (TUInt b1) (TSInt b2) v1 v2 =
     (if b1 < b2
       then Some (createBool (op \<lceil>v1\<rceil> \<lceil>v2\<rceil>), TBool)
       else None)" 
 | "plift _ _ _ _ _ = None"
 
 (*Covered*)
 definition add :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "add = olift (+)"
 
 (*Covered informally*)
 definition sub :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "sub = olift (-)"
 
 (*Covered informally*)
 definition equal :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "equal = plift (=)"
 
 (*Covered informally*)
 definition less :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "less = plift (<)"
 
-declare less_def [solidity_symbex]
 
 (*Covered informally*)
 definition leq :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "leq = plift (\<le>)"
 
+declare add_def sub_def equal_def leq_def less_def [solidity_symbex]
+
 (*Covered*)
 fun vtand :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "vtand TBool TBool a b =
     (if a = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True \<and> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True then Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool)
     else Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False, TBool))"
 | "vtand _ _ _ _ = None"
 
 (*Covered informally*)
 fun vtor :: "Types \<Rightarrow> Types \<Rightarrow> Valuetype \<Rightarrow> Valuetype \<Rightarrow> (Valuetype * Types) option"
 where
   "vtor TBool TBool a b =
     (if a = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False \<and> b = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False
       then Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False, TBool)
       else Some (ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l True, TBool))"
 | "vtor _ _ _ _ = None"
 
 definition checkBool :: "Valuetype  \<Rightarrow> bool"
 where
   "checkBool v = (if (v = STR ''True'' \<or> v = STR ''False'') then True else False)"
 
+declare checkBool_def [solidity_symbex]
+
 definition checkAddress :: "Valuetype  \<Rightarrow> bool"
   where
     "checkAddress v = (if (size v = 42 \<and> ((String.explode v !1) = CHR ''x'')) then True else False)"
 
+declare checkAddress_def [solidity_symbex]
+
 (*value "checkBool STR ''True''"*)
 (*value "checkAddress STR ''0x0000000000000000000000000000000000000000''"*)
 
 (*Covered informally*)
 primrec ival :: "Types \<Rightarrow> Valuetype"
 where
   "ival (TSInt x) = ShowL\<^sub>i\<^sub>n\<^sub>t 0"
 | "ival (TUInt x) = ShowL\<^sub>i\<^sub>n\<^sub>t 0"
 | "ival TBool = ShowL\<^sub>b\<^sub>o\<^sub>o\<^sub>l False"
 | "ival TAddr = STR ''0x0000000000000000000000000000000000000000''"
 
 
-declare convert.simps [simp del]
-declare olift.simps [simp del]
-declare plift.simps [simp del]
-declare vtand.simps [simp del]
-declare vtor.simps [simp del]
+declare convert.simps [simp del, solidity_symbex add]
+declare olift.simps [simp del, solidity_symbex add]
+declare plift.simps [simp del, solidity_symbex add]
+declare vtand.simps [simp del, solidity_symbex add]
+declare vtor.simps [simp del, solidity_symbex add]
 
 end