diff --git a/.devcontainer/postCreate.sh b/.devcontainer/postCreate.sh
index 85a31ea86..0e4252fc2 100644
--- a/.devcontainer/postCreate.sh
+++ b/.devcontainer/postCreate.sh
@@ -14,4 +14,4 @@ curl -L https://foundry.paradigm.xyz | bash
 echo 'source .venv/bin/activate' >> ~/.bashrc
 
 # just a test
-# pytest -v -k "not long and not ffi" --ignore=tests/lib --halmos-options="-v -st --storage-layout solidity --solver-timeout-assertion 0"
+# pytest -v -k "not long and not ffi" --ignore=tests/lib --dolmos-options="-v -st --storage-layout solidity --solver-timeout-assertion 0"
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..8d8067ed1
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+# the file cheatcode tests (tests/regression/test/File.t.sol) hash these fixtures byte for byte:
+# never convert their line endings (core.autocrlf is on by default on the Windows runners)
+tests/regression/test/data/** -text
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 58b11868d..8343d9a2d 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -16,7 +16,7 @@ Please provide a reproducible example.
 **Environment:**
  - OS: [e.g., Linux / Windows / macOS]
  - Python version: [e.g., `python --version`]
- - Halmos and other dependency versions: [e.g., `pip list`]
+ - dolmos and other dependency versions: [e.g., `pip list`]
 
 **Additional context**
 Add any other context about the problem here.
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index ad7e4d580..2d77655aa 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           # let's use the oldest version of python that is supported by the project
           python-version: "3.11"
@@ -27,9 +27,9 @@ jobs:
         uses: foundry-rs/foundry-toolchain@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           version: "0.5.21"
 
-      - name: Install halmos and its dependencies
+      - name: Install dolmos and its dependencies
         run: uv sync --extra dev
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 027d087d4..1cb0eec15 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -6,6 +6,15 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-    - uses: pre-commit/action@v3.0.1
+    - uses: actions/checkout@v6
+    - uses: actions/setup-python@v6
+      with:
+        python-version: "3.12"
+    # pre-commit/action@v3.0.1 still uses actions/cache@v4 (node20) internally:
+    # run pre-commit directly, with a node24 cache
+    - uses: actions/cache@v5
+      with:
+        path: ~/.cache/pre-commit
+        key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+    - run: pip install pre-commit
+    - run: pre-commit run --show-diff-on-failure --color=always --all-files
diff --git a/.github/workflows/publish-halmos-builder-package.yml b/.github/workflows/publish-dolmos-builder-package.yml
similarity index 83%
rename from .github/workflows/publish-halmos-builder-package.yml
rename to .github/workflows/publish-dolmos-builder-package.yml
index 60a6a494c..000d2b18c 100644
--- a/.github/workflows/publish-halmos-builder-package.yml
+++ b/.github/workflows/publish-dolmos-builder-package.yml
@@ -1,8 +1,8 @@
 # based on https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token
-name: Push halmos-builder package
+name: Push dolmos-builder package
 
 on:
-  # only trigger manually, this is independent from halmos releases
+  # only trigger manually, this is independent from dolmos releases
   workflow_dispatch:
   workflow_run:
     workflows: ["Push solvers package"]
@@ -10,11 +10,11 @@ on:
       - completed
   push:
     paths:
-      - packages/halmos-builder/**/*
-      - .github/workflows/publish-halmos-builder-package.yml
+      - packages/dolmos-builder/**/*
+      - .github/workflows/publish-dolmos-builder-package.yml
 
 env:
-  IMAGE_NAME: halmos-builder
+  IMAGE_NAME: dolmos-builder
 
 jobs:
   # This pushes the image to GitHub Packages.
@@ -28,18 +28,18 @@ jobs:
 
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: false
 
       - name: Build image
-        run: docker build . --file packages/halmos-builder/Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build . --file packages/dolmos-builder/Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Push image
         run: |
diff --git a/.github/workflows/publish-halmos-package.yml b/.github/workflows/publish-dolmos-package.yml
similarity index 58%
rename from .github/workflows/publish-halmos-package.yml
rename to .github/workflows/publish-dolmos-package.yml
index abbef3993..6e2525a6b 100644
--- a/.github/workflows/publish-halmos-package.yml
+++ b/.github/workflows/publish-dolmos-package.yml
@@ -1,22 +1,22 @@
 # based on https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token
-name: Push halmos package
+name: Push dolmos package
 
 on:
   workflow_dispatch:
   workflow_run:
-    workflows: ["Push halmos-builder package"]
+    workflows: ["Push dolmos-builder package"]
     types:
       - completed
   push:
     paths:
-      - packages/halmos/**/*
-      - .github/workflows/publish-halmos-package.yml
+      - packages/dolmos/**/*
+      - .github/workflows/publish-dolmos-package.yml
     tags:
       # push when we release a new tagged version
       - 'v*'
 
 env:
-  IMAGE_NAME: halmos
+  IMAGE_NAME: dolmos
 
 jobs:
   # This pushes the image to GitHub Packages.
@@ -30,22 +30,22 @@ jobs:
 
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # we may need tests/lib for the workflows using this image
           submodules: recursive
 
       - name: Build image
-        run: docker build . --file packages/halmos/Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build . --file packages/dolmos/Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
 
-      - name: Print halmos version
-        run: docker run $IMAGE_NAME halmos --version
+      - name: Print dolmos version
+        run: docker run $IMAGE_NAME dolmos --version
 
       - name: Push image
         run: |
@@ -54,15 +54,17 @@ jobs:
           # This changes all uppercase characters to lowercase.
           IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
 
-          # This strips the git ref prefix from the version.
-          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            # release: X.Y.Z, X.Y and latest
+            VERSION="${GITHUB_REF_NAME#v}"
+            TAGS="$VERSION ${VERSION%.*} latest"
+          else
+            # anything else (main, builder rebuilds): a moving `main` tag
+            TAGS="main"
+          fi
 
-          # This strips the "v" prefix from the tag name.
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
-
-          # This uses the Docker `latest` tag convention.
-          [ "$VERSION" == "main" ] && VERSION=latest
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          for TAG in $TAGS; do
+            echo "pushing $IMAGE_ID:$TAG"
+            docker tag $IMAGE_NAME $IMAGE_ID:$TAG
+            docker push $IMAGE_ID:$TAG
+          done
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 0984e529e..cdc8591b7 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -1,22 +1,87 @@
 name: Publish to PyPI
+
+# Triggered by publishing a GitHub Release whose tag is vX.Y.Z.
+# The package version comes from that tag (setuptools-scm).
+
 on:
   release:
     types: [published]
+  # manual dry run: builds and checks the distributions, publishes nothing
+  workflow_dispatch:
+
 jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # setuptools-scm needs the tags and the history
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          twine check --strict dist/*
+
+      - name: Check that the version matches the tag
+        if: github.event_name == 'release'
+        run: |
+          expected="${GITHUB_REF_NAME#v}"
+          wheel=$(ls dist/*.whl)
+          case "$wheel" in
+            dist/dolmos-${expected}-*) echo "version $expected OK" ;;
+            *) echo "::error::wheel $wheel does not match tag $GITHUB_REF_NAME"; exit 1 ;;
+          esac
+
+      - name: Smoke test the wheel
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/dolmos --version
+          /tmp/smoke/bin/python -Ic 'import dolmos'
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
   pypi:
+    needs: build
+    if: github.event_name == 'release'
     runs-on: ubuntu-latest
-    environment: release
+    environment:
+      name: release
+      url: https://pypi.org/project/dolmos/
     permissions:
-      # IMPORTANT: this permission is mandatory for Trusted Publishing
+      # mandatory for Trusted Publishing
       # https://docs.pypi.org/trusted-publishers/using-a-publisher/
       id-token: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/download-artifact@v7
         with:
-          fetch-depth: 0
-      - name: Build
-        run: python3 -m pip install --upgrade build && python3 -m build
+          name: dist
+          path: dist/
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1
 
+  github-release-assets:
+    needs: build
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v7
+        with:
+          name: dist
+          path: dist/
+      - name: Attach the distributions to the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --clobber
diff --git a/.github/workflows/publish-solvers-package.yml b/.github/workflows/publish-solvers-package.yml
index b1274e148..07860dcf1 100644
--- a/.github/workflows/publish-solvers-package.yml
+++ b/.github/workflows/publish-solvers-package.yml
@@ -2,7 +2,7 @@
 name: Push solvers package
 
 on:
-  # only trigger manually, this is independent from halmos releases
+  # only trigger manually, this is independent from dolmos releases
   workflow_dispatch:
   push:
     paths:
@@ -21,13 +21,13 @@ jobs:
 
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: false
 
diff --git a/.github/workflows/test-external.yml b/.github/workflows/test-external.yml
index e0c9776ba..7582bea28 100644
--- a/.github/workflows/test-external.yml
+++ b/.github/workflows/test-external.yml
@@ -5,8 +5,8 @@ on:
     branches: [main, chore-workflows]
   workflow_dispatch:
     inputs:
-      halmos-options:
-        description: "additional halmos options"
+      dolmos-options:
+        description: "additional dolmos options"
         required: false
         type: string
         default: ""
@@ -28,8 +28,10 @@ jobs:
           - repo: "morpho-org/morpho-blue"
             dir: "morpho-blue"
             cmd: "--solver-threads 3"
-            branch: ""
-            profile: "test"
+            # morpho-blue removed its halmos tests in January 2026 (d788823);
+            # pin the last commit that still has test/halmos/HalmosTest.sol
+            branch: "e773d85cd24d5162c836ec01ebcfa1d84550b668"
+            profile: ""
           - repo: "a16z/cicada"
             dir: "cicada"
             cmd: "--contract LibUint1024Test --function testProve --loop 256 --solver-threads 3"
@@ -77,43 +79,51 @@ jobs:
             profile: ""
 
     steps:
-      - name: Checkout halmos
-        uses: actions/checkout@v4
+      - name: Checkout dolmos
+        uses: actions/checkout@v6
         with:
           # we won't be needing tests/lib for this workflow
           submodules: false
 
       - name: Build image
-        run: docker build -t halmos-image . --file packages/halmos/Dockerfile
+        run: docker build -t dolmos-image . --file packages/dolmos/Dockerfile
 
       - name: Run foundryup
         run: |
-          # run foundryup in halmos-image, save the result as a new image
-          docker run --name halmos-image-foundryup halmos-image foundryup
+          # run foundryup in dolmos-image, save the result as a new image
+          docker run --name dolmos-image-foundryup dolmos-image foundryup
 
-          # commit the result back to halmos-image
-          docker commit halmos-image-foundryup halmos-image
+          # commit the result back to dolmos-image
+          docker commit dolmos-image-foundryup dolmos-image
 
       # for snekmate
       - name: Install Vyper
         if: ${{ matrix.project.dir == 'snekmate' }}
         run: |
-          docker run --name halmos-image-vyper halmos-image uv pip install git+https://github.com/vyperlang/vyper@master
-          docker commit halmos-image-vyper halmos-image
+          docker run --name dolmos-image-vyper dolmos-image uv pip install git+https://github.com/vyperlang/vyper@master
+          docker commit dolmos-image-vyper dolmos-image
 
       # for sys-asm-halmos
       - name: Install Geas
+        if: ${{ matrix.project.dir == 'sys-asm-halmos' }}
         run: |
-          docker run --name tmp-halmos-image halmos-image bash -c "\
+          # proxy.golang.org occasionally resets HTTP/2 streams mid-download:
+          # force HTTP/1.1, fall back to direct git fetch on any proxy error, retry
+          docker run --name tmp-dolmos-image dolmos-image bash -c "\
+            set -e; \
             apt-get update && \
-            apt-get install -y golang-go && \
+            apt-get install -y --no-install-recommends golang-go ca-certificates git && \
             go version && \
-            env 'GOBIN=/halmos/bin' go install github.com/fjl/geas/cmd/geas@latest && \
+            export GOBIN=/dolmos/bin GOPROXY='https://proxy.golang.org|direct' GODEBUG=http2client=0; \
+            for i in 1 2 3; do \
+              go install github.com/fjl/geas/cmd/geas@v0.3.3 && break; \
+              [ \$i -lt 3 ] || exit 1; echo \"retry \$i...\"; sleep 10; \
+            done; \
             geas -h"
-          docker commit tmp-halmos-image halmos-image
+          docker commit tmp-dolmos-image dolmos-image
 
       - name: Checkout external repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ matrix.project.repo }}
           path: ${{ matrix.project.dir }}
@@ -121,13 +131,13 @@ jobs:
           submodules: recursive
 
       - name: Print forge version
-        run: docker run halmos-image forge --version
+        run: docker run dolmos-image forge --version
 
-      - name: Print halmos version
-        run: docker run halmos-image halmos --version
+      - name: Print dolmos version
+        run: docker run dolmos-image dolmos --version
 
       - name: Test external repo
-        run: docker run -e FOUNDRY_PROFILE -v .:/workspace halmos-image halmos ${{ matrix.project.cmd }} --statistics --solver-timeout-assertion 0 ${{ matrix.cache-solver }} ${{ inputs.halmos-options }}
+        run: docker run -e FOUNDRY_PROFILE -v .:/workspace dolmos-image dolmos ${{ matrix.project.cmd }} --statistics --solver-timeout-assertion 0 ${{ matrix.cache-solver }} ${{ inputs.dolmos-options }}
         working-directory: ${{ matrix.project.dir }}
         env:
           FOUNDRY_PROFILE: ${{ matrix.project.profile }}
diff --git a/.github/workflows/test-ffi.yml b/.github/workflows/test-ffi.yml
index 6026e5f65..a68f67821 100644
--- a/.github/workflows/test-ffi.yml
+++ b/.github/workflows/test-ffi.yml
@@ -18,16 +18,16 @@ jobs:
         - testname: "tests/ffi"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
       - name: Build image
         run: |
-          docker build -t halmos-image . --file packages/halmos/Dockerfile
+          docker build -t dolmos-image . --file packages/dolmos/Dockerfile
 
-      - name: Print halmos version
-        run: docker run halmos-image halmos --version
+      - name: Print dolmos version
+        run: docker run dolmos-image dolmos --version
 
       - name: Run pytest
-        run: docker run -v .:/workspace halmos-image pytest -v tests/test_halmos.py -k ${{ matrix.testname }} --halmos-options="--ffi -v -st"
+        run: docker run -v .:/workspace dolmos-image pytest -v tests/test_dolmos.py -k ${{ matrix.testname }} --dolmos-options="--ffi -v -st"
diff --git a/.github/workflows/test-long.yml b/.github/workflows/test-long.yml
index 03b99c34b..6cdfed382 100644
--- a/.github/workflows/test-long.yml
+++ b/.github/workflows/test-long.yml
@@ -5,8 +5,8 @@ on:
     branches: [main, chore-workflows]
   workflow_dispatch:
     inputs:
-      halmos-options:
-        description: "additional halmos options"
+      dolmos-options:
+        description: "additional dolmos options"
         required: false
         type: string
         default: ""
@@ -28,17 +28,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
       - name: Build image
         run: |
-          docker build -t halmos-image . --file packages/halmos/Dockerfile
+          docker build -t dolmos-image . --file packages/dolmos/Dockerfile
 
-      - name: Print halmos version
-        run: docker run halmos-image halmos --version
+      - name: Print dolmos version
+        run: docker run dolmos-image dolmos --version
 
       - name: Run pytest
         run: |
-          docker run -v .:/workspace halmos-image pytest -x -v tests/test_halmos.py -k ${{ matrix.testname }} --halmos-options='-st --solver-threads 3 ${{ matrix.cache-solver }} ${{ inputs.halmos-options }}' -s --log-cli-level=
+          docker run -v .:/workspace dolmos-image pytest -x -v tests/test_dolmos.py -k ${{ matrix.testname }} --dolmos-options='-st --solver-threads 3 ${{ matrix.cache-solver }} ${{ inputs.dolmos-options }}' -s --log-cli-level=
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1145e13b1..2aa24b650 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,8 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
     inputs:
-      halmos-options:
-        description: "additional halmos options"
+      dolmos-options:
+        description: "additional dolmos options"
         required: false
         type: string
         default: ""
@@ -22,7 +22,7 @@ jobs:
   test:
     runs-on: ${{ matrix.os }}
     env:
-      HALMOS_ALLOW_DOWNLOAD: 1
+      DOLMOS_ALLOW_DOWNLOAD: 1
 
     strategy:
       fail-fast: false
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # note: it is faster to let foundry do a sparse checkout of the missing libraries rather than having the action do a git checkout of the submodules
           submodules: false
@@ -46,7 +46,7 @@ jobs:
         run: forge --version
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           # Install a specific version of uv.
           version: "0.5.21"
@@ -54,20 +54,25 @@ jobs:
       - name: Set up python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
 
-      - name: Install halmos and its dependencies
+      - name: Install dolmos and its dependencies
         run: |
           uv sync --extra dev
 
-      - name: Write halmos.toml
+      - name: Write dolmos.toml
         shell: bash
         run: |
-          uv run python -m halmos.config \
+          uv run python -m dolmos.config \
             --storage-layout ${{ matrix.storage-layout }} \
             ${{ matrix.cache-solver }} \
-            | tee tests/regression/halmos.toml
+            | tee tests/regression/dolmos.toml
 
       - name: Run pytest
         shell: bash
         run: |
-          uv run pytest -v -k "not long and not ffi" --ignore=tests/lib \
-            --halmos-options="-st --disable-gc --solver-threads 1 ${{ inputs.halmos-options }}" ${{ inputs.pytest-options }}
+          # failed tests are reported as annotations on the run page (readable without
+          # signing in, pytest-github-actions-annotate-failures in the dev extras), and
+          # summarized at the end of the log (-rfE).
+          # no `uv run --with`: it runs pytest in an overlay environment, where dolmos
+          # does not find z3.exe (installed in .venv\bin, not on PATH, on Windows)
+          uv run pytest -v -rfE -k "not long and not ffi" --ignore=tests/lib \
+            --dolmos-options="-st --disable-gc --solver-threads 1 ${{ inputs.dolmos-options }}" ${{ inputs.pytest-options }}
diff --git a/BUILDING.md b/BUILDING.md
new file mode 100644
index 000000000..0021730f0
--- /dev/null
+++ b/BUILDING.md
@@ -0,0 +1 @@
+pip install -e ".[dev]"
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..51e3200bc
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,115 @@
+# Changelog
+
+All notable changes to dolmos are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow
+[Semantic Versioning](https://semver.org/). Dolmos is derived from halmos; see
+[NOTICE](NOTICE) for the upstream commit it is based on.
+
+## [Unreleased]
+
+## [0.2.0] - 2026-10-16
+
+### Added
+
+- file cheatcodes `vm.readFile`, `vm.readFileBinary`, `vm.parseBytes` and
+  `vm.projectRoot`, e.g. to deploy Huff bytecode read from a file; reads honor
+  `fs_permissions` from `foundry.toml` with foundry's semantics, and
+  `vm.parseBytes` accepts exactly what foundry accepts (halmos#213)
+- `vm.expectRevert` (all overloads, including the reverter address and `count`
+  variants), `vm.expectPartialRevert`, `vm.expectEmit` and
+  `vm.expectEmitAnonymous` (including the emitter address and `count` variants),
+  with foundry's semantics; symbolic revert data and event fields are matched
+  symbolically and a counterexample is reported when an expectation can be
+  violated (halmos#409)
+- multiple setup states: when `setUp()` has several feasible successful paths,
+  each test and each invariant test sequence is run from every one of them,
+  instead of failing with "Multiple paths were found in setUp()" (halmos#186)
+- experimental: `--dump-lassos DIR` exports each loop that reaches the unrolling
+  bound as a lasso program, and `--pasttel BINARY` analyses it with PaSTTeL
+  (termination proof with a ranking function, or non-termination). Lassos use
+  a small-constants encoding by default, because PaSTTeL computes with doubles
+  and is unsound on 2^256 constants; `--lasso-exact-constants` gives the exact
+  encoding. See docs/loop-termination.md
+- `SELFDESTRUCT` opcode, with the EIP-6780 (Cancun) semantics: the balance is sent to
+  the beneficiary and the frame halts; the account (code, storage, balance, nonce) is
+  deleted at the end of the transaction only if it was created in that transaction;
+  forbidden in static contexts (halmos#411)
+- EVM version setting, `--evm-version VERSION` (also usable in `dolmos.toml` and
+  `@custom:dolmos` annotations): opcodes introduced after the selected fork are invalid,
+  and `SELFDESTRUCT` deletes the account unconditionally before Cancun. Defaults to the
+  `evmVersion` the test contract was compiled for (foundry's `evm_version`), or to the
+  latest supported fork, `osaka` (halmos#128)
+- `--pretty-counterexamples` (`-pcex`) prints counterexamples that can be acted upon; see
+  docs/pretty-counterexamples.md:
+  - test arguments decoded with the ABI of the test, with the lengths of dynamic values
+    applied and values rendered by type (decimal, checksummed addresses, strings)
+  - `bytes` holding calldata decoded with the ABIs of the compiled contracts, and calls
+    made with calldata built by `svm.createCalldata` listed (halmos#369)
+  - `bytes4` values rendered as selectors, `0x00000000` as the empty selector of plain
+    ether transfers (halmos#419)
+  - invariant call sequences with concrete senders, values, arguments and timestamps
+  - a forge test replaying each counterexample
+  - duplicate counterexamples hidden, and counted (halmos#398)
+  - potentially invalid counterexamples relying on the approximation of `EXP` checked
+    against the real exponentiation: they are confirmed, replaced by a valid one, or
+    proven spurious; otherwise the reason is printed (halmos#280)
+
+### Fixed
+
+- `--early-exit` no longer reports the queries cancelled after the first counterexample as
+  solver errors (`executor has been shutdown`), nor saves them as failed queries
+  (halmos#398)
+- SHA256, RIPEMD160 and MODEXP precompiles with symbolic input no longer crash
+  with a z3 sort mismatch (input sizes were given in bytes instead of bits).
+  Concrete inputs are now evaluated exactly; MODEXP follows EIP-198 (zero-padded
+  input, output on `len(M)` bytes) and EIP-7823 (lengths above 1024 bytes make
+  the call fail), and its symbolic model guarantees `result < M` (halmos#402)
+- storage slots written as precomputed keccak256 literals (e.g. constant-folded by the
+  via-IR optimizer in a constructor) and read through SHA3 at runtime now hit the same
+  storage cell, instead of reading zero and reporting a false counterexample; applies to
+  both storage layouts (halmos#579)
+- counterexamples relying on keccak256 values that differ from the real hash function
+  (keccak256 is uninterpreted, so the solver could pick e.g. `x = 0` and assume that its
+  hash is the key of a storage entry) are no longer reported as valid. The real hashes of
+  the preimages chosen by the model are added to the query, which is solved again, up to
+  `--keccak-refinement-rounds` times (default 3, 0 disables the check); a counterexample
+  that still disagrees is reported as potentially invalid (halmos#562)
+- on Windows, `--solver-command` with a path such as `C:\solvers\z3.exe` is no
+  longer mangled (backslashes were parsed as shell escapes); quotes still group words
+- on Windows, `vm.readFile` no longer falls back to foundry's default `fs_permissions`
+  when `forge config` writes non-ascii output, and `fs_permissions` paths are matched
+  case-insensitively, as by foundry
+
+## [0.1.0] - 2026-09-22
+
+First release of dolmos.
+
+### Added
+
+- CREATE address derivation from `keccak256(rlp([sender, nonce]))` and account
+  nonces (EIP-161), so that CREATE3-style address prediction matches execution
+- nonce cheatcodes: `vm.getNonce`, `vm.setNonce`, `vm.setNonceUnsafe`,
+  `vm.resetNonce`
+- opcodes `CLZ` (EIP-7939), `BLOBHASH` and `BLOBBASEFEE` (EIP-4844)
+- experimental Vyper support: Vyper test contracts, Solidity tests targeting
+  Vyper contracts, `@custom:dolmos` annotations in docstrings,
+  `--invalid-as-failure`
+- `dolmos.toml` configuration file and `@custom:dolmos` annotations
+  (`halmos.toml`, `@custom:halmos` and `HALMOS_ALLOW_DOWNLOAD` remain accepted)
+- PyPI package and Docker image `ghcr.io/dowsers/dolmos`
+
+### Changed
+
+- command, Python package and symbolic variable prefix renamed from `halmos` to
+  `dolmos`; downloaded solvers are cached in `~/.dolmos/solvers`
+
+### Fixed
+
+- Vyper artifact lookup in the forge cache on Windows
+- builds with forge ≥ 1.8: `dynamic_test_linking` is disabled when dolmos runs
+  `forge build`, since it rewrites `new C()` into unsupported `vm.deployCode`
+  calls
+
+[Unreleased]: https://github.com/Dowsers/dolmos/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/Dowsers/dolmos/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/Dowsers/dolmos/releases/tag/v0.1.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4c385ca98..b8bf7e56b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,10 +1,7 @@
-# Contributing to Halmos
+# Contributing to dolmos
 
-We greatly appreciate your feedback, suggestions, and contributions to make Halmos a better tool for everyone!
-
-Join the [Halmos Telegram Group][chat] for any inquiries or further discussions.
-
-[chat]: <https://t.me/+4UhzHduai3MzZmUx>
+Bug reports, suggestions and pull requests are welcome on
+[GitHub](https://github.com/Dowsers/dolmos/issues).
 
 ## Development Setup
 
@@ -12,13 +9,13 @@ Clone or fork the repository:
 
 ```sh
 # if you want to submit a pull request, fork the repository:
-gh repo fork a16z/halmos
+gh repo fork Dowsers/dolmos
 
 # Or, if you just want to develop locally, clone it:
-git clone git@github.com:a16z/halmos.git
+git clone git@github.com:Dowsers/dolmos.git
 
 # navigate to the project directory
-cd halmos
+cd dolmos
 ```
 
 **Recommended**: set up the development environment using [uv](https://docs.astral.sh/uv/):
@@ -39,8 +36,8 @@ uv sync --extra dev
 uv run pre-commit install
 uv run pre-commit run --all-files
 
-# make changes to halmos, then run it with:
-uv run halmos
+# make changes to dolmos, then run it with:
+uv run dolmos
 
 # run the tests with:
 uv run pytest
@@ -65,7 +62,7 @@ Alternatively, you can manage the python version and the virtual environment man
 # create and activate a virtual environment with a suitable python version
 python3.12 -m venv .venv && source .venv/bin/activate
 
-# install halmos and its runtime dependencies in editable mode
+# install dolmos and its runtime dependencies in editable mode
 python -m pip install -e ".[dev]"
 
 # install and run the pre-commit hooks
@@ -94,4 +91,4 @@ By contributing, you agree that your contributions will be licensed under its [A
 
 ## Disclaimer
 
-_These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info._
+See the disclaimer in the [README](README.md#disclaimer).
diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
index 000000000..3d8cb64a3
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,6 @@
+# setuptools-scm puts every git-tracked file in the sdist, submodules included.
+# Keep the sdist to what is needed to build and test dolmos itself.
+prune tests/lib
+prune benchmarks
+prune .github
+prune .devcontainer
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 000000000..e0bfcf3bc
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,45 @@
+dolmos
+Copyright (C) 2026 Dowsers SAS
+
+This program is free software: you can redistribute it and/or modify it under
+the terms of the GNU Affero General Public License as published by the Free
+Software Foundation, version 3. See LICENSE.
+
+
+ORIGIN
+======
+
+dolmos is a modified version of halmos (https://github.com/a16z/halmos),
+a symbolic testing tool for EVM smart contracts developed by a16z crypto and its
+contributors (maintainers at the time of the fork: Daejun Park, karmacoma),
+distributed under the GNU Affero General Public License v3.
+
+dolmos is based on halmos as of upstream commit "fix: shorten bytecode output in
+unknown deployed bytecode warning (#573)" (2025-08-06). Dowsers SAS has modified
+it since 2026-05-15; the modifications include CREATE address derivation and
+account nonces, nonce cheatcodes, the CLZ, BLOBHASH and BLOBBASEFEE opcodes,
+Vyper support, and the renaming of the command, the Python package and the
+Docker images to dolmos. The git history records every change.
+
+dolmos is maintained by Dowsers SAS and is not affiliated with or endorsed by
+a16z crypto or the halmos maintainers.
+
+
+COMPATIBILITY WITH HALMOS
+=========================
+
+For compatibility with existing test suites, dolmos still accepts the
+`@custom:halmos` natspec tag, the `halmos.toml` configuration file name and the
+HALMOS_ALLOW_DOWNLOAD environment variable, and it supports the cheatcodes of
+the halmos-cheatcodes Solidity library (https://github.com/a16z/halmos-cheatcodes),
+which is a separate project used by the test suite as a git submodule.
+
+
+DISCLAIMER OF THE ORIGINAL WORK
+===============================
+
+The following disclaimer accompanies halmos and applies to the original work:
+
+_These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info._
+
+The same absence of warranty applies to the modifications made by Dowsers SAS.
diff --git a/README.md b/README.md
index e06d88444..a188784a4 100644
--- a/README.md
+++ b/README.md
@@ -1,102 +1,207 @@
-# Halmos
+# Dolmos
+
+[![License](https://img.shields.io/github/license/Dowsers/dolmos)](https://github.com/Dowsers/dolmos/blob/main/LICENSE)
+[![Python Version from PEP 621 TOML](https://img.shields.io/python/required-version-toml?tomlFilePath=https%3A%2F%2Fraw.githubusercontent.com%2FDowsers%2Fdolmos%2Frefs%2Fheads%2Fmain%2Fpyproject.toml)](pyproject.toml)
+
+Dolmos is a _symbolic testing_ tool for EVM smart contracts, driven by
+Foundry-style tests, maintained by [Dowsers](https://github.com/Dowsers) for its
+audit and formal verification work. Tests look like fuzz tests, but inputs are
+symbolic: a passing test holds for every input, and a failing one comes with a
+counterexample.
+
+Start with the [getting started guide](https://github.com/Dowsers/dolmos/blob/main/docs/getting-started.md) and the
+[examples](https://github.com/Dowsers/dolmos/blob/main/examples/README.md).
+Loops that reach the unrolling bound can be exported for termination analysis with
+PaSTTeL (experimental): see [docs/loop-termination.md](https://github.com/Dowsers/dolmos/blob/main/docs/loop-termination.md).
+
+## Features
+
+On top of symbolic execution of Solidity (and Vyper) tests with `check_*` and
+`invariant_*` functions, dolmos provides the following.
+
+**CREATE address derivation and account nonces.** Accounts carry nonces (1 for a
+newly created account per EIP-161, incremented by CREATE and CREATE2 even when
+the creation fails), and CREATE addresses are derived from
+`keccak256(rlp([sender, nonce]))`, mapped to a magic address as for CREATE2. A
+contract that predicts its own deployment address, as every CREATE3 library
+does, therefore agrees with the executor.
+
+**Nonce cheatcodes.** `vm.getNonce`, `vm.setNonce`, `vm.setNonceUnsafe` and
+`vm.resetNonce`, with foundry's semantics: `setNonce` only raises a nonce,
+`resetNonce` gives 0 to EOAs and 1 to accounts with code.
+
+**File cheatcodes.** `vm.readFile`, `vm.readFileBinary`, `vm.parseBytes` and
+`vm.projectRoot`, so a test can deploy bytecode compiled outside solc (Huff, for
+instance) from a file. Reads are subject to `fs_permissions` in `foundry.toml`,
+resolved with `forge config` and applied as foundry does (paths normalized
+against the project root, most specific permission wins, denied by default), so
+a test that reads a file passes or fails the same way under `forge test`.
+
+**Fusaka / Cancun opcodes.** `CLZ` (EIP-7939), with a concrete fast path and a
+logarithmic symbolic encoding, plus `BLOBHASH` and `BLOBBASEFEE` (EIP-4844).
+
+**Vyper.** Test contracts can be written in Vyper, and Solidity tests can target
+Vyper contracts. forge's Vyper artifacts have no AST, no metadata and an empty
+`methodIdentifiers`; dolmos reads `.vy`/`.vyi` artifacts, computes the selectors
+from the ABI, takes the source path and compiler version from forge's cache, and
+makes Vyper contracts visible to Solidity tests (deployed code, ABI for
+invariant targets and traces, including contracts with immutables).
+`vm.getCode` accepts `Foo.vy`, `src/Foo.vy` and `Foo.vy:Foo`.
+
+A Vyper test looks like a Solidity one: `setUp()` and `check_*`/`invariant_*`
+functions, with cheatcodes called through an interface at
+`0x7109709ECfa91a80626fF3989D68f67F5b1DD12D`. Use `assert ..., UNREACHABLE` for
+properties: it compiles to the INVALID opcode, which the `--invalid-as-failure`
+option reports as a failure, even when it is hit in a nested call and bubbles up
+as an empty revert. A plain `assert` is an empty revert, indistinguishable from
+a `require`, so the path is silently discarded. The `vm.assert*` cheatcodes work
+as well. `@custom:dolmos` annotations go in the module and function docstrings.
+
+When the build contains Vyper contracts, `--storage-layout generic` (Vyper
+computes `HashMap` slots as `keccak256(slot . key)`) and `--invalid-as-failure`
+become the defaults; a value set in `dolmos.toml`, an annotation or on the
+command line still wins. Coverage reports do not include Vyper code, since forge
+emits no source maps for it. See `tests/vyper` for examples.
+
+## Compatibility with halmos
+
+Dolmos is derived from halmos (see [NOTICE](https://github.com/Dowsers/dolmos/blob/main/NOTICE)) and accepts the names used
+by test suites written for it, so they should run without changes:
+
+| halmos | dolmos | |
+|---|---|---|
+| `@custom:halmos` | `@custom:dolmos` | both accepted, in contracts and functions |
+| `halmos.toml` | `dolmos.toml` | `dolmos.toml` is read first |
+| `HALMOS_ALLOW_DOWNLOAD` | `DOLMOS_ALLOW_DOWNLOAD` | both honored |
+| `halmos-cheatcodes` | unchanged | the `svm.*` cheatcodes of this library are supported |
+
+Some things do change: the command and the Python package are named `dolmos`
+(`import dolmos`), symbolic variables in counterexamples are prefixed with
+`dolmos_`, and solvers downloaded on demand are cached in `~/.dolmos/solvers`.
 
-[![PyPI - Version](https://img.shields.io/pypi/v/halmos)](https://pypi.org/project/halmos)
-[![Python Version from PEP 621 TOML](https://img.shields.io/python/required-version-toml?tomlFilePath=https%3A%2F%2Fraw.githubusercontent.com%2Fa16z%2Fhalmos%2Frefs%2Fheads%2Fmain%2Fpyproject.toml)](https://github.com/a16z/halmos)
-[![License](https://img.shields.io/github/license/a16z/halmos)](https://github.com/a16z/halmos/blob/main/LICENSE)
-[![chat](https://img.shields.io/badge/chat-telegram-blue)](https://t.me/+4UhzHduai3MzZmUx)
-
-[**Install**](https://github.com/a16z/halmos?tab=readme-ov-file#installation)
-| [**Getting Started**](https://github.com/a16z/halmos/blob/main/docs/getting-started.md)
-| [**Examples**](https://github.com/a16z/halmos/blob/main/examples/README.md)
-| [**FAQ**](https://github.com/a16z/halmos/wiki/FAQ)
-| [**Chat**][chat]
-| [**awesome-halmos**](https://github.com/redtrama/awesome-halmos)
-
-Halmos is a _symbolic testing_ tool for EVM smart contracts. A Solidity/Foundry frontend is currently offered by default, with plans to provide support for other languages, such as Vyper and Huff, in the future.
-
-You can read more in our post: "_[Symbolic testing with Halmos: Leveraging existing tests for formal verification][post]_."
+## Installation
 
-Join the [Halmos Telegram Group][chat] for any inquiries or further discussions.
+Requires Python ≥ 3.11 and [Foundry](https://getfoundry.sh).
 
-[post]: https://a16zcrypto.com/symbolic-testing-with-halmos-leveraging-existing-tests-for-formal-verification/
-[chat]: https://t.me/+4UhzHduai3MzZmUx
+With [uv](https://docs.astral.sh/uv/) (recommended, installs `dolmos` as an
+isolated command-line tool):
 
-## Installation
+```sh
+uv tool install dolmos
+dolmos --version
+```
 
-### ⭐ Using `uv` (recommended for most users)
+With pipx or pip:
 
 ```sh
-# install uv if you don't have it already
-curl -LsSf https://astral.sh/uv/install.sh | sh
+pipx install dolmos
+# or, in a virtual environment
+pip install dolmos
+```
 
-# install the latest version of halmos for the current user and add it to PATH
-uv tool install --python 3.12 halmos
+Upgrade with `uv tool upgrade dolmos` (or `pipx upgrade dolmos`,
+`pip install -U dolmos`).
 
-# or, install the development version from the repository
-# uv tool install --python 3.12 git+https://github.com/a16z/halmos
+### Docker
 
-# after installing, you can update halmos to the latest version with:
-uv tool upgrade halmos
-```
+Each release is published as a Docker image that bundles dolmos, Foundry and the
+SMT solvers (yices, z3, cvc5, bitwuzla, stp):
 
-### Using `docker`
+```sh
+docker run --rm -v "$PWD":/workspace ghcr.io/dowsers/dolmos:latest dolmos
+# or a fixed version
+docker run --rm -v "$PWD":/workspace ghcr.io/dowsers/dolmos:0.1.0 dolmos
+```
 
-You can download a pre-built Docker image that contains python, halmos, its dependencies, foundry, solvers, etc.:
+### From source
 
 ```sh
-docker pull ghcr.io/a16z/halmos:latest
+git clone https://github.com/Dowsers/dolmos.git
+cd dolmos
+uv sync --extra dev        # or: python -m venv .venv && pip install -e ".[dev]"
+uv run dolmos --version
 ```
 
-### Using `pip` (for advanced users)
+See [CONTRIBUTING.md](https://github.com/Dowsers/dolmos/blob/main/CONTRIBUTING.md)
+for the development setup.
 
-Note: this is not recommended because of the extra work required to manage the python version and the virtual environment. But if you know what you are doing, and need the extra control, you can do it like this:
+## Usage
 
 ```sh
-# make sure you have a suitable python version installed, e.g.:
-python3.12 --version
+cd /path/to/foundry/project
+forge build
+dolmos
+```
 
-# create and activate a virtual environment with an explicit python version
-python3.12 -m venv .venv && source .venv/bin/activate
+```sh
+dolmos --help
+dolmos -test <regex>          # alias for --match-test
+dolmos --match-contract <regex>
+```
 
-# install the latest version of halmos
-pip install halmos
+Options can be set per project in `dolmos.toml` at the project root:
 
-# or, install the development version from the repository
-pip install git+https://github.com/a16z/halmos
+```toml
+[global]
+solver-timeout-assertion = 10000
 ```
 
-## Usage
+`python -m dolmos.config` prints every option with its default value, in that
+format. Warnings link to their explanation in [docs/warnings.md](https://github.com/Dowsers/dolmos/blob/main/docs/warnings.md).
+
+## Tests
 
 ```sh
-cd /path/to/src
-halmos
+pytest                                   # unit tests and integration tests
+pytest tests/test_dolmos.py -k "not long"
 ```
 
-For more details:
+The regression suite lives in `tests/regression` and runs with both forge (real
+EVM) and dolmos (symbolic):
 
 ```sh
-halmos --help
+cd tests/regression
+forge build
+dolmos
 ```
 
-Alternatively, you can run the latest halmos Docker image available at [ghcr.io/a16z/halmos](https://ghcr.io/a16z/halmos):
+A few notes on the toolchain:
 
-```sh
-cd /path/to/src
+- The suite sets `evm_version = 'osaka'` because of the CLZ tests, and
+  `test/OpCodesCLZ.sol` needs a solc recent enough to accept `clz()` in assembly
+  (0.8.31 or later); an older compiler fails with `Function "clz" not found`.
+- `test/Invalid.t.sol` requires solc `^0.5.2`; if that version is unavailable,
+  `forge build` stops there.
+- `test/Arith.t.sol` uses the `bitwuzla-abs` solver; set
+  `DOLMOS_ALLOW_DOWNLOAD=1` to let dolmos download it.
+- The Vyper tests live in `tests/vyper` and need the `vyper` compiler in `PATH`
+  (`pip install vyper`); pytest skips them otherwise.
 
-# mount '.' under /workspace in the container
-docker run -v .:/workspace ghcr.io/a16z/halmos:latest
-```
+## Contributing
 
-## Getting Started
+See [CONTRIBUTING.md](https://github.com/Dowsers/dolmos/blob/main/CONTRIBUTING.md).
 
-Refer to the [getting started guide](docs/getting-started.md) and the [examples](examples/README.md) directory.
+## Roadmap
 
-## Contributing / Developing
+- MODEXP precompile (EIP-198): concrete evaluation and a typed uninterpreted
+  function instead of the current opaque one
+- performance: skip the Z3 `substitute()` traversal when no free variable
+  matches, bound the concurrency of solver subprocesses, memoize invariant
+  target resolution
+- support multiple `setUp()` states
 
-Refer to the [contributing guidelines](CONTRIBUTING.md), and explore the list of issues labeled ["good first issue" or "help wanted."][issues]
+## License
 
-[issues]: https://github.com/a16z/halmos/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22%2C%22help+wanted%22
+AGPL-3.0, see [LICENSE](https://github.com/Dowsers/dolmos/blob/main/LICENSE). Dolmos is a modified version of another
+AGPL-3.0 program; [NOTICE](https://github.com/Dowsers/dolmos/blob/main/NOTICE) gives its origin and the notices that come
+with it.
 
 ## Disclaimer
 
-_These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info._
+_This software and the smart contracts in this repository are provided as is,
+without warranty of any kind, express or implied, including any warranty of
+merchantability, non-infringement or fitness for a particular purpose. They have
+not been audited. Passing symbolic tests is not a proof that a contract is free
+of bugs. Nothing in this repository is investment or legal advice. See
+[NOTICE](https://github.com/Dowsers/dolmos/blob/main/NOTICE) for the disclaimers attached to the original work this code is
+derived from._
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 000000000..f8b6215e5
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,60 @@
+# Releasing dolmos
+
+A release is a git tag `vX.Y.Z` plus a GitHub Release. The package version is
+derived from the tag by setuptools-scm: there is no version number to edit in
+the code.
+
+## One-time setup
+
+1. **PyPI Trusted Publisher.** On https://pypi.org/manage/account/publishing/,
+   add a *pending publisher* (the `dolmos` project does not exist yet):
+   owner `Dowsers`, repository `dolmos`, workflow `publish-pypi.yml`,
+   environment `release`. After the first upload, the pending publisher becomes
+   a regular one. Do the same on https://test.pypi.org if you want dry runs.
+2. **GitHub environment.** In the repository settings, create the `release`
+   environment and add required reviewers, so that a PyPI upload always needs
+   an explicit approval.
+3. **Docker images.** Run, in this order and once, the workflows
+   `Push solvers package`, `Push dolmos-builder package` and
+   `Push dolmos package` (each triggers the next one). Then, in the
+   organization's *Packages* page, set `solvers`, `dolmos-builder` and `dolmos`
+   to **public** and link them to this repository. The CI jobs that run inside
+   these images (`test-long`, `test-ffi`, `test-external`) need them.
+4. **Tag protection.** Add a ruleset that restricts who can create `v*` tags.
+
+## Release checklist
+
+1. All workflows are green on `main` (`Test`, `Test long`, `Test external`,
+   `pre-commit`).
+2. Move the entries of `## [Unreleased]` in `CHANGELOG.md` under a new
+   `## [X.Y.Z] - YYYY-MM-DD` heading, update the links at the bottom, commit.
+3. Optional dry run: run `Publish to PyPI` by hand (*workflow_dispatch*); it
+   builds, checks and smoke-tests the distributions without publishing.
+4. Tag and push:
+
+   ```sh
+   git tag -a vX.Y.Z -m "dolmos X.Y.Z"
+   git push origin vX.Y.Z
+   ```
+
+   The tag push triggers `Push dolmos package`, which publishes
+   `ghcr.io/dowsers/dolmos:X.Y.Z`, `:X.Y` and `:latest`.
+5. Create the GitHub Release from the tag, with the changelog section as notes:
+
+   ```sh
+   gh release create vX.Y.Z --title "dolmos X.Y.Z" --notes-file <(sed -n '/## \[X.Y.Z\]/,/## \[/p' CHANGELOG.md | sed '$d')
+   ```
+
+   Publishing it triggers `Publish to PyPI` (after the `release` environment
+   approval), which uploads to PyPI and attaches the wheel and sdist to the
+   release.
+6. Check: `uv tool install dolmos==X.Y.Z && dolmos --version`, and
+   `docker run --rm ghcr.io/dowsers/dolmos:X.Y.Z dolmos --version`.
+
+A version published on PyPI can never be re-uploaded. If a release is broken,
+yank it on PyPI and release `X.Y.(Z+1)`.
+
+## Version numbers
+
+- `0.x`: the CLI and the configuration may still change between minor versions.
+- Patch releases (`0.1.1`) only contain fixes.
diff --git a/benchmarks/baolean.sh b/benchmarks/baolean.sh
index 73f2229df..2c37b2629 100755
--- a/benchmarks/baolean.sh
+++ b/benchmarks/baolean.sh
@@ -13,6 +13,6 @@ fi
 for test_name in "PostExampleTest" "PostExampleTwoTest" "PostExampleTwoLiveTest" "FooTest" "MiniVatTest"; do
     echo
     echo -e "▀▄▀▄▀▄   🎀  Running ${GREEN}${test_name}${NC}  🎀   ▄▀▄▀▄▀"
-    time halmos --root symexec-bench/SymTest --contract ${test_name} "--function" test
+    time dolmos --root symexec-bench/SymTest --contract ${test_name} "--function" test
 done
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index bfac18cc0..3ae44f352 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,4 +1,4 @@
-# How to write symbolic tests with Halmos
+# How to write symbolic tests with dolmos
 
 Symbolic tests look similar to fuzz tests, but there are certain differences that need to be understood. This guide will walk you through the process of writing symbolic tests, highlighting the differences compared to fuzz tests. It is intended for those who are already familiar with [Dapptools]-/[Foundry]-style fuzz tests. If you haven't experienced fuzz tests before, please refer to the [Foundry document][Foundry Fuzz Testing] to grasp the basic concepts.
 
@@ -6,21 +6,17 @@ Symbolic tests look similar to fuzz tests, but there are certain differences tha
 [Foundry]: <https://book.getfoundry.sh/>
 [Foundry Fuzz Testing]: <https://book.getfoundry.sh/forge/fuzz-testing>
 
-## 0. Install Halmos
+## 0. Install dolmos
 
-If you haven't installed Halmos yet, please refer to the [installation guide](../README.md#installation) or quickly install it with:
-
-```sh
-uv tool install halmos
-```
+If you haven't installed dolmos yet, follow the [installation guide](../README.md#installation).
 
 ## 1. Write setUp()
 
 Similar to foundry tests, you can provide the `setUp()` function that will be executed before each test. In the setup function, you can create an instance of the target contracts, and initialize their state. These initialized contracts will then be accessible for every test.
 
-Furthermore, you are also allowed to call the constructor with symbolic arguments, initializing the contract state to be symbolic. You can create those symbols using [Halmos cheatcodes].
+Furthermore, you are also allowed to call the constructor with symbolic arguments, initializing the contract state to be symbolic. You can create those symbols using the cheatcodes of the [halmos-cheatcodes] library, which dolmos supports.
 
-[Halmos cheatcodes]: <https://github.com/a16z/halmos-cheatcodes>
+[halmos-cheatcodes]: <https://github.com/a16z/halmos-cheatcodes>
 
 For example, consider a basic ERC20 token contract as shown below:
 ```solidity
@@ -53,12 +49,14 @@ By using the symbolic initial supply, you can check if the given tests pass for
 
 **Tips:**
 
-- The Halmos cheatcodes can be installed like any other Solidity dependencies:
+- The cheatcodes library can be installed like any other Solidity dependency:
   ```
   forge install a16z/halmos-cheatcodes
   ```
 
-- The current list of available Halmos cheatcodes can be found [here][halmos-cheatcodes-list].
+- The current list of available cheatcodes can be found [here][halmos-cheatcodes-list].
+
+- `setUp()` may branch on symbolic values (or revert on some of them): every feasible successful path becomes a separate setup state, and each test (and each invariant test sequence) is run from each of them. Counterexamples include the symbolic values that select the setup state. Run with `-v` to display the number of setup states.
 
 [halmos-cheatcodes-list]: <https://github.com/a16z/halmos-cheatcodes/blob/main/src/SVM.sol>
 
@@ -128,7 +126,7 @@ for (uint160 sender = 0; sender < type(uint160).max; sender++) {
 
 **Tips:**
 
-- Instead of declaring symbolic input parameters, you can dynamically create symbols inside the test using the Halmos cheatcodes. For instance, our running example can be rewritten as follows:
+- Instead of declaring symbolic input parameters, you can dynamically create symbols inside the test using the symbolic cheatcodes. For instance, our running example can be rewritten as follows:
   ```solidity
   function check_transfer() {
       address sender = svm.createAddress("sender");
@@ -138,7 +136,7 @@ for (uint160 sender = 0; sender < type(uint160).max; sender++) {
   }
   ```
 
-- Halmos requires dynamically-sized arrays (including `bytes` and `string`) to be given with a fixed size. Thus they cannot be declared as input parameters, but need to be programmatically constructed. For example, a byte array can be generated using the `svm.createBytes()` cheatcode as follows:
+- Dolmos requires dynamically-sized arrays (including `bytes` and `string`) to be given with a fixed size. Thus they cannot be declared as input parameters, but need to be programmatically constructed. For example, a byte array can be generated using the `svm.createBytes()` cheatcode as follows:
   ```solidity
   bytes memory data = svm.createBytes(96, 'data');
   ```
@@ -200,6 +198,15 @@ token.transfer(receiver, amount);
   }
   ```
 
+- Foundry's `vm.expectRevert()` (all variants, including `expectPartialRevert`, the reverter address and the `count` overloads) and `vm.expectEmit()` (including `expectEmitAnonymous`, the emitter address and the `count` overloads) are supported, with the same semantics as in foundry. With symbolic inputs, dolmos reports a counterexample whenever the expectation can be violated:
+  ```solidity
+  vm.assume(amount > balanceOfSender);
+  vm.expectRevert(abi.encodeWithSelector(Token.InsufficientBalance.selector, sender));
+  vm.prank(sender);
+  token.transfer(receiver, amount);
+  ```
+  Note that like foundry, logs emitted by reverted subcalls are taken into account by `expectEmit`.
+
 ### 2.4 Check output states
 
 After calling the target contracts, you can write assertions against the output state of the contracts.
@@ -210,15 +217,17 @@ assert(token.balanceOf(sender) == balanceOfSender - amount);
 assert(token.balanceOf(receiver) == balanceOfReceiver + amount);
 ```
 
-If there are any inputs that violate these assertions, Halmos will reports those inputs, referred to as counterexamples.
+If there are any inputs that violate these assertions, dolmos will report those inputs, referred to as counterexamples.
 
-For our example, Halmos will identify an input combination where the sender address is identical to the receiver address. This is because self-transfers do not alter the balance, leading to scenarios where the above assertions are not satisfied.
+For our example, dolmos will identify an input combination where the sender address is identical to the receiver address. This is because self-transfers do not alter the balance, leading to scenarios where the above assertions are not satisfied.
 
 **Tips:**
 
-- Halmos focuses solely on assertion violations (i.e., revert with `Panic(1)`), disregarding other revert cases. This means that Halmos doesn't report any inputs that lead to other types of revert. For instance, in our example, any inputs that trigger an overflow in `balanceOfReceiver + amount`, or inputs causing the external contract call to fail will be ignored. To avoid disregarding such inputs, you can utilize an `unchecked` block or a low-level call.
+- Run with `--pretty-counterexamples` (`-pcex`) to get counterexamples decoded with the ABI (arguments, calldata, selectors, invariant call sequences), without duplicates, and with a forge test that replays each of them. See [pretty counterexamples](pretty-counterexamples.md).
+
+- Dolmos focuses solely on assertion violations (i.e., revert with `Panic(1)`), disregarding other revert cases. This means that dolmos doesn't report any inputs that lead to other types of revert. For instance, in our example, any inputs that trigger an overflow in `balanceOfReceiver + amount`, or inputs causing the external contract call to fail will be ignored. To avoid disregarding such inputs, you can utilize an `unchecked` block or a low-level call.
 
-- If you're using an older compiler version (`< 0.8.0`) that uses the `INVALID` opcode for assertion violation, rather than the `Panic(1)` error code, then Halmos will _not_ report any counterexamples. In that case, you will need to use a custom assertion that reverts with `Panic(1)` upon failure, as shown below:
+- If you're using an older compiler version (`< 0.8.0`) that uses the `INVALID` opcode for assertion violation, rather than the `Panic(1)` error code, then dolmos will _not_ report any counterexamples by default. In that case, run with `--invalid-as-failure` (the default when the build contains Vyper contracts), or use a custom assertion that reverts with `Panic(1)` upon failure, as shown below:
   ```solidity
   function myAssert(bool cond) internal pure {
       if (!cond) {
@@ -245,7 +254,3 @@ However, since symbolic tests are performed symbolically, certain behavioral dif
 - The `vm.assume()` cheatcode performs better than `bound()`.
 
 For further insights, refer to [examples of symbolic tests](../examples/README.md).
-
-Join the [Halmos Telegram Group] for any inquiries or further discussions.
-
-[Halmos Telegram Group]: <https://t.me/+4UhzHduai3MzZmUx>
diff --git a/docs/loop-termination.md b/docs/loop-termination.md
new file mode 100644
index 000000000..0668a1e3f
--- /dev/null
+++ b/docs/loop-termination.md
@@ -0,0 +1,217 @@
+# Loop termination analysis with PaSTTeL (experimental)
+
+dolmos explores loops by unrolling them up to a bound (`--loop`, 2 by default). When a
+path would need more iterations, it is dropped and the test reports
+`bounds: [...]`: the exploration is incomplete, and nothing is known about the loop
+itself.
+
+With `--dump-lassos`, every loop that reaches the unrolling bound is exported as a
+*lasso program*, which [PaSTTeL](https://github.com/Dowsers/PaSTTeL) can analyse to
+prove termination (with a ranking function) or non-termination.
+
+- [Usage](#usage)
+- [Reading the results](#reading-the-results)
+- [How a loop becomes a lasso](#how-a-loop-becomes-a-lasso)
+- [From bitvectors to integers](#from-bitvectors-to-integers)
+- [The small-constants encoding (PaSTTeL workaround)](#the-small-constants-encoding-pasttel-workaround)
+- [Limitations](#limitations)
+
+## Usage
+
+```bash
+# export the lassos only
+dolmos --dump-lassos lassos/
+
+# export and analyse them
+dolmos --dump-lassos lassos/ --pasttel /path/to/pasttel [--pasttel-timeout 30]
+```
+
+| Option | Description |
+|---|---|
+| `--dump-lassos DIR` | export each loop that reaches the unrolling bound to `DIR` |
+| `--pasttel BINARY` | run PaSTTeL on each exported lasso and report the verdict |
+| `--pasttel-timeout SECONDS` | time limit per PaSTTeL run (default: 30) |
+| `--lasso-exact-constants` | exact wrap-around encoding with 2^256 constants, for tools with exact arithmetic (not PaSTTeL, see below) |
+
+The option has no effect on the test results: the extraction runs on a separate
+solver, and a failed extraction is reported without affecting the test.
+
+For each loop, three files are written:
+
+- `<test>_<loop id>_<branch>.json`: the lasso, in PaSTTeL's JSON trace format
+- `<test>_<loop id>_<branch>.meta.json`: which stack slots the program variables
+  `v0, v1, ...` stand for, the number of body paths, the encoding, and warnings
+- `<test>_<loop id>_<branch>.pasttel.txt`: PaSTTeL's output (with `--pasttel`)
+
+and a line is printed after the test result:
+
+```
+[PASS] check_count_down(uint256) (paths: 5, time: 0.15s, bounds: [])
+    loop 2129:473 (false branch): TERMINATING [RankingBased(AffineTemplate): v0] -> lassos/check_count_down_2129_473_f.json
+```
+
+## Reading the results
+
+- **TERMINATING**, with a ranking function: the loop terminates. This result is
+  reliable: the lasso over-approximates the behaviours of the loop, and a proof for
+  more behaviours is a proof for the actual ones.
+- **NON-TERMINATING**: PaSTTeL found an infinite execution *of the lasso*. If the lasso
+  is exact (`"exact": true` in the metadata), the witness is an infinite execution of
+  the loop. Otherwise the verdict is printed as *unconfirmed*: the witness may rely on
+  behaviours that the over-approximation introduced.
+- **UNKNOWN / TIMEOUT**: no conclusion.
+- **Warnings**:
+  - `storage written in the loop body`: only stack variables are tracked (see
+    [Limitations](#limitations)). If the loop condition depends on a storage slot
+    written in the body, the result is not reliable, including a TERMINATING verdict.
+  - `body path not explored`, `too many body paths`, `step budget exhausted`: the
+    extraction is incomplete; the result is only indicative.
+
+## How a loop becomes a lasso
+
+A lasso is a *stem* (how the execution reaches the loop) followed by a *loop*
+transition that repeats forever. dolmos builds both from the symbolic execution:
+
+1. **Loop variables.** At each visit of a symbolic `JUMPI`, the stack is recorded.
+   When the unrolling bound is reached, the stack slots that differ from the previous
+   visit are the loop variables.
+2. **Cut point.** The lasso is cut right after the `JUMPI`, on the branch that
+   stays in the loop. The bound is often reached on a `JUMPI` inside an internal
+   function that solc generates (e.g. checked arithmetic): any point of the cycle is
+   a valid cut point, but it must be identified precisely. Like the unrolling
+   counters, dolmos uses the program counter and the jump destinations on the stack,
+   plus the stack height to tell apart the call sites of the same internal function.
+3. **Generalized iteration.** The loop body is executed once more from a state where
+   the loop variables are fresh symbols, until the execution is back at the cut
+   point in the same frame. Each path that comes back *and takes the loop branch
+   again* is a disjunct of the loop transition. This execution runs on a separate
+   solver, with its own step budget.
+4. **Stem.** The path condition up to the cut point, sliced to the conditions that
+   relate to the initial values of the loop variables.
+
+Subterms that don't depend on the loop variables (inputs, values read before the
+loop) become constant program variables, shared by the stem and the loop: without
+them, `for (i = 0; i < n; i++)` could not be proven, as `n` would change at every
+iteration.
+
+## From bitvectors to integers
+
+EVM words are 256-bit bitvectors; PaSTTeL works on integers. Every w-bit value
+becomes an integer `x` with `0 <= x`, and:
+
+| Bitvector | Integer encoding |
+|---|---|
+| `bvadd`, `bvsub`, `bvneg`, `bvmul`/`bvshl` by a constant | exact, with the wrap-around made explicit (see below) |
+| `bvudiv`, `bvurem`, `bvlshr` by a constant, `extract`, `concat`, `zero_extend` | exact, with a quotient `q` such that `c*q <= a <= c*q + c - 1` |
+| unsigned comparisons, boolean connectives | exact |
+| `ite` | a fresh variable and a disjunction (PaSTTeL doesn't parse arithmetic `ite`) |
+| anything else (keccak, storage and memory reads, bitwise operations, nonlinear arithmetic...) | a fresh variable: over-approximation |
+
+## The small-constants encoding (PaSTTeL workaround)
+
+### The problem
+
+The natural encoding of a wrap-around is `r = e - 2^256 * k`. It needs 2^256
+constants, and PaSTTeL cannot represent them: it parses and stores numbers as C++
+`double` (`std::stod` in its SMT parser, `double` coefficients in `AffineTerm`),
+which are exact for integers up to 2^53 only. 2^256 and 2^256 - 1 become the same
+number, and the analysis becomes unsound. In our experiments, PaSTTeL reported a
+simple countdown loop as non-terminating, with a witness that is impossible even over
+the rationals; it also produced ranking functions with coefficients equal to
+`DBL_MAX`, and, worse, a termination proof for a loop that does not terminate (see
+[Results](#results)).
+
+(A second, independent issue: ranking function synthesis works over the rationals.
+With a free integer `k`, a fractional `k` allows any result, so the encoding
+`r = e - 2^256 * k` loses all precision even with exact arithmetic. The exact
+encoding therefore uses one disjunct per possible value of `k`.)
+
+The proper fix is exact rational arithmetic in PaSTTeL. Until then, dolmos produces
+lassos without large constants: this is the default encoding.
+
+### The encoding
+
+No literal in the lasso exceeds 2^52 (this is checked before writing the file).
+
+1. **Wrap-arounds are proven absent when possible.** For each addition, subtraction
+   or multiplication by a constant, dolmos asks z3, with the bitvector semantics,
+   whether the operation can wrap around on the path. If it cannot, the result is
+   the plain integer expression (`x + 1`, `x - 1`), which is exact.
+   - With checked arithmetic (Solidity >= 0.8), the overflow checks are on the path,
+     so the proof usually succeeds.
+   - `x - 1` is compiled as `x + (2^256 - 1)`: an addition of a constant `C >=
+     2^255` is handled as a subtraction of `2^256 - C`, with the borrow condition
+     `x >= 1`.
+2. **The prover knows how the iteration was entered.** An increment `i + 1` only
+   wraps around if `i = 2^256 - 1`, which is excluded by the loop condition `i < n`
+   checked *before* the iteration, i.e. at the end of the previous one. The prover is
+   given this fact, as a disjunction over the body paths with renamed variables. It
+   is valid because the unrolling bound was reached (so there was a previous
+   iteration), and only used when the body paths are complete.
+3. **Facts about the inputs are used.** The path conditions of the stem are about
+   input symbols, which never change: they hold at every iteration. For instance,
+   `vm.assume(n < 1000)` lets the prover show that `i += 3` doesn't wrap while
+   `i < n`.
+4. **Otherwise, a sound over-approximation without large constants:**
+   - addition, multiplication (the result can only wrap downwards): `0 <= r <= e`
+   - subtraction (the result can only wrap upwards):
+     `(e >= 0 and r = e) or e < 0`, where `r` is unconstrained in the second case
+   - truncation (`extract`, masks): same as addition
+   - division or remainder by a large constant: `0 <= q <= a`
+5. **Large literals become constant program variables** (`c0, c1, ...`), constrained
+   by their order (`0 <= c0 < c1 < ...`): comparisons such as `x < 2^200` keep their
+   structure.
+6. **Upper bounds `x < 2^256` are dropped** (only `0 <= x` is kept): an
+   over-approximation.
+7. **Signed comparisons** are exact when both operands are provably below 2^255
+   (then they are unsigned comparisons); otherwise they are over-approximated.
+
+The metadata records the encoding and whether the lasso is exact
+(`"exact": false` as soon as one over-approximation was used).
+
+### Results
+
+On a set of test loops (countdown, count-up, `unchecked` step of 3, loops leaving
+through a wrap-around):
+
+| Loop | exact encoding (`--lasso-exact-constants`) | small-constants encoding (default) |
+|---|---|---|
+| `while (x > 0) x -= 1;` | TERMINATING, coefficients ~2^251 (unreliable) | TERMINATING, rank `v0` |
+| `for (i = 0; i < n; i++) s += 1;` | TERMINATING, huge coefficients (unreliable) | TERMINATING, rank `5·k0 + v0 − 3·v1 − 3` |
+| `while (i < n) unchecked { i += 3; }` (`n < 1000`) | TERMINATING, huge coefficients (unreliable) | TERMINATING, rank `8·k0 − 2·v0 − 27` |
+| `while (x != 0) { unchecked { x -= 2; } if (x > 1000) break; }` | TERMINATING, rank `10·v0 − 1` | TERMINATING, rank `10·v0 + 19` |
+| `while (x != 0) unchecked { x -= 2; }` (non-terminating for odd `x`) | **TERMINATING (wrong)** | NON-TERMINATING, unconfirmed (correct) |
+
+The fourth loop terminates: for odd `x`, `x - 2` eventually wraps around to
+`2^256 - 1 > 1000`. An earlier version of the extraction, with the exact encoding,
+reported it and the countdown loop as non-terminating.
+
+On the regression suite, the 20 loops reaching the bound are all extracted; the
+test results are unchanged.
+
+### Exact encoding
+
+`--lasso-exact-constants` produces the exact encoding (2^256 constants, one
+disjunct per wrap-around case). It is meant for termination tools with exact
+arithmetic; with the current PaSTTeL, its results are unreliable.
+
+## Limitations
+
+- **Only stack variables are tracked.** Storage and memory are not generalized:
+  values read from them are either constants (if they don't depend on the loop
+  variables) or fresh values. Loops whose body writes to storage are flagged.
+  Loops that index memory with the loop counter (`arr[i]` on a memory array) often
+  cannot be extracted, as dolmos doesn't support symbolic memory offsets.
+- **Non-termination is not confirmed.** A NON-TERMINATING verdict on an
+  over-approximated lasso would need to be replayed with the bitvector semantics;
+  this is not implemented yet.
+- **Loops whose condition becomes constant are not exported.** dolmos only applies
+  the unrolling bound to loops whose condition is symbolic. A loop that makes no
+  progress, like `while (x > y) {}`, has a condition that becomes known after the
+  first iteration: dolmos keeps unrolling it forever, and the bound, hence the export,
+  is never reached. This is an existing dolmos limitation.
+- **One cut point per loop and branch** is exported per test; the lasso describes
+  the loop from that point, with the paths found from the state where the bound was
+  reached.
+- The ranking function proves termination, but it is not used yet to raise the
+  unrolling bound of the loop.
diff --git a/docs/pretty-counterexamples.md b/docs/pretty-counterexamples.md
new file mode 100644
index 000000000..cbda2ef4d
--- /dev/null
+++ b/docs/pretty-counterexamples.md
@@ -0,0 +1,140 @@
+# Pretty counterexamples
+
+By default, a counterexample is printed as the raw solver model: one line per symbol, with
+the full hexadecimal value of every word. A `bytes` argument of length 65 is printed as the
+1024 bytes of its largest length candidate, a `bytes4` selector as `0x00`, and the same
+values are repeated for every failing path.
+
+`--pretty-counterexamples` (short: `-pcex`) prints counterexamples that can be acted upon:
+
+```
+dolmos -pcex
+```
+
+It can also be set in `dolmos.toml` (`pretty-counterexamples = true`), or for a contract or
+a function with `/// @custom:dolmos --pretty-counterexamples`. The verdicts of the tests
+and the JSON output are the same as without the option, except for counterexamples that
+are proven spurious (see [Potentially invalid counterexamples](#potentially-invalid-counterexamples)).
+
+## What it changes
+
+- **Arguments decoded with the ABI of the test.** The lengths of dynamic arrays, `bytes` and
+  `string` are applied, and values are printed by type: decimal integers (with a readable
+  form such as `1e18`, `2**255` or `type(uint256).max` when there is one), checksummed
+  addresses (with the contract deployed there and the state variable of the test holding
+  it), quoted strings, `true`/`false`. Structs and arrays are flattened to one line per
+  value (`p.a = 7`, `calls[1] = …`).
+- **Calldata decoded** (halmos#369). `bytes` values whose first 4 bytes are the selector of a
+  function of a compiled contract are decoded with its ABI, e.g.
+  `Token.transfer(to: 0x…, amount: 2) + 956 trailing zero bytes`. Calls made by the test
+  with calldata built from other symbols (e.g. by `svm.createCalldata`) are listed under
+  `Calls made with symbolic calldata`.
+- **Selectors** (halmos#419). `bytes4` values are printed with the function they select, and
+  `0x00000000` as the empty selector of plain ether transfers (`receive()` or
+  `fallback()`), unless some contract has a function with that selector.
+- **Invariant call sequences with concrete values**: target, decoded arguments, `msg.sender`,
+  `msg.value`, `tx.origin` and `block.timestamp` of each call. The symbolic trace is still
+  printed with `-vv`.
+- **A forge test replaying the counterexample**, to paste into the test contract. It fails
+  if the counterexample is real.
+- **Duplicates hidden** (halmos#398). A counterexample with the same values as one already
+  printed for the test is counted but not printed; the number of hidden duplicates is
+  printed after the result of the test. `--early-exit` stops at the first valid
+  counterexample.
+- **Potentially invalid counterexamples are checked**, and the reason is printed when they
+  remain potentially invalid (halmos#280), see below.
+
+## Example
+
+From `tests/regression/test/PrettyCex.t.sol`:
+
+```solidity
+function check_pcex_calldata(bytes calldata data) external {
+    (bool ok,) = address(token).call(data);
+    assert(!ok || token.balanceOf(address(this)) == 1000);
+}
+```
+
+Without the option, the counterexample is the 2048 hex digits of `data` (its largest length
+candidate) and the length symbol. With it:
+
+```
+Counterexample: check_pcex_calldata(bytes)
+    data = PcexToken.transfer(to: 0x0000000000000000000000000000000000000000, amount: 512) + 956 trailing zero bytes
+           0xa9059cbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002 + 957 zero bytes (1024 bytes)
+Reproduce: add to PrettyCexTest (test/PrettyCex.t.sol), then `forge test --mt test_pcex_check_pcex_calldata_1 -vvvv` (the test fails if the counterexample is real)
+    function test_pcex_check_pcex_calldata_1() public {
+        this.check_pcex_calldata(abi.encodePacked(hex"a9059cbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002", new bytes(957)));
+    }
+```
+
+For an invariant test, the call sequence is printed with concrete values:
+
+```
+Counterexample: invariant_pcex_balance()
+    Sequence:
+        [1] PcexToken(token).transfer(to: 0xFFA9385be102ac3EAc297483Dd6233d62b3e1496, amount: 492)
+            msg.sender: 0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496 (PrettyCexTest), tx.origin: 0x0000000000000000000000000000000000000000
+        then invariant_pcex_balance() at block.timestamp: 9223372036854775808
+Reproduce: add to PrettyCexTest (test/PrettyCex.t.sol), then `forge test --mt test_pcex_invariant_pcex_balance_1 -vvvv` (the test fails if the counterexample is real)
+    function test_pcex_invariant_pcex_balance_1() public {
+        vm.prank(0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496, address(0));
+        token.transfer(0xFFA9385be102ac3EAc297483Dd6233d62b3e1496, 492);
+        vm.warp(9223372036854775808);
+        this.invariant_pcex_balance();
+    }
+```
+
+## Reproduction tests
+
+The generated function calls the test function through `this`, with the values of the
+counterexample. When the arguments cannot be written as Solidity literals (a value that is
+not a valid ABI encoding of its type, e.g. a `uint8` above 255, or an overloaded test
+function), it replays the exact calldata with a low-level call instead.
+
+Invariant sequences are replayed with `vm.prank`, `vm.deal` and `vm.warp`. A target is
+called through the state variable of the test that holds it (`vault.deposit(…)`), so that
+the call goes to the instance deployed by forge. Dolmos deploys contracts at its own
+addresses (`0xaaaa…`, `0xcccc…`), so a target that is not held by a state variable of the
+test is called at the dolmos address, with a note to replace it.
+
+Values that the test creates itself with `svm.create*` cheatcodes (and the calldata it
+builds with `svm.createCalldata`) cannot be injected: they are listed as comments at the
+top of the function, to replace the cheatcodes with.
+
+## Potentially invalid counterexamples
+
+Dolmos approximates some operations with uninterpreted functions, so a model may rely on
+values that the real operation never produces. Such counterexamples are reported as
+*potentially invalid*. Without the option, the reason is not given (halmos#280).
+
+With the option, the operands and the result of every exponentiation that dolmos
+approximates (`x ** y` with a symbolic exponent, or with a symbolic base and a constant
+exponent above `--smt-exp-by-const`) are compared with the real `**`:
+
+- if they agree, the counterexample is valid;
+- otherwise the query is solved again with facts that hold for the real `**`: constant
+  exponents are expanded by square and multiply, constant bases are tabulated (exactly for
+  an even base), and the real value is added at the operands chosen by the model. Every
+  real counterexample is kept, so `unsat` proves that there is none, and the test passes.
+  This is repeated up to 3 times, plus `--keccak-refinement-rounds` times for the keccak
+  values checked in the same loop.
+
+For example, `assert(x ** 3 != 27)` gives a potentially invalid counterexample `x = 8`
+without the option, and the valid counterexample `x = 3` with it. When the model still
+disagrees, the reason is printed:
+
+```solidity
+function check_pow(uint256 x, uint256 y) external pure {
+    vm.assume(x % 2 == 0 && y > 0);
+    assert(x ** y != 3);
+}
+```
+
+```
+Counterexample (potentially invalid): check_pow(uint256,uint256)
+    reason: EXP is approximated: x ** y (symbolic base and exponent): the model takes 10 ** 16 = 3 instead of 10000000000000000 (constrain the operands with vm.assume (e.g. exponent < 256) or make the base or the exponent constant)
+    x = 10
+    y = 16
+(see https://github.com/Dowsers/dolmos/blob/main/docs/warnings.md#counterexample-invalid)
+```
diff --git a/docs/warnings.md b/docs/warnings.md
new file mode 100644
index 000000000..1617beda5
--- /dev/null
+++ b/docs/warnings.md
@@ -0,0 +1,64 @@
+# Warnings
+
+Each warning printed by dolmos ends with a link to its section below.
+
+## parsing-error
+
+A build artifact in the forge output directory could not be parsed and was
+skipped, so the contracts it defines are neither tested nor available to
+`vm.getCode`/`deployCode`. Rebuild with `forge build --force`; if the artifact
+comes from an unusual compiler setup, run with `--debug` to see the full error.
+
+## internal-error
+
+Symbolic execution hit a case dolmos does not handle, or a cheatcode was used
+in a way it does not support (for instance `vm.ffi` without `--ffi`). The
+affected path is dropped, so the result of the test may be incomplete. Run with
+`--debug` for details, and report it if the input looks legitimate.
+
+## library-placeholder
+
+The bytecode still contains unlinked library placeholders (`__$...$__`). Only
+libraries compiled in the same build can be linked; deploy or link external
+libraries explicitly in `setUp()`.
+
+## counterexample-invalid
+
+The solver produced a model for a failing path, but replaying it did not
+reproduce the failure. This usually comes from approximations in the symbolic
+model (hash functions, unbounded arrays, precompiles). The test is still
+reported as failing; inspect the counterexample before trusting it.
+
+With `--pretty-counterexamples`, counterexamples relying on the approximation of
+exponentiation are checked against the real `**` (and replaced by a valid
+counterexample, or proven spurious, when possible), and the reason is printed when
+they remain potentially invalid, e.g. a symbolic base and exponent, or keccak256
+values that differ from the real hash function. See
+[pretty counterexamples](pretty-counterexamples.md#potentially-invalid-counterexamples).
+
+## counterexample-unknown
+
+The solver could not decide whether a failing path is feasible within
+`--solver-timeout-assertion`. The test is reported as a timeout rather than a
+pass. Increase the timeout, try another `--solver`, or reduce the input space
+with `vm.assume` and smaller `--array-lengths`.
+
+## unsupported-opcode
+
+An opcode dolmos does not implement was executed; the path is dropped.
+
+## revert-all
+
+Every path of the test reverted, so nothing was actually checked. Typical
+causes: `vm.assume` conditions that can never hold, a `setUp()` state that makes
+the target always revert, or input bounds that are too tight.
+
+## loop-bound
+
+Some paths were cut at the loop unrolling bound (`--loop`), so they have not
+been fully explored and bugs beyond that bound can be missed. Raise `--loop`
+(globally or with a `@custom:dolmos --loop N` annotation) if the loops in
+question are bounded by a small constant.
+
+To find out whether these loops terminate, export them with `--dump-lassos` and
+analyse them with PaSTTeL: see [loop-termination.md](loop-termination.md).
diff --git a/examples/README.md b/examples/README.md
index 885695939..7187f7171 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -1,4 +1,4 @@
-# Halmos Examples
+# Dolmos Examples
 
 #### Usage Examples
 
@@ -8,7 +8,12 @@
   - Includes identifying the DEI token bug exploited in the [Deus DAO hack](https://rekt.news/deus-dao-r3kt/).
 - [ERC721](tokens/ERC721/test/): verifies OpenZeppelin, Solady, and Solmate ERC721 tokens.
 
-#### Halmos Tests in External Projects
+#### Symbolic Tests in External Projects
+
+These suites were written for halmos; thanks to dolmos' compatibility with
+`@custom:halmos` annotations and `halmos.toml` they should run with dolmos as
+they are.
+
 
 - [Morpho Blue] ([HalmosTest]): verifies the Morpho Blue protocol.
 - [Farcaster] ([IdRegistrySymTest], [KeyRegistrySymTest]): verifies state machine invariants in Farcaster's onchain registry contracts.
@@ -36,4 +41,10 @@
 
 ## Disclaimer
 
-_These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info._
+_This software and the smart contracts in this repository are provided as is,
+without warranty of any kind, express or implied, including any warranty of
+merchantability, non-infringement or fitness for a particular purpose. They have
+not been audited. Passing symbolic tests is not a proof that a contract is free
+of bugs. Nothing in this repository is investment or legal advice. See
+[NOTICE](../NOTICE) for the disclaimers attached to the original work this code is
+derived from._
diff --git a/examples/invariants/README.md b/examples/invariants/README.md
index 21f0a1a70..823bc9ca7 100644
--- a/examples/invariants/README.md
+++ b/examples/invariants/README.md
@@ -1,6 +1,6 @@
-# Halmos Invariant Testing Examples
+# Dolmos Invariant Testing Examples
 
-This directory contains examples demonstrating various approaches to invariant testing with halmos.
+This directory contains examples demonstrating various approaches to invariant testing with dolmos.
 
 ## Examples
 
@@ -8,13 +8,13 @@ This directory contains examples demonstrating various approaches to invariant t
 
 - **ERC721 Test** ([`ERC721.t.sol`](test/ERC721.t.sol)): Simple ERC721 invariant testing without handlers. Demonstrates how straightforward invariant testing can be when state tracking isn't needed.
 
-- **MiniVat Test** ([`MiniVat.t.sol`](test/MiniVat.t.sol)): Halmos version of [Antonio's MiniVat test](https://github.com/aviggiano/property-based-testing-benchmark/blob/main/projects/dai-certora/test/TargetFunctions.sol). Unlike other fuzzers, no bounds are needed, so no handlers are required. Simply deploy the contract and write the invariant.
+- **MiniVat Test** ([`MiniVat.t.sol`](test/MiniVat.t.sol)): dolmos version of [Antonio's MiniVat test](https://github.com/aviggiano/property-based-testing-benchmark/blob/main/projects/dai-certora/test/TargetFunctions.sol). Unlike other fuzzers, no bounds are needed, so no handlers are required. Simply deploy the contract and write the invariant.
 
 - **Vat Test** ([`Vat.t.sol`](test/Vat.t.sol)): Tests the full Vat contract using the same invariant as MiniVat. It is more comprehensive and takes longer to run.
 
-- **SimpleState Test** ([`SimpleState.t.sol`](test/SimpleState.t.sol)): Example from the [ItyFuzz paper](https://arxiv.org/pdf/2306.17135) that's hard to detect with simple random testing. Halmos uses exhaustive search and considers only unique state-generating call sequences for efficient space exploration.
+- **SimpleState Test** ([`SimpleState.t.sol`](test/SimpleState.t.sol)): Example from the [ItyFuzz paper](https://arxiv.org/pdf/2306.17135) that's hard to detect with simple random testing. Dolmos uses exhaustive search and considers only unique state-generating call sequences for efficient space exploration.
 
-- **Reentrancy Test** ([`Reentrancy.t.sol`](test/Reentrancy.t.sol)): Shows how to detect reentrancy exploits using halmos invariant testing. Demonstrates attacker contract implementation using [halmos cheatcodes](https://github.com/a16z/halmos-cheatcodes).
+- **Reentrancy Test** ([`Reentrancy.t.sol`](test/Reentrancy.t.sol)): Shows how to detect reentrancy exploits using dolmos invariant testing. Demonstrates attacker contract implementation using the [halmos-cheatcodes](https://github.com/a16z/halmos-cheatcodes) library.
 
 ## Running Tests
 
@@ -22,11 +22,11 @@ This directory contains examples demonstrating various approaches to invariant t
 cd examples/invariants
 
 # Run all invariant tests
-halmos
+dolmos
 
 # Run specific test
-halmos --contract ERC20Test
+dolmos --contract ERC20Test
 
 # Run specific invariant
-halmos --function invariant_sumOfBalancesEqualsTotalSupply
+dolmos --function invariant_sumOfBalancesEqualsTotalSupply
 ```
diff --git a/examples/invariants/test/ERC20.t.sol b/examples/invariants/test/ERC20.t.sol
index 577c320ba..1ed5e43f9 100644
--- a/examples/invariants/test/ERC20.t.sol
+++ b/examples/invariants/test/ERC20.t.sol
@@ -6,7 +6,7 @@ pragma solidity >=0.8.0 <0.9.0;
 import {ERC20} from "../src/ERC20.sol";
 import {Test} from "forge-std/Test.sol";
 
-/// @custom:halmos --solver bitwuzla-abs --loop 3 --solver-timeout-assertion 0
+/// @custom:dolmos --solver bitwuzla-abs --loop 3 --solver-timeout-assertion 0
 contract ERC20Test is Test {
     // token address
     ERC20 internal token;
diff --git a/examples/invariants/test/ERC721.t.sol b/examples/invariants/test/ERC721.t.sol
index e892be540..55835a4b5 100644
--- a/examples/invariants/test/ERC721.t.sol
+++ b/examples/invariants/test/ERC721.t.sol
@@ -4,7 +4,7 @@ pragma solidity >=0.8.0 <0.9.0;
 import {ERC721} from "../src/ERC721.sol";
 import {Test} from "forge-std/Test.sol";
 
-/// @custom:halmos --solver bitwuzla-abs --solver-timeout-assertion 0
+/// @custom:dolmos --solver bitwuzla-abs --solver-timeout-assertion 0
 contract ERC721Test is Test {
     // ERC721 token address
     ERC721 internal token;
diff --git a/examples/invariants/test/MiniVat.t.sol b/examples/invariants/test/MiniVat.t.sol
index 86aca9231..431d92645 100644
--- a/examples/invariants/test/MiniVat.t.sol
+++ b/examples/invariants/test/MiniVat.t.sol
@@ -7,7 +7,7 @@ import "forge-std/Test.sol";
 
 import {MiniVat} from "../src/MiniVat.sol";
 
-/// @custom:halmos --early-exit
+/// @custom:dolmos --early-exit
 contract MiniVatTest is Test {
     MiniVat public minivat;
 
diff --git a/examples/invariants/test/Reentrancy.t.sol b/examples/invariants/test/Reentrancy.t.sol
index 171bc281d..adf819f0c 100644
--- a/examples/invariants/test/Reentrancy.t.sol
+++ b/examples/invariants/test/Reentrancy.t.sol
@@ -68,7 +68,7 @@ contract Attacker is SymTest, Test {
     }
 }
 
-/// @custom:halmos --early-exit
+/// @custom:dolmos --early-exit
 contract ReentrancyTest is Test, ERC1155Holder {
     ERC1155Mock token;
     BuggyVault vault;
diff --git a/examples/invariants/test/SimpleState.t.sol b/examples/invariants/test/SimpleState.t.sol
index bb96d8430..47eabb208 100644
--- a/examples/invariants/test/SimpleState.t.sol
+++ b/examples/invariants/test/SimpleState.t.sol
@@ -30,7 +30,7 @@ contract SimpleStateTest is Test {
         target = new SimpleState();
     }
 
-    /// @custom:halmos --invariant-depth 10
+    /// @custom:dolmos --invariant-depth 10
     function invariant_buggy() public view {
         assertFalse(target.buggy());
     }
diff --git a/examples/invariants/test/Vat.t.sol b/examples/invariants/test/Vat.t.sol
index a9ae8aaff..530dd81b0 100644
--- a/examples/invariants/test/Vat.t.sol
+++ b/examples/invariants/test/Vat.t.sol
@@ -5,7 +5,7 @@ import "forge-std/Test.sol";
 
 import {Vat} from "../src/Vat.sol";
 
-/// @custom:halmos --early-exit
+/// @custom:dolmos --early-exit
 contract VatTest is Test {
     Vat public vat;
     bytes32 ilk;
diff --git a/examples/simple/README.md b/examples/simple/README.md
index 0ed140b14..10ce25b74 100644
--- a/examples/simple/README.md
+++ b/examples/simple/README.md
@@ -29,13 +29,19 @@ $ forge test
 
 Once it passes, you can also perform **symbolic testing** to verify the same properties for **all possible inputs** (up to a specified limit):
 ```
-$ halmos --function test
+$ dolmos --function test
 [FAIL] testTotalPriceBuggy(uint96,uint32) (paths: 6, time: 0.10s, bounds: [])
 Counterexample: [p_price_uint96 = 39614081294025656978550816768, p_quantity_uint32 = 1073741824]
 ```
 
-_(In this specific example, Halmos discovered an input that violated the assertion, which was missed by the fuzzer!)_
+_(In this specific example, Dolmos discovered an input that violated the assertion, which was missed by the fuzzer!)_
 
 ## Disclaimer
 
-_These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info._
+_This software and the smart contracts in this repository are provided as is,
+without warranty of any kind, express or implied, including any warranty of
+merchantability, non-infringement or fitness for a particular purpose. They have
+not been audited. Passing symbolic tests is not a proof that a contract is free
+of bugs. Nothing in this repository is investment or legal advice. See
+[NOTICE](../../NOTICE) for the disclaimers attached to the original work this code is
+derived from._
diff --git a/examples/simple/foundry.toml b/examples/simple/foundry.toml
index f9e9259ff..40162b395 100644
--- a/examples/simple/foundry.toml
+++ b/examples/simple/foundry.toml
@@ -6,5 +6,5 @@ libs = ["../../tests/lib", 'lib']
 evm_version = 'cancun'
 
 force = false
-# compile options used by halmos (to prevent unnecessary recompilation when running forge test and halmos together)
+# compile options used by dolmos (to prevent unnecessary recompilation when running forge test and dolmos together)
 extra_output = ["storageLayout", "metadata"]
diff --git a/examples/simple/test/BadElections.t.sol b/examples/simple/test/BadElections.t.sol
index 4bf89d969..24897f9cc 100644
--- a/examples/simple/test/BadElections.t.sol
+++ b/examples/simple/test/BadElections.t.sol
@@ -18,12 +18,12 @@ contract BadElectionsTest is SymTest, Test {
     ///
     ///     Running 1 tests for test/BadElections.t.sol:BadElectionsTest
     ///     Counterexample:
-    ///         halmos_fakeSig_bytes_01 = 0x00000000000000000000000000000000000000000000000000000000000000003fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a100 (65 bytes)
+    ///         dolmos_fakeSig_bytes_01 = 0x00000000000000000000000000000000000000000000000000000000000000003fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a100 (65 bytes)
     ///         p_proposalId_uint256 = 0x0000000000000000000000000000000000000000000000000000000000000000 (0)
     ///     [FAIL] check_canNotVoteTwice(uint256) (paths: 7, time: 0.63s, bounds: [])
     ///
     /// the counterexample values are not meaningful, but examining the trace shows
-    /// that halmos found a signature s.t. the voter can vote twice on the same proposal,
+    /// that dolmos found a signature s.t. the voter can vote twice on the same proposal,
     /// and the final vote count is 2
     function check_canNotVoteTwice(uint256 proposalId) public {
         // setup
diff --git a/examples/simple/test/IsPowerOfTwo.t.sol b/examples/simple/test/IsPowerOfTwo.t.sol
index 17e2ec573..b28820abc 100644
--- a/examples/simple/test/IsPowerOfTwo.t.sol
+++ b/examples/simple/test/IsPowerOfTwo.t.sol
@@ -3,7 +3,7 @@ pragma solidity >=0.8.0 <0.9.0;
 
 import "../src/IsPowerOfTwo.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract IsPowerOfTwoTest {
     IsPowerOfTwo target;
 
@@ -17,7 +17,7 @@ contract IsPowerOfTwoTest {
         assert(result1 == result2);
     }
 
-    /// @custom:halmos --loop 256
+    /// @custom:dolmos --loop 256
     function check_isPowerOfTwo(uint256 x) public view {
         bool result1 = target.isPowerOfTwo(x);
         bool result2 = false;
@@ -30,7 +30,7 @@ contract IsPowerOfTwoTest {
         assert(result1 == result2);
     }
 
-    /// @custom:halmos --loop 256
+    /// @custom:dolmos --loop 256
     function check_eq_isPowerOfTwo_isPowerOfTwoIter(uint x) public view {
         bool result1 = target.isPowerOfTwo(x);
         bool result2 = target.isPowerOfTwoIter(x);
diff --git a/examples/simple/test/TotalPrice.t.sol b/examples/simple/test/TotalPrice.t.sol
index e1a6ed835..265b70637 100644
--- a/examples/simple/test/TotalPrice.t.sol
+++ b/examples/simple/test/TotalPrice.t.sol
@@ -3,7 +3,7 @@ pragma solidity >=0.8.0 <0.9.0;
 
 import "../src/TotalPrice.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract TotalPriceTest {
     TotalPrice target;
 
diff --git a/examples/simple/test/Vault.t.sol b/examples/simple/test/Vault.t.sol
index d354ff10b..583b57941 100644
--- a/examples/simple/test/Vault.t.sol
+++ b/examples/simple/test/Vault.t.sol
@@ -15,7 +15,7 @@ contract VaultMock is Vault {
     }
 }
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract VaultTest is SymTest {
     VaultMock vault;
 
@@ -27,7 +27,7 @@ contract VaultTest is SymTest {
     }
 
     /// need to set a timeout for this test, the solver can run for hours
-    /// @custom:halmos --solver-timeout-assertion 10000
+    /// @custom:dolmos --solver-timeout-assertion 10000
     function check_deposit(uint assets) public {
         uint A1 = vault.totalAssets();
         uint S1 = vault.totalShares();
diff --git a/examples/tokens/ERC20/remappings.txt b/examples/tokens/ERC20/remappings.txt
index acf3e02df..95f579e0b 100644
--- a/examples/tokens/ERC20/remappings.txt
+++ b/examples/tokens/ERC20/remappings.txt
@@ -1,2 +1,3 @@
 openzeppelin/=../../../tests/lib/openzeppelin-contracts/contracts/
 ds-test/=../../../tests/lib/forge-std/lib/ds-test/src/
+solady/=../../../tests/lib/solady/src/
diff --git a/examples/tokens/ERC20/test/BackdoorERC20.t.sol b/examples/tokens/ERC20/test/BackdoorERC20.t.sol
index 439514862..b7a79867b 100644
--- a/examples/tokens/ERC20/test/BackdoorERC20.t.sol
+++ b/examples/tokens/ERC20/test/BackdoorERC20.t.sol
@@ -10,10 +10,10 @@ import {IERC20} from "forge-std/interfaces/IERC20.sol";
 // empty interface
 interface IEmpty { }
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract BackdoorERC20Test is ERC20Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         address deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC20/test/CurveTokenV3.t.sol b/examples/tokens/ERC20/test/CurveTokenV3.t.sol
index c68645c39..037cb9d31 100644
--- a/examples/tokens/ERC20/test/CurveTokenV3.t.sol
+++ b/examples/tokens/ERC20/test/CurveTokenV3.t.sol
@@ -28,12 +28,12 @@ interface CurveTokenV3 {
 
 contract EmptyContract { }
 
-/// @custom:halmos --storage-layout=generic --solver-timeout-assertion 0
+/// @custom:dolmos --storage-layout=generic --solver-timeout-assertion 0
 contract CurveTokenV3Test is ERC20Test {
     CurveTokenV3 token_;
     address minter;
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         token = address(new EmptyContract());
         // Source of Deployed Bytecode: https://etherscan.io/address/0x06325440D014e39736583c165C2963BA99fAf14E#code
diff --git a/examples/tokens/ERC20/test/DEIStablecoin.t.sol b/examples/tokens/ERC20/test/DEIStablecoin.t.sol
index 942f9ed0e..be29f5a0c 100644
--- a/examples/tokens/ERC20/test/DEIStablecoin.t.sol
+++ b/examples/tokens/ERC20/test/DEIStablecoin.t.sol
@@ -19,12 +19,12 @@ contract SymAccount is SymTest {
 }
 
 /// @notice This example shows how to find the DEI token bug exploited by the Deus DAO hack: https://rekt.news/deus-dao-r3kt/
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract DEIStablecoinTest is ERC20Test {
     DEIStablecoin token_;
     address lossless;
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         token = address(new EmptyContract());
         // Source of Deployed Bytecode: https://etherscan.io/address/0x63c28e2ff796e1480eb9ac8c3c55dcb9ae7b3df6#code
diff --git a/examples/tokens/ERC20/test/OpenZeppelinERC20.t.sol b/examples/tokens/ERC20/test/OpenZeppelinERC20.t.sol
index d21913e7b..dbdd4e771 100644
--- a/examples/tokens/ERC20/test/OpenZeppelinERC20.t.sol
+++ b/examples/tokens/ERC20/test/OpenZeppelinERC20.t.sol
@@ -5,10 +5,10 @@ import {ERC20Test} from "./ERC20Test.sol";
 
 import {OpenZeppelinERC20} from "../src/OpenZeppelinERC20.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract OpenZeppelinERC20Test is ERC20Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         address deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC20/test/SoladyERC20.t.sol b/examples/tokens/ERC20/test/SoladyERC20.t.sol
index 2c45da8c7..57d87064a 100644
--- a/examples/tokens/ERC20/test/SoladyERC20.t.sol
+++ b/examples/tokens/ERC20/test/SoladyERC20.t.sol
@@ -5,10 +5,10 @@ import {ERC20Test} from "./ERC20Test.sol";
 
 import {SoladyERC20} from "../src/SoladyERC20.sol";
 
-/// @custom:halmos --storage-layout=generic --solver-timeout-assertion 0
+/// @custom:dolmos --storage-layout=generic --solver-timeout-assertion 0
 contract SoladyERC20Test is ERC20Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         address deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC20/test/SolmateERC20.t.sol b/examples/tokens/ERC20/test/SolmateERC20.t.sol
index 6e64252ec..89d453c5c 100644
--- a/examples/tokens/ERC20/test/SolmateERC20.t.sol
+++ b/examples/tokens/ERC20/test/SolmateERC20.t.sol
@@ -5,10 +5,10 @@ import {ERC20Test} from "./ERC20Test.sol";
 
 import {SolmateERC20} from "../src/SolmateERC20.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract SolmateERC20Test is ERC20Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         address deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC721/remappings.txt b/examples/tokens/ERC721/remappings.txt
index acf3e02df..95f579e0b 100644
--- a/examples/tokens/ERC721/remappings.txt
+++ b/examples/tokens/ERC721/remappings.txt
@@ -1,2 +1,3 @@
 openzeppelin/=../../../tests/lib/openzeppelin-contracts/contracts/
 ds-test/=../../../tests/lib/forge-std/lib/ds-test/src/
+solady/=../../../tests/lib/solady/src/
diff --git a/examples/tokens/ERC721/test/OpenZeppelinERC721.t.sol b/examples/tokens/ERC721/test/OpenZeppelinERC721.t.sol
index 868a274d4..26b9ed744 100644
--- a/examples/tokens/ERC721/test/OpenZeppelinERC721.t.sol
+++ b/examples/tokens/ERC721/test/OpenZeppelinERC721.t.sol
@@ -5,10 +5,10 @@ import {ERC721Test} from "./ERC721Test.sol";
 
 import {OpenZeppelinERC721} from "../src/OpenZeppelinERC721.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract OpenZeppelinERC721Test is ERC721Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC721/test/SoladyERC721.t.sol b/examples/tokens/ERC721/test/SoladyERC721.t.sol
index c3241a5e1..72f62e26f 100644
--- a/examples/tokens/ERC721/test/SoladyERC721.t.sol
+++ b/examples/tokens/ERC721/test/SoladyERC721.t.sol
@@ -5,10 +5,10 @@ import {ERC721Test} from "./ERC721Test.sol";
 
 import {SoladyERC721} from "../src/SoladyERC721.sol";
 
-/// @custom:halmos --storage-layout=generic --solver-timeout-assertion 0
+/// @custom:dolmos --storage-layout=generic --solver-timeout-assertion 0
 contract SoladyERC721Test is ERC721Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         deployer = address(0x1000);
 
diff --git a/examples/tokens/ERC721/test/SolmateERC721.t.sol b/examples/tokens/ERC721/test/SolmateERC721.t.sol
index 1ca6eb4f2..8e3f256e8 100644
--- a/examples/tokens/ERC721/test/SolmateERC721.t.sol
+++ b/examples/tokens/ERC721/test/SolmateERC721.t.sol
@@ -5,10 +5,10 @@ import {ERC721Test} from "./ERC721Test.sol";
 
 import {SolmateERC721} from "../src/SolmateERC721.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract SolmateERC721Test is ERC721Test {
 
-    /// @custom:halmos --solver-timeout-branching 1000
+    /// @custom:dolmos --solver-timeout-branching 1000
     function setUp() public override {
         deployer = address(0x1000);
 
diff --git a/packages/halmos-builder/Dockerfile b/packages/dolmos-builder/Dockerfile
similarity index 71%
rename from packages/halmos-builder/Dockerfile
rename to packages/dolmos-builder/Dockerfile
index b62594684..3e957761a 100644
--- a/packages/halmos-builder/Dockerfile
+++ b/packages/dolmos-builder/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/a16z/solvers:latest
+FROM ghcr.io/dowsers/solvers:latest
 
 RUN apt-get update && apt-get install --no-install-recommends -y \
     git \
@@ -18,12 +18,14 @@ RUN mkdir -p /root/.foundry/bin /root/.foundry/share/man/man1
 # Add foundry binaries to PATH
 ENV PATH="/root/.foundry/bin:${PATH}"
 
-# Download and run foundryup
+# Download foundryup and install a pinned foundry version, so that the images (and
+# the CI jobs that use them) do not change behaviour when foundry releases
+ARG FOUNDRY_VERSION=v1.8.3
 RUN curl -sSf -L https://raw.githubusercontent.com/foundry-rs/foundry/master/foundryup/foundryup \
     -o /root/.foundry/bin/foundryup && \
     chmod +x /root/.foundry/bin/foundryup && \
-    foundryup
+    foundryup --install ${FOUNDRY_VERSION}
 
 # Set a nicer prompt
-ENV IMAGE_NAME=halmos-builder
+ENV IMAGE_NAME=dolmos-builder
 RUN echo 'PS1="($IMAGE_NAME) \[\033[1;32m\]\u@\h \[\033[1;35m\]\w \$\[\033[0m\] "' >> /root/.bashrc
diff --git a/packages/halmos/Dockerfile b/packages/dolmos/Dockerfile
similarity index 62%
rename from packages/halmos/Dockerfile
rename to packages/dolmos/Dockerfile
index 1a26a55d3..f92e76488 100644
--- a/packages/halmos/Dockerfile
+++ b/packages/dolmos/Dockerfile
@@ -1,36 +1,36 @@
-FROM ghcr.io/a16z/halmos-builder:latest
+FROM ghcr.io/dowsers/dolmos-builder:latest
 
 # inspired by https://hynek.me/articles/docker-uv/
 
 # - enable the virtual environment
-# - install halmos and its dependencies in UV_PROJECT_ENVIRONMENT
+# - install dolmos and its dependencies in UV_PROJECT_ENVIRONMENT
 # - enable bytecode compilation for faster startup
-# - disable downloading any additional packages
+# - use the python of the builder image (ubuntu 24.04 ships 3.12), never download one
 # - use copy mode for linking instead of symlinking (because we mount to /src temporarily)
-ENV PATH="/halmos/bin:$PATH" \
-    VIRTUAL_ENV='/halmos' \
-    UV_PROJECT_ENVIRONMENT='/halmos' \
+ENV PATH="/dolmos/bin:$PATH" \
+    VIRTUAL_ENV='/dolmos' \
+    UV_PROJECT_ENVIRONMENT='/dolmos' \
     UV_COMPILE_BYTECODE=1 \
-    UV_PYTHON=python3.13 \
+    UV_PYTHON=python3.12 \
     UV_PYTHON_DOWNLOADS=never \
     UV_LINK_MODE=copy
 
-# Install halmos, assuming it is checked out in the current host directory
+# Install dolmos, assuming it is checked out in the current host directory
 # we don't specify --frozen or --locked because we don't check in uv.lock
 RUN --mount=type=bind,source=../..,target=/src,readonly=false \
     cd /src && \
     uv sync --extra dev --no-editable
 
 # Set a nicer prompt
-ENV IMAGE_NAME=halmos
+ENV IMAGE_NAME=dolmos
 RUN echo 'PS1="($IMAGE_NAME) \[\033[1;32m\]\u@\h \[\033[1;35m\]\w \$\[\033[0m\] "' >> /root/.bashrc
 
-# optional: print python version, site packages, and check that halmos can be imported
+# optional: print python version, site packages, and check that dolmos can be imported
 RUN <<EOT
 python -V
 python -Im site
-python -Ic 'import halmos'
+python -Ic 'import dolmos'
 EOT
 
 WORKDIR /workspace
-CMD ["halmos"]
+CMD ["dolmos"]
diff --git a/packages/dolmos/README.md b/packages/dolmos/README.md
new file mode 100644
index 000000000..fa09cb506
--- /dev/null
+++ b/packages/dolmos/README.md
@@ -0,0 +1,15 @@
+# dolmos Docker image
+
+```sh
+# build it
+docker build -t dolmos --file packages/dolmos/Dockerfile .
+
+# run it
+docker run --rm -v .:/workspace dolmos --root tests/regression --function check_log_string
+
+# run the container interactively (for debugging)
+docker run --rm -v .:/workspace -it --entrypoint bash dolmos
+
+# run tests
+docker run -v .:/workspace --entrypoint pytest dolmos -k test_config.py
+```
diff --git a/packages/halmos/README.md b/packages/halmos/README.md
deleted file mode 100644
index ac58a76d7..000000000
--- a/packages/halmos/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# halmos Docker image
-
-```sh
-# build it
-docker build -t halmos --file packages/halmos/Dockerfile .
-
-# run it
-docker run --rm -v .:/workspace halmos --root tests/regression --function check_log_string
-
-# run the container interactively (for debugging)
-docker run --rm -v .:/workspace -it --entrypoint bash halmos
-
-# run tests
-docker run -v .:/workspace --entrypoint pytest halmos -k test_config.py
-```
diff --git a/packages/solvers/Dockerfile b/packages/solvers/Dockerfile
index 36a3e9518..a359e40da 100644
--- a/packages/solvers/Dockerfile
+++ b/packages/solvers/Dockerfile
@@ -15,7 +15,8 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     python3-venv \
     ninja-build \
     software-properties-common \
-    g++ zlib1g-dev libboost-all-dev flex bison
+    g++ zlib1g-dev libboost-all-dev flex bison \
+    pkg-config libgmp-dev libmpfr-dev
 
 # Install Z3
 ARG Z3_VERSION=4.13.3
@@ -48,8 +49,11 @@ RUN wget https://github.com/cvc5/cvc5/releases/download/cvc5-${CVC5_VERSION}/cvc
     rm -rf /cvc5
 
 # Install Bitwuzla
+# pinned: its main branch changes without notice (since 0.9, GMP and MPFR must be
+# installed on the system, found through pkg-config, and are linked statically)
 WORKDIR /bitwuzla
-RUN git clone --depth 1 https://github.com/bitwuzla/bitwuzla . && \
+ARG BITWUZLA_VERSION=0.9.1
+RUN git clone --depth 1 --branch ${BITWUZLA_VERSION} https://github.com/bitwuzla/bitwuzla . && \
     python3 -m venv .venv && \
     . .venv/bin/activate && \
     python3 -m pip install meson && \
@@ -84,6 +88,10 @@ COPY --from=builder \
     /usr/local/bin/boolector \
     /usr/local/bin/
 
+# Fail the build now rather than at test time if a solver misses a shared library
+RUN ! ldd /usr/local/bin/* 2>/dev/null | grep "not found" && \
+    bitwuzla --version && z3 --version
+
 # Install uv
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
diff --git a/packages/solvers/README.md b/packages/solvers/README.md
index c5d961ac3..609d29d85 100644
--- a/packages/solvers/README.md
+++ b/packages/solvers/README.md
@@ -6,10 +6,10 @@ A minimalist Docker image containing high-performance SMT solvers.
 
 ```sh
 # Step 1: Pull the image
-docker pull ghcr.io/a16z/solvers:latest
+docker pull ghcr.io/dowsers/solvers:latest
 
 # Step 2: Tag the image with a shorter name
-docker tag ghcr.io/a16z/solvers:latest solvers
+docker tag ghcr.io/dowsers/solvers:latest solvers
 
 # Step 3: Run the container using the shorter name,
 for solver in bitwuzla boolector cvc5 stp yices z3 ; do \
@@ -48,12 +48,12 @@ z3: 4.13.3
 
 Everyone is welcome to contribute new solvers or new versions to the image via pull requests. If a solver is competitive at [SMT-COMP](https://smt-comp.github.io), it would be great to have it included in the image.
 
-When possible, we prefer release binaries from an official source like the Github releases for the project to minimize the time it takes to build the image. If you're unsure about a particular solver or how to integrate it, consider reaching out on the [Halmos Dev Chat](https://t.me/+4UhzHduai3MzZmUx).
+When possible, we prefer release binaries from an official source like the Github releases for the project to minimize the time it takes to build the image.
 
 Before opening the pull request, please test your changes by verifying:
 
 * that you can build the image locally
-* that you can correctly invoke the solver as described in the [Quick Start](https://github.com/a16z/halmos/tree/main/packages/solvers#quick-start) section
+* that you can correctly invoke the solver as described in the [Quick Start](#quick-start) section
 * update this README with the name, version and source of the solver
 
 Thank you in advance!
diff --git a/pyproject.toml b/pyproject.toml
index 69cb98a46..bfd9ebefc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,24 +1,35 @@
 [build-system]
-requires = ["setuptools>=61.0", "setuptools_scm[toml]>=6.2"]
+requires = ["setuptools>=77.0", "setuptools_scm[toml]>=8.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
+# the version comes from the git tag (vX.Y.Z); a missing tag gives 0.1.devN
 
 [project]
-name = "halmos"
+name = "dolmos"
 description = "A symbolic testing tool for EVM smart contracts"
 readme = "README.md"
+license = "AGPL-3.0-only"
+license-files = ["LICENSE", "NOTICE"]
+keywords = ["ethereum", "evm", "solidity", "vyper", "symbolic-execution", "formal-verification", "foundry"]
+# dolmos is derived from other authors' work, see NOTICE
 authors = [
-    { name="a16z crypto" },
+    { name="Dowsers SAS" },
 ]
 maintainers = [
-    { name="Daejun Park" },
-    { name="karmacoma <karma@coma.lol>" },
+    { name="Dowsers SAS" },
 ]
 classifiers = [
-    "Programming Language :: Python :: 3",
-    "License :: OSI Approved :: GNU Affero General Public License v3",
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
     "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Software Development :: Testing",
 ]
 requires-python = ">=3.11"
 dependencies = [
@@ -36,10 +47,13 @@ dependencies = [
 dynamic = ["version"]
 
 [project.scripts]
-halmos = "halmos.__main__:main"
+dolmos = "dolmos.__main__:main"
 
 [project.urls]
-"Homepage" = "https://github.com/a16z/halmos"
+"Homepage" = "https://github.com/Dowsers/dolmos"
+"Documentation" = "https://github.com/Dowsers/dolmos/blob/main/docs/getting-started.md"
+"Issues" = "https://github.com/Dowsers/dolmos/issues"
+"Changelog" = "https://github.com/Dowsers/dolmos/blob/main/CHANGELOG.md"
 
 # development dependencies, can be installed with
 #   uv sync --extra dev
@@ -50,6 +64,7 @@ halmos = "halmos.__main__:main"
 dev = [
     "pre-commit>=4.0.1",
     "pytest>=8.3.4",
+    "pytest-github-actions-annotate-failures>=0.3.0",
     "ruff>=0.8.1",
 ]
 
diff --git a/specification.md b/specification.md
new file mode 100644
index 000000000..d6463d515
--- /dev/null
+++ b/specification.md
@@ -0,0 +1,36 @@
+
+
+# Modeling choices #
+
+## CLZ operator ##
+
+
+## Self Destruct ##
+
+## Keccak256 256 operator ##
+
+Simplified explanation
+
+Dolmos models keccak256 using a family of uninterpreted functions, f_sha3_N, with one function for each input size. Instead of encoding the whole hash algorithm bit by bit—which would make SMT solving impractical—Dolmos only adds a few basic properties to these functions.
+
+When the input is concrete, Dolmos computes the real keccak256 value and stores the input/output pair for that execution path. This makes it possible to recover the preimage of a concrete storage slot and decode it into its structure, such as the base slot, mapping keys, and offsets. When the input is symbolic, the hash remains uninterpreted and is constrained only by a small set of axioms. An inverse function guarantees injectivity, so two different inputs cannot have the same hash. Hash values are also assumed to be non-zero and smaller than 2^256 − 2^64, preventing a struct or array offset from overflowing when added to a hashed storage slot.
+
+These assumptions are sound in practice, but they are deliberately incomplete: they do not formally connect the symbolic function to the real keccak256. As a result, the solver can invent a hash value. For example, it may choose an input whose symbolic hash matches a storage key written in setUp(), producing a counterexample that cannot actually be reproduced (halmos#562).
+
+Dolmos handles this lazily through counterexample-guided refinement. When the solver finds a satisfiable model, Dolmos reads the concrete preimages chosen by the model, computes their real keccak256 values, adds facts such as f_sha3_N(v) = keccak256(v), and runs the solver again. Because these facts are true for the real hash function, a real counterexample is never removed. Therefore, an unsat result proves that no counterexample exists under the stated assumptions. If the model remains inconsistent after a bounded number of refinement rounds, or if refinement cannot determine whether it is valid, Dolmos still reports it but marks it as potentially invalid instead of silently discarding it.
+
+Two additional design choices complete this approach. First, the optimizer may fold a keccak256 computation into a precomputed constant. If the resulting storage location is later decoded structurally, the value stored at the raw location is moved to the corresponding structured location (halmos#579). Second, the alternative generic storage layout can decode hashed storage keys purely structurally. This implicitly assumes that a hash cannot be equal to an unrelated constant.
+
+Example: halmos#562
+
+The issue halmos#562, reproduced in KeccakRefinement.t.sol, shows why this refinement mechanism is necessary. In setUp(), the contract executes balances[key] = 50, where key is a concrete value. The test then checks that balances[uint256(keccak256(abi.encodePacked(amt)))] != 50 for every symbolic amt.
+
+When balances[key] is written, its storage location is keccak256(key . 0). Because the input is concrete, Dolmos computes the real hash and records it. It can therefore decode the storage location as (slot 0, key) rather than treating it as an arbitrary 256-bit value.
+
+During the test, however, keccak256(amt) is symbolic. Dolmos represents it as h = f_sha3_256(amt), so the read becomes a lookup at (slot 0, h). The read returns 50 if h = key. The current axioms do not prevent this: injectivity only says that two different inputs cannot have the same hash. The solver can therefore invent a model such as amt = 0 together with f_sha3_256(0) = key. It reports sat, but this is a false counterexample because the real keccak256(0) is not equal to key.
+
+Refinement then starts. Dolmos takes the model's preimage, 0, computes the real value of keccak256(0), and adds the constraint f_sha3_256(0) = keccak256(0). The previous model is now impossible. The solver may then try another value, for example amt = 1, with another invented hash. Dolmos adds the corresponding real hash and repeats the process. After the configured three refinement rounds (--keccak-refinement-rounds), the counterexample is reported as potentially invalid, rather than being presented as a valid exploit.
+
+The same mechanism behaves differently when a real preimage exists. In check_keccak_known_preimage, the test searches for an amt such that keccak256(amt) == keccak256(42). The solver proposes amt = 42, and the refinement step confirms that this matches the real hash. The counterexample is therefore validated immediately.
+
+The example also shows the effect of the two other modeling choices. With the generic storage layout, h is structurally understood as the hash of amt. It therefore cannot simply be treated as the unrelated constant key, so the problematic path can be eliminated before SMT solving. This is why the test uses the Solidity storage layout. Finally, if key were a compile-time constant, the optimizer could fold keccak256(key . 0) into a PUSH32 constant (halmos#579). The value would initially be stored under the raw location and then moved to the structured location when that location is later decoded. This is why the test keeps key in a state variable.
diff --git a/src/halmos/__init__.py b/src/dolmos/__init__.py
similarity index 100%
rename from src/halmos/__init__.py
rename to src/dolmos/__init__.py
diff --git a/src/halmos/__main__.py b/src/dolmos/__main__.py
similarity index 79%
rename from src/halmos/__main__.py
rename to src/dolmos/__main__.py
index d768243d2..ddd410d17 100644
--- a/src/halmos/__main__.py
+++ b/src/dolmos/__main__.py
@@ -39,36 +39,50 @@
     unsat,
 )
 
-import halmos.traces
-from halmos.build import (
+import dolmos.traces
+from dolmos.build import (
     build_output_iterator,
+    get_source_path,
+    has_vyper_contracts,
     import_libs,
     parse_build_out,
     parse_devdoc,
     parse_natspec,
 )
-from halmos.bytevec import ByteVec
-from halmos.calldata import FunctionInfo, get_abi, mk_calldata
-from halmos.cheatcodes import snapshot_state
-from halmos.config import Config as HalmosConfig
-from halmos.config import (
+from dolmos.bytevec import ByteVec
+from dolmos.calldata import FunctionInfo, get_abi, mk_calldata
+from dolmos.cheatcodes import snapshot_state
+from dolmos.config import Config as DolmosConfig
+from dolmos.config import (
     ConfigSource,
     arg_parser,
     default_config,
+    program_name,
     resolve_config_files,
     toml_parser,
 )
-from halmos.constants import (
+from dolmos.constants import (
     VERBOSITY_TRACE_CONSTRUCTOR,
     VERBOSITY_TRACE_COUNTEREXAMPLE,
     VERBOSITY_TRACE_PATHS,
     VERBOSITY_TRACE_SETUP,
 )
-from halmos.contract import CoverageReporter
-from halmos.env import init_env
-from halmos.exceptions import FailCheatcode, HalmosException
-from halmos.flamegraphs import CallSequenceFlamegraph, call_flamegraph, exec_flamegraph
-from halmos.logs import (
+from dolmos.contract import CoverageReporter
+from dolmos.env import init_env
+from dolmos.evm_version import (
+    EVM_VERSIONS,
+    LATEST_EVM_VERSION,
+    evm_version_from_metadata,
+    normalize_evm_version,
+)
+from dolmos.exceptions import (
+    DolmosException,
+    FailCheatcode,
+    InvalidOpcode,
+    Revert,
+)
+from dolmos.flamegraphs import CallSequenceFlamegraph, call_flamegraph, exec_flamegraph
+from dolmos.logs import (
     COUNTEREXAMPLE_INVALID,
     INTERNAL_ERROR,
     LOOP_BOUND,
@@ -80,9 +94,16 @@
     warn,
     warn_code,
 )
-from halmos.mapper import BuildOut, DeployAddressMapper
-from halmos.processes import ExecutorRegistry, ShutdownError
-from halmos.sevm import (
+from dolmos.mapper import BuildOut, DeployAddressMapper
+from dolmos.pcex import (
+    CexLayout,
+    RenderedCex,
+    collect_layout,
+    render_counterexample,
+    repro_function,
+)
+from dolmos.processes import ExecutorRegistry, ShutdownError
+from dolmos.sevm import (
     EMPTY_BALANCE,
     FOUNDRY_CALLER,
     FOUNDRY_ORIGIN,
@@ -102,24 +123,26 @@
     jumpid_str,
     mnemonic,
 )
-from halmos.solve import (
+from dolmos.solve import (
     ContractContext,
     FunctionContext,
     InvariantTestingContext,
     PathContext,
     SolverOutput,
     dirname,
+    mk_exp_apps,
+    mk_sha3_args,
     solve_end_to_end,
     solve_low_level,
 )
-from halmos.traces import (
+from dolmos.traces import (
     render_trace,
     rendered_address,
     rendered_call_sequence,
     rendered_trace,
 )
-from halmos.ui import suspend_status, ui
-from halmos.utils import (
+from dolmos.ui import suspend_status, ui
+from dolmos.utils import (
     EVM,
     Address,
     BitVecSort256,
@@ -184,7 +207,7 @@ class Exitcode(Enum):
 COUNTEREXAMPLE = Exitcode.COUNTEREXAMPLE.value
 
 
-def with_devdoc(args: HalmosConfig, fn_sig: str, contract_json: dict) -> HalmosConfig:
+def with_devdoc(args: DolmosConfig, fn_sig: str, contract_json: dict) -> DolmosConfig:
     devdoc = parse_devdoc(fn_sig, contract_json)
     if not devdoc:
         return args
@@ -194,9 +217,38 @@ def with_devdoc(args: HalmosConfig, fn_sig: str, contract_json: dict) -> HalmosC
     return args.with_overrides(source, **vars(overrides))
 
 
+def with_evm_version(args: DolmosConfig, contract_json: dict) -> DolmosConfig:
+    """
+    Resolves the EVM version (a16z/halmos#128): the --evm-version option if given,
+    otherwise the evmVersion the contract was compiled for, otherwise the latest fork.
+    """
+    if args.evm_version:
+        if normalize_evm_version(args.evm_version) is None:
+            error(
+                f"unsupported EVM version: {args.evm_version} "
+                f"(supported: {', '.join(EVM_VERSIONS)})"
+            )
+            sys.exit(2)
+        return args
+
+    compiled_for = evm_version_from_metadata(contract_json)
+    if compiled_for is None:
+        return args
+
+    version = normalize_evm_version(compiled_for)
+    if version is None:
+        warn(
+            f"unsupported evmVersion {compiled_for} in the build output, "
+            f"using {LATEST_EVM_VERSION} (see --evm-version)"
+        )
+        return args
+
+    return args.with_overrides(ConfigSource.default, evm_version=version)
+
+
 def with_natspec(
-    args: HalmosConfig, contract_name: str, contract_natspec: str
-) -> HalmosConfig:
+    args: DolmosConfig, contract_name: str, contract_natspec: str
+) -> DolmosConfig:
     if not contract_natspec:
         return args
 
@@ -209,7 +261,41 @@ def with_natspec(
     return args.with_overrides(source, **vars(overrides))
 
 
-def load_config(_args) -> HalmosConfig:
+def with_vyper_defaults(args: DolmosConfig) -> DolmosConfig:
+    """
+    Adjust the defaults for projects that contain vyper contracts:
+    - the solidity storage layout model does not apply to vyper (e.g. HashMap slots
+      are computed as keccak256(slot . key) instead of keccak256(key . slot))
+    - vyper uses the INVALID opcode for `assert ..., UNREACHABLE`, its equivalent of
+      solidity's `assert` (Panic(0x01))
+
+    Values set in a config file, an annotation or on the command line take precedence.
+    """
+    vyper_defaults = {"storage_layout": "generic", "invalid_as_failure": True}
+
+    overrides = {
+        name: value
+        for name, value in vyper_defaults.items()
+        if args.value_with_source(name)[1] <= ConfigSource.default
+    }
+
+    if not overrides:
+        return args
+
+    print(
+        "Vyper contracts found, using "
+        + ", ".join(
+            f"--{name.replace('_', '-')}" + ("" if value is True else f" {value}")
+            for name, value in overrides.items()
+        )
+        + " by default"
+    )
+
+    # same precedence as the global defaults, so any explicit setting still wins
+    return args.with_overrides(ConfigSource.default, **overrides)
+
+
+def load_config(_args) -> DolmosConfig:
     config = default_config()
 
     # parse CLI args first, so that can get `--help` out of the way and resolve `--debug`
@@ -252,7 +338,7 @@ def mk_addr(name: str) -> Address:
     return BitVec(name, 160)
 
 
-def mk_solver(args: HalmosConfig, logic="QF_AUFBV", ctx=None) -> Solver:
+def mk_solver(args: DolmosConfig, logic="QF_AUFBV", ctx=None) -> Solver:
     # in the config, we have a float in seconds
     # z3 expects an int in milliseconds
     timeout_ms = int(args.solver_timeout_branching * 1000)
@@ -293,6 +379,9 @@ def deploy_test(ctx: FunctionContext, sevm: SEVM) -> Exec:
     # foundry default balance for the test contract
     ex.balance_update(this, con(0xFFFFFFFFFFFFFFFFFFFFFFFF))
 
+    # the test contract is a deployed contract, so its nonce starts at 1 (EIP-161)
+    ex.set_nonce(this, 1)
+
     # deploy libraries and resolve library placeholders in hexcode
     contract_ctx = ctx.contract_ctx
     (creation_hexcode, _) = ex.resolve_libs(
@@ -308,7 +397,7 @@ def deploy_test(ctx: FunctionContext, sevm: SEVM) -> Exec:
 
     # sanity check
     if len(exs) != 1:
-        raise HalmosException(f"constructor: # of paths: {len(exs)}")
+        raise DolmosException(f"constructor: # of paths: {len(exs)}")
 
     [ex] = exs
 
@@ -322,7 +411,7 @@ def deploy_test(ctx: FunctionContext, sevm: SEVM) -> Exec:
     output = ex.context.output
     returndata = output.data
     if output.error is not None or not returndata:
-        raise HalmosException(f"constructor failed: {output.error=} {returndata=}")
+        raise DolmosException(f"constructor failed: {output.error=} {returndata=}")
 
     deployed_bytecode = Contract(returndata)
     ex.try_resolve_contract_info(deployed_bytecode, args.coverage_output)
@@ -335,7 +424,13 @@ def deploy_test(ctx: FunctionContext, sevm: SEVM) -> Exec:
     return ex
 
 
-def setup(ctx: FunctionContext) -> Exec:
+def setup(ctx: FunctionContext) -> list[Exec]:
+    """
+    Deploys the test contract and runs its setUp function.
+
+    Returns every feasible successful setup path: when setUp branches (e.g. on
+    symbolic values), each test is run from each of the resulting states.
+    """
     setup_timer = NamedTimer("setup")
     setup_timer.create_subtimer("decode")
 
@@ -349,7 +444,7 @@ def setup(ctx: FunctionContext) -> Exec:
     if not setup_sig:
         if args.statistics:
             print(setup_timer.report())
-        return setup_ex
+        return [setup_ex]
 
     # TODO: dyn_params may need to be passed to mk_calldata in run()
     calldata, dyn_params = mk_calldata(ctx.contract_ctx.abi, setup_info, args)
@@ -404,6 +499,7 @@ def setup(ctx: FunctionContext) -> Exec:
         case [(ex, _)]:
             setup_exs.append(ex)
         case _:
+            # keep every path that is not provably infeasible
             for path_id, (ex, query) in enumerate(setup_exs_no_error):
                 path_ctx = PathContext(
                     args=args,
@@ -414,20 +510,24 @@ def setup(ctx: FunctionContext) -> Exec:
                 solver_output = solve_low_level(path_ctx)
                 if solver_output.result != unsat:
                     setup_exs.append(ex)
-                    if len(setup_exs) > 1:
-                        break
 
-    match len(setup_exs):
-        case 0:
-            raise HalmosException(f"No successful path found in {setup_sig}")
-        case n if n > 1:
-            debug("\n".join(map(str, setup_exs)))
-            raise HalmosException(f"Multiple paths were found in {setup_sig}")
+    if not setup_exs:
+        raise DolmosException(f"No successful path found in {setup_sig}")
 
-    [setup_ex] = setup_exs
+    if len(setup_exs) > 1:
+        msg = (
+            f"{setup_sig}: {len(setup_exs)} setup states found; "
+            "each test will be run from each of them"
+        )
+        if args.verbose >= 1:
+            print(msg)
+        else:
+            debug(msg)
 
     if args.print_setup_states:
-        print(setup_ex)
+        for path_id, ex in enumerate(setup_exs):
+            print(f"# setup state {path_id}")
+            print(ex)
 
     if sevm.logs.bounded_loops:
         warn_code(
@@ -439,7 +539,7 @@ def setup(ctx: FunctionContext) -> Exec:
     if args.statistics:
         print(setup_timer.report())
 
-    return setup_ex
+    return setup_exs
 
 
 def is_global_fail_set(context: CallContext) -> bool:
@@ -447,6 +547,30 @@ def is_global_fail_set(context: CallContext) -> bool:
     return hevm_fail or any(is_global_fail_set(x) for x in context.subcalls())
 
 
+def is_invalid_opcode_found(context: CallContext) -> bool:
+    """
+    Check if the call failed because of an INVALID opcode (0xFE), e.g. vyper's
+    `assert ..., UNREACHABLE`.
+
+    The INVALID opcode may have been hit in a nested call: the callers then see a
+    failed call with no returndata and typically bubble it up as an empty revert
+    (vyper `extcall`/`staticcall`, solidity high-level calls), so we follow the chain
+    of empty reverts down the last subcall.
+    """
+    output = context.output
+    if isinstance(output.error, InvalidOpcode):
+        return True
+
+    if not isinstance(output.error, Revert):
+        return False
+
+    if output.data is not None and len(output.data) != 0:
+        return False
+
+    last_subcall = context.last_subcall()
+    return last_subcall is not None and is_invalid_opcode_found(last_subcall)
+
+
 def get_state_id(ex: Exec) -> bytes:
     """
     Computes the state snapshot hash, incorporating constraints on state variables.
@@ -458,7 +582,7 @@ def get_state_id(ex: Exec) -> bytes:
 
 
 def run_target_function(
-    args: HalmosConfig,
+    args: DolmosConfig,
     ex: Exec,
     addr: Address,
     abi: dict,
@@ -546,12 +670,12 @@ def run_target_contract(
         try:
             # create a symbolic tx.origin
             tx_origin = mk_addr(
-                f"halmos_tx_origin_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}"
+                f"dolmos_tx_origin_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}"
             )
 
             # create a symbolic msg.sender
             msg_sender = mk_addr(
-                f"halmos_msg_sender_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}"
+                f"dolmos_msg_sender_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}"
             )
 
             # restrict msg.sender to the specified target senders.
@@ -569,7 +693,7 @@ def run_target_contract(
 
             # create a symbolic msg.value
             msg_value = BitVec(
-                f"halmos_msg_value_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}",
+                f"dolmos_msg_value_{id_str(addr)}_{uid()}_{ex.new_symbol_id():>02}",
                 BitVecSort256,
             )
 
@@ -668,7 +792,7 @@ def _compute_frontier(ctx: ContractContext, depth: int) -> Iterator[Exec]:
                 if flamegraph_enabled:
                     call_flamegraph.add_with_sequence(post_ex.call_sequence, subcall)
 
-                # ignore and report if halmos-errored
+                # ignore and report if dolmos-errored
                 if subcall.is_stuck():
                     error(
                         f"{depth=}: addr={hexify(addr)}: {subcall.get_stuck_reason()}"
@@ -679,7 +803,16 @@ def _compute_frontier(ctx: ContractContext, depth: int) -> Iterator[Exec]:
                 if subcall.output.error:
                     # ignore normal reverts
                     panic_found = post_ex.is_panic_of(panic_error_codes)
-                    if not panic_found and not is_global_fail_set(subcall):
+                    invalid_found = (
+                        not panic_found
+                        and args.invalid_as_failure
+                        and is_invalid_opcode_found(subcall)
+                    )
+                    if (
+                        not panic_found
+                        and not invalid_found
+                        and not is_global_fail_set(subcall)
+                    ):
                         continue
 
                     fun_info = subcall.message.fun_info
@@ -696,6 +829,7 @@ def _compute_frontier(ctx: ContractContext, depth: int) -> Iterator[Exec]:
                             ex=post_ex,
                             panic_found=panic_found,
                             description=msg,
+                            invalid_found=invalid_found,
                         )
                     except ShutdownError:
                         if args.debug:
@@ -718,7 +852,7 @@ def _compute_frontier(ctx: ContractContext, depth: int) -> Iterator[Exec]:
                 visited.add(post_id)
 
                 # update timestamp
-                timestamp_name = f"halmos_block_timestamp_depth{depth}_{uid()}"
+                timestamp_name = f"dolmos_block_timestamp_depth{depth}_{uid()}"
                 post_ex.block.timestamp = ZeroExt(192, BitVec(timestamp_name, 64))
                 post_ex.path.append(post_ex.block.timestamp >= pre_ex.block.timestamp)
 
@@ -804,6 +938,7 @@ def handle_assertion_violation(
         ex: Exec,
         panic_found: bool,
         description: str = None,
+        invalid_found: bool = False,
     ) -> None:
         """
         Handles a potential assertion violation by solving it in a separate process.
@@ -816,6 +951,7 @@ def handle_assertion_violation(
             ex: The execution state containing the potential violation
             panic_found: Whether it's a panic error or a legacy hevm.fail flag
             description: Optional description of the violation
+            invalid_found: Whether an INVALID opcode was hit (see --invalid-as-failure)
 
         Raises:
             ShutdownError: If the executor has been shutdown during the solving process
@@ -830,6 +966,8 @@ def handle_assertion_violation(
             if panic_found:
                 panic_code = unbox_int(output.data[4:36].unwrap())
                 print(f"Panic(0x{panic_code:02x}) {error_output}")
+            elif invalid_found:
+                print(f"INVALID opcode (0xFE) {error_output}")
             else:  # fail_found
                 print(f"(fail flag set) {error_output}")
 
@@ -851,6 +989,17 @@ def handle_assertion_violation(
 
         query: SMTQuery = ex.path.to_smt2(args)
 
+        # with --pretty-counterexamples, collect what is needed to render the counterexample
+        # (on this thread, as it reads z3 objects), and the EXP applications to be checked
+        layout, exp_apps = None, None
+        if args.pretty_counterexamples:
+            try:
+                layout = collect_layout(ctx, ex, self.is_invariant, self.is_probe)
+            except Exception as e:
+                debug(f"could not collect the counterexample layout: {e!r}")
+            if "f_evm_exp_256" in query.smtlib:
+                exp_apps = mk_exp_apps(ex.path.conditions)
+
         # beware: because this object crosses thread boundaries, we must be careful to
         # avoid any reference to z3 objects
         path_ctx = PathContext(
@@ -858,6 +1007,8 @@ def handle_assertion_violation(
             path_id=path_id,
             query=query,
             solving_ctx=ctx.solving_ctx,
+            sha3_args=mk_sha3_args(ex.sha3s) if args.keccak_refinement_rounds else (),
+            exp_apps=exp_apps,
         )
 
         # ShutdownError may be raised here and will be handled by the caller
@@ -868,33 +1019,46 @@ def handle_assertion_violation(
                 ex=ex,
                 path_ctx=path_ctx,
                 description=description,
+                layout=layout,
             )
         )
         self.submitted_futures.append(solve_future)
 
-    def _get_solver_output(self, future: Future, path_ctx: PathContext) -> SolverOutput:
+    def _get_solver_output(
+        self, future: Future, path_ctx: PathContext
+    ) -> SolverOutput | None:
+        """
+        Returns the output of the solver, or None if solving was cancelled because the
+        executor has been shut down (e.g. by --early-exit once a counterexample is found).
+        """
         path_id, query_file = path_ctx.path_id, str(path_ctx.dump_file)
 
         if self.ctx.solving_ctx.executor.is_shutdown():
             # if the thread pool is in the process of shutting down,
             # we want to stop processing remaining models/timeouts/errors, etc.
-            e = "executor has been shutdown"
-            return SolverOutput.from_error(e, path_id=path_id, query_file=query_file)
+            return None
 
         if e := future.exception():
-            if not is_benign_solving_error(e):
-                error(f"encountered exception during assertion solving: {e!r}")
+            if is_benign_solving_error(e):
+                return None
+            error(f"encountered exception during assertion solving: {e!r}")
             return SolverOutput.from_error(e, path_id=path_id, query_file=query_file)
 
         try:
             return future.result()
         except Exception as e:
-            if not is_benign_solving_error(e):
-                error(f"encountered exception during assertion solving: {e!r}")
+            if is_benign_solving_error(e):
+                return None
+            error(f"encountered exception during assertion solving: {e!r}")
             return SolverOutput.from_error(e, path_id=path_id, query_file=query_file)
 
     def _solve_end_to_end_callback(
-        self, future: Future, ex: Exec, path_ctx: PathContext, description: str
+        self,
+        future: Future,
+        ex: Exec,
+        path_ctx: PathContext,
+        description: str,
+        layout: CexLayout | None = None,
     ) -> None:
         """
         Callback function for handling solver results.
@@ -903,6 +1067,7 @@ def _solve_end_to_end_callback(
             future: The Future object containing the solver result
             ex: The execution state
             description: Optional description of counterexample
+            layout: what is needed to render the counterexample (--pretty-counterexamples)
         """
         # beware: this function may be called from threads other than the main thread,
         # so we must be careful to avoid referencing any z3 objects / contexts
@@ -910,7 +1075,11 @@ def _solve_end_to_end_callback(
         ctx = self.ctx
         args = ctx.args
 
-        solver_output: SolverOutput = self._get_solver_output(future, path_ctx)
+        solver_output: SolverOutput | None = self._get_solver_output(future, path_ctx)
+        if solver_output is None:
+            # cancelled, e.g. by --early-exit: neither an error nor a result
+            return
+
         ctx.solver_outputs.append(solver_output)
         result, model = solver_output.result, solver_output.model
         path_id = solver_output.path_id
@@ -934,6 +1103,10 @@ def _solve_end_to_end_callback(
         if model is None:
             return
 
+        if args.pretty_counterexamples:
+            self._report_pretty_counterexample(ex, solver_output, description, layout)
+            return
+
         # mark this probe as reported to avoid duplicate reporting
         # note: message.fun_info is used instead of ctx.info because the function context for probes is dummy.
         if self.is_probe:
@@ -972,6 +1145,113 @@ def _solve_end_to_end_callback(
         if sequence := ctx.call_sequences[path_id]:
             print(f"Sequence:\n{sequence}")
 
+    def _report_pretty_counterexample(
+        self,
+        ex: Exec,
+        solver_output: SolverOutput,
+        description: str | None,
+        layout: CexLayout | None,
+    ) -> None:
+        """Reports a counterexample with --pretty-counterexamples (see dolmos.pcex)"""
+        # beware: called from the solver threads, see _solve_end_to_end_callback()
+        ctx = self.ctx
+        args = ctx.args
+        model, path_id = solver_output.model, solver_output.path_id
+
+        rendered = None
+        if layout is not None:
+            try:
+                rendered = render_counterexample(layout, model.model)
+            except Exception as e:
+                debug(f"could not render the counterexample: {e!r}")
+                if args.debug:
+                    traceback.print_exc()
+
+        fun_sig = (layout.fun_sig if layout else ctx.info.sig) or ""
+        if rendered is not None:
+            body = rendered.body
+        else:
+            body = str(model).lstrip("\n").split("\n")
+
+        pcex = ctx.pcex
+        with pcex.lock:
+            if model.is_valid:
+                ctx.valid_counterexamples.append(model)
+            else:
+                ctx.invalid_counterexamples.append(model)
+
+            # mark this probe as reported to avoid duplicate reporting
+            if self.is_probe:
+                ctx.contract_ctx.probes_reported.add(ex.context.message.fun_info)
+
+            # counterexamples with the same values as one already shown are only counted
+            if pcex.admit("\n".join(body), model.is_valid):
+                self._print_pretty_counterexample(
+                    solver_output, description, layout, rendered, body, fun_sig
+                )
+
+        if model.is_valid:
+            # add the stacks from the temporary flamegraph to the global one
+            if self.flamegraph_enabled and self.is_invariant:
+                call_flamegraph.stacks.extend(
+                    self.potential_flamegraphs[path_id].stacks
+                )
+
+            # we have a valid counterexample, so we are eligible for early exit
+            if args.early_exit:
+                debug(f"Shutting down {ctx.info.name}'s solver executor")
+                ctx.solving_ctx.executor.shutdown(wait=False)
+
+    def _print_pretty_counterexample(
+        self,
+        solver_output: SolverOutput,
+        description: str | None,
+        layout: CexLayout | None,
+        rendered: RenderedCex | None,
+        body: list[str],
+        fun_sig: str,
+    ) -> None:
+        """Prints a counterexample shown by _report_pretty_counterexample()"""
+        ctx = self.ctx
+        args = ctx.args
+        model, path_id = solver_output.model, solver_output.path_id
+
+        lines = []
+        if description:
+            lines.append(description)
+
+        if args.verbose >= VERBOSITY_TRACE_COUNTEREXAMPLE:
+            pid_str = f" #{path_id}" if args.verbose >= VERBOSITY_TRACE_PATHS else ""
+            lines.append(f"Trace{pid_str}:")
+            lines.append(ctx.traces[path_id].rstrip("\n"))
+
+        if model.is_valid:
+            lines.append(color_error(f"Counterexample: {fun_sig}"))
+        else:
+            reason = (
+                solver_output.invalid_reason
+                or "relies on an approximation of the EVM semantics"
+            )
+            lines.append(color_warn(f"Counterexample (potentially invalid): {fun_sig}"))
+            lines.append(color_warn(f"    reason: {reason}"))
+
+        lines.extend(body)
+
+        # the symbolic call sequence of invariant testing, replaced by the concrete one
+        sequence = ctx.call_sequences.get(path_id)
+        if sequence and (
+            rendered is None or args.verbose >= VERBOSITY_TRACE_COUNTEREXAMPLE
+        ):
+            lines.append(f"Sequence (symbolic):\n{sequence.rstrip()}")
+
+        if rendered is not None and rendered.repro and model.is_valid:
+            lines.extend(repro_function(layout, rendered, ctx.pcex.shown))
+
+        if not model.is_valid:
+            lines.append(f"(see {COUNTEREXAMPLE_INVALID.url()})")
+
+        print("\n".join(lines))
+
     def _save_failed_query(
         self, path_id: int, solver_output: SolverOutput, failure_type: str
     ) -> None:
@@ -1011,7 +1291,7 @@ def run_test(ctx: FunctionContext) -> TestResult:
     is_invariant = funname.startswith("invariant_")
 
     # set the config for every trace rendered in this test
-    halmos.traces.config_context.set(args)
+    dolmos.traces.config_context.set(args)
 
     #
     # prepare calldata
@@ -1087,8 +1367,13 @@ def run_test(ctx: FunctionContext) -> TestResult:
         output = ex.context.output
         error_output = output.error
         panic_found = ex.is_panic_of(args.panic_error_codes)
+        invalid_found = (
+            not panic_found
+            and args.invalid_as_failure
+            and is_invalid_opcode_found(ex.context)
+        )
 
-        if panic_found or is_global_fail_set(ex.context):
+        if panic_found or invalid_found or is_global_fail_set(ex.context):
             potential += 1
 
             try:
@@ -1096,6 +1381,7 @@ def run_test(ctx: FunctionContext) -> TestResult:
                     path_id=path_id,
                     ex=ex,
                     panic_found=panic_found,
+                    invalid_found=invalid_found,
                 )
             except ShutdownError:
                 if args.debug:
@@ -1205,6 +1491,12 @@ def run_test(ctx: FunctionContext) -> TestResult:
         f"bounds: [{', '.join([str(x) for x in dyn_params])}])"
     )
 
+    if args.pretty_counterexamples and (hidden := ctx.pcex.hidden):
+        print(
+            f"    {hidden} duplicate counterexample{'s' if hidden > 1 else ''} not shown "
+            "(same values as a counterexample above)"
+        )
+
     if exitcode in (Exitcode.TIMEOUT.value, Exitcode.EXCEPTION.value):
         # print query directory information
         failure_type = "timeout" if exitcode == Exitcode.TIMEOUT.value else "error"
@@ -1225,6 +1517,9 @@ def run_test(ctx: FunctionContext) -> TestResult:
         )
         debug("\n".join(jumpid_str(x) for x in logs.bounded_loops))
 
+    for lasso_result in logs.lassos:
+        print(f"    {lasso_result.summary()}")
+
     # return test result
     num_cexes = len(ctx.valid_counterexamples) + len(ctx.invalid_counterexamples)
     if args.minimal_json_output:
@@ -1315,7 +1610,7 @@ def execute_simple_getter(
 
     # sanity check
     if len(exs) != 1:
-        raise HalmosException(f"{fun_info.sig}: # of paths: {len(exs)}")
+        raise DolmosException(f"{fun_info.sig}: # of paths: {len(exs)}")
 
     [ex] = exs
 
@@ -1323,7 +1618,7 @@ def execute_simple_getter(
     returndata = output.data
 
     if output.error is not None or not returndata:
-        raise HalmosException(f"{fun_info.sig}: {output.error=} {returndata=}")
+        raise DolmosException(f"{fun_info.sig}: {output.error=} {returndata=}")
 
     return returndata
 
@@ -1487,7 +1782,7 @@ def resolve_target_contracts(ctx: InvariantTestingContext, ex: Exec) -> set[Addr
     )
 
     if not resolved_target_contracts:
-        raise HalmosException("No target contracts available.")
+        raise DolmosException("No target contracts available.")
 
     return resolved_target_contracts
 
@@ -1523,7 +1818,7 @@ def resolve_target_selectors(
                 debug(f"Skipping {fun_sig} ({state_mutability})")
                 continue
 
-            # https://github.com/a16z/halmos/issues/514
+            # see upstream halmos issue #514
             # exclude special functions like test_, check_, setUp(), etc.
             if is_test_contract and (
                 fun_sig.startswith("test_")
@@ -1560,9 +1855,10 @@ def run_contract(ctx: ContractContext) -> list[TestResult]:
             contract_ctx=ctx,
         )
 
-        halmos.traces.config_context.set(setup_config)
-        setup_ex = setup(setup_ctx)
-        setup_ex.path_slice()
+        dolmos.traces.config_context.set(setup_config)
+        setup_exs = setup(setup_ctx)
+        for setup_ex in setup_exs:
+            setup_ex.path_slice()
     except Exception as err:
         error(f"{setup_info.sig} failed: {type(err).__name__}: {err}")
         if args.debug:
@@ -1573,11 +1869,15 @@ def run_contract(ctx: ContractContext) -> list[TestResult]:
 
         return []
 
-    # initialize the frontier and visited states using the initial setup state
-    ctx.frontier_states[0] = [setup_ex]
-    ctx.visited.add(get_state_id(setup_ex))
+    # initialize the frontier and visited states using the initial setup states.
+    # every test (and every invariant test sequence) starts from each of them.
+    ctx.frontier_states[0] = setup_exs
+    for setup_ex in setup_exs:
+        ctx.visited.add(get_state_id(setup_ex))
 
-    test_results = run_tests(ctx, setup_ex, ctx.funsigs)
+    # the invariant testing context (target contracts, senders, selectors)
+    # is read from the first setup state
+    test_results = run_tests(ctx, setup_exs[0], ctx.funsigs)
 
     # reset any remaining solver states from the default context
     reset(setup_solver)
@@ -1588,7 +1888,7 @@ def run_contract(ctx: ContractContext) -> list[TestResult]:
 def print_invariant_targets(ctx: ContractContext, ex: Exec):
     try:
         target_contracts = resolve_target_contracts(ctx.inv_ctx, ex)
-    except HalmosException:
+    except DolmosException:
         # no target contracts found, let the downstream tests fail
         target_contracts = []
 
@@ -1729,7 +2029,7 @@ def _main(_args=None) -> MainResult:
     args = load_config(_args)
 
     if args.version:
-        print(f"halmos {metadata.version('halmos')}")
+        print(f"{program_name()} {metadata.version('dolmos')}")
         return MainResult(0)
 
     init_env(args.root)
@@ -1742,7 +2042,7 @@ def _main(_args=None) -> MainResult:
         logger_unique.setLevel(logging.DEBUG)
 
     if args.trace_memory:
-        import halmos.memtrace as memtrace
+        import dolmos.memtrace as memtrace
 
         memtrace.MemTracer.get().start()
 
@@ -1781,7 +2081,14 @@ def _main(_args=None) -> MainResult:
     # run forge without capturing stdout/stderr
     debug(f"Running {' '.join(build_cmd)}")
 
-    build_exitcode = subprocess.run(build_cmd).returncode
+    # recent forge versions enable `dynamic_test_linking` by default, which rewrites
+    # `new C(...)` in test files into `vm.deployCode(...)` calls. dolmos needs the
+    # original creation bytecode, so we turn it off (env var: ignored by older forge,
+    # and still overridable by the user).
+    build_env = os.environ.copy()
+    build_env.setdefault("FOUNDRY_DYNAMIC_TEST_LINKING", "false")
+
+    build_exitcode = subprocess.run(build_cmd, env=build_env).returncode
 
     if build_exitcode:
         error(f"Build failed: {build_cmd}")
@@ -1798,6 +2105,10 @@ def _main(_args=None) -> MainResult:
             traceback.print_exc()
         return MainResult(1)
 
+    # vyper support: switch some defaults, unless explicitly configured
+    if has_vyper_contracts(build_out):
+        args = with_vyper_defaults(args)
+
     timer.create_subtimer("tests")
 
     total_passed = 0
@@ -1862,14 +2173,15 @@ def on_signal(signum, frame):
         linkReferences = contract_json["bytecode"]["linkReferences"]
         libs = import_libs(build_out_map, creation_hexcode, linkReferences)
 
-        contract_path = f"{contract_json['ast']['absolutePath']}:{contract_name}"
+        contract_path = f"{get_source_path(contract_json, filename)}:{contract_name}"
         print(f"\nRunning {num_found} tests for {contract_path}")
 
         # Set the test contract address in DeployAddressMapper
         DeployAddressMapper().add_deployed_contract(hexify(FOUNDRY_TEST), contract_name)
 
-        # support for `/// @custom:halmos` annotations
+        # support for `/// @custom:dolmos` annotations
         contract_args = with_natspec(args, contract_name, natspec)
+        contract_args = with_evm_version(contract_args, contract_json)
         contract_ctx = ContractContext(
             args=contract_args,
             name=contract_name,
@@ -1942,12 +2254,12 @@ def on_signal(signum, frame):
     return on_exit(exitcode)
 
 
-# entrypoint for the `halmos` script
+# entrypoint for the `dolmos` script
 def main() -> int:
     exitcode = _main().exitcode
     return exitcode
 
 
-# entrypoint for `python -m halmos`
+# entrypoint for `python -m dolmos`
 if __name__ == "__main__":
     sys.exit(main())
diff --git a/src/halmos/assertions.py b/src/dolmos/assertions.py
similarity index 98%
rename from src/halmos/assertions.py
rename to src/dolmos/assertions.py
index de9e432ed..b4a225563 100644
--- a/src/halmos/assertions.py
+++ b/src/dolmos/assertions.py
@@ -13,8 +13,8 @@
     is_bv,
 )
 
-from halmos.exceptions import HalmosException
-from halmos.utils import (
+from dolmos.exceptions import DolmosException
+from dolmos.utils import (
     bytes_to_bv_value,
     extract_bytes,
     extract_bytes32_array_argument,
@@ -178,7 +178,7 @@ def mk_assert_handler(signature):
         operator = match.group(1)
         params = match.group(2).split(",")
     else:
-        raise HalmosException(f"not supported signatures: {signature}")
+        raise DolmosException(f"not supported signatures: {signature}")
 
     # operator type:
     # - binary: compare two arguments
diff --git a/src/halmos/bitvec.py b/src/dolmos/bitvec.py
similarity index 65%
rename from src/halmos/bitvec.py
rename to src/dolmos/bitvec.py
index e1d6ac3b7..cff22de4f 100644
--- a/src/halmos/bitvec.py
+++ b/src/dolmos/bitvec.py
@@ -34,10 +34,10 @@
     simplify,
 )
 
-from halmos.exceptions import NotConcreteError
+from dolmos.exceptions import NotConcreteError
 
-BV: TypeAlias = "HalmosBitVec"
-AnyValue: TypeAlias = "int | bytes | BitVecRef | BV | HalmosBool | str"
+BV: TypeAlias = "DolmosBitVec"
+AnyValue: TypeAlias = "int | bytes | BitVecRef | BV | DolmosBool | str"
 BVValue: TypeAlias = int | BitVecRef | BoolRef
 MaybeSize: TypeAlias = int | None
 AnyBool: TypeAlias = bool | BoolRef
@@ -62,11 +62,11 @@ def as_int(value: AnyValue) -> tuple[BVValue, MaybeSize]:
         return int.from_bytes(value, "big"), len(value) * 8
     elif is_bv_value(value):
         return value.as_long(), value.size()
-    elif isinstance(value, HalmosBitVec):
+    elif isinstance(value, DolmosBitVec):
         return value.unwrap(), value.size
     elif isinstance(value, BitVecRef):
         return value, value.size()
-    elif isinstance(value, HalmosBool):
+    elif isinstance(value, DolmosBool):
         return value.unwrap(), 1
     elif isinstance(value, BoolRef):
         return value, 1
@@ -74,23 +74,23 @@ def as_int(value: AnyValue) -> tuple[BVValue, MaybeSize]:
         raise TypeError(f"Cannot convert {type(value)} to int")
 
 
-class HalmosBool:
+class DolmosBool:
     """
     Immutable wrapper for concrete or symbolic boolean values.
 
     Can be constructed with:
-    - HalmosBool(42 % 2 == 0) # bool
-    - HalmosBool(BitVec(x, 8) != 0) # BoolRef
-    - HalmosBool(HalmosBitVec(x, 8)) # HalmosBitVec, same as above
+    - DolmosBool(42 % 2 == 0) # bool
+    - DolmosBool(BitVec(x, 8) != 0) # BoolRef
+    - DolmosBool(DolmosBitVec(x, 8)) # DolmosBitVec, same as above
 
-    Conversion to and from HalmosBitVec:
-    - HalmosBitVec(halmos_bool) (same as halmos_bool.as_bv())
-    - HalmosBool(halmos_bitvec) (same as halmos_bitvec.is_non_zero())
+    Conversion to and from DolmosBitVec:
+    - DolmosBitVec(dolmos_bool) (same as dolmos_bool.as_bv())
+    - DolmosBool(dolmos_bitvec) (same as dolmos_bitvec.is_non_zero())
 
     Wrapping/unwrapping:
-    - halmos_bool.as_z3() always converts to a z3 BoolRef
-    - bool(halmos_bool) converts to a concrete bool, raises if symbolic
-    - halmos_bool.value/unwrap() returns the underlying bool or z3 BoolRef
+    - dolmos_bool.as_z3() always converts to a z3 BoolRef
+    - bool(dolmos_bool) converts to a concrete bool, raises if symbolic
+    - dolmos_bool.value/unwrap() returns the underlying bool or z3 BoolRef
     """
 
     __slots__ = ("con_val", "sym_val")
@@ -103,10 +103,10 @@ def __new__(cls, value, *, do_simplify: bool = True):
         if type_value is bool:
             return TRUE if value else FALSE
 
-        if type_value is HalmosBool:
+        if type_value is DolmosBool:
             return value
 
-        if type_value is HalmosBitVec:
+        if type_value is DolmosBitVec:
             return value.is_non_zero()
 
         if type_value is BoolRef:
@@ -137,14 +137,14 @@ def __init__(self, value: AnyBool | str, *, do_simplify: bool = True):
                 self.sym_val = Bool(value)
                 self.con_val = None
 
-            case HalmosBool():
+            case DolmosBool():
                 return
 
-            case HalmosBitVec():
+            case DolmosBitVec():
                 return
 
             case _:
-                raise TypeError(f"Cannot create HalmosBool from {type(value)}")
+                raise TypeError(f"Cannot create DolmosBool from {type(value)}")
 
         assert self.con_val is None or self.sym_val is None
         assert self.con_val is not None or self.sym_val is not None
@@ -209,7 +209,7 @@ def __eq__(self, other: Any) -> bool:
         note: this is not the same as z3's comparison, which returns a constraint
         """
 
-        if not isinstance(other, HalmosBool):
+        if not isinstance(other, DolmosBool):
             return False
 
         match (self.con_val, other.con_val):
@@ -232,28 +232,28 @@ def __hash__(self) -> int:
 
         return hash((self.con_val, self.sym_val))
 
-    def is_zero(self) -> "HalmosBool":
+    def is_zero(self) -> "DolmosBool":
         if self is TRUE:
             return FALSE
 
         if self is FALSE:
             return TRUE
 
-        return HalmosBool(Not(self.sym_val))
+        return DolmosBool(Not(self.sym_val))
 
-    def is_non_zero(self) -> "HalmosBool":
+    def is_non_zero(self) -> "DolmosBool":
         return self
 
-    def eq(self, other: "HalmosBool") -> "HalmosBool":
-        return HalmosBool(self.value == other.value)
+    def eq(self, other: "DolmosBool") -> "DolmosBool":
+        return DolmosBool(self.value == other.value)
 
-    def neg(self) -> "HalmosBool":
+    def neg(self) -> "DolmosBool":
         return self.is_zero()
 
-    def bitwise_not(self) -> "HalmosBool":
+    def bitwise_not(self) -> "DolmosBool":
         return self.is_zero()
 
-    def bitwise_and(self, other: "HalmosBool") -> "HalmosBool":
+    def bitwise_and(self, other: "DolmosBool") -> "DolmosBool":
         if self is TRUE:
             return other
 
@@ -266,9 +266,9 @@ def bitwise_and(self, other: "HalmosBool") -> "HalmosBool":
         if other is FALSE:
             return other
 
-        return HalmosBool(And(self.as_z3(), other.as_z3()))
+        return DolmosBool(And(self.as_z3(), other.as_z3()))
 
-    def bitwise_or(self, other: "HalmosBool") -> "HalmosBool":
+    def bitwise_or(self, other: "DolmosBool") -> "DolmosBool":
         if self is TRUE:
             return self
 
@@ -281,9 +281,9 @@ def bitwise_or(self, other: "HalmosBool") -> "HalmosBool":
         if other is FALSE:
             return self
 
-        return HalmosBool(Or(self.as_z3(), other.as_z3()))
+        return DolmosBool(Or(self.as_z3(), other.as_z3()))
 
-    def bitwise_xor(self, other: "HalmosBool") -> "HalmosBool":
+    def bitwise_xor(self, other: "DolmosBool") -> "DolmosBool":
         if self is TRUE:
             return other.bitwise_not()
 
@@ -296,47 +296,47 @@ def bitwise_xor(self, other: "HalmosBool") -> "HalmosBool":
         if other is FALSE:
             return self
 
-        return HalmosBool(Xor(self.as_z3(), other.as_z3()))
+        return DolmosBool(Xor(self.as_z3(), other.as_z3()))
 
     def as_bv(self, size: int = 1) -> BV:
         if self is TRUE:
-            return ONE if size == 256 else HalmosBitVec(1, size=size)
+            return ONE if size == 256 else DolmosBitVec(1, size=size)
 
         if self is FALSE:
-            return ZERO if size == 256 else HalmosBitVec(0, size=size)
+            return ZERO if size == 256 else DolmosBitVec(0, size=size)
 
         expr = If(self.sym_val, BitVecVal(1, size), BitVecVal(0, size))
-        return HalmosBitVec(expr, size=size)
+        return DolmosBitVec(expr, size=size)
 
 
-class HalmosBitVec:
+class DolmosBitVec:
     """
     Immutable wrapper for concrete or symbolic bitvectors.
 
     Can be constructed with:
-    - HalmosBitVec(42) # int, size is default (256)
-    - HalmosBitVec(-1, size=8) # int, 2's complement
-    - HalmosBitVec(bytes.fromhex("12345678")) # bytes, size is inherited
-    - HalmosBitVec(BitVecVal(42, 8)) # BitVecVal, size is inherited
-    - HalmosBitVec(BitVec(x, 8)) # BitVecRef, size is inherited
-    - HalmosBitVec(halmos_bool) # HalmosBool, size 1
-    - HalmosBitVec("x") # named symbol, size is default (256)
-
-    Conversion to and from HalmosBool:
-    - HalmosBitVec(halmos_bool) (same as halmos_bool.as_bv())
-    - HalmosBool(halmos_bitvec) (same as halmos_bitvec.is_non_zero())
+    - DolmosBitVec(42) # int, size is default (256)
+    - DolmosBitVec(-1, size=8) # int, 2's complement
+    - DolmosBitVec(bytes.fromhex("12345678")) # bytes, size is inherited
+    - DolmosBitVec(BitVecVal(42, 8)) # BitVecVal, size is inherited
+    - DolmosBitVec(BitVec(x, 8)) # BitVecRef, size is inherited
+    - DolmosBitVec(dolmos_bool) # DolmosBool, size 1
+    - DolmosBitVec("x") # named symbol, size is default (256)
+
+    Conversion to and from DolmosBool:
+    - DolmosBitVec(dolmos_bool) (same as dolmos_bool.as_bv())
+    - DolmosBool(dolmos_bitvec) (same as dolmos_bitvec.is_non_zero())
 
     Wrapping/unwrapping:
-    - halmos_bitvec.as_z3() always converts to a z3 BitVecRef
-    - int(halmos_bitvec) converts to a concrete int, raises if symbolic
-    - halmos_bitvec.value/unwrap() returns the underlying int or z3 BitVecRef
+    - dolmos_bitvec.as_z3() always converts to a z3 BitVecRef
+    - int(dolmos_bitvec) converts to a concrete int, raises if symbolic
+    - dolmos_bitvec.value/unwrap() returns the underlying int or z3 BitVecRef
     """
 
     __slots__ = ("_value", "_symbolic", "_size")
 
     def __new__(cls, value, size=None, do_simplify=True):
-        # fast path for existing HalmosBitVec of same size
-        if isinstance(value, HalmosBitVec):
+        # fast path for existing DolmosBitVec of same size
+        if isinstance(value, DolmosBitVec):
             size = size or value._size
             if size == value._size:
                 return value
@@ -348,7 +348,7 @@ def __init__(
         self, value: AnyValue, *, size: MaybeSize = None, do_simplify: bool = True
     ):
         """
-        Create a new HalmosBitVec from an integer, bytes, or a z3 BitVecRef.
+        Create a new DolmosBitVec from an integer, bytes, or a z3 BitVecRef.
 
         If the value is too large for the bit size, it will be truncated.
 
@@ -357,16 +357,16 @@ def __init__(
 
         type_value = type(value)
 
-        if type_value is HalmosBitVec:
-            # avoid reinitializing HalmosBitVec because of __new__ shortcut if same size
+        if type_value is DolmosBitVec:
+            # avoid reinitializing DolmosBitVec because of __new__ shortcut if same size
             if size == value.size:
                 return
 
-            # otherwise, create a new HalmosBitVec with the new size
+            # otherwise, create a new DolmosBitVec with the new size
             value = value.unwrap()
 
-        # unwrap HalmosBool
-        elif type_value is HalmosBool:
+        # unwrap DolmosBool
+        elif type_value is DolmosBool:
             value = value.unwrap()
 
         # convenience, wrap a string as a named symbol
@@ -404,7 +404,7 @@ def __init__(
                 self._value = simplified
 
         else:
-            raise TypeError(f"Cannot create HalmosBitVec from {type(value)}")
+            raise TypeError(f"Cannot create DolmosBitVec from {type(value)}")
 
     def __deepcopy__(self, memo):
         # yay immutability
@@ -441,7 +441,7 @@ def __eq__(self, other: Any) -> bool:
 
         note: this is not the same as z3's comparison, which returns a constraint
         """
-        if not isinstance(other, HalmosBitVec):
+        if not isinstance(other, DolmosBitVec):
             return False
 
         if self._size != other.size:
@@ -476,13 +476,13 @@ def __repr__(self) -> str:
     def __str__(self) -> str:
         return str(self._value)
 
-    def is_zero(self) -> HalmosBool:
+    def is_zero(self) -> DolmosBool:
         # works for both symbolic and concrete
-        return HalmosBool(self._value == 0)
+        return DolmosBool(self._value == 0)
 
-    def is_non_zero(self) -> HalmosBool:
+    def is_non_zero(self) -> DolmosBool:
         # works for both symbolic and concrete
-        return HalmosBool(self._value != 0)
+        return DolmosBool(self._value != 0)
 
     #
     # operations
@@ -492,24 +492,24 @@ def add(self, other: BV) -> BV:
         size = self._size
         assert size == other._size
 
-        return HalmosBitVec(self._value + other._value, size=size)
+        return DolmosBitVec(self._value + other._value, size=size)
 
-    def sub(self, other: BV) -> "HalmosBitVec":
+    def sub(self, other: BV) -> "DolmosBitVec":
         size = self._size
         assert size == other._size
 
-        return HalmosBitVec(self._value - other._value, size=size)
+        return DolmosBitVec(self._value - other._value, size=size)
 
     def mul(
         self, other: BV, *, abstraction: FuncDeclRef | None = None
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
 
         lhs, rhs = self.value, other.value
         match (self.is_concrete, other.is_concrete):
             case (True, True):
-                return HalmosBitVec(lhs * rhs, size=size)
+                return DolmosBitVec(lhs * rhs, size=size)
 
             case (True, False):
                 if lhs == 0:
@@ -519,9 +519,9 @@ def mul(
                     return other
 
                 if is_power_of_two(lhs):
-                    return other.lshl(HalmosBitVec(lhs.bit_length() - 1, size=size))
+                    return other.lshl(DolmosBitVec(lhs.bit_length() - 1, size=size))
 
-                return HalmosBitVec(lhs * rhs, size=size)
+                return DolmosBitVec(lhs * rhs, size=size)
 
             case (False, True):
                 if rhs == 0:
@@ -531,20 +531,20 @@ def mul(
                     return self
 
                 if is_power_of_two(rhs):
-                    return self.lshl(HalmosBitVec(rhs.bit_length() - 1, size=size))
+                    return self.lshl(DolmosBitVec(rhs.bit_length() - 1, size=size))
 
                 # simplify(x * 123) -> 123 * x
-                return HalmosBitVec(rhs * lhs, size=size)
+                return DolmosBitVec(rhs * lhs, size=size)
 
         return (
-            HalmosBitVec(lhs * rhs, size=size)
+            DolmosBitVec(lhs * rhs, size=size)
             if abstraction is None
-            else HalmosBitVec(abstraction(lhs, rhs), size=size)
+            else DolmosBitVec(abstraction(lhs, rhs), size=size)
         )
 
     def div(
         self, other: BV, *, abstraction: FuncDeclRef | None = None
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         # TODO: div_xy_y
 
         size = self._size
@@ -564,20 +564,20 @@ def div(
 
             # fully concrete case
             if self.is_concrete:
-                return HalmosBitVec(lhs // rhs, size=size)
+                return DolmosBitVec(lhs // rhs, size=size)
 
             if is_power_of_two(rhs):
-                return self.lshr(HalmosBitVec(rhs.bit_length() - 1, size=size))
+                return self.lshr(DolmosBitVec(rhs.bit_length() - 1, size=size))
 
         # symbolic case
         if abstraction is None:
-            return HalmosBitVec(UDiv(lhs, rhs), size=size)
+            return DolmosBitVec(UDiv(lhs, rhs), size=size)
 
-        return HalmosBitVec(abstraction(lhs, rhs), size=size)
+        return DolmosBitVec(abstraction(lhs, rhs), size=size)
 
     def sdiv(
         self, other: BV, *, abstraction: FuncDeclRef | None = None
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         # TODO: sdiv_xy_y
         size = self._size
         assert size == other.size
@@ -593,20 +593,20 @@ def sdiv(
 
             if self.is_concrete:
                 # rely on z3 to handle the signed division
-                return HalmosBitVec(
+                return DolmosBitVec(
                     BitVecVal(lhs, size) / BitVecVal(rhs, size),
                     size=size,
                     do_simplify=True,
                 )
 
         if abstraction is None:
-            return HalmosBitVec(other / self, size=size)
+            return DolmosBitVec(other / self, size=size)
 
-        return HalmosBitVec(abstraction(lhs, rhs), size=size)
+        return DolmosBitVec(abstraction(lhs, rhs), size=size)
 
     def mod(
-        self, other: "HalmosBitVec", *, abstraction: FuncDeclRef | None = None
-    ) -> "HalmosBitVec":
+        self, other: "DolmosBitVec", *, abstraction: FuncDeclRef | None = None
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
 
@@ -619,27 +619,27 @@ def mod(
 
             # mod by one is zero
             if rhs == 1:
-                return HalmosBitVec(0, size=size)
+                return DolmosBitVec(0, size=size)
 
             # fully concrete case
             if self.is_concrete:
-                return HalmosBitVec(lhs % rhs, size=size)
+                return DolmosBitVec(lhs % rhs, size=size)
 
             # mod by a power of two only keeps the low bits
             if is_power_of_two(rhs):
                 # option 1: use z3 bitwise and
                 # 10000 loops, best of 5: 148.215 usec per loop
-                # return HalmosBitVec(lhs & (rhs - 1), size=size)
+                # return DolmosBitVec(lhs & (rhs - 1), size=size)
 
                 # option 2: truncate and extend
                 # 10000 loops, best of 5: 146.525 usec per loop
-                # truncated = HalmosBitVec(lhs, size=rhs.bit_length() - 1)
-                # return HalmosBitVec(truncated, size=size)
+                # truncated = DolmosBitVec(lhs, size=rhs.bit_length() - 1)
+                # return DolmosBitVec(truncated, size=size)
 
                 # option 3: truncate and extend, skip simplify
                 # 10000 loops, best of 5: 130.028 usec per loop
-                # truncated = HalmosBitVec(lhs, size=rhs.bit_length() - 1, do_simplify=False)
-                # return HalmosBitVec(truncated, size=size)
+                # truncated = DolmosBitVec(lhs, size=rhs.bit_length() - 1, do_simplify=False)
+                # return DolmosBitVec(truncated, size=size)
 
                 # option 4: explicit ZeroExt and Extract
                 # on this path, we know that rhs > 1, so bitsize > 1
@@ -647,17 +647,17 @@ def mod(
                 bitsize = rhs.bit_length() - 1
                 truncated = Extract(bitsize - 1, 0, lhs)
                 extended = ZeroExt(size - bitsize, truncated)
-                return HalmosBitVec(extended, size=size)
+                return DolmosBitVec(extended, size=size)
 
         # symbolic case
         if abstraction is None:
-            return HalmosBitVec(URem(lhs, rhs), size=size)
+            return DolmosBitVec(URem(lhs, rhs), size=size)
 
-        return HalmosBitVec(abstraction(lhs, rhs), size=size)
+        return DolmosBitVec(abstraction(lhs, rhs), size=size)
 
     def smod(
-        self, other: "HalmosBitVec", *, abstraction: FuncDeclRef | None = None
-    ) -> "HalmosBitVec":
+        self, other: "DolmosBitVec", *, abstraction: FuncDeclRef | None = None
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
 
@@ -669,14 +669,14 @@ def smod(
 
             # mod by one is zero
             if rhs == 1:
-                return HalmosBitVec(0, size=size)
+                return DolmosBitVec(0, size=size)
 
             # TODO: implement concrete signed remainder
             # (tricky because it truncates towards zero)
 
             if self.is_concrete:
                 # rely on z3 to handle the signed division
-                return HalmosBitVec(
+                return DolmosBitVec(
                     SRem(BitVecVal(lhs, size), BitVecVal(rhs, size)),
                     size=size,
                     do_simplify=True,
@@ -684,18 +684,18 @@ def smod(
 
         # lhs and rhs are symbolic
         if abstraction is None:
-            return HalmosBitVec(SRem(lhs, rhs), size=size)
+            return DolmosBitVec(SRem(lhs, rhs), size=size)
 
-        return HalmosBitVec(abstraction(lhs, rhs), size=size)
+        return DolmosBitVec(abstraction(lhs, rhs), size=size)
 
     def exp(
         self,
-        other: "HalmosBitVec",
+        other: "DolmosBitVec",
         *,
         exp_abstraction: FuncDeclRef | None = None,
         mul_abstraction: FuncDeclRef | None = None,
         smt_exp_by_const: int = 0,
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
 
@@ -703,13 +703,13 @@ def exp(
 
         if other.is_concrete:
             if rhs == 0:
-                return HalmosBitVec(1, size=size)
+                return DolmosBitVec(1, size=size)
 
             if rhs == 1:
                 return self
 
             if self.is_concrete:
-                return HalmosBitVec(lhs**rhs, size=size)
+                return DolmosBitVec(lhs**rhs, size=size)
 
             if rhs <= smt_exp_by_const:
                 exp = self
@@ -720,55 +720,55 @@ def exp(
         if exp_abstraction is None:
             raise NotImplementedError("missing SMT abstraction for exponentiation")
 
-        return HalmosBitVec(exp_abstraction(lhs, rhs), size=size)
+        return DolmosBitVec(exp_abstraction(lhs, rhs), size=size)
 
     def addmod(
         self,
-        other: "HalmosBitVec",
-        modulus: "HalmosBitVec",
+        other: "DolmosBitVec",
+        modulus: "DolmosBitVec",
         *,
         abstraction: FuncDeclRef | None = None,
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
         assert size == modulus.size
 
         if self.is_concrete and other.is_concrete and modulus.is_concrete:
-            return HalmosBitVec((self.value + other.value) % modulus.value, size=size)
+            return DolmosBitVec((self.value + other.value) % modulus.value, size=size)
 
         # to avoid add overflow; and to be a multiple of 8-bit
         newsize = size + 8
 
-        r1 = HalmosBitVec(self, size=newsize).add(HalmosBitVec(other, size=newsize))
-        r2 = r1.mod(HalmosBitVec(modulus, size=newsize), abstraction=abstraction)
+        r1 = DolmosBitVec(self, size=newsize).add(DolmosBitVec(other, size=newsize))
+        r2 = r1.mod(DolmosBitVec(modulus, size=newsize), abstraction=abstraction)
 
         if r1.size != newsize:
             raise ValueError(r1)
         if r2.size != newsize:
             raise ValueError(r2)
 
-        return HalmosBitVec(r2, size=size)
+        return DolmosBitVec(r2, size=size)
 
     def mulmod(
         self,
-        other: "HalmosBitVec",
-        modulus: "HalmosBitVec",
+        other: "DolmosBitVec",
+        modulus: "DolmosBitVec",
         *,
         mul_abstraction: FuncDeclRef | None = None,
         mod_abstraction: FuncDeclRef | None = None,
-    ) -> "HalmosBitVec":
+    ) -> "DolmosBitVec":
         size = self._size
         assert size == other.size
         assert size == modulus.size
 
         if self.is_concrete and other.is_concrete and modulus.is_concrete:
-            return HalmosBitVec((self.value * other.value) % modulus.value, size=size)
+            return DolmosBitVec((self.value * other.value) % modulus.value, size=size)
 
         # to avoid mul overflow
         newsize = size * 2
-        self_ext = HalmosBitVec(self, size=newsize)
-        other_ext = HalmosBitVec(other, size=newsize)
-        mod_ext = HalmosBitVec(modulus, size=newsize)
+        self_ext = DolmosBitVec(self, size=newsize)
+        other_ext = DolmosBitVec(other, size=newsize)
+        mod_ext = DolmosBitVec(modulus, size=newsize)
 
         r1 = self_ext.mul(other_ext, abstraction=mul_abstraction)
         r2 = r1.mod(mod_ext, abstraction=mod_abstraction)
@@ -779,9 +779,9 @@ def mulmod(
         if r2.size != newsize:
             raise ValueError(r2)
 
-        return HalmosBitVec(r2, size=size)
+        return DolmosBitVec(r2, size=size)
 
-    def signextend(self, size: int) -> "HalmosBitVec":
+    def signextend(self, size: int) -> "DolmosBitVec":
         # TODO: handle other sizes
         assert self.size == 256
 
@@ -791,11 +791,11 @@ def signextend(self, size: int) -> "HalmosBitVec":
         # TODO: handle concrete case natively
 
         bl = (size + 1) * 8
-        return HalmosBitVec(
+        return DolmosBitVec(
             SignExt(256 - bl, Extract(bl - 1, 0, self.as_z3())), size=256
         )
 
-    def lshl(self, shift: BV) -> "HalmosBitVec":
+    def lshl(self, shift: BV) -> "DolmosBitVec":
         """
         Logical left shift
         """
@@ -808,11 +808,11 @@ def lshl(self, shift: BV) -> "HalmosBitVec":
                 return self
 
             if shift_amount >= size:
-                return HalmosBitVec(0, size=size)
+                return DolmosBitVec(0, size=size)
 
-        return HalmosBitVec(self._value << shift_amount, size=size)
+        return DolmosBitVec(self._value << shift_amount, size=size)
 
-    def lshr(self, shift: BV) -> "HalmosBitVec":
+    def lshr(self, shift: BV) -> "DolmosBitVec":
         """
         Logical right shift
         """
@@ -825,14 +825,14 @@ def lshr(self, shift: BV) -> "HalmosBitVec":
                 return self
 
             if self.is_concrete:
-                return HalmosBitVec(self.value >> shift_amount, size=size)
+                return DolmosBitVec(self.value >> shift_amount, size=size)
 
             if shift_amount >= size:
-                return HalmosBitVec(0, size=size)
+                return DolmosBitVec(0, size=size)
 
-        return HalmosBitVec(LShR(self.as_z3(), shift.as_z3()), size=size)
+        return DolmosBitVec(LShR(self.as_z3(), shift.as_z3()), size=size)
 
-    def ashr(self, shift: BV) -> "HalmosBitVec":
+    def ashr(self, shift: BV) -> "DolmosBitVec":
         """
         Arithmetic right shift
         """
@@ -841,81 +841,126 @@ def ashr(self, shift: BV) -> "HalmosBitVec":
         if shift.is_concrete and shift.value == 0:
             return self
 
-        return HalmosBitVec(self.as_z3() >> shift.value, size=self.size)
+        return DolmosBitVec(self.as_z3() >> shift.value, size=self.size)
+
+    def clz(self) -> "DolmosBitVec":
+        """
+        Count Leading Zeros — EVM opcode CLZ (0x1E, EIP-7939 / Fusaka).
+
+        Stack semantics: [x] -> [clz(x)]
+          clz(0)      == size  (256 for a standard EVM word)
+          clz(1)      == 255
+          clz(2^255)  == 0
+
+        Concrete: O(1) via int.bit_length().
+        Symbolic: binary-search tree of 8 nested If() nodes (one per
+        bit-doubling level: 128/64/32/16/8/4/2/1), O(log n) Z3 terms.
+
+        Algorithm: at each level `shift`, inspect the top `shift` bits of cur.
+          - If zero: add `shift` to acc, slide window left to expose next band.
+          - If nonzero: isolate this band for the next level.
+        """
+        size = self._size  # 256 in standard EVM context
+
+        # --- concrete fast path ---
+        if self.is_concrete:
+            v = self._value
+            return DolmosBitVec(size if v == 0 else size - v.bit_length(), size=size)
+
+        # --- symbolic path: binary search over bit-levels ---
+        x = self.as_z3()
+        zero = BitVecVal(0, size)
+
+        acc = zero
+        cur = x
+
+        for shift in (128, 64, 32, 16, 8, 4, 2, 1):
+            top_bits = LShR(cur, BitVecVal(size - shift, size))
+            top_zero = top_bits == zero
+            acc = If(top_zero, acc + BitVecVal(shift, size), acc)
+            cur = If(
+                top_zero,
+                cur << BitVecVal(shift, size),  # expose next band at MSB
+                top_bits << BitVecVal(size - shift, size),  # keep current band aligned
+            )
+
+        # x == 0 -> every bit is a leading zero, result is `size`.
+        result = If(x == zero, BitVecVal(size, size), acc)
+        return DolmosBitVec(result, size=size)
 
     def bitwise_not(self) -> BV:
         if self.is_concrete:
-            return HalmosBitVec(~self._value & ((1 << self._size) - 1), size=self._size)
+            return DolmosBitVec(~self._value & ((1 << self._size) - 1), size=self._size)
 
-        return HalmosBitVec(~self.as_z3(), size=self.size)
+        return DolmosBitVec(~self.as_z3(), size=self.size)
 
     def bitwise_and(self, other: BV) -> BV:
         assert self._size == other._size
-        return HalmosBitVec(self._value & other._value, size=self._size)
+        return DolmosBitVec(self._value & other._value, size=self._size)
 
     def bitwise_or(self, other: BV) -> BV:
         assert self._size == other._size
-        return HalmosBitVec(self._value | other._value, size=self._size)
+        return DolmosBitVec(self._value | other._value, size=self._size)
 
     def bitwise_xor(self, other: BV) -> BV:
         assert self._size == other._size
-        return HalmosBitVec(self._value ^ other._value, size=self._size)
+        return DolmosBitVec(self._value ^ other._value, size=self._size)
 
-    def ult(self, other: BV) -> HalmosBool:
+    def ult(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if self.is_concrete and other.is_concrete:
-            return HalmosBool(self.value < other.value)
+            return DolmosBool(self.value < other.value)
 
-        return HalmosBool(ULT(self.as_z3(), other.as_z3()))
+        return DolmosBool(ULT(self.as_z3(), other.as_z3()))
 
-    def ugt(self, other: BV) -> HalmosBool:
+    def ugt(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if not self._symbolic and not other._symbolic:
             return TRUE if self.value > other.value else FALSE
 
-        return HalmosBool(UGT(self.as_z3(), other.as_z3()))
+        return DolmosBool(UGT(self.as_z3(), other.as_z3()))
 
-    def slt(self, other: BV) -> HalmosBool:
+    def slt(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if self.is_concrete and other.is_concrete:
             left = to_signed(self._value, self._size)
             right = to_signed(other._value, other._size)
-            return HalmosBool(left < right)
+            return DolmosBool(left < right)
 
-        return HalmosBool(self.as_z3() < other.as_z3())
+        return DolmosBool(self.as_z3() < other.as_z3())
 
-    def sgt(self, other: BV) -> HalmosBool:
+    def sgt(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if self.is_concrete and other.is_concrete:
             left = to_signed(self._value, self._size)
             right = to_signed(other._value, other._size)
-            return HalmosBool(left > right)
+            return DolmosBool(left > right)
 
-        return HalmosBool(self.as_z3() > other.as_z3())
+        return DolmosBool(self.as_z3() > other.as_z3())
 
-    def ule(self, other: BV) -> HalmosBool:
+    def ule(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if self.is_concrete and other.is_concrete:
-            return HalmosBool(self.value <= other.value)
+            return DolmosBool(self.value <= other.value)
 
-        return HalmosBool(ULE(self.as_z3(), other.as_z3()))
+        return DolmosBool(ULE(self.as_z3(), other.as_z3()))
 
-    def uge(self, other: BV) -> HalmosBool:
+    def uge(self, other: BV) -> DolmosBool:
         assert self._size == other._size
 
         if self.is_concrete and other.is_concrete:
-            return HalmosBool(self.value >= other.value)
+            return DolmosBool(self.value >= other.value)
 
-        return HalmosBool(UGE(self.as_z3(), other.as_z3()))
+        return DolmosBool(UGE(self.as_z3(), other.as_z3()))
 
-    def eq(self, other: BV) -> HalmosBool:
+    def eq(self, other: BV) -> DolmosBool:
         assert self._size == other._size
-        return HalmosBool(self._value == other._value)
+        return DolmosBool(self._value == other._value)
 
     def byte(self, idx: int, *, output_size: int = 8) -> BV:
         """
@@ -937,28 +982,28 @@ def byte(self, idx: int, *, output_size: int = 8) -> BV:
         assert idx >= 0
 
         if idx >= byte_length:
-            return HalmosBitVec(0, size=output_size)
+            return DolmosBitVec(0, size=output_size)
 
         if self.is_concrete:
             b = self._value.to_bytes(length=byte_length, byteorder="big")
-            return HalmosBitVec(b[idx], size=output_size)
+            return DolmosBitVec(b[idx], size=output_size)
 
         # symbolic case
         lo = (byte_length - 1 - idx) * 8
         hi = lo + 7
-        return HalmosBitVec(
+        return DolmosBitVec(
             Extract(hi, lo, self._value),
             size=output_size,
         )
 
 
 # initialize global constants
-TRUE = object.__new__(HalmosBool)
-FALSE = object.__new__(HalmosBool)
+TRUE = object.__new__(DolmosBool)
+FALSE = object.__new__(DolmosBool)
 TRUE.con_val = True
 TRUE.sym_val = None
 FALSE.con_val = False
 FALSE.sym_val = None
 
-ZERO = HalmosBitVec(0, size=256)
-ONE = HalmosBitVec(1, size=256)
+ZERO = DolmosBitVec(0, size=256)
+ONE = DolmosBitVec(1, size=256)
diff --git a/src/dolmos/build.py b/src/dolmos/build.py
new file mode 100644
index 000000000..7426990bf
--- /dev/null
+++ b/src/dolmos/build.py
@@ -0,0 +1,474 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+import json
+import os
+import posixpath
+import re
+import traceback
+
+from eth_hash.auto import keccak
+
+from dolmos.calldata import str_abi
+from dolmos.config import Config as DolmosConfig
+from dolmos.logs import PARSING_ERROR, debug, warn_code
+from dolmos.mapper import Mapper, SourceFileMap
+from dolmos.ui import ui
+
+SOLIDITY_EXTENSIONS = (".sol",)
+VYPER_EXTENSIONS = (".vy", ".vyi")
+
+# build output groups are keyed by compiler version; vyper groups get this prefix
+# so that they never collide with solc versions (e.g. vyper 0.4.3 vs solc 0.4.3)
+VYPER_VERSION_PREFIX = "vyper:"
+
+FORGE_CACHE_FILE = os.path.join("cache", "solidity-files-cache.json")
+
+
+def is_vyper_file(filename: str) -> bool:
+    return filename.endswith(VYPER_EXTENSIONS)
+
+
+def is_vyper_group(compiler_version: str) -> bool:
+    return compiler_version.startswith(VYPER_VERSION_PREFIX)
+
+
+def is_vyper_contract(contract_json: dict) -> bool:
+    return contract_json.get("language") == "vyper"
+
+
+def get_source_path(contract_json: dict, default: str | None = None) -> str | None:
+    """
+    Return the source path of a build artifact (e.g. `test/Foo.t.sol`).
+
+    solc artifacts carry it in their AST; vyper artifacts get it from the forge
+    cache during normalization (see `normalize_vyper_artifact`).
+    """
+    if path := contract_json.get("sourcePath"):
+        return path
+    try:
+        return contract_json["ast"]["absolutePath"]
+    except (KeyError, TypeError):
+        return default
+
+
+def _artifact_key(path: str) -> str:
+    """Normalize an artifact path to a platform-independent key (`/` separators)."""
+    return posixpath.normpath(path.replace("\\", "/"))
+
+
+def load_forge_cache(root: str, out_path: str) -> dict:
+    """
+    Return a mapping from artifact path (relative to the build output directory,
+    e.g. `Counter.vy/Counter.json`) to a (source path, compiler version) pair.
+
+    Vyper artifacts emitted by forge only contain the abi and the bytecode, so the
+    forge cache is the only place where the source path and compiler version live.
+    Best effort: returns an empty mapping if the cache is missing or unreadable.
+    """
+    cache_path = os.path.join(root, FORGE_CACHE_FILE)
+    result = {}
+
+    try:
+        with open(cache_path, encoding="utf8") as f:
+            cache = json.load(f)
+    except (OSError, ValueError) as err:
+        debug(f"could not read forge cache {cache_path}: {err}")
+        return result
+
+    for source_path, entry in cache.get("files", {}).items():
+        for versions in entry.get("artifacts", {}).values():
+            for version, profiles in versions.items():
+                for artifact in profiles.values():
+                    artifact_path = artifact.get("path")
+                    if not artifact_path:
+                        continue
+                    # paths are relative to the out dir; tolerate an `out/` prefix
+                    artifact_path = _artifact_key(artifact_path)
+                    out_prefix = os.path.basename(os.path.normpath(out_path)) + "/"
+                    if artifact_path.startswith(out_prefix):
+                        artifact_path = artifact_path[len(out_prefix) :]
+                    result[artifact_path] = (source_path, version)
+
+    return result
+
+
+_DOCSTRING = r'(?:"""(?P<doc>.*?)"""|\'\'\'(?P<doc2>.*?)\'\'\')'
+
+# module docstring: the first string literal of the file, possibly after comments
+# such as `# pragma version ...`
+_VYPER_MODULE_DOCSTRING = re.compile(r"\A(?:\s*#[^\n]*\n|\s+)*" + _DOCSTRING, re.DOTALL)
+
+# function docstring: first string literal right after the (possibly multiline) signature
+_VYPER_FUNCTION_DOCSTRING = re.compile(
+    r"^[ \t]*def[ \t]+(?P<name>\w+)[ \t]*\((?:[^()]|\([^()]*\))*\)"
+    r"(?:[ \t]*->[^:\n]+)?[ \t]*:[ \t]*(?:#[^\n]*)?\n\s*" + _DOCSTRING,
+    re.DOTALL | re.MULTILINE,
+)
+
+
+def _docstring_text(match: re.Match) -> str:
+    return match.group("doc") if match.group("doc") is not None else match.group("doc2")
+
+
+def parse_vyper_docstrings(source: str) -> tuple[str | None, dict[str, str]]:
+    """
+    Extract the module docstring and the per-function docstrings of a vyper source.
+
+    Returns (module docstring or None, function name -> docstring).
+    """
+    module_doc = None
+    if match := _VYPER_MODULE_DOCSTRING.match(source):
+        module_doc = _docstring_text(match)
+
+    function_docs = {}
+    for match in _VYPER_FUNCTION_DOCSTRING.finditer(source):
+        function_docs.setdefault(match.group("name"), _docstring_text(match))
+
+    return module_doc, function_docs
+
+
+def normalize_vyper_artifact(
+    json_out: dict, dirname: str, root: str, cache_entry
+) -> tuple[str, str, dict | None]:
+    """
+    Bring a forge vyper artifact into the shape that dolmos expects from solc artifacts.
+
+    forge only emits `abi`, `bytecode`, `deployedBytecode`, an empty `methodIdentifiers`
+    and an `id` for vyper, so we fill in:
+    - `methodIdentifiers`, computed from the abi
+    - `bytecode.linkReferences` (vyper has no libraries)
+    - `metadata.compiler.version` and `metadata.output.devdoc` (for `@custom:dolmos`)
+    - `sourcePath` and `language`
+
+    Returns (contract type, compiler version group key, natspec).
+    """
+    source_path, version = cache_entry if cache_entry else (dirname, "unknown")
+
+    json_out["language"] = "vyper"
+    json_out["sourcePath"] = source_path
+
+    if not json_out.get("methodIdentifiers"):
+        json_out["methodIdentifiers"] = {
+            (sig := str_abi(item)): keccak(sig.encode()).hex()[:8]
+            for item in json_out.get("abi", [])
+            if item.get("type") == "function"
+        }
+
+    for key in ("bytecode", "deployedBytecode"):
+        entry = json_out.get(key)
+        if isinstance(entry, str):
+            entry = {"object": entry}
+        entry = entry or {"object": "0x"}
+        entry.setdefault("object", "0x")
+        entry.setdefault("linkReferences", {})
+        json_out[key] = entry
+
+    # vyper modules are always contracts, .vyi files are always interfaces
+    contract_type = "interface" if dirname.endswith(".vyi") else "contract"
+
+    # `@custom:dolmos` annotations live in docstrings; forge does not give us the
+    # devdoc for vyper, so read them straight from the source
+    natspec = None
+    devdoc_methods = {}
+    try:
+        with open(os.path.join(root, source_path), encoding="utf8") as f:
+            module_doc, function_docs = parse_vyper_docstrings(f.read())
+
+        if module_doc:
+            natspec = {"text": module_doc}
+
+        for funsig in json_out["methodIdentifiers"]:
+            doc = function_docs.get(funsig.split("(")[0])
+            if doc and (options := parse_natspec({"text": doc})):
+                devdoc_methods[funsig] = {"custom:dolmos": options}
+    except OSError as err:
+        debug(f"could not read vyper source {source_path}: {err}")
+
+    metadata = json_out.setdefault("metadata", {})
+    metadata.setdefault("compiler", {}).setdefault("version", version)
+    metadata.setdefault("output", {}).setdefault("devdoc", {}).setdefault(
+        "methods", {}
+    ).update(devdoc_methods)
+
+    return contract_type, VYPER_VERSION_PREFIX + version, natspec
+
+
+def get_contract_type(
+    ast_nodes: list, contract_name: str
+) -> tuple[str | None, str | None]:
+    for node in ast_nodes:
+        if node["nodeType"] == "ContractDefinition" and node["name"] == contract_name:
+            abstract = "abstract " if node.get("abstract") else ""
+            contract_type = abstract + node["contractKind"]
+            natspec = node.get("documentation")
+            return contract_type, natspec
+
+    return None, None
+
+
+def parse_build_out(args: DolmosConfig) -> dict:
+    result = {}  # compiler version -> source filename -> contract name -> (json, type)
+
+    coverage_output = args.coverage_output
+    root = args.root
+
+    if coverage_output:
+        SourceFileMap().set_root(root)
+
+    out_path = os.path.join(root, args.forge_build_out)
+    if not os.path.exists(out_path):
+        raise FileNotFoundError(
+            f"The build output directory `{out_path}` does not exist"
+        )
+
+    ui.update_status(f"Parsing {out_path}")
+
+    # only needed for vyper artifacts, loaded lazily
+    forge_cache = None
+
+    for sol_dirname in os.listdir(out_path):  # for each source filename
+        if not sol_dirname.endswith(SOLIDITY_EXTENSIONS + VYPER_EXTENSIONS):
+            continue
+
+        sol_path = os.path.join(out_path, sol_dirname)
+        if not os.path.isdir(sol_path):
+            continue
+
+        for json_filename in os.listdir(sol_path):  # for each contract name
+            try:
+                if not json_filename.endswith(".json"):
+                    continue
+                if json_filename.startswith("."):
+                    continue
+
+                json_path = os.path.join(sol_path, json_filename)
+                with open(json_path, encoding="utf8") as f:
+                    json_out = json.load(f)
+
+                # cut off compiler version number as well
+                contract_name = json_filename.split(".")[0]
+
+                if is_vyper_file(sol_dirname):
+                    if forge_cache is None:
+                        forge_cache = load_forge_cache(root, out_path)
+
+                    cache_entry = forge_cache.get(
+                        _artifact_key(f"{sol_dirname}/{json_filename}")
+                    )
+                    contract_type, compiler_version, natspec = normalize_vyper_artifact(
+                        json_out, sol_dirname, root, cache_entry
+                    )
+
+                    # note: coverage is not supported for vyper (no source maps),
+                    # and vyper file ids would clash with solc ones
+                    add_to_build_out(
+                        result,
+                        compiler_version,
+                        sol_dirname,
+                        contract_name,
+                        (json_out, contract_type, natspec),
+                    )
+                    parse_symbols(
+                        args, result[compiler_version][sol_dirname], contract_name
+                    )
+                    continue
+
+                ast = json_out["ast"]
+
+                if coverage_output:
+                    # record the mapping between file id and file path
+                    SourceFileMap().add_mapping(json_out["id"], ast["absolutePath"])
+
+                ast_nodes = ast["nodes"]
+                contract_type, natspec = get_contract_type(ast_nodes, contract_name)
+
+                # can happen to solidity files for multiple reasons:
+                # - import only (like console2.log)
+                # - defines only structs or enums
+                # - defines only free functions
+                # - ...
+                if contract_type is None:
+                    debug(f"Skipped {json_filename}, no contract definition found")
+                    continue
+
+                compiler_version = json_out["metadata"]["compiler"]["version"]
+                add_to_build_out(
+                    result,
+                    compiler_version,
+                    sol_dirname,
+                    contract_name,
+                    (json_out, contract_type, natspec),
+                )
+                parse_symbols(
+                    args, result[compiler_version][sol_dirname], contract_name
+                )
+
+            except Exception as err:
+                warn_code(
+                    PARSING_ERROR,
+                    f"Skipped {json_filename} due to parsing failure: {type(err).__name__}: {err}",
+                )
+                if args.debug:
+                    traceback.print_exc()
+                continue
+
+    ui.stop_status()
+    return result
+
+
+def add_to_build_out(
+    result: dict, compiler_version: str, filename: str, contract_name: str, entry
+) -> None:
+    contract_map = result.setdefault(compiler_version, {}).setdefault(filename, {})
+
+    if contract_name in contract_map:
+        raise ValueError(
+            "duplicate contract names in the same file",
+            contract_name,
+            filename,
+        )
+
+    contract_map[contract_name] = entry
+
+
+def parse_symbols(args: DolmosConfig, contract_map: dict, contract_name: str) -> None:
+    try:
+        json_out = contract_map[contract_name][0]
+
+        # workaround: solx does not emit bytecode at all for library contracts
+        # default to an empty object to emulate solc behavior
+        bytecode = json_out.get("bytecode", {"object": "0x"})["object"]
+        contract_mapping_info = Mapper().get_or_create(contract_name)
+        contract_mapping_info.bytecode = bytecode
+
+        # vyper artifacts have no (solc-style) ast
+        if "ast" in json_out:
+            Mapper().parse_ast(json_out["ast"])
+
+    except Exception:
+        debug(f"error parsing symbols for contract {contract_name}")
+        debug(traceback.format_exc())
+
+        # we parse symbols as best effort, don't propagate exceptions
+        pass
+
+
+# natspec tags carrying command line options; @custom:halmos is still accepted so
+# that test suites written for halmos keep working unchanged
+NATSPEC_TAGS = ("dolmos", "halmos")
+
+
+def parse_devdoc(funsig: str, contract_json: dict) -> str | None:
+    try:
+        method_doc = contract_json["metadata"]["output"]["devdoc"]["methods"][funsig]
+    except KeyError:
+        return None
+
+    values = [
+        method_doc[f"custom:{tag}"]
+        for tag in NATSPEC_TAGS
+        if f"custom:{tag}" in method_doc
+    ]
+    return " ".join(values) if values else None
+
+
+def parse_natspec(natspec: dict) -> str:
+    # This parsing scheme is designed to handle:
+    #
+    # - multiline tags:
+    #   /// @custom:dolmos --x
+    #   ///                --y
+    #
+    # - multiple tags:
+    #   /// @custom:dolmos --x
+    #   /// @custom:dolmos --y
+    #
+    # - tags that start in the middle of line:
+    #   /// blah blah @custom:dolmos --x
+    #   /// --y
+    #
+    # In all the above examples, this scheme returns "--x (whitespaces) --y"
+    # (@custom:halmos is accepted as well, see NATSPEC_TAGS)
+    tags = {f"@custom:{tag}" for tag in NATSPEC_TAGS}
+    is_options_tag = False
+    result = ""
+    for item in re.split(r"(@\S+)", natspec.get("text", "")):
+        if item in tags:
+            is_options_tag = True
+        elif re.match(r"^@\S", item):
+            is_options_tag = False
+        elif is_options_tag:
+            result += item
+    return result.strip()
+
+
+def import_libs(build_out_map: dict, hexcode: str, linkReferences: dict) -> dict:
+    libs = {}
+
+    for filepath in linkReferences:
+        file_name = filepath.split("/")[-1]
+
+        for lib_name in linkReferences[filepath]:
+            (lib_json, _, _) = build_out_map[file_name][lib_name]
+            lib_hexcode = lib_json["deployedBytecode"]["object"]
+
+            # in bytes, multiply indices by 2 and offset 0x
+            placeholder_index = linkReferences[filepath][lib_name][0]["start"] * 2 + 2
+            placeholder = hexcode[placeholder_index : placeholder_index + 40]
+
+            libs[f"{filepath}:{lib_name}"] = {
+                "placeholder": placeholder,
+                "hexcode": lib_hexcode,
+            }
+
+    return libs
+
+
+def has_vyper_contracts(build_out: dict) -> bool:
+    return any(is_vyper_group(version) for version in build_out)
+
+
+def build_out_view(build_out: dict, compiler_version: str) -> dict:
+    """
+    Return the build output map visible to test contracts of the given group.
+
+    Test contracts normally only see contracts compiled with the same compiler version
+    (e.g. for library linking and bytecode lookups). Cross-language setups are common
+    though (solidity tests for vyper contracts, and vice versa), so:
+    - solidity groups also see every vyper contract
+    - vyper groups see every vyper contract, and the solidity contracts if there is
+      a single solc version (otherwise the lookup would be ambiguous)
+
+    Solidity and vyper filenames can't collide since they have different extensions.
+    """
+    own = build_out[compiler_version]
+    vyper_groups = [v for v in build_out if is_vyper_group(v)]
+    solc_groups = [v for v in build_out if not is_vyper_group(v)]
+
+    if is_vyper_group(compiler_version):
+        shared = [v for v in vyper_groups if v != compiler_version]
+        if len(solc_groups) == 1:
+            shared += solc_groups
+    else:
+        shared = vyper_groups
+
+    if not shared:
+        return own
+
+    view = dict(own)
+    for version in sorted(shared):
+        for filename, contracts in build_out[version].items():
+            view.setdefault(filename, contracts)
+    return view
+
+
+def build_output_iterator(build_out: dict):
+    for compiler_version in sorted(build_out):
+        build_out_map = build_out[compiler_version]
+
+        # computed once per group, so that the BuildOut singleton can cache it
+        view = build_out_view(build_out, compiler_version)
+
+        for filename in sorted(build_out_map):
+            for contract_name in sorted(build_out_map[filename]):
+                yield (view, filename, contract_name)
diff --git a/src/halmos/bytevec.py b/src/dolmos/bytevec.py
similarity index 99%
rename from src/halmos/bytevec.py
rename to src/dolmos/bytevec.py
index a84d069ae..258de25ff 100644
--- a/src/halmos/bytevec.py
+++ b/src/dolmos/bytevec.py
@@ -7,9 +7,9 @@
 from sortedcontainers import SortedDict
 from z3 import BitVecRef, If, eq, is_bool, is_bv, is_bv_value, simplify, substitute
 
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.logs import warn
-from halmos.utils import (
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.logs import warn
+from dolmos.utils import (
     Byte,
     Word,
     bv_value_to_bytes,
diff --git a/src/halmos/calldata.py b/src/dolmos/calldata.py
similarity index 97%
rename from src/halmos/calldata.py
rename to src/dolmos/calldata.py
index 8d35cd4cc..08f37fb48 100644
--- a/src/halmos/calldata.py
+++ b/src/dolmos/calldata.py
@@ -10,10 +10,10 @@
     BitVecRef,
 )
 
-from halmos.bytevec import ByteVec
-from halmos.config import Config as HalmosConfig
-from halmos.logs import debug_once
-from halmos.utils import con, uid
+from dolmos.bytevec import ByteVec
+from dolmos.config import Config as DolmosConfig
+from dolmos.logs import debug_once
+from dolmos.utils import con, uid
 
 
 @dataclass(frozen=True)
@@ -108,7 +108,7 @@ class Calldata:
     # For dynamic parameters not explicitly listed in --array-lengths, default sizes are used:
     # - For dynamic arrays: the size ranges from 0 to the value of --loop (inclusive).
     # - For bytes or strings: the size candidates are given by --default-bytes-lengths.
-    args: HalmosConfig
+    args: DolmosConfig
 
     # `dyn_params` will be updated to include the fully resolved size information for all dynamic parameters.
     dyn_params: list[DynamicParam]
@@ -119,7 +119,7 @@ class Calldata:
 
     def __init__(
         self,
-        args: HalmosConfig,
+        args: DolmosConfig,
         new_symbol_id: Callable | None,
     ) -> None:
         self.args = args
@@ -329,7 +329,7 @@ def get_abi(contract_json: dict) -> dict:
 def mk_calldata(
     abi: dict,
     fun_info: FunctionInfo,
-    args: HalmosConfig,
+    args: DolmosConfig,
     new_symbol_id: Callable = None,
 ) -> tuple[ByteVec, list[DynamicParam]]:
     return Calldata(args, new_symbol_id).create(abi, fun_info)
diff --git a/src/halmos/cheatcodes.py b/src/dolmos/cheatcodes.py
similarity index 86%
rename from src/halmos/cheatcodes.py
rename to src/dolmos/cheatcodes.py
index 73452180e..eb0f0b316 100644
--- a/src/halmos/cheatcodes.py
+++ b/src/dolmos/cheatcodes.py
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0
 
 import json
+import os
 import re
 from contextlib import suppress
 from dataclasses import dataclass
@@ -25,27 +26,34 @@
     unsat,
 )
 
-from halmos import env
-from halmos.assertions import assert_cheatcode_handler
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bitvec import HalmosBool as Bool
-from halmos.bytevec import ByteVec
-from halmos.calldata import (
+from dolmos import env
+from dolmos.assertions import assert_cheatcode_handler
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bitvec import DolmosBool as Bool
+from dolmos.bytevec import ByteVec
+from dolmos.calldata import (
     FunctionInfo,
     get_abi,
     mk_calldata,
 )
-from halmos.constants import MAX_MEMORY_SIZE
-from halmos.exceptions import (
+from dolmos.constants import MAX_MEMORY_SIZE
+from dolmos.exceptions import (
+    DolmosException,
     FailCheatcode,
-    HalmosException,
     InfeasiblePath,
     NotConcreteError,
     OutOfGasError,
 )
-from halmos.logs import debug
-from halmos.mapper import BuildOut
-from halmos.utils import (
+from dolmos.expectations import (
+    EMIT_SIGNATURES,
+    REVERT_SIGNATURES,
+    parse_expect_emit,
+    parse_expect_revert,
+)
+from dolmos.fs import parse_hex_bytes, read_file
+from dolmos.logs import debug
+from dolmos.mapper import BuildOut
+from dolmos.utils import (
     Address,
     BitVecSort8,
     BitVecSort160,
@@ -194,7 +202,7 @@ def lookup(self, to: BV) -> PrankResult:
         """
 
         assert_address(to)
-        if self and to not in [halmos_cheat_code.address, hevm_cheat_code.address]:
+        if self and to not in [svm_cheat_code.address, hevm_cheat_code.address]:
             result = self.active
             if not self.keep:
                 self.stopPrank()
@@ -231,7 +239,7 @@ def symbolic_storage(ex, arg, sevm, stack):
 
     if account_alias is None:
         error_msg = f"enableSymbolicStorage() or setArbitraryStorage() is not allowed for a nonexistent account: {hexify(account)}"
-        raise HalmosException(error_msg)
+        raise DolmosException(error_msg)
 
     ex.storage[account_alias].symbolic = True
 
@@ -246,7 +254,7 @@ def snapshot_storage(ex, arg, sevm, stack):
 
     if account_alias is None:
         error_msg = f"snapshotStorage() is not allowed for a nonexistent account: {hexify(account)}"
-        raise HalmosException(error_msg)
+        raise DolmosException(error_msg)
 
     zero_pad = b"\x00" * 16
     return ByteVec(zero_pad + ex.storage[account_alias].digest())
@@ -299,10 +307,10 @@ def _get_contract_name(ex, arg) -> tuple[str | None, str | None]:
     )
 
     if not (code := ex.code.get(addr)):
-        raise HalmosException(f"createCalldata: not contract account: {hexify(addr)}")
+        raise DolmosException(f"createCalldata: not contract account: {hexify(addr)}")
 
     if not (contract_name := code.contract_name):
-        raise HalmosException(
+        raise DolmosException(
             f"createCalldata: couldn't find the contract name for: {hexify(addr)}"
         )
 
@@ -436,14 +444,14 @@ def create_generic(ex, bits: int, var_name: str, type_name: str) -> BitVecRef |
     if not bits:
         return ByteVec()
 
-    label = f"halmos_{var_name}_{type_name}_{uid()}_{ex.new_symbol_id():>02}"
+    label = f"dolmos_{var_name}_{type_name}_{uid()}_{ex.new_symbol_id():>02}"
     return BitVec(label, BitVecSorts[bits])
 
 
 def create_uint(ex, arg, name: str | None = None, **kwargs):
     bits = int_of(arg.get_word(4), "symbolic bit size for svm.createUint()")
     if bits > 256:
-        raise HalmosException(f"bitsize larger than 256: {bits}")
+        raise DolmosException(f"bitsize larger than 256: {bits}")
 
     name = name or name_of(extract_string_argument(arg, 1))
     return ByteVec(uint256(create_generic(ex, bits, name, f"uint{bits}")))
@@ -457,7 +465,7 @@ def create_uint256(ex, arg, name: str | None = None, **kwargs):
 def create_int(ex, arg, name: str | None = None, **kwargs):
     bits = int_of(extract_word(arg, 4), "symbolic bit size for svm.createUint()")
     if bits > 256:
-        raise HalmosException(f"bitsize larger than 256: {bits}")
+        raise DolmosException(f"bitsize larger than 256: {bits}")
 
     name = name or name_of(extract_string_argument(arg, 1))
     return ByteVec(int256(create_generic(ex, bits, name, f"int{bits}")))
@@ -521,7 +529,7 @@ def create_uint256_min_max(ex, arg, name: str | None = None, **kwargs):
     symbolic_value = create_generic(ex, 256, name, "uint256")
 
     if min_value > max_value:
-        raise HalmosException(f"expected min={min_value} <= max={max_value}")
+        raise DolmosException(f"expected min={min_value} <= max={max_value}")
 
     # Add constraints for the symbolic value to be within the specified range
     min_condition = simplify(UGE(symbolic_value, min_value))
@@ -595,6 +603,44 @@ def env_int(arg, **kwargs):
     return ByteVec(int_val)
 
 
+def concrete_string_argument(arg, arg_idx: int, cheatcode: str) -> str:
+    value = extract_string_argument(arg, arg_idx)
+    if not isinstance(value, str):
+        raise NotConcreteError(f"{cheatcode}: expected a concrete string, got {value}")
+    return value
+
+
+def read_file_cheatcode(sevm, arg) -> ByteVec:
+    """vm.readFile(string path) returns (string)"""
+    path = concrete_string_argument(arg, 0, "vm.readFile")
+    data = read_file(sevm.options.root, path, "vm.readFile")
+    try:
+        # like foundry, reject files that are not valid utf-8 text
+        data.decode("utf-8")
+    except UnicodeDecodeError as e:
+        msg = f"vm.readFile: {path} is not valid UTF-8 (use vm.readFileBinary): {e}"
+        raise DolmosException(msg) from e
+    return encode_tuple_bytes(data)
+
+
+def read_file_binary_cheatcode(sevm, arg) -> ByteVec:
+    """vm.readFileBinary(string path) returns (bytes)"""
+    path = concrete_string_argument(arg, 0, "vm.readFileBinary")
+    return encode_tuple_bytes(read_file(sevm.options.root, path, "vm.readFileBinary"))
+
+
+def parse_bytes_cheatcode(arg) -> ByteVec:
+    """vm.parseBytes(string) returns (bytes)"""
+    value = concrete_string_argument(arg, 0, "vm.parseBytes")
+    return encode_tuple_bytes(parse_hex_bytes(value, "vm.parseBytes"))
+
+
+def project_root_cheatcode(sevm) -> ByteVec:
+    """vm.projectRoot() returns (string)"""
+    root = os.path.abspath(sevm.options.root)
+    return encode_tuple_bytes(root.encode("utf-8"))
+
+
 def abi_encode_array_words(values: list[Bool | Address | Word]) -> ByteVec:
     result = ByteVec()
 
@@ -875,7 +921,7 @@ def apply_vmaddr(ex, private_key: Word):
     return addr
 
 
-class halmos_cheat_code:
+class svm_cheat_code:
     # address constant SVM_ADDRESS =
     #     address(bytes20(uint160(uint256(keccak256('svm cheat code')))));
     address = BV(0xF3993A62377BCD56AE39D773740A5390411E8BC9, size=160)
@@ -905,13 +951,13 @@ class halmos_cheat_code:
 
     @staticmethod
     def handle(sevm, ex, arg: ByteVec, stack) -> list[BitVecRef]:
-        funsig = int_of(extract_funsig(arg), "symbolic halmos cheatcode")
-        if handler := halmos_cheat_code.handlers.get(funsig):
+        funsig = int_of(extract_funsig(arg), "symbolic svm cheatcode")
+        if handler := svm_cheat_code.handlers.get(funsig):
             result = handler(ex, arg, sevm=sevm, stack=stack)
             return result if isinstance(result, list) else [result]
 
-        error_msg = f"Unknown halmos cheat code: function selector = 0x{funsig:0>8x}, calldata = {hexify(arg)}"
-        raise HalmosException(error_msg)
+        error_msg = f"Unknown svm cheat code: function selector = 0x{funsig:0>8x}, calldata = {hexify(arg)}"
+        raise DolmosException(error_msg)
 
 
 class hevm_cheat_code:
@@ -958,6 +1004,21 @@ class hevm_cheat_code:
     # bytes4(keccak256("deal(address,uint256)"))
     deal_sig: int = 0xC88A5E6D
 
+    # bytes4(keccak256("getNonce(address)"))
+    get_nonce_sig: int = 0x2D0335AB
+
+    # bytes4(keccak256("getNonce((address,uint256,uint256,uint256))"))
+    get_nonce_wallet_sig: int = 0xA5748AAD
+
+    # bytes4(keccak256("setNonce(address,uint64)"))
+    set_nonce_sig: int = 0xF8E18B57
+
+    # bytes4(keccak256("setNonceUnsafe(address,uint64)"))
+    set_nonce_unsafe_sig: int = 0x9B67B21C
+
+    # bytes4(keccak256("resetNonce(address)"))
+    reset_nonce_sig: int = 0x1C72346D
+
     # bytes4(keccak256("store(address,bytes32,bytes32)"))
     store_sig: int = 0x70CA10BB
 
@@ -1099,6 +1160,18 @@ class hevm_cheat_code:
     # bytes4(keccak256("envExists(string)"))
     env_exists_sig: int = 0xCE8365F9
 
+    # bytes4(keccak256("readFile(string)"))
+    read_file_sig: int = 0x60F9BB11
+
+    # bytes4(keccak256("readFileBinary(string)"))
+    read_file_binary_sig: int = 0x16ED7BC4
+
+    # bytes4(keccak256("parseBytes(string)"))
+    parse_bytes_sig: int = 0x8F5D232D
+
+    # bytes4(keccak256("projectRoot()"))
+    project_root_sig: int = 0xD930A0E6
+
     @staticmethod
     def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
         funsig: int = int_of(arg[:4].unwrap(), "symbolic hevm cheatcode")
@@ -1134,9 +1207,17 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             path_len = arg.get_word(36)
             path = arg[68 : 68 + path_len].unwrap().decode("utf-8")
 
+            out_dir = sevm.options.forge_build_out
             if ":" in path:
+                # `File.sol:Name`, `path/to/File.vy:Name`
                 [filename, contract_name] = path.split(":")
-                path = "out/" + filename + "/" + contract_name + ".json"
+                filename = os.path.basename(filename)
+                path = f"{out_dir}/{filename}/{contract_name}.json"
+            elif path.endswith((".sol", ".vy")):
+                # `File.sol`, `path/to/File.vy`: the contract named after the file
+                filename = os.path.basename(path)
+                contract_name = filename.rsplit(".", 1)[0]
+                path = f"{out_dir}/{filename}/{contract_name}.json"
 
             target = sevm.options.root.rstrip("/")
             path = target + "/" + path
@@ -1156,7 +1237,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             sender = uint160(arg.get_word(4)).as_z3()
             result = ex.context.prank.prank(sender)
             if not result:
-                raise HalmosException(
+                raise DolmosException(
                     "can not call vm.prank(address) with an active prank"
                 )
             return ret
@@ -1167,7 +1248,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             origin = uint160(arg.get_word(36)).as_z3()
             result = ex.context.prank.prank(sender, origin)
             if not result:
-                raise HalmosException(
+                raise DolmosException(
                     "can not call vm.prank(address, address) with an active prank"
                 )
             return ret
@@ -1177,7 +1258,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             address = uint160(arg.get_word(4)).as_z3()
             result = ex.context.prank.startPrank(address)
             if not result:
-                raise HalmosException(
+                raise DolmosException(
                     "can not call vm.startPrank(address) with an active prank"
                 )
             return ret
@@ -1188,7 +1269,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             origin = uint160(arg.get_word(36)).as_z3()
             result = ex.context.prank.startPrank(sender, origin)
             if not result:
-                raise HalmosException(
+                raise DolmosException(
                     "can not call vm.startPrank(address, address) with an active prank"
                 )
             return ret
@@ -1205,6 +1286,63 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
             ex.balance_update(who, amount)
             return ret
 
+        # vm.getNonce(address) / vm.getNonce(Wallet)
+        elif funsig in (
+            hevm_cheat_code.get_nonce_sig,
+            hevm_cheat_code.get_nonce_wallet_sig,
+        ):
+            # Wallet is a static struct, its first field is the address
+            who = uint160(arg.get_word(4)).as_z3()
+            return ByteVec(con(ex.nonce_of(who)))
+
+        # vm.setNonce(address,uint64) / vm.setNonceUnsafe(address,uint64)
+        elif funsig in (
+            hevm_cheat_code.set_nonce_sig,
+            hevm_cheat_code.set_nonce_unsafe_sig,
+        ):
+            unsafe = funsig == hevm_cheat_code.set_nonce_unsafe_sig
+            name = "setNonceUnsafe" if unsafe else "setNonce"
+
+            who = uint160(arg.get_word(4))
+            if not who.is_concrete:
+                error_msg = f"vm.{name}(address who, uint64 nonce) must have concrete argument `who` but received {who}"
+                raise DolmosException(error_msg)
+
+            nonce = int_of(arg.get_word(36), f"symbolic nonce in vm.{name}()")
+            if not (0 <= nonce < 2**64):
+                raise DolmosException(
+                    f"vm.{name}(): nonce out of uint64 range: {nonce}"
+                )
+
+            who = who.as_z3()
+            current = ex.nonce_of(who)
+
+            # vm.setNonce() can only increase the nonce, as in foundry
+            if not unsafe and nonce < current:
+                error_msg = (
+                    f"vm.setNonce(): the new nonce ({nonce}) must be greater than or equal to "
+                    f"the current nonce ({current}) of {hexify(who)}; "
+                    f"use vm.setNonceUnsafe() to decrease it"
+                )
+                raise DolmosException(error_msg)
+
+            ex.set_nonce(who, nonce)
+            return ret
+
+        # vm.resetNonce(address)
+        elif funsig == hevm_cheat_code.reset_nonce_sig:
+            who = uint160(arg.get_word(4))
+            if not who.is_concrete:
+                error_msg = f"vm.resetNonce(address who) must have concrete argument `who` but received {who}"
+                raise DolmosException(error_msg)
+
+            who = who.as_z3()
+
+            # 0 for EOAs, 1 for contract accounts
+            code = ex.code.get(who)
+            ex.set_nonce(who, 1 if code is not None and len(code) > 0 else 0)
+            return ret
+
         # vm.store(address,bytes32,bytes32)
         elif funsig == hevm_cheat_code.store_sig:
             if arg == hevm_cheat_code.fail_payload:
@@ -1221,7 +1359,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
 
             if store_account_alias is None:
                 error_msg = f"vm.store() is not allowed for a nonexistent account: {hexify(store_account)}"
-                raise HalmosException(error_msg)
+                raise DolmosException(error_msg)
 
             store_slot = uint256(arg.get_word(36))
             store_value = uint256(arg.get_word(68))
@@ -1281,7 +1419,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
 
             if not who.is_concrete:
                 error_msg = f"vm.etch(address who, bytes code) must have concrete argument `who` but received {who}"
-                raise HalmosException(error_msg)
+                raise DolmosException(error_msg)
 
             # code must be concrete
             code_offset = int_of(arg.get_word(36), "symbolic code offset")
@@ -1307,7 +1445,7 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
         elif funsig == hevm_cheat_code.ffi_sig:
             if not sevm.options.ffi:
                 error_msg = "ffi cheatcode is disabled. Run again with `--ffi` if you want to enable it"
-                raise HalmosException(error_msg)
+                raise DolmosException(error_msg)
 
             cmd = extract_string_array_argument(arg, 0)
 
@@ -1538,11 +1676,37 @@ def handle(sevm, ex, arg: ByteVec, stack) -> ByteVec | None:
         elif funsig == hevm_cheat_code.env_exists_sig:
             return env_exists(arg)
 
+        # vm.readFile(string) returns (string)
+        elif funsig == hevm_cheat_code.read_file_sig:
+            return read_file_cheatcode(sevm, arg)
+
+        # vm.readFileBinary(string) returns (bytes)
+        elif funsig == hevm_cheat_code.read_file_binary_sig:
+            return read_file_binary_cheatcode(sevm, arg)
+
+        # vm.parseBytes(string) returns (bytes)
+        elif funsig == hevm_cheat_code.parse_bytes_sig:
+            return parse_bytes_cheatcode(arg)
+
+        # vm.projectRoot() returns (string)
+        elif funsig == hevm_cheat_code.project_root_sig:
+            return project_root_cheatcode(sevm)
+
+        # vm.expectRevert(...) / vm.expectPartialRevert(...)
+        elif funsig in REVERT_SIGNATURES:
+            ex.context.expectations.expect_revert(parse_expect_revert(funsig, arg))
+            return ret
+
+        # vm.expectEmit(...) / vm.expectEmitAnonymous(...)
+        elif funsig in EMIT_SIGNATURES:
+            ex.context.expectations.expect_emit(parse_expect_emit(funsig, arg))
+            return ret
+
         elif funsig in dict_of_unsupported_cheatcodes:
             msg = f"Unsupported cheat code: {dict_of_unsupported_cheatcodes[funsig]}"
-            raise HalmosException(msg)
+            raise DolmosException(msg)
 
         else:
             # TODO: support other cheat codes
             msg = f"Unsupported cheat code: calldata = {hexify(arg)}"
-            raise HalmosException(msg)
+            raise DolmosException(msg)
diff --git a/src/halmos/config.py b/src/dolmos/config.py
similarity index 86%
rename from src/halmos/config.py
rename to src/dolmos/config.py
index ff9cde8ff..b2e3b9e73 100644
--- a/src/halmos/config.py
+++ b/src/dolmos/config.py
@@ -15,9 +15,9 @@
 
 import toml
 
-from halmos.logs import warn
-from halmos.solvers import SOLVERS, get_solver_command
-from halmos.utils import parse_time
+from dolmos.logs import warn
+from dolmos.solvers import SOLVERS, get_solver_command
+from dolmos.utils import parse_time
 
 # common strings
 internal = "internal"
@@ -45,13 +45,13 @@ class ConfigSource(IntEnum):
     # default value, lowest precedence
     default = 1
 
-    # e.g. halmos.toml
+    # e.g. dolmos.toml
     config_file = 2
 
-    # contract-level annotation (e.g. @custom:halmos --some-option)
+    # contract-level annotation (e.g. @custom:dolmos --some-option)
     contract_annotation = 3
 
-    # function-level annotation (e.g. @custom:halmos --some-option)
+    # function-level annotation (e.g. @custom:dolmos --some-option)
     function_annotation = 4
 
     # from command line, highest precedence
@@ -69,6 +69,7 @@ def arg(
     countable: bool = False,
     global_default_str: str | None = None,
     action: Callable = None,
+    extra_names: list[str] | None = None,
 ):
     return dataclass_field(
         default=None,
@@ -79,6 +80,7 @@ def arg(
             "group": group,
             "choices": choices,
             "short": short,
+            "extra_names": extra_names or [],
             "countable": countable,
             "global_default_str": global_default_str,
             "action": action,
@@ -86,6 +88,21 @@ def arg(
     )
 
 
+def split_command(command: str, windows: bool = os.name == "nt") -> list[str]:
+    """
+    Split a command line into its arguments, like a POSIX shell.
+
+    On Windows, backslashes are path separators rather than escape characters
+    (`C:\\solvers\\yices-smt2.exe` must stay intact); quotes still group words.
+    """
+    if not windows:
+        return shlex.split(command)
+    lexer = shlex.shlex(command, posix=True)
+    lexer.whitespace_split = True
+    lexer.escape = ""
+    return list(lexer)
+
+
 def ensure_non_empty(values: list | set | dict) -> list:
     if not values:
         raise ValueError("required a non-empty list")
@@ -211,7 +228,7 @@ def unparse(values: dict[str, list[int]]) -> str:
 # TODO: add kw_only=True when we support Python>=3.10
 @dataclass(frozen=True)
 class Config:
-    """Configuration object for halmos.
+    """Configuration object for dolmos.
 
     Don't instantiate this directly, since all fields have default value None. Instead, use:
 
@@ -259,8 +276,8 @@ class Config:
     config: str = arg(
         help="path to the config file",
         metavar="FILE",
-        global_default=lambda: os.path.join(os.getcwd(), "halmos.toml"),
-        global_default_str="ROOT/halmos.toml",
+        global_default=lambda: os.path.join(os.getcwd(), "dolmos.toml"),
+        global_default_str="ROOT/dolmos.toml",
     )
 
     contract: str = arg(
@@ -287,6 +304,7 @@ class Config:
         global_default="",
         metavar="FUNCTION_NAME_REGEX",
         short="mt",
+        extra_names=["-test"],
     )
 
     panic_error_codes: str = arg(
@@ -296,6 +314,11 @@ class Config:
         action=ParseErrorCodes,
     )
 
+    invalid_as_failure: bool = arg(
+        help="treat the INVALID opcode (0xFE) as a test failure, like a Panic(0x01) revert. This is how Vyper compiles `assert ..., UNREACHABLE` (and how solc < 0.8 compiles `assert`). Enabled by default when the build output contains Vyper contracts.",
+        global_default=False,
+    )
+
     invariant_depth: int = arg(
         help="set depth for invariant testing (length of the stateful sequence of calls)",
         global_default=2,
@@ -308,6 +331,29 @@ class Config:
         metavar="MAX_BOUND",
     )
 
+    dump_lassos: str = arg(
+        help="when the loop unrolling bound is reached, export the loop as a lasso program (PaSTTeL JSON format) in the given directory",
+        global_default=None,
+        metavar="LASSO_DIR",
+    )
+
+    pasttel: str = arg(
+        help="path to the PaSTTeL binary: run the termination analysis on each exported lasso (requires --dump-lassos)",
+        global_default=None,
+        metavar="PASTTEL_BINARY",
+    )
+
+    lasso_exact_constants: bool = arg(
+        help="encode wrap-arounds exactly in exported lassos, with 2^256 constants (for termination tools with exact arithmetic; PaSTTeL needs the default small-constants encoding)",
+        global_default=False,
+    )
+
+    pasttel_timeout: int = arg(
+        help="time limit in seconds for each PaSTTeL run",
+        global_default=30,
+        metavar="SECONDS",
+    )
+
     width: int = arg(
         help="set the max number of paths; 0 means unlimited",
         global_default=0,
@@ -342,11 +388,19 @@ class Config:
     )
 
     storage_layout: str = arg(
-        help="Select one of the available storage layout models. The generic model should only be necessary for vyper, huff, or unconventional storage patterns in yul.",
+        help="Select one of the available storage layout models. The generic model should only be necessary for vyper, huff, or unconventional storage patterns in yul. Defaults to generic when the build output contains Vyper contracts.",
         global_default="solidity",
         choices=["solidity", "generic"],
     )
 
+    evm_version: str = arg(
+        help="EVM version (hard fork) to execute against, e.g. shanghai, cancun, prague, osaka; "
+        "determines the available opcodes and the semantics of SELFDESTRUCT. "
+        "Defaults to the evmVersion the test contract was compiled for, or the latest supported fork",
+        global_default="",
+        metavar="VERSION",
+    )
+
     ffi: bool = arg(
         help="allow the usage of FFI to call external functions",
         global_default=False,
@@ -471,6 +525,18 @@ class Config:
         group=debugging,
     )
 
+    pretty_counterexamples: bool = arg(
+        help=(
+            "print exploitable counterexamples: arguments decoded with the ABI, calldata and "
+            "selectors decoded, concrete call sequences, a forge test replaying each "
+            "counterexample, duplicates hidden, and potentially invalid counterexamples "
+            "checked against the real EXP semantics, with the reason when they remain invalid"
+        ),
+        global_default=False,
+        group=debugging,
+        short="pcex",
+    )
+
     dump_smt_queries: bool = arg(
         help="dump SMT queries for assertion violations",
         global_default=False,
@@ -583,6 +649,15 @@ class Config:
         group=solver_group,
     )
 
+    keccak_refinement_rounds: int = arg(
+        help="when a counterexample relies on keccak values inconsistent with the real hash function, "
+        "add the real hash values to the query and solve again, at most this many times; "
+        "a counterexample that is still inconsistent is reported as potentially invalid (0 disables the check)",
+        global_default=3,
+        metavar="N",
+        group=solver_group,
+    )
+
     ### Experimental options
 
     symbolic_jump: bool = arg(
@@ -744,7 +819,7 @@ def resolved_solver_command(self) -> list[str]:
                     f"--solver-command will be used and --solver will be ignored",
                     allow_duplicate=False,
                 )
-            return shlex.split(solver_command)
+            return split_command(solver_command)
 
         # if no `--solver-command` is provided, or `--solver` has higher precedence,
         # we need to resolve `--solver <name>` to an actual command
@@ -775,12 +850,15 @@ def resolve_config_files(args: list[str], include_missing: bool = False) -> list
     if args.config:
         return [args.config]
 
-    # we expect to find halmos.toml in the project root directory
-    default_config_path = os.path.join(args.root, "halmos.toml")
-    if not include_missing and not os.path.exists(default_config_path):
-        return []
+    # we expect to find dolmos.toml (or halmos.toml) in the project root directory
+    candidates = [
+        os.path.join(args.root, name) for name in ("dolmos.toml", "halmos.toml")
+    ]
+    for path in candidates:
+        if os.path.exists(path):
+            return [path]
 
-    return [default_config_path]
+    return candidates[:1] if include_missing else []
 
 
 class TomlParser:
@@ -849,8 +927,9 @@ def _create_default_config() -> "Config":
 
 def _create_arg_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
-        prog="halmos",
-        epilog="For more information, see https://github.com/a16z/halmos",
+        # use the name the command was invoked with
+        prog=program_name(),
+        epilog="For more information, see https://github.com/Dowsers/dolmos",
     )
 
     groups = {
@@ -870,6 +949,8 @@ def _create_arg_parser() -> argparse.ArgumentParser:
         if short_name:
             names.append(f"-{short_name}")
 
+        names.extend(field_info.metadata.get("extra_names", []))
+
         arg_help = field_info.metadata.get("help", "")
         metavar = field_info.metadata.get("metavar", None)
         group_name = field_info.metadata.get("group", None)
@@ -913,6 +994,12 @@ def default_config() -> "Config":
     return _default_config
 
 
+def program_name() -> str:
+    """The name the command was invoked with (`dolmos` for `python -m dolmos`)."""
+    name = os.path.basename(sys.argv[0])
+    return "dolmos" if not name or name.endswith(".py") else name
+
+
 def arg_parser() -> argparse.ArgumentParser:
     return _arg_parser
 
@@ -928,7 +1015,7 @@ def toml_parser():
 
 
 # can generate a sample config file using:
-# python -m halmos.config ARGS > halmos.toml
+# python -m dolmos.config ARGS > dolmos.toml
 def main():
     def _to_toml_str(value: Any, type) -> str:
         assert value is not None
@@ -943,16 +1030,7 @@ def _to_toml_str(value: Any, type) -> str:
         source=ConfigSource.command_line, **vars(args)
     )
 
-    # devs can have a little easter egg
-    lines = [
-        "#     ___       ___       ___       ___       ___       ___",
-        "#    /\\__\\     /\\  \\     /\\__\\     /\\__\\     /\\  \\     /\\  \\",
-        "#   /:/__/_   /::\\  \\   /:/  /    /::L_L_   /::\\  \\   /::\\  \\",
-        "#  /::\\/\\__\\ /::\\:\\__\\ /:/__/    /:/L:\\__\\ /:/\\:\\__\\ /\\:\\:\\__\\",
-        "#  \\/\\::/  / \\/\\::/  / \\:\\  \\    \\/_/:/  / \\:\\/:/  / \\:\\:\\/__/",
-        "#    /:/  /    /:/  /   \\:\\__\\     /:/  /   \\::/  /   \\::/  /",
-        "#    \\/__/     \\/__/     \\/__/     \\/__/     \\/__/     \\/__/",
-    ]
+    lines = ["# dolmos configuration, generated by `python -m dolmos.config`"]
 
     lines.append("\n[global]")
     current_group_name = None
diff --git a/src/halmos/console.py b/src/dolmos/console.py
similarity index 97%
rename from src/halmos/console.py
rename to src/dolmos/console.py
index 9a219172d..56a2269f7 100644
--- a/src/halmos/console.py
+++ b/src/dolmos/console.py
@@ -2,12 +2,12 @@
 
 from z3 import BitVec
 
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.logs import (
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.logs import (
     info,
     warn,
 )
-from halmos.utils import (
+from dolmos.utils import (
     extract_bytes,
     extract_bytes_argument,
     extract_funsig,
diff --git a/src/halmos/constants.py b/src/dolmos/constants.py
similarity index 83%
rename from src/halmos/constants.py
rename to src/dolmos/constants.py
index 7511cad33..ae5296f50 100644
--- a/src/halmos/constants.py
+++ b/src/dolmos/constants.py
@@ -8,5 +8,5 @@
 MAX_MEMORY_SIZE = 2**20
 
 # to be compatible with startHoax(address),
-# see https://github.com/a16z/halmos/issues/338
+# see upstream halmos issue #338
 MAX_ETH = 1 << 128
diff --git a/src/halmos/contract.py b/src/dolmos/contract.py
similarity index 97%
rename from src/halmos/contract.py
rename to src/dolmos/contract.py
index 560c22ee2..20d798e3e 100644
--- a/src/halmos/contract.py
+++ b/src/dolmos/contract.py
@@ -4,19 +4,19 @@
 from dataclasses import dataclass
 from typing import ClassVar
 
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bytevec import ByteVec, ConcreteChunk
-from halmos.constants import MAX_MEMORY_SIZE
-from halmos.exceptions import (
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bytevec import ByteVec, ConcreteChunk
+from dolmos.constants import MAX_MEMORY_SIZE
+from dolmos.exceptions import (
     NotConcreteError,
     OutOfGasError,
 )
-from halmos.logs import (
+from dolmos.logs import (
     LIBRARY_PLACEHOLDER,
     warn_code,
 )
-from halmos.mapper import SingletonMeta, SourceFileMap
-from halmos.utils import (
+from dolmos.mapper import SingletonMeta, SourceFileMap
+from dolmos.utils import (
     Address,
     Byte,
     con_addr,
@@ -54,6 +54,7 @@
 OP_SHL = 0x1B
 OP_SHR = 0x1C
 OP_SAR = 0x1D
+OP_CLZ = 0x1E
 OP_SHA3 = 0x20
 OP_ADDRESS = 0x30
 OP_BALANCE = 0x31
@@ -80,6 +81,8 @@
 OP_CHAINID = 0x46
 OP_SELFBALANCE = 0x47
 OP_BASEFEE = 0x48
+OP_BLOBHASH = 0x49
+OP_BLOBBASEFEE = 0x4A
 OP_POP = 0x50
 OP_MLOAD = 0x51
 OP_MSTORE = 0x52
diff --git a/src/halmos/env.py b/src/dolmos/env.py
similarity index 98%
rename from src/halmos/env.py
rename to src/dolmos/env.py
index bcd4386b5..14dad12de 100644
--- a/src/halmos/env.py
+++ b/src/dolmos/env.py
@@ -6,8 +6,8 @@
 
 from dotenv import find_dotenv, load_dotenv
 
-from halmos.logs import debug
-from halmos.utils import Address, uint160
+from dolmos.logs import debug
+from dolmos.utils import Address, uint160
 
 
 def init_env(path: str | None = None):
diff --git a/src/dolmos/evm_version.py b/src/dolmos/evm_version.py
new file mode 100644
index 000000000..88b585b96
--- /dev/null
+++ b/src/dolmos/evm_version.py
@@ -0,0 +1,124 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+EVM version (hard fork) setting (a16z/halmos#128).
+
+The version determines which opcodes are available: executing an opcode introduced
+by a later fork halts the current frame with an invalid-opcode error, as on a node
+running that fork. It also selects the semantics of SELFDESTRUCT (EIP-6780, Cancun).
+
+When no version is given, the `evmVersion` the test contract was compiled for is
+used (from the compiler metadata), falling back to the latest supported fork.
+"""
+
+from dolmos.contract import (
+    OP_BASEFEE,
+    OP_BLOBBASEFEE,
+    OP_BLOBHASH,
+    OP_CHAINID,
+    OP_CLZ,
+    OP_CREATE2,
+    OP_DELEGATECALL,
+    OP_EXTCODEHASH,
+    OP_MCOPY,
+    OP_PUSH0,
+    OP_RETURNDATACOPY,
+    OP_RETURNDATASIZE,
+    OP_REVERT,
+    OP_SAR,
+    OP_SELFBALANCE,
+    OP_SHL,
+    OP_SHR,
+    OP_STATICCALL,
+    OP_TLOAD,
+    OP_TSTORE,
+)
+
+# supported forks, in chronological order (solc/foundry names)
+EVM_VERSIONS = (
+    "homestead",
+    "tangerineWhistle",
+    "spuriousDragon",
+    "byzantium",
+    "constantinople",
+    "petersburg",
+    "istanbul",
+    "berlin",
+    "london",
+    "paris",
+    "shanghai",
+    "cancun",
+    "prague",
+    "osaka",
+)
+
+LATEST_EVM_VERSION = EVM_VERSIONS[-1]
+
+# alternative names accepted on input
+EVM_VERSION_ALIASES = {
+    "merge": "paris",
+    "frontier": "homestead",  # frontier-only semantics are not modeled
+}
+
+# fork that introduced each opcode, for opcodes not available since homestead
+OPCODE_INTRODUCED_IN = {
+    OP_DELEGATECALL: "homestead",
+    OP_REVERT: "byzantium",
+    OP_RETURNDATASIZE: "byzantium",
+    OP_RETURNDATACOPY: "byzantium",
+    OP_STATICCALL: "byzantium",
+    OP_SHL: "constantinople",
+    OP_SHR: "constantinople",
+    OP_SAR: "constantinople",
+    OP_CREATE2: "constantinople",
+    OP_EXTCODEHASH: "constantinople",
+    OP_CHAINID: "istanbul",
+    OP_SELFBALANCE: "istanbul",
+    OP_BASEFEE: "london",
+    OP_PUSH0: "shanghai",
+    OP_TLOAD: "cancun",
+    OP_TSTORE: "cancun",
+    OP_MCOPY: "cancun",
+    OP_BLOBHASH: "cancun",
+    OP_BLOBBASEFEE: "cancun",
+    OP_CLZ: "osaka",
+}
+
+
+def normalize_evm_version(name: str) -> str | None:
+    """Returns the canonical fork name, or None if the name is not supported"""
+    name = EVM_VERSION_ALIASES.get(name, name)
+    for version in EVM_VERSIONS:
+        if version.lower() == name.lower():
+            return version
+    return None
+
+
+def fork_index(version: str) -> int:
+    return EVM_VERSIONS.index(version)
+
+
+def is_at_least(version: str, fork: str) -> bool:
+    return fork_index(version) >= fork_index(fork)
+
+
+def unavailable_opcodes(version: str) -> frozenset[int]:
+    """Opcodes introduced after the given fork"""
+    index = fork_index(version)
+    return frozenset(
+        opcode
+        for opcode, fork in OPCODE_INTRODUCED_IN.items()
+        if fork_index(fork) > index
+    )
+
+
+def evm_version_from_metadata(contract_json: dict) -> str | None:
+    """Returns the evmVersion found in the compiler metadata of a build artifact"""
+    metadata = contract_json.get("metadata")
+    if not isinstance(metadata, dict):
+        return None
+    settings = metadata.get("settings")
+    if not isinstance(settings, dict):
+        return None
+    version = settings.get("evmVersion")
+    return version if isinstance(version, str) else None
diff --git a/src/halmos/exceptions.py b/src/dolmos/exceptions.py
similarity index 97%
rename from src/halmos/exceptions.py
rename to src/dolmos/exceptions.py
index 300d77f65..74b64e573 100644
--- a/src/halmos/exceptions.py
+++ b/src/dolmos/exceptions.py
@@ -20,7 +20,7 @@ class PathEndingException(Exception):
     pass
 
 
-class HalmosException(PathEndingException):
+class DolmosException(PathEndingException):
     """
     Base class for unexpected internal errors happening during a test run.
     Inherits from RunEndingException because it should stop further path exploration.
@@ -29,7 +29,7 @@ class HalmosException(PathEndingException):
     pass
 
 
-class NotConcreteError(HalmosException):
+class NotConcreteError(DolmosException):
     pass
 
 
diff --git a/src/dolmos/expectations.py b/src/dolmos/expectations.py
new file mode 100644
index 000000000..c4a719c7e
--- /dev/null
+++ b/src/dolmos/expectations.py
@@ -0,0 +1,461 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+Support for the `vm.expectRevert*` / `vm.expectPartialRevert*` and
+`vm.expectEmit*` / `vm.expectEmitAnonymous*` cheatcodes (halmos issue #409).
+
+The semantics follow foundry:
+
+- an expectation is set by a cheatcode call and applies to the *next call* (or
+  contract creation) made by the same frame; calls to cheatcode addresses and to
+  the console are ignored.
+- expectRevert: the next call must revert, with a matching reason and reverter if
+  given. When the expectation is met the call is reported as successful to the
+  caller, with dummy return data (like foundry). `count = n` requires the next n
+  calls to revert, `count = 0` requires the next call not to revert.
+- expectEmit: the next event emitted by the frame itself is recorded as the
+  expected event. The next call must then emit events matching the expected ones
+  (in order, anywhere in its call tree). With a `count`, the expected event must
+  be emitted exactly `count` times.
+- an expectation that is still pending when the frame returns successfully makes
+  the test fail.
+
+Because data may be symbolic, matching produces an SMT condition: the caller
+forks a failing path when the condition can be false.
+"""
+
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+
+from z3 import (
+    And,
+    BitVecRef,
+    BoolRef,
+    BoolVal,
+    Concat,
+    Extract,
+    If,
+    Or,
+    Sum,
+    is_bv,
+    simplify,
+)
+
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bytevec import ByteVec
+from dolmos.exceptions import DolmosException
+from dolmos.utils import (
+    bytes_to_bv_value,
+    con,
+    extract_bytes_argument,
+    int_of,
+    uint160,
+)
+
+# foundry reports a successful call with 8192 zero bytes when a revert was expected
+DUMMY_CALL_OUTPUT = ByteVec(bytes(8192))
+
+# bytes4(keccak256("Error(string)"))
+ERROR_STRING_SELECTOR = bytes.fromhex("08c379a0")
+
+UnwrappedBytes = bytes | BitVecRef
+
+
+#
+# expectation records
+#
+
+
+@dataclass
+class ExpectedRevert:
+    reason: UnwrappedBytes | None = None  # None: any revert data
+    partial: bool = False  # only compare the first 4 bytes
+    reverter: BitVecRef | None = None  # None: any reverter
+    count: int = 1  # 0: the next call must not revert
+
+    def __str__(self) -> str:
+        parts = []
+        if self.reason is not None:
+            parts.append(f"reason={_hex(self.reason)}")
+        if self.reverter is not None:
+            parts.append(f"reverter={self.reverter}")
+        if self.count != 1:
+            parts.append(f"count={self.count}")
+        name = "expectPartialRevert" if self.partial else "expectRevert"
+        return f"{name}({', '.join(parts)})"
+
+
+@dataclass
+class ExpectedEmit:
+    # checks for topic0 (anonymous events only), topic1, topic2, topic3, data
+    checks: tuple[bool, bool, bool, bool, bool]
+    anonymous: bool = False
+    emitter: BitVecRef | None = None
+    count: int | None = None  # None: plain (ordered) expectation
+    log: object | None = None  # the expected EventLog, once emitted
+
+    def __str__(self) -> str:
+        name = "expectEmitAnonymous" if self.anonymous else "expectEmit"
+        emitter = f", emitter={self.emitter}" if self.emitter is not None else ""
+        count = f", count={self.count}" if self.count is not None else ""
+        return f"{name}(checks={self.checks}{emitter}{count})"
+
+
+@dataclass
+class Expectations:
+    """
+    Pending expectations of a call frame. Stored in its CallContext.
+    """
+
+    revert: ExpectedRevert | None = None
+    emits: list[ExpectedEmit] = field(default_factory=list)
+
+    def __bool__(self) -> bool:
+        return self.revert is not None or bool(self.emits)
+
+    def expect_revert(self, expected: ExpectedRevert) -> None:
+        if self.revert is not None:
+            raise DolmosException(
+                "expectRevert: an expected revert is already pending; "
+                "call another function before expecting a second revert"
+            )
+        self.revert = expected
+
+    def expect_emit(self, expected: ExpectedEmit) -> None:
+        self.emits.append(expected)
+
+    def capture_log(self, log) -> None:
+        """Records `log` as the expected event of the first unfilled expectEmit."""
+        for spec in self.emits:
+            if spec.log is None:
+                spec.log = log
+                return
+
+    def take(self) -> "Expectations | None":
+        """
+        Returns the expectations that apply to the next call, and clears them.
+        """
+        if not self:
+            return None
+
+        taken = Expectations(revert=self.revert, emits=self.emits)
+        self.revert = None
+        self.emits = []
+        return taken
+
+    def describe(self) -> str:
+        items = ([str(self.revert)] if self.revert else []) + [
+            str(e) for e in self.emits
+        ]
+        return ", ".join(items)
+
+
+#
+# cheatcode argument decoding
+#
+
+
+def _word(arg: ByteVec, idx: int):
+    return arg.get_word(4 + 32 * idx)
+
+
+def _bool(arg: ByteVec, idx: int, name: str) -> bool:
+    return int_of(_word(arg, idx), f"symbolic {name} argument") != 0
+
+
+def _address(arg: ByteVec, idx: int) -> BitVecRef:
+    return uint160(_word(arg, idx)).as_z3()
+
+
+def _uint64(arg: ByteVec, idx: int, name: str) -> int:
+    return int_of(_word(arg, idx), f"symbolic {name} count") & (2**64 - 1)
+
+
+def _bytes4(arg: ByteVec, idx: int) -> UnwrappedBytes:
+    start = 4 + 32 * idx
+    return arg.slice(start, start + 4).unwrap()
+
+
+# expectRevert variants: signature -> argument layout
+REVERT_SIGNATURES: dict[int, tuple[str, tuple[str, ...]]] = {
+    0xF4844814: ("expectRevert()", ()),
+    0xC31EB0E0: ("expectRevert(bytes4)", ("bytes4",)),
+    0xF28DCEB3: ("expectRevert(bytes)", ("bytes",)),
+    0xD814F38A: ("expectRevert(address)", ("address",)),
+    0x260BC5DE: ("expectRevert(bytes4,address)", ("bytes4", "address")),
+    0x61EBCF12: ("expectRevert(bytes,address)", ("bytes", "address")),
+    0x4EE38244: ("expectRevert(uint64)", ("count",)),
+    0xE45CA72D: ("expectRevert(bytes4,uint64)", ("bytes4", "count")),
+    0x4994C273: ("expectRevert(bytes,uint64)", ("bytes", "count")),
+    0x1FF5F952: ("expectRevert(address,uint64)", ("address", "count")),
+    0xB0762D73: (
+        "expectRevert(bytes4,address,uint64)",
+        ("bytes4", "address", "count"),
+    ),
+    0xD345FB1F: (
+        "expectRevert(bytes,address,uint64)",
+        ("bytes", "address", "count"),
+    ),
+    0x11FB5B9C: ("expectPartialRevert(bytes4)", ("bytes4",)),
+    0x51AA008A: ("expectPartialRevert(bytes4,address)", ("bytes4", "address")),
+}
+
+# expectEmit variants: signature -> (anonymous, argument layout)
+EMIT_SIGNATURES: dict[int, tuple[str, bool, tuple[str, ...]]] = {
+    0x440ED10D: ("expectEmit()", False, ()),
+    0x86B9620D: ("expectEmit(address)", False, ("address",)),
+    0x491CC7C2: ("expectEmit(bool,bool,bool,bool)", False, ("bool",) * 4),
+    0x81BAD6F3: (
+        "expectEmit(bool,bool,bool,bool,address)",
+        False,
+        ("bool",) * 4 + ("address",),
+    ),
+    0x4C74A335: ("expectEmit(uint64)", False, ("count",)),
+    0xB43AECE3: ("expectEmit(address,uint64)", False, ("address", "count")),
+    0x5E1D1C33: (
+        "expectEmit(bool,bool,bool,bool,uint64)",
+        False,
+        ("bool",) * 4 + ("count",),
+    ),
+    0xC339D02C: (
+        "expectEmit(bool,bool,bool,bool,address,uint64)",
+        False,
+        ("bool",) * 4 + ("address", "count"),
+    ),
+    0x2E5F270C: ("expectEmitAnonymous()", True, ()),
+    0x6FC68705: ("expectEmitAnonymous(address)", True, ("address",)),
+    0xC948DB5E: (
+        "expectEmitAnonymous(bool,bool,bool,bool,bool)",
+        True,
+        ("bool",) * 5,
+    ),
+    0x71C95899: (
+        "expectEmitAnonymous(bool,bool,bool,bool,bool,address)",
+        True,
+        ("bool",) * 5 + ("address",),
+    ),
+}
+
+
+def parse_expect_revert(funsig: int, arg: ByteVec) -> ExpectedRevert:
+    name, layout = REVERT_SIGNATURES[funsig]
+    expected = ExpectedRevert(partial=name.startswith("expectPartialRevert"))
+
+    for idx, kind in enumerate(layout):
+        match kind:
+            case "bytes4":
+                expected.reason = _bytes4(arg, idx)
+            case "bytes":
+                expected.reason = extract_bytes_argument(arg, idx)
+            case "address":
+                expected.reverter = _address(arg, idx)
+            case "count":
+                expected.count = _uint64(arg, idx, name)
+
+    return expected
+
+
+def parse_expect_emit(funsig: int, arg: ByteVec) -> ExpectedEmit:
+    name, anonymous, layout = EMIT_SIGNATURES[funsig]
+
+    bools = [_bool(arg, i, name) for i, k in enumerate(layout) if k == "bool"]
+    if not bools:
+        bools = [True] * (5 if anonymous else 4)
+
+    # normalize to (topic0, topic1, topic2, topic3, data);
+    # topic0 (the event selector) is always checked for non-anonymous events
+    checks = tuple(bools) if anonymous else (True, *bools)
+
+    expected = ExpectedEmit(checks=checks, anonymous=anonymous)
+    for idx, kind in enumerate(layout):
+        match kind:
+            case "address":
+                expected.emitter = _address(arg, idx)
+            case "count":
+                expected.count = _uint64(arg, idx, name)
+
+    return expected
+
+
+#
+# symbolic matching
+#
+
+
+def _unwrap(x) -> UnwrappedBytes:
+    if isinstance(x, ByteVec):
+        return x.unwrap()
+    return x
+
+
+def _len(x: UnwrappedBytes) -> int:
+    return x.size() // 8 if is_bv(x) else len(x)
+
+
+def _slice(x: UnwrappedBytes, start: int, stop: int) -> UnwrappedBytes:
+    """Byte slice [start:stop), zero-padded if out of bounds."""
+    n = _len(x)
+    if stop <= start:
+        return b""
+    if not is_bv(x):
+        return (x + bytes(max(0, stop - n)))[start:stop]
+    if start >= n:
+        return bytes(stop - start)
+    hi = (n - start) * 8 - 1
+    lo = max(0, (n - stop) * 8)
+    part = Extract(hi, lo, x)
+    pad = stop - min(stop, n)
+    return simplify(Concat(part, con(0, pad * 8))) if pad else simplify(part)
+
+
+def _to_bv(x: UnwrappedBytes) -> BitVecRef:
+    return x if is_bv(x) else bytes_to_bv_value(x)
+
+
+def eq_bytes(a, b) -> BoolRef:
+    a, b = _unwrap(a), _unwrap(b)
+    if _len(a) != _len(b):
+        return BoolVal(False)
+    if _len(a) == 0:
+        return BoolVal(True)
+    if not is_bv(a) and not is_bv(b):
+        return BoolVal(a == b)
+    return _to_bv(a) == _to_bv(b)
+
+
+def as_z3_word(x):
+    if isinstance(x, BV):
+        return x.as_z3()
+    if isinstance(x, int):
+        return con(x)
+    return x
+
+
+def revert_reason_matches(expected: ExpectedRevert, data: ByteVec) -> BoolRef:
+    """
+    Whether revert `data` matches the expected reason:
+    - the raw revert data equals the reason, or
+    - the data is `Error(string)` and its payload equals the reason, or
+    - for partial matches, the first 4 bytes are equal.
+    """
+    if expected.reason is None:
+        return BoolVal(True)
+
+    reason = expected.reason
+    raw = _unwrap(data)
+    reason_len, data_len = _len(reason), _len(raw)
+
+    conds = [eq_bytes(raw, reason)]
+
+    if expected.partial and reason_len >= 4 and data_len >= 4:
+        conds.append(eq_bytes(_slice(raw, 0, 4), _slice(reason, 0, 4)))
+
+    # Error(string) unwrapping: selector | offset (0x20) | length | payload
+    payload_end = 68 + reason_len
+    if data_len >= payload_end:
+        conds.append(
+            And(
+                eq_bytes(_slice(raw, 0, 4), ERROR_STRING_SELECTOR),
+                eq_bytes(_slice(raw, 4, 36), (32).to_bytes(32, "big")),
+                eq_bytes(_slice(raw, 36, 68), reason_len.to_bytes(32, "big")),
+                eq_bytes(_slice(raw, 68, payload_end), reason),
+            )
+        )
+
+    return simplify(Or(*conds))
+
+
+def find_reverter(subcall) -> BitVecRef:
+    """
+    The address that originally reverted: follow the chain of reverted subcalls
+    that bubbled up the same revert data.
+    """
+    ctx = subcall
+    while True:
+        child = ctx.last_subcall()
+        if (
+            child is None
+            or child.output.error is None
+            or child.output.data is None
+            or child.output.data != ctx.output.data
+        ):
+            return ctx.message.target
+        ctx = child
+
+
+def iter_logs(ctx) -> Iterator:
+    """All the logs emitted in a call tree, in execution order."""
+    for item in ctx.trace:
+        if hasattr(item, "topics"):
+            yield item
+        elif hasattr(item, "trace"):
+            yield from iter_logs(item)
+
+
+def log_matches(spec: ExpectedEmit, log) -> BoolRef:
+    expected = spec.log
+    conds = []
+
+    if spec.emitter is not None:
+        conds.append(as_z3_word(log.address) == as_z3_word(spec.emitter))
+
+    if len(log.topics) != len(expected.topics):
+        return BoolVal(False)
+
+    for i, (actual, wanted) in enumerate(zip(log.topics, expected.topics, strict=True)):
+        if spec.checks[i]:
+            conds.append(as_z3_word(actual) == as_z3_word(wanted))
+
+    if spec.checks[4]:
+        conds.append(eq_bytes(log.data or b"", expected.data or b""))
+
+    return simplify(And(*conds)) if conds else BoolVal(True)
+
+
+def emits_match(specs: list[ExpectedEmit], subcall) -> tuple[BoolRef, str | None]:
+    """
+    Returns (condition, error). A non-None error means the expectation can't be met.
+    """
+    unfilled = [s for s in specs if s.log is None]
+    if unfilled:
+        return BoolVal(False), (
+            f"{unfilled[0]}: no event was emitted between the cheatcode and the next call"
+        )
+
+    logs = list(iter_logs(subcall))
+    conds = []
+
+    # counted expectations are checked independently
+    for spec in (s for s in specs if s.count is not None):
+        hits = [If(log_matches(spec, log), con(1), con(0)) for log in logs]
+        total = simplify(Sum(hits)) if hits else con(0)
+        conds.append(total == con(spec.count))
+
+    # plain expectations must appear as an ordered subsequence of the logs
+    ordered = [s for s in specs if s.count is None]
+    memo: dict[tuple[int, int], BoolRef] = {}
+
+    def matches_from(i: int, j: int) -> BoolRef:
+        if i == len(ordered):
+            return BoolVal(True)
+        if len(ordered) - i > len(logs) - j:
+            return BoolVal(False)
+        if (i, j) not in memo:
+            memo[i, j] = simplify(
+                Or(
+                    And(log_matches(ordered[i], logs[j]), matches_from(i + 1, j + 1)),
+                    matches_from(i, j + 1),
+                )
+            )
+        return memo[i, j]
+
+    if ordered:
+        conds.append(matches_from(0, 0))
+
+    return simplify(And(*conds)) if conds else BoolVal(True), None
+
+
+def _hex(x: UnwrappedBytes) -> str:
+    if is_bv(x):
+        return str(x)
+    return "0x" + x.hex()
diff --git a/src/halmos/flamegraphs.py b/src/dolmos/flamegraphs.py
similarity index 97%
rename from src/halmos/flamegraphs.py
rename to src/dolmos/flamegraphs.py
index 4502ea51a..3bd923f42 100644
--- a/src/halmos/flamegraphs.py
+++ b/src/dolmos/flamegraphs.py
@@ -7,10 +7,10 @@
 import traceback
 from dataclasses import dataclass, field
 
-from halmos.logs import debug, warn
-from halmos.sevm import CallContext, CallSequence, Message
-from halmos.traces import rendered_address
-from halmos.utils import hexify
+from dolmos.logs import debug, warn
+from dolmos.sevm import CallContext, CallSequence, Message
+from dolmos.traces import rendered_address
+from dolmos.utils import hexify
 
 AUTO_REFRESH_INTERVAL_SECONDS = 0.250
 
diff --git a/src/dolmos/fs.py b/src/dolmos/fs.py
new file mode 100644
index 000000000..0380c3bb0
--- /dev/null
+++ b/src/dolmos/fs.py
@@ -0,0 +1,172 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+Filesystem access for the file cheatcodes (vm.readFile, vm.readFileBinary, ...).
+
+Access is governed by the project's `fs_permissions`, with the same semantics as
+Foundry, so that a test reading a file behaves identically under `forge test` and
+under dolmos:
+
+- permissions are read from the resolved forge configuration (`forge config --json`),
+  so profiles and environment overrides are honored;
+- paths, both requested and permitted, are resolved against the project root and
+  normalized lexically (`a/../b` becomes `b`; symlinks are not followed);
+- the most specific permission (longest matching path) wins, so a nested
+  `{ access = "none", path = "./data/private" }` overrides a broader read grant;
+- without any matching permission, access is denied.
+"""
+
+import json
+import os
+import re
+import subprocess
+from dataclasses import dataclass
+from functools import cache
+
+from dolmos.exceptions import DolmosException
+from dolmos.logs import debug, warn
+
+# foundry's default when fs_permissions is not configured
+DEFAULT_FS_PERMISSIONS: tuple[dict, ...] = ({"access": "read", "path": "out"},)
+
+# `forge config --json` serializes "read-write" as true and "none" as false
+_ACCESS_ALIASES = {
+    True: "read-write",
+    False: "none",
+    "true": "read-write",
+    "false": "none",
+}
+
+_READABLE = frozenset({"read", "read-write"})
+
+
+@dataclass(frozen=True)
+class FsPermission:
+    access: str  # "none" | "read" | "write" | "read-write"
+    path: str  # absolute and normalized
+
+    @property
+    def can_read(self) -> bool:
+        return self.access in _READABLE
+
+
+def resolve_path(root: str, path: str) -> str:
+    """Absolute, lexically normalized path; relative paths are taken from root."""
+    return os.path.normpath(os.path.join(os.path.abspath(root), path))
+
+
+def parse_fs_permissions(root: str, raw: list | tuple) -> tuple[FsPermission, ...]:
+    permissions = []
+    for entry in raw:
+        access = entry["access"]
+        access = _ACCESS_ALIASES.get(access, access)
+        if isinstance(access, str):
+            access = access.lower()
+        permissions.append(FsPermission(access, resolve_path(root, entry["path"])))
+    return tuple(permissions)
+
+
+@cache
+def load_fs_permissions(root: str) -> tuple[FsPermission, ...]:
+    """Resolved fs_permissions of the forge project at root (cached per root)."""
+
+    cmd = ["forge", "config", "--json", "--root", root]
+    try:
+        # forge writes utf-8 (warnings may contain non-ascii): do not decode with the
+        # locale encoding, which is not utf-8 on Windows
+        result = subprocess.run(
+            cmd,
+            capture_output=True,
+            encoding="utf-8",
+            errors="replace",
+            check=True,
+        )
+        raw = json.loads(result.stdout).get("fs_permissions") or []
+    except (OSError, subprocess.CalledProcessError, ValueError) as e:
+        warn(
+            f"could not resolve fs_permissions with `{' '.join(cmd)}` ({e}); "
+            "falling back to foundry's default (read access to `out` only)"
+        )
+        raw = DEFAULT_FS_PERMISSIONS
+
+    permissions = parse_fs_permissions(root, raw)
+    debug(f"fs_permissions for {root}: {permissions}")
+    return permissions
+
+
+def find_permission(
+    permissions: tuple[FsPermission, ...], abs_path: str
+) -> FsPermission | None:
+    """The most specific permission covering abs_path, if any."""
+
+    # paths are case-insensitive on Windows (normcase is the identity elsewhere)
+    target = os.path.normcase(abs_path)
+    best = None
+    for permission in permissions:
+        base = os.path.normcase(permission.path)
+        covered = target == base or target.startswith(base.rstrip(os.sep) + os.sep)
+        if covered and (best is None or len(permission.path) > len(best.path)):
+            best = permission
+    return best
+
+
+def ensure_readable(
+    root: str,
+    path: str,
+    cheatcode: str,
+    permissions: tuple[FsPermission, ...] | None = None,
+) -> str:
+    """
+    Returns the absolute path to read, or raises if fs_permissions deny reading it.
+    """
+
+    if permissions is None:
+        permissions = load_fs_permissions(root)
+
+    abs_path = resolve_path(root, path)
+    permission = find_permission(permissions, abs_path)
+    if permission is None or not permission.can_read:
+        shown = os.path.relpath(abs_path, os.path.abspath(root))
+        if shown.startswith(os.pardir):
+            shown = abs_path
+        raise DolmosException(
+            f"{cheatcode}: the path {shown} is not allowed to be accessed for read "
+            "operations (see fs_permissions in foundry.toml)"
+        )
+
+    return abs_path
+
+
+def read_file(root: str, path: str, cheatcode: str) -> bytes:
+    """Raw content of the file at path, subject to fs_permissions."""
+
+    abs_path = ensure_readable(root, path, cheatcode)
+    try:
+        with open(abs_path, "rb") as f:
+            return f.read()
+    except OSError as e:
+        raise DolmosException(f"{cheatcode}: failed to read {abs_path}: {e}") from e
+
+
+_HEX_DIGITS = re.compile(r"[0-9a-fA-F]*")
+
+
+def parse_hex_bytes(value: str, cheatcode: str = "vm.parseBytes") -> bytes:
+    """
+    Parses a hex string the way Foundry's vm.parseBytes does: an optional
+    lowercase `0x` prefix followed by an even number of hex digits. Whitespace
+    is rejected, and the empty string is only accepted as `0x`.
+    """
+
+    digits = value[2:] if value.startswith("0x") else value
+
+    if not value:
+        reason = 'missing hex prefix ("0x") for hex string'
+    elif not _HEX_DIGITS.fullmatch(digits):
+        reason = "invalid hex character"
+    elif len(digits) % 2:
+        reason = "odd number of digits"
+    else:
+        return bytes.fromhex(digits)
+
+    raise DolmosException(f'{cheatcode}: failed parsing "{value}" as bytes: {reason}')
diff --git a/src/halmos/hashes.py b/src/dolmos/hashes.py
similarity index 100%
rename from src/halmos/hashes.py
rename to src/dolmos/hashes.py
diff --git a/src/dolmos/lasso.py b/src/dolmos/lasso.py
new file mode 100644
index 000000000..7ca56fc16
--- /dev/null
+++ b/src/dolmos/lasso.py
@@ -0,0 +1,886 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+Export of bounded loops as lasso programs, for termination analysis with PaSTTeL.
+
+When the loop unrolling bound (--loop) is reached on a symbolic JUMPI, dolmos can
+export the loop as a *lasso*: a stem (how the execution reaches the loop) and a
+loop transition (one iteration of the body), in PaSTTeL's JSON format
+(https://github.com/Dowsers/PaSTTeL).
+
+Extraction (see SEVM.extract_lasso)
+- the loop variables are the stack slots that change between two visits
+- the lasso is cut right after the JUMPI, on the branch that stays in the loop
+- the body is re-executed once from a generalized state (fresh loop variables),
+  on a separate solver; each path that comes back and takes the loop branch
+  again is a disjunct of the loop transition
+
+Translation (Translator): bitvectors become non-negative integers. Exact where
+possible, over-approximated otherwise (fresh variables), so that termination
+proofs stay valid.
+
+By default, lassos use the *small-constants encoding*: no literal exceeds 2^52,
+because PaSTTeL computes with doubles and is unsound on 2^256 constants.
+Wrap-arounds are proven absent with z3 (bitvector semantics) when possible, and
+over-approximated without large constants otherwise.
+
+See docs/loop-termination.md for details, soundness and limitations.
+"""
+
+import json
+import os
+import re
+import subprocess
+from dataclasses import dataclass, field
+
+from z3 import (
+    UGE,
+    ULT,
+    Z3_OP_AND,
+    Z3_OP_BADD,
+    Z3_OP_BAND,
+    Z3_OP_BLSHR,
+    Z3_OP_BMUL,
+    Z3_OP_BNEG,
+    Z3_OP_BNUM,
+    Z3_OP_BSHL,
+    Z3_OP_BSUB,
+    Z3_OP_BUDIV,
+    Z3_OP_BUDIV_I,
+    Z3_OP_BUREM,
+    Z3_OP_BUREM_I,
+    Z3_OP_CONCAT,
+    Z3_OP_DISTINCT,
+    Z3_OP_EQ,
+    Z3_OP_EXTRACT,
+    Z3_OP_FALSE,
+    Z3_OP_IFF,
+    Z3_OP_IMPLIES,
+    Z3_OP_ITE,
+    Z3_OP_NOT,
+    Z3_OP_OR,
+    Z3_OP_SGEQ,
+    Z3_OP_SGT,
+    Z3_OP_SLEQ,
+    Z3_OP_SLT,
+    Z3_OP_TRUE,
+    Z3_OP_UGEQ,
+    Z3_OP_UGT,
+    Z3_OP_ULEQ,
+    Z3_OP_ULT,
+    Z3_OP_UNINTERPRETED,
+    Z3_OP_XOR,
+    Z3_OP_ZERO_EXT,
+    And,
+    BitVec,
+    BitVecRef,
+    BitVecVal,
+    BoolRef,
+    ExprRef,
+    LShR,
+    Not,
+    Or,
+    Solver,
+    Sum,
+    ZeroExt,
+    is_bool,
+    is_bv,
+    is_bv_value,
+    is_false,
+    is_true,
+    simplify,
+    substitute,
+    unsat,
+)
+from z3.z3util import get_vars
+
+# upper bound on the paths of the generalized iteration
+MAX_BODY_PATHS = 32
+
+# upper bound on the number of instructions executed by the generalized iteration
+MAX_BODY_STEPS = 200_000
+
+LOOP_VAR_PREFIX = "lasso_v"
+
+# wrap-arounds with at most this many cases are encoded as disjunctions
+MAX_WRAP_CASES = 4
+
+# PaSTTeL stores numbers as doubles: integers are exact up to 2^53
+MAX_SMALL_CONSTANT = 2**52
+
+
+#
+# snapshots and results
+#
+
+
+@dataclass(frozen=True)
+class LoopSnapshot:
+    stack: tuple  # stack below the JUMPI operands
+    cond: BoolRef  # branching condition
+
+
+@dataclass
+class LassoResult:
+    test: str
+    jumpid: str
+    direction: bool
+    path: str | None = None  # dumped JSON file
+    error: str | None = None  # extraction failure
+    warnings: list[str] = field(default_factory=list)
+    verdict: str | None = None  # PaSTTeL verdict
+    proof: str | None = None
+    approximate: bool = False  # the lasso over-approximates the loop
+
+    def summary(self) -> str:
+        where = f"loop {self.jumpid} ({'true' if self.direction else 'false'} branch)"
+        if self.error:
+            return f"{where}: lasso not extracted: {self.error}"
+        text = f"{where}: {self.verdict or 'lasso dumped'}"
+        if self.verdict == "NON-TERMINATING" and (self.approximate or self.warnings):
+            # only termination proofs survive over-approximation
+            text += " (unconfirmed: the lasso over-approximates the loop)"
+        if self.proof:
+            text += f" [{self.proof}]"
+        if self.warnings:
+            text += f" (warning: {'; '.join(self.warnings)})"
+        if self.path:
+            text += f" -> {self.path}"
+        return text
+
+
+class LassoError(Exception):
+    pass
+
+
+#
+# BV -> Int translation
+#
+
+
+def is_loop_var(e: ExprRef) -> bool:
+    return (
+        e.num_args() == 0
+        and e.decl().kind() == Z3_OP_UNINTERPRETED
+        and e.decl().name().startswith(LOOP_VAR_PREFIX)
+    )
+
+
+def depends_on_loop_vars(e: ExprRef) -> bool:
+    return any(is_loop_var(v) for v in get_vars(e))
+
+
+class WrapProver:
+    """
+    Proves, with the bitvector semantics, that an operation cannot wrap around
+    under the conditions of a path. Used by the small-constants encoding.
+
+    The conditions of a generalized iteration mention the input symbols (via the
+    stem) and the fresh loop variables (via the body). Input symbols never
+    change, so facts about them hold at every iteration: using them is sound.
+    """
+
+    def __init__(self, conditions: list[BoolRef], timeout_ms: int):
+        self.solver = Solver()
+        self.solver.set(timeout=timeout_ms)
+        self.solver.add(*conditions)
+        self.memo: dict[int, bool] = {}
+
+    def valid(self, cond: BoolRef) -> bool:
+        cond = simplify(cond)
+        if is_true(cond):
+            return True
+        if is_false(cond):
+            return False
+        key = cond.get_id()
+        if key not in self.memo:
+            self.solver.push()
+            self.solver.add(Not(cond))
+            self.memo[key] = self.solver.check() == unsat
+            self.solver.pop()
+        return self.memo[key]
+
+
+class Registry:
+    """State shared by all the translation contexts of one lasso."""
+
+    def __init__(self):
+        self.aux_counter = 0
+        # loop-invariant opaque terms -> (program variable name, width, term)
+        self.invariants: dict[int, tuple[str, int, ExprRef]] = {}
+        # large literals (small-constants encoding) -> program variable name
+        self.big_constants: dict[int, str] = {}
+        # set when the translation over-approximates the bitvector semantics
+        self.approximate = False
+
+    def fresh(self, prefix: str) -> str:
+        self.aux_counter += 1
+        return f"{prefix}{self.aux_counter}"
+
+    def invariant(self, e: ExprRef) -> str:
+        key = e.get_id()
+        if key not in self.invariants:
+            width = e.size() if is_bv(e) else 1
+            self.invariants[key] = (f"k{len(self.invariants)}", width, e)
+        return self.invariants[key][0]
+
+    def big_constant(self, value: int) -> str:
+        if value not in self.big_constants:
+            self.big_constants[value] = f"c{len(self.big_constants)}"
+        return self.big_constants[value]
+
+
+class Translator:
+    """
+    Translates bitvector formulas to linear integer SMT-LIB terms.
+
+    One translator per transition disjunct: auxiliary variables and their
+    constraints are local to it.
+
+    Two encodings:
+    - exact (prover is None): wrap-arounds are encoded exactly, with 2^w
+      constants. Suitable for tools with exact arithmetic.
+    - small constants (with a prover): no literal exceeds MAX_SMALL_CONSTANT,
+      because PaSTTeL represents numbers as doubles (exact up to 2^53 only).
+      See docs/loop-termination.md.
+    """
+
+    def __init__(
+        self,
+        registry: Registry,
+        names: dict[str, str],
+        stem: bool,
+        prover: WrapProver | None = None,
+    ):
+        self.reg = registry
+        self.names = names  # loop variable name -> SSA name
+        self.stem = stem
+        self.prover = prover
+        self.aux: list[str] = []
+        self.constraints: list[str] = []
+        self.memo: dict[int, str] = {}
+
+    @property
+    def small(self) -> bool:
+        return self.prover is not None
+
+    # helpers
+
+    def _aux(self, width: int | None) -> str:
+        name = self.reg.fresh("aux")
+        self.aux.append(name)
+        if width is not None:
+            self.constraints.append(f"(<= 0 {name})")
+            upper = 2**width
+            if not self.small or upper <= MAX_SMALL_CONSTANT:
+                self.constraints.append(f"(< {name} {upper})")
+        return name
+
+    def _num(self, value: int) -> str:
+        """A literal; large ones become constant program variables if needed."""
+        if self.small and value > MAX_SMALL_CONSTANT:
+            self.reg.approximate = True
+            name = self.reg.big_constant(value)
+            return f"{name}_s" if self.stem else name
+        return str(value)
+
+    def _wrap(
+        self,
+        expr: str,
+        width: int,
+        k_min: int,
+        k_max: int | None,
+        no_wrap: BoolRef | None = None,
+    ) -> str:
+        """
+        expr mod 2^width, where expr - r = 2^width * k with k in [k_min, k_max].
+
+        `no_wrap` is the bitvector condition under which k = 0.
+        """
+        m = 2**width
+
+        if self.small:
+            # k = 0 proven: the result is the integer expression itself
+            if no_wrap is not None and self.prover.valid(no_wrap):
+                return expr
+            self.reg.approximate = True
+            r = self._aux(width)
+            if k_min >= 0:
+                # only positive wrap-arounds: r = expr - 2^w * k <= expr
+                self.constraints.append(f"(<= {r} {expr})")
+            elif k_max is not None and k_max <= 0:
+                # only borrows: no wrap iff expr >= 0 (no large constant needed)
+                self.constraints.append(
+                    f"(or (and (<= 0 {expr}) (= {r} {expr})) (< {expr} 0))"
+                )
+            return r
+
+        r = self._aux(width)
+        if k_max is not None and k_max - k_min < MAX_WRAP_CASES:
+            cases = []
+            for k in range(k_min, k_max + 1):
+                lo, hi = m * k, m * (k + 1)
+                shifted = expr if k == 0 else f"(- {expr} {lo})"
+                cases.append(
+                    f"(and (<= {lo} {expr}) (< {expr} {hi}) (= {r} {shifted}))"
+                )
+            self.constraints.append(
+                cases[0] if len(cases) == 1 else f"(or {' '.join(cases)})"
+            )
+        else:
+            k = self._aux(None)
+            self.constraints.append(f"(= {r} (- {expr} (* {m} {k})))")
+        return r
+
+    def _ite(self, cond: str, a: str, b: str, width: int | None) -> str:
+        """Arithmetic if-then-else, which PaSTTeL doesn't parse: a fresh t with
+        (cond and t = a) or (not cond and t = b)."""
+        t = self._aux(width)
+        self.constraints.append(
+            f"(or (and {cond} (= {t} {a})) (and (not {cond}) (= {t} {b})))"
+        )
+        return t
+
+    def _div_const(self, a: str, c: int) -> str:
+        """a div c for a constant c > 0: c*q <= a <= c*q + c - 1."""
+        if c == 1:
+            return a
+        q = self._aux(None)
+        if self.small and c > MAX_SMALL_CONSTANT:
+            self.reg.approximate = True
+            # only keep 0 <= q <= a
+            self.constraints.append(f"(<= 0 {q})")
+            self.constraints.append(f"(<= {q} {a})")
+            return q
+        self.constraints.append(f"(<= (* {c} {q}) {a})")
+        self.constraints.append(f"(<= {a} (+ (* {c} {q}) {c - 1}))")
+        return q
+
+    def _rem_const(self, a: str, c: int) -> str:
+        if self.small and c > MAX_SMALL_CONSTANT:
+            self.reg.approximate = True
+            r = self._aux(None)
+            self.constraints.append(f"(<= 0 {r})")
+            self.constraints.append(f"(<= {r} {a})")
+            return r
+        return f"(- {a} (* {c} {self._div_const(a, c)}))"
+
+    def _truncate(self, a_term: str, a: BitVecRef, width: int) -> str:
+        """a (of a wider sort) mod 2^width."""
+        upper = 2**width
+        no_wrap = ULT(a, BitVecVal(upper, a.size())) if upper < 2 ** a.size() else None
+        k_max = 2 ** (a.size() - width) - 1
+        return self._wrap(a_term, width, 0, k_max, no_wrap)
+
+    def _opaque(self, e: ExprRef) -> str:
+        """Opaque term: shared constant if loop-invariant, fresh value otherwise."""
+        # a free input symbol is represented exactly by a variable; a compound
+        # term (keccak, storage read, bitwise operation...) is not
+        if e.num_args() > 0:
+            self.reg.approximate = True
+        width = e.size() if is_bv(e) else 1
+        if not self.stem and not depends_on_loop_vars(e):
+            return self.reg.invariant(e)
+        if self.stem and e.get_id() in self.reg.invariants:
+            return self.reg.invariants[e.get_id()][0] + "_s"
+        return self._aux(width)
+
+    @staticmethod
+    def _const(e: ExprRef) -> int | None:
+        return e.as_long() if is_bv_value(e) else None
+
+    # entry points
+
+    def bv(self, e: BitVecRef) -> str:
+        key = e.get_id()
+        if key not in self.memo:
+            self.memo[key] = self._bv(e)
+        return self.memo[key]
+
+    def bool(self, e: BoolRef) -> str:
+        key = e.get_id()
+        if key not in self.memo:
+            self.memo[key] = self._bool(e)
+        return self.memo[key]
+
+    def any(self, e: ExprRef) -> str:
+        """Int term for a bitvector, 0/1 for a boolean."""
+        if is_bool(e):
+            return self._ite(self.bool(e), "1", "0", 1)
+        return self.bv(e)
+
+    # bitvectors
+
+    def _bv(self, e: BitVecRef) -> str:
+        w = e.size()
+        kind = e.decl().kind()
+        args = e.children()
+
+        if kind == Z3_OP_BNUM:
+            return self._num(e.as_long())
+
+        if e.num_args() == 0 and kind == Z3_OP_UNINTERPRETED:
+            name = e.decl().name()
+            if name in self.names:
+                return self.names[name]
+            return self._opaque(e)
+
+        if kind == Z3_OP_BADD:
+            # x + C with C >= 2^(w-1) is x - (2^w - C), e.g. solc's x - 1
+            consts = [c for a in args if (c := self._const(a)) is not None]
+            neg = sum(2**w - c for c in consts if c >= 2 ** (w - 1))
+            if neg and 0 < neg < 2**w and len(consts) < len(args):
+                rest = [a for a in args if not (self._const(a) or 0) >= 2 ** (w - 1)]
+                rest_expr = rest[0] if len(rest) == 1 else Sum(rest)
+                d = BitVecVal(neg, w)
+                return self._wrap(
+                    f"(- {self.bv(rest_expr)} {self._num(neg)})",
+                    w,
+                    -1,
+                    0,
+                    UGE(rest_expr, d),
+                )
+            terms = " ".join(self.bv(a) for a in args)
+            wide = w + len(args).bit_length()
+            total = Sum([ZeroExt(wide - w, a) for a in args])
+            no_wrap = ULT(total, BitVecVal(2**w, wide))
+            return self._wrap(f"(+ {terms})", w, 0, len(args) - 1, no_wrap)
+
+        if kind == Z3_OP_BSUB:
+            a, b = args
+            return self._wrap(f"(- {self.bv(a)} {self.bv(b)})", w, -1, 0, UGE(a, b))
+
+        if kind == Z3_OP_BNEG:
+            return self._wrap(f"(- 0 {self.bv(args[0])})", w, -1, 0, args[0] == 0)
+
+        if kind == Z3_OP_BMUL:
+            consts = [c for a in args if (c := self._const(a)) is not None]
+            others = [a for a in args if self._const(a) is None]
+            if len(others) <= 1:
+                coef = 1
+                for c in consts:
+                    coef *= c
+                coef %= 2**w
+                if not others:
+                    return self._num(coef)
+                return self._scale(others[0], coef, w)
+            return self._opaque(e)
+
+        if kind == Z3_OP_BSHL and (s := self._const(args[1])) is not None:
+            if s >= w:
+                return "0"
+            return self._scale(args[0], 2**s, w)
+
+        if kind == Z3_OP_BLSHR and (s := self._const(args[1])) is not None:
+            if s >= w:
+                return "0"
+            return self._div_const(self.bv(args[0]), 2**s)
+
+        if kind in (Z3_OP_BUDIV, Z3_OP_BUDIV_I) and (c := self._const(args[1])):
+            return self._div_const(self.bv(args[0]), c)
+
+        if kind in (Z3_OP_BUREM, Z3_OP_BUREM_I) and (c := self._const(args[1])):
+            return self._rem_const(self.bv(args[0]), c)
+
+        if kind == Z3_OP_BAND:
+            # masking with 2^n - 1 is a truncation
+            consts = [c for a in args if (c := self._const(a)) is not None]
+            others = [a for a in args if self._const(a) is None]
+            if len(consts) == 1 and len(others) == 1:
+                mask = consts[0]
+                if mask & (mask + 1) == 0:
+                    n = mask.bit_length()
+                    if n >= w:
+                        return self.bv(others[0])
+                    return self._truncate(self.bv(others[0]), others[0], n)
+            return self._opaque(e)
+
+        if kind == Z3_OP_EXTRACT:
+            hi, lo = e.params()
+            a = args[0]
+            if lo == 0 and hi + 1 >= a.size():
+                return self.bv(a)
+            if lo == 0:
+                return self._truncate(self.bv(a), a, hi + 1)
+            shifted = self._div_const(self.bv(a), 2**lo)
+            if hi + 1 >= a.size():
+                return shifted
+            # (a >> lo) mod 2^(hi - lo + 1)
+            return self._truncate(shifted, LShR(a, lo), hi - lo + 1)
+
+        if kind == Z3_OP_CONCAT:
+            acc = None
+            for a in args:
+                term = self.bv(a)
+                if acc is None:
+                    acc = term
+                elif self.small and 2 ** a.size() > MAX_SMALL_CONSTANT:
+                    # the high part is scaled by a large constant
+                    zeros = all(self._const(x) == 0 for x in args[:-1])
+                    acc = term if zeros else self._opaque(e)
+                    if not zeros:
+                        return acc
+                else:
+                    acc = f"(+ (* {2 ** a.size()} {acc}) {term})"
+            return acc
+
+        if kind == Z3_OP_ZERO_EXT:
+            return self.bv(args[0])
+
+        if kind == Z3_OP_ITE:
+            return self._ite(self.bool(args[0]), self.bv(args[1]), self.bv(args[2]), w)
+
+        # dolmos abstractions of nonlinear arithmetic: exact when the divisor is constant
+        if kind == Z3_OP_UNINTERPRETED and len(args) == 2:
+            name = e.decl().name()
+            c = self._const(args[1])
+            if name.startswith("f_evm_bvudiv") and c:
+                return self._div_const(self.bv(args[0]), c)
+            if name.startswith("f_evm_bvurem") and c:
+                return self._rem_const(self.bv(args[0]), c)
+            if name.startswith("f_evm_bvmul"):
+                c0, c1 = self._const(args[0]), self._const(args[1])
+                if c0 is not None or c1 is not None:
+                    coef, other = (c0, args[1]) if c0 is not None else (c1, args[0])
+                    return self._scale(other, coef, w)
+
+        return self._opaque(e)
+
+    def _scale(self, x: BitVecRef, coef: int, w: int) -> str:
+        """(coef * x) mod 2^w for a constant coef."""
+        if coef == 0:
+            return "0"
+        if coef == 1:
+            return self.bv(x)
+        if self.small and coef > MAX_SMALL_CONSTANT:
+            self.reg.approximate = True
+            r = self._aux(w)
+            return r
+        wide = w + coef.bit_length()
+        no_wrap = ULT(ZeroExt(wide - w, x) * coef, BitVecVal(2**w, wide))
+        return self._wrap(f"(* {coef} {self.bv(x)})", w, 0, max(coef - 1, 0), no_wrap)
+
+    # booleans
+
+    def _signed(self, e: BitVecRef) -> str:
+        w = e.size()
+        a = self.bv(e)
+        return self._ite(f"(>= {a} {2 ** (w - 1)})", f"(- {a} {2**w})", a, None)
+
+    def _signed_cmp(self, op: str, a: BitVecRef, b: BitVecRef) -> str:
+        if self.small:
+            # without large constants: exact only when both operands are
+            # provably non-negative, in which case it is the unsigned comparison
+            w = a.size()
+            half = BitVecVal(2 ** (w - 1), w)
+            if self.prover.valid(And(ULT(a, half), ULT(b, half))):
+                return f"({op} {self.bv(a)} {self.bv(b)})"
+            self.reg.approximate = True
+            aux = self._aux(1)
+            return f"(= {aux} 1)"
+        return f"({op} {self._signed(a)} {self._signed(b)})"
+
+    def _bool(self, e: BoolRef) -> str:
+        kind = e.decl().kind()
+        args = e.children()
+
+        if kind == Z3_OP_TRUE:
+            return "true"
+        if kind == Z3_OP_FALSE:
+            return "false"
+        if kind == Z3_OP_NOT:
+            return f"(not {self.bool(args[0])})"
+        if kind == Z3_OP_AND:
+            return f"(and {' '.join(self.bool(a) for a in args)})"
+        if kind == Z3_OP_OR:
+            return f"(or {' '.join(self.bool(a) for a in args)})"
+        if kind == Z3_OP_IMPLIES:
+            return f"(or (not {self.bool(args[0])}) {self.bool(args[1])})"
+        if kind in (Z3_OP_IFF, Z3_OP_EQ) and is_bool(args[0]):
+            a, b = self.bool(args[0]), self.bool(args[1])
+            return f"(or (and {a} {b}) (and (not {a}) (not {b})))"
+        if kind == Z3_OP_XOR:
+            a, b = self.bool(args[0]), self.bool(args[1])
+            return f"(or (and {a} (not {b})) (and (not {a}) {b}))"
+        if kind == Z3_OP_ITE:
+            c, a, b = (self.bool(x) for x in args)
+            return f"(or (and {c} {a}) (and (not {c}) {b}))"
+
+        if kind == Z3_OP_EQ:
+            return f"(= {self.bv(args[0])} {self.bv(args[1])})"
+        if kind == Z3_OP_DISTINCT and len(args) == 2:
+            return f"(not (= {self.bv(args[0])} {self.bv(args[1])}))"
+
+        unsigned = {Z3_OP_ULT: "<", Z3_OP_ULEQ: "<=", Z3_OP_UGT: ">", Z3_OP_UGEQ: ">="}
+        if kind in unsigned:
+            return f"({unsigned[kind]} {self.bv(args[0])} {self.bv(args[1])})"
+
+        signed = {Z3_OP_SLT: "<", Z3_OP_SLEQ: "<=", Z3_OP_SGT: ">", Z3_OP_SGEQ: ">="}
+        if kind in signed:
+            return self._signed_cmp(signed[kind], args[0], args[1])
+
+        # opaque boolean: encoded as an Int in {0, 1}
+        self.reg.approximate = True
+        b = self._aux(1)
+        return f"(= {b} 1)"
+
+    def conj(self, parts: list[str]) -> str:
+        parts = [p for p in parts + self.constraints if p != "true"]
+        if not parts:
+            return "true"
+        if len(parts) == 1:
+            return parts[0]
+        return f"(and {' '.join(parts)})"
+
+
+#
+# lasso construction
+#
+
+
+def slice_conditions(conditions: list[BoolRef], seeds: list[ExprRef]) -> list[BoolRef]:
+    """Keeps the conditions transitively sharing variables with the seeds."""
+    cond_vars = [{v.get_id() for v in get_vars(c)} for c in conditions]
+    wanted = {v.get_id() for s in seeds for v in get_vars(s)}
+    kept: set[int] = set()
+    changed = True
+    while changed:
+        changed = False
+        for i, vs in enumerate(cond_vars):
+            if i not in kept and vs & wanted:
+                kept.add(i)
+                wanted |= vs
+                changed = True
+    return [c for i, c in enumerate(conditions) if i in kept]
+
+
+@dataclass
+class BodyPath:
+    conditions: list[BoolRef]  # conditions added during the iteration
+    outputs: list[ExprRef]  # new values of the loop variables (in order)
+    context: list[BoolRef] = field(default_factory=list)  # all path conditions
+
+
+_LARGE_LITERAL_RE = re.compile(r"(?<![\w.])\d{16,}(?![\w.])")
+
+
+def check_small_constants(formula: str) -> None:
+    for m in _LARGE_LITERAL_RE.finditer(formula):
+        if int(m.group(0)) > MAX_SMALL_CONSTANT:
+            raise LassoError(f"internal error: large literal {m.group(0)} in the lasso")
+
+
+def build_lasso(
+    loop_vars: list[str],
+    widths: list[int],
+    initial_values: list[ExprRef],
+    stem_conditions: list[BoolRef],
+    guard: BoolRef | None,
+    bodies: list[BodyPath],
+    exact_constants: bool = False,
+    stem_context: list[BoolRef] | None = None,
+    prover_timeout_ms: int = 1000,
+    complete: bool = False,
+) -> dict:
+    """
+    loop_vars[i]: name of the i-th fresh loop variable (lasso_v...);
+    the branching condition is the last loop variable (0/1 or raw word), and
+    `guard` (over the loop variables) must hold to stay in the loop.
+    """
+    small = not exact_constants
+    reg = Registry()
+    prog = [f"v{i}" for i in range(len(loop_vars))]
+    in_names = {lv: f"{p}_i" for lv, p in zip(loop_vars, prog, strict=True)}
+
+    def upper(name: str, w: int) -> list[str]:
+        if small and 2**w > MAX_SMALL_CONSTANT:
+            return []
+        return [f"(< {name} {2**w})"]
+
+    # facts for the wrap-around prover: the current iteration was entered by
+    # taking the loop branch at the end of a previous iteration (there is one,
+    # since the unrolling bound was reached). Only valid if the body paths are
+    # complete, as the previous iteration may have followed any of them.
+    previous: list[BoolRef] = []
+    if small and complete and bodies:
+        cur = [BitVec(name, 256) for name in loop_vars]
+        prev = [BitVec(f"{name}_prev", 256) for name in loop_vars]
+        pairs = list(zip(cur, prev, strict=True))
+        previous.append(
+            Or(
+                *[
+                    And(
+                        *[substitute(c, *pairs) for c in b.conditions],
+                        *[
+                            v == substitute(out, *pairs)
+                            for v, out in zip(cur, b.outputs, strict=True)
+                        ],
+                    )
+                    for b in bodies
+                ]
+            )
+        )
+
+    # loop transition: one disjunct per body path
+    disjuncts = []
+    loop_aux: list[str] = []
+    for body in bodies:
+        prover = (
+            WrapProver([*body.context, *previous], prover_timeout_ms) if small else None
+        )
+        tr = Translator(reg, in_names, stem=False, prover=prover)
+        parts = [tr.bool(guard)] if guard is not None else []
+        parts += [tr.bool(c) for c in body.conditions]
+        for p, out in zip(prog, body.outputs, strict=True):
+            parts.append(f"(= {p}_o {tr.any(out)})")
+        disjuncts.append(tr.conj(parts))
+        loop_aux += tr.aux
+
+    ranges = []
+    for p, w in zip(prog, widths, strict=True):
+        for suffix in ("_i", "_o"):
+            ranges += [f"(<= 0 {p}{suffix})", *upper(f"{p}{suffix}", w)]
+    for name, w, _ in reg.invariants.values():
+        ranges += [f"(<= 0 {name})", *upper(name, w)]
+
+    body_formula = (
+        disjuncts[0] if len(disjuncts) == 1 else f"(or {' '.join(disjuncts)})"
+    )
+    loop_formula = f"(and {' '.join(ranges)} {body_formula})"
+
+    invariant_names = [name for name, _, _ in reg.invariants.values()]
+
+    # stem: initial values of the loop variables and of the loop invariants
+    prover = (
+        WrapProver(stem_context or stem_conditions, prover_timeout_ms)
+        if small
+        else None
+    )
+    tr = Translator(reg, {}, stem=True, prover=prover)
+    parts = [tr.bool(c) for c in stem_conditions]
+    for p, init in zip(prog, initial_values, strict=True):
+        parts.append(f"(= {p}_s {tr.any(init)})")
+    for name, _, term in list(reg.invariants.values()):
+        parts.append(f"(= {name}_s {tr.any(term)})")
+    stem_ranges = []
+    for p, w in zip(prog, widths, strict=True):
+        stem_ranges += [f"(<= 0 {p}_s)", *upper(f"{p}_s", w)]
+    for name, w, _ in reg.invariants.values():
+        stem_ranges += [f"(<= 0 {name}_s)", *upper(f"{name}_s", w)]
+    stem_formula = tr.conj(stem_ranges + parts)
+
+    # large literals are constant program variables, identical in the stem and
+    # the loop; their only known facts are positivity and their relative order
+    big_names = [reg.big_constants[v] for v in sorted(reg.big_constants)]
+    order = [f"(<= 0 {big_names[0]})"] if big_names else []
+    order += [f"(< {a} {b})" for a, b in zip(big_names, big_names[1:], strict=False)]
+    if order:
+        loop_formula = f"(and {' '.join(order)} {loop_formula})"
+        stem_order = [re.sub(r"\b(c\d+)\b", r"\1_s", o) for o in order]
+        stem_formula = f"(and {' '.join(stem_order)} {stem_formula})"
+
+    if small:
+        check_small_constants(loop_formula)
+        check_small_constants(stem_formula)
+
+    all_vars = prog + invariant_names + big_names
+    constants = invariant_names + big_names
+    return reg.approximate, {
+        "program_vars": all_vars,
+        "var_types": {v: "Int" for v in all_vars},
+        "stem": [
+            {
+                "source": "entry",
+                "target": "head",
+                "formula": stem_formula,
+                "in_vars": {v: f"{v}_e" for v in all_vars},
+                "out_vars": {v: f"{v}_s" for v in all_vars},
+                "aux_vars": tr.aux,
+                "assigned_vars": all_vars,
+            }
+        ],
+        "loop": [
+            {
+                "source": "head",
+                "target": "head",
+                "formula": loop_formula,
+                "in_vars": {**{p: f"{p}_i" for p in prog}, **{k: k for k in constants}},
+                "out_vars": {
+                    **{p: f"{p}_o" for p in prog},
+                    **{k: k for k in constants},
+                },
+                "aux_vars": loop_aux,
+                "assigned_vars": prog,
+            }
+        ],
+    }
+
+
+def fresh_loop_var(index: int, uid: int) -> BitVecRef:
+    return BitVec(f"{LOOP_VAR_PREFIX}{uid}_{index}", 256)
+
+
+def as_z3(x) -> ExprRef:
+    return x.as_z3() if hasattr(x, "as_z3") else x
+
+
+def same_term(a, b) -> bool:
+    if a is b:
+        return True
+    za, zb = as_z3(a), as_z3(b)
+    if is_bool(za) != is_bool(zb):
+        return False
+    return za.eq(zb)
+
+
+def branch_taken(cond: ExprRef, direction: bool) -> BoolRef:
+    """The condition for a JUMPI on `cond` to take the `direction` branch."""
+    if is_bool(cond):
+        return cond if direction else simplify(Not(cond))
+    return cond != 0 if direction else cond == 0
+
+
+#
+# PaSTTeL
+#
+
+_VERDICT_RE = re.compile(r"OVERALL RESULT:\s*(\S+)")
+_PROOF_RE = re.compile(
+    r"^(\S+\([^)]*\)|\S+)\s+(TERMINATING|NON-TERMINATING)\s+[\d.]+\s+(.*)$", re.M
+)
+
+
+def run_pasttel(binary: str, lasso_path: str, timeout: int) -> tuple[str, str | None]:
+    try:
+        proc = subprocess.run(
+            [binary, "-a", "both", "-t", str(timeout), lasso_path],
+            capture_output=True,
+            text=True,
+            timeout=timeout + 10,
+        )
+    except subprocess.TimeoutExpired:
+        return "TIMEOUT", None
+    except OSError as err:
+        return f"ERROR ({err})", None
+
+    output = proc.stdout + proc.stderr
+    with open(lasso_path.removesuffix(".json") + ".pasttel.txt", "w") as f:
+        f.write(output)
+
+    verdict = m.group(1) if (m := _VERDICT_RE.search(output)) else "UNKNOWN"
+    proof = None
+    for m in _PROOF_RE.finditer(output):
+        if m.group(2) == verdict:
+            proof = f"{m.group(1)}: {m.group(3).strip()}"
+            break
+    return verdict, proof
+
+
+def write_lasso(out_dir: str, name: str, lasso: dict, meta: dict) -> str:
+    os.makedirs(out_dir, exist_ok=True)
+    path = os.path.join(out_dir, f"{name}.json")
+    with open(path, "w") as f:
+        json.dump(lasso, f, indent=2)
+    with open(os.path.join(out_dir, f"{name}.meta.json"), "w") as f:
+        json.dump(meta, f, indent=2, default=str)
+    return path
diff --git a/src/halmos/logs.py b/src/dolmos/logs.py
similarity index 91%
rename from src/halmos/logs.py
rename to src/dolmos/logs.py
index f44a2b18a..05d7814c5 100644
--- a/src/halmos/logs.py
+++ b/src/dolmos/logs.py
@@ -14,7 +14,7 @@
     handlers=[RichHandler(level=logging.NOTSET, show_time=False, show_path=False)],
 )
 
-logger = logging.getLogger("halmos")
+logger = logging.getLogger("dolmos")
 
 
 #
@@ -33,7 +33,7 @@ def filter(self, record):
         return True
 
 
-logger_unique = logging.getLogger("halmos.unique")
+logger_unique = logging.getLogger("dolmos.unique")
 logger_unique.addFilter(UniqueLoggingFilter())
 
 
@@ -65,7 +65,7 @@ def debug_once(text: str) -> None:
 # Warnings with error code
 #
 
-WARNINGS_BASE_URL = "https://github.com/a16z/halmos/wiki/warnings"
+WARNINGS_BASE_URL = "https://github.com/Dowsers/dolmos/blob/main/docs/warnings.md"
 
 
 @dataclass
diff --git a/src/halmos/mapper.py b/src/dolmos/mapper.py
similarity index 94%
rename from src/halmos/mapper.py
rename to src/dolmos/mapper.py
index f534e0c66..5425efc3b 100644
--- a/src/halmos/mapper.py
+++ b/src/dolmos/mapper.py
@@ -6,8 +6,8 @@
 from dataclasses import dataclass, field
 from typing import Any, ForwardRef, Optional
 
-from halmos.exceptions import HalmosException
-from halmos.logs import debug
+from dolmos.exceptions import DolmosException
+from dolmos.logs import debug
 
 SELECTOR_FIELDS = {
     "VariableDeclaration": "functionSelector",
@@ -204,6 +204,7 @@ def __init__(self):
         self._build_out_map: dict = None
         self._build_out_map_reverse: dict = None
         self._build_out_map_code: dict = None
+        self._vyper_code: list = None
 
     def set_build_out(self, build_out_map: dict):
         if self._build_out_map is build_out_map:
@@ -212,6 +213,7 @@ def set_build_out(self, build_out_map: dict):
         self._build_out_map = build_out_map
         self._build_out_map_reverse = None
         self._build_out_map_code = None
+        self._vyper_code = None
 
     def create_build_out_map_reverse(self):
         # create reverse mapping
@@ -276,6 +278,10 @@ def create_build_out_map_code(self):
         """
         self._build_out_map_code = defaultdict(list)
 
+        # vyper appends immutables to the runtime code at deployment time, so the
+        # deployed code is longer than the compile-time runtime code (matched by prefix)
+        self._vyper_code = []
+
         empty = {"object": "0x"}
         for filename, file_map in self._build_out_map.items():
             for contract_name, (contract_map, _, _) in file_map.items():
@@ -292,6 +298,9 @@ def create_build_out_map_code(self):
                 code_data = (hexcode, placeholders, contract_name, filename, source_map)
                 self._build_out_map_code[size].append(code_data)
 
+                if contract_map.get("language") == "vyper":
+                    self._vyper_code.append(code_data)
+
     def get_by_code(
         self, bytecode: ForwardRef("ByteVec")
     ) -> tuple[str | None, str | None, str | None]:
@@ -323,13 +332,20 @@ def eq_bytes(bytecode: ForwardRef("ByteVec"), hexcode: str):
             if eq_except_placeholders(hexcode, placeholders):
                 return (contract_name, filename, source_map)
 
+        # vyper contracts with immutables: compile-time runtime code + immutables section
+        for code_data in self._vyper_code:
+            hexcode, _, contract_name, filename, source_map = code_data
+            size = len(hexcode) // 2
+            if size < len(bytecode) and eq_bytes(bytecode[:size], hexcode):
+                return (contract_name, filename, source_map)
+
         return (None, None, None)
 
     def get_by_name(self, contract_name: str, filename: str = None) -> dict:
         """
         Return the build output json for the given contract name.
 
-        Raise a HalmosException if the contract is not found, or cannot be uniquely determined.
+        Raise a DolmosException if the contract is not found, or cannot be uniquely determined.
 
         The optional filename argument is required, if the contract name appears in multiple files.
         """
@@ -339,11 +355,11 @@ def get_by_name(self, contract_name: str, filename: str = None) -> dict:
         mapping = self._build_out_map_reverse[contract_name]
 
         if not mapping:
-            raise HalmosException(f"{contract_name} is not found")
+            raise DolmosException(f"{contract_name} is not found")
 
         if filename is None:
             if len(mapping) > 1:
-                raise HalmosException(
+                raise DolmosException(
                     f"{contract_name} exists in multiple files: {list(mapping.keys())}"
                 )
             [filename] = mapping.keys()
@@ -351,7 +367,7 @@ def get_by_name(self, contract_name: str, filename: str = None) -> dict:
         result = mapping.get(filename)
 
         if not result:
-            raise HalmosException(f"{contract_name} is not found in {filename}")
+            raise DolmosException(f"{contract_name} is not found in {filename}")
 
         return result
 
@@ -497,7 +513,7 @@ def main():
     import json
     import sys
 
-    from halmos.utils import cyan
+    from dolmos.utils import cyan
 
     def read_json_file(file_path: str) -> dict:
         with open(file_path) as f:
diff --git a/src/halmos/memtrace.py b/src/dolmos/memtrace.py
similarity index 99%
rename from src/halmos/memtrace.py
rename to src/dolmos/memtrace.py
index e82db5a93..737bf2ca6 100644
--- a/src/halmos/memtrace.py
+++ b/src/dolmos/memtrace.py
@@ -8,7 +8,7 @@
 
 from rich.console import Console
 
-from halmos.logs import debug
+from dolmos.logs import debug
 
 console = Console()
 
diff --git a/src/dolmos/pcex.py b/src/dolmos/pcex.py
new file mode 100644
index 000000000..6745d5aa4
--- /dev/null
+++ b/src/dolmos/pcex.py
@@ -0,0 +1,1791 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+Pretty counterexamples, enabled with --pretty-counterexamples (-pcex).
+
+The raw output of a counterexample is the solver model: one line per symbol, with the full
+hex value of every word, e.g. 1024 bytes for a `bytes` argument whose length is 65. This module
+turns the model into something that can be acted upon:
+
+- the arguments of the test are decoded with its ABI: the lengths of dynamic arguments are
+  applied, and values are rendered by type (decimal amounts, checksummed addresses, strings);
+- `bytes` values that hold calldata are decoded with the ABIs of the compiled contracts,
+  e.g. `Token.transfer(to: 0x…, amount: 2)` (halmos#369);
+- `bytes4` values are rendered as function selectors, including the empty selector 0x00000000
+  of plain ether transfers (halmos#419);
+- invariant call sequences are rendered with their concrete senders, values and arguments;
+- a forge test that replays the counterexample is generated;
+- duplicate counterexamples are hidden (halmos#398).
+
+Potentially invalid counterexamples are checked against the real EXP by the solver loop of
+solve.py (see refine_exp, halmos#280).
+
+Threading: rendering runs in the callbacks of the solver threads, so nothing here may touch
+z3 objects, except the collect_* functions, which run on the main thread when a potential
+assertion violation is found, and return plain Python data.
+"""
+
+import json
+import re
+import threading
+from collections.abc import Iterable
+from dataclasses import dataclass, field
+
+from eth_hash.auto import keccak
+
+# a raw model variable has .value (int) and .size_bits (int); see solve.ModelVariable
+Model = dict
+
+WORD_BITS = 256
+WORD_MODULUS = 2**256
+
+# selector of plain ether transfers and of calls with empty calldata
+EMPTY_SELECTOR = b"\x00\x00\x00\x00"
+
+# limits, to keep the output readable
+MAX_INLINE_ITEMS = 8
+MAX_HEX_BYTES = 160
+MAX_DECODE_DEPTH = 2
+MAX_ARRAY_LENGTH = 4096
+
+
+#
+# symbol names
+#
+
+# p_<path>_<abi type>_<uid>_<n>, created for ABI encoded arguments (see calldata.py);
+# p_<path>_length_<uid>_<n> for the length of a dynamic array, bytes or string
+p_symbol_pattern = re.compile(
+    r"^p_(?P<path>.*)_(?P<typ>[a-z]+[0-9]*)_(?P<uid>[0-9a-f]{7})_(?P<n>\d+)$"
+)
+
+# dolmos_<label>_<type>_<uid>_<n>, created by svm.create* cheatcodes
+svm_symbol_pattern = re.compile(
+    r"^dolmos_(?P<label>.*)_(?P<typ>[a-z]+[0-9]*)_(?P<uid>[0-9a-f]{7})_(?P<n>\d+)$"
+)
+
+# transaction context of the calls of invariant testing
+tx_symbol_pattern = re.compile(
+    r"^dolmos_(?P<kind>msg_sender|msg_value|tx_origin)_(?P<addr>0x[0-9a-fA-F]+)_"
+    r"(?P<uid>[0-9a-f]{7})_(?P<n>\d+)$"
+)
+
+timestamp_symbol_pattern = re.compile(
+    r"^dolmos_block_timestamp_depth(?P<depth>\d+)_(?P<uid>[0-9a-f]{7})$"
+)
+
+
+def index_symbols(names: Iterable[str]) -> dict[tuple[str, str], list[str]]:
+    """Maps (path, abi type or "length") to the p_ symbols with that path, in order"""
+    index: dict[tuple[str, str], list[str]] = {}
+    for name in names:
+        if match := p_symbol_pattern.match(name):
+            index.setdefault((match["path"], match["typ"]), []).append(name)
+    return index
+
+
+#
+# ABI types
+#
+
+
+class UnsupportedType(Exception):
+    pass
+
+
+@dataclass(frozen=True)
+class AbiType:
+    # "base" (static types: uintN, intN, address, bool, bytesN), "bytes", "string",
+    # "array" (T[]), "fixed" (T[k]), or "tuple"
+    kind: str
+
+    # canonical ABI type, e.g. "uint256", "bytes[]" or "(uint256,int8)"
+    abi: str
+
+    # element type of arrays
+    elem: "AbiType | None" = None
+
+    # length of fixed arrays
+    length: int = 0
+
+    # components of tuples, and their names
+    components: tuple["AbiType", ...] = ()
+    names: tuple[str, ...] = ()
+
+    # solidity type from the compiler (internalType), e.g. "struct Foo.Bar[]"
+    internal: str = ""
+
+    @property
+    def is_dynamic(self) -> bool:
+        match self.kind:
+            case "bytes" | "string" | "array":
+                return True
+            case "fixed":
+                return self.elem.is_dynamic
+            case "tuple":
+                return any(c.is_dynamic for c in self.components)
+            case _:
+                return False
+
+    @property
+    def static_size(self) -> int:
+        match self.kind:
+            case "fixed":
+                return self.length * self.elem.static_size
+            case "tuple":
+                return sum(c.head_size for c in self.components)
+            case _:
+                return 32
+
+    @property
+    def head_size(self) -> int:
+        return 32 if self.is_dynamic else self.static_size
+
+    @property
+    def bits(self) -> int:
+        """bit size of uintN/intN/bytesN"""
+        digits = re.sub(r"^[a-z]+", "", self.abi)
+        if self.abi.startswith("bytes"):
+            return 8 * int(digits)
+        return int(digits) if digits else WORD_BITS
+
+
+def parse_abi_type(item: dict) -> AbiType:
+    """Parses an ABI parameter, e.g. {"name": "x", "type": "uint256", "internalType": ...}"""
+    return _parse_abi_type(
+        item["type"], item.get("components"), item.get("internalType") or ""
+    )
+
+
+def params_type(inputs: list[dict]) -> AbiType:
+    """The tuple of the parameters of a function"""
+    components = tuple(parse_abi_type(item) for item in inputs)
+    return AbiType(
+        "tuple",
+        "(" + ",".join(c.abi for c in components) + ")",
+        components=components,
+        names=tuple(item.get("name", "") for item in inputs),
+    )
+
+
+def _parse_abi_type(typ: str, components: list | None, internal: str) -> AbiType:
+    if match := re.fullmatch(r"(.*)\[(\d*)\]", typ):
+        inner, size = match.group(1), match.group(2)
+        inner_internal = re.sub(r"\[\d*\]$", "", internal)
+        elem = _parse_abi_type(inner, components, inner_internal)
+        if size == "":
+            return AbiType("array", f"{elem.abi}[]", elem=elem, internal=internal)
+        return AbiType(
+            "fixed",
+            f"{elem.abi}[{size}]",
+            elem=elem,
+            length=int(size),
+            internal=internal,
+        )
+
+    if typ == "tuple":
+        parsed = tuple(parse_abi_type(c) for c in components or [])
+        return AbiType(
+            "tuple",
+            "(" + ",".join(c.abi for c in parsed) + ")",
+            components=parsed,
+            names=tuple(c.get("name", "") for c in components or []),
+            internal=internal,
+        )
+
+    if typ in ("bytes", "string"):
+        return AbiType(typ, typ, internal=internal)
+
+    if typ == "function":
+        # address + selector, encoded as bytes24
+        return AbiType("base", "bytes24", internal=internal)
+
+    if match := re.fullmatch(r"(u?int)(\d*)", typ):
+        return AbiType(
+            "base", f"{match.group(1)}{match.group(2) or 256}", internal=internal
+        )
+
+    if re.fullmatch(r"address|bool|bytes([1-9]|[12][0-9]|3[0-2])", typ):
+        return AbiType("base", typ, internal=internal)
+
+    raise UnsupportedType(typ)
+
+
+#
+# values
+#
+
+
+@dataclass
+class Val:
+    t: AbiType
+
+    # static types: the ABI encoded word
+    word: int = 0
+
+    # bytes, string
+    data: bytes = b""
+
+    # arrays, tuples
+    items: list["Val"] = field(default_factory=list)
+
+    # the value is absent from the model: any value works
+    free: bool = False
+
+    def is_clean(self) -> bool:
+        """whether the value is a valid ABI encoding of its type"""
+        t = self.t
+        if t.kind == "base":
+            return is_clean_word(t, self.word)
+        return all(item.is_clean() for item in self.items)
+
+
+def is_clean_word(t: AbiType, word: int) -> bool:
+    abi = t.abi
+    if abi.startswith("uint"):
+        return word < 2**t.bits
+    if abi.startswith("int"):
+        value = signed(word)
+        return -(2 ** (t.bits - 1)) <= value < 2 ** (t.bits - 1)
+    if abi == "address":
+        return word < 2**160
+    if abi == "bool":
+        return word in (0, 1)
+    if abi.startswith("bytes"):
+        return word % 2 ** (WORD_BITS - t.bits) == 0
+    return True
+
+
+def signed(word: int, bits: int = WORD_BITS) -> int:
+    word %= 2**bits
+    return word - 2**bits if word >= 2 ** (bits - 1) else word
+
+
+class ModelReader:
+    """Reads ABI values from the symbols of a call and the model"""
+
+    def __init__(self, model: Model, symbols: dict[tuple[str, str], list[str]]):
+        self.model = model
+        self.symbols = {key: list(names) for key, names in symbols.items()}
+        self.used: set[str] = set()
+
+    def take(self, path: str, typ: str):
+        """returns (symbol name or None, model variable or None)"""
+        names = self.symbols.get((path, typ))
+        if not names:
+            return None, None
+        name = names.pop(0)
+        self.used.add(name)
+        return name, self.model.get(name)
+
+    def read(self, t: AbiType, path: str) -> Val:
+        match t.kind:
+            case "tuple":
+                prefix = f"{path}." if path else ""
+                items = [
+                    self.read(c, prefix + name)
+                    for c, name in zip(t.components, t.names, strict=True)
+                ]
+                return Val(t, items=items)
+
+            case "fixed":
+                items = [self.read(t.elem, f"{path}[{i}]") for i in range(t.length)]
+                return Val(t, items=items)
+
+            case "array":
+                length, free = self.read_length(path)
+                items = [self.read(t.elem, f"{path}[{i}]") for i in range(length)]
+                return Val(t, items=items, free=free)
+
+            case "bytes" | "string":
+                length, free = self.read_length(path)
+                name, var = self.take(path, t.kind)
+                raw = var.value.to_bytes(var.size_bits // 8, "big") if var else b""
+                data = raw[:length] + bytes(max(0, length - len(raw)))
+                return Val(t, data=data, free=free)
+
+            case _:
+                name, var = self.take(path, t.abi)
+                return Val(t, word=var.value if var else 0, free=var is None)
+
+    def read_length(self, path: str) -> tuple[int, bool]:
+        name, var = self.take(path, "length")
+        if var is None:
+            return 0, True
+        return min(var.value, MAX_ARRAY_LENGTH), False
+
+
+#
+# ABI decoding and encoding of concrete values
+#
+
+
+class AbiDecodeError(Exception):
+    pass
+
+
+def _word_at(data: bytes, pos: int) -> int:
+    if pos < 0 or pos + 32 > len(data):
+        raise AbiDecodeError(f"out of bounds read at {pos}")
+    return int.from_bytes(data[pos : pos + 32], "big")
+
+
+def abi_decode(t: AbiType, data: bytes, pos: int = 0) -> Val:
+    """Decodes the value of type t encoded at data[pos:] (strict, raises AbiDecodeError)"""
+    match t.kind:
+        case "base":
+            return Val(t, word=_word_at(data, pos))
+
+        case "bytes" | "string":
+            length = _word_at(data, pos)
+            if pos + 32 + length > len(data):
+                raise AbiDecodeError(f"{t.abi} of length {length} out of bounds")
+            return Val(t, data=data[pos + 32 : pos + 32 + length])
+
+        case "array":
+            length = _word_at(data, pos)
+            if length > (len(data) - pos - 32) // 32 or length > MAX_ARRAY_LENGTH:
+                raise AbiDecodeError(f"array of length {length} out of bounds")
+            return Val(t, items=_decode_tuple([t.elem] * length, data, pos + 32))
+
+        case "fixed":
+            return Val(t, items=_decode_tuple([t.elem] * t.length, data, pos))
+
+        case "tuple":
+            return Val(t, items=_decode_tuple(list(t.components), data, pos))
+
+    raise AbiDecodeError(t.kind)
+
+
+def _decode_tuple(types: list[AbiType], data: bytes, base: int) -> list[Val]:
+    items = []
+    head = base
+    for t in types:
+        if t.is_dynamic:
+            offset = _word_at(data, head)
+            if offset >= len(data):
+                raise AbiDecodeError(f"offset {offset} out of bounds")
+            items.append(abi_decode(t, data, base + offset))
+        else:
+            items.append(abi_decode(t, data, head))
+        head += t.head_size
+    return items
+
+
+def abi_encode(v: Val) -> bytes:
+    t = v.t
+    match t.kind:
+        case "base":
+            return (v.word % WORD_MODULUS).to_bytes(32, "big")
+        case "bytes" | "string":
+            padding = bytes(-len(v.data) % 32)
+            return len(v.data).to_bytes(32, "big") + v.data + padding
+        case "array":
+            return len(v.items).to_bytes(32, "big") + _encode_tuple(v.items)
+        case _:
+            return _encode_tuple(v.items)
+
+
+def _encode_tuple(items: list[Val]) -> bytes:
+    head_size = sum(item.t.head_size for item in items)
+    heads, tails = [], []
+    tail_size = 0
+    for item in items:
+        if item.t.is_dynamic:
+            heads.append((head_size + tail_size).to_bytes(32, "big"))
+            encoded = abi_encode(item)
+            tails.append(encoded)
+            tail_size += len(encoded)
+        else:
+            heads.append(abi_encode(item))
+    return b"".join(heads + tails)
+
+
+#
+# function selectors of the compiled contracts
+#
+
+
+def selector_of(signature: str) -> bytes:
+    return keccak(signature.encode())[:4]
+
+
+def function_signature(item: dict) -> str:
+    """e.g. "transfer(address,uint256)", with tuples expanded"""
+
+    def type_str(arg: dict) -> str:
+        typ = arg["type"]
+        if typ.startswith("tuple"):
+            return (
+                "(" + ",".join(type_str(c) for c in arg["components"]) + ")" + typ[5:]
+            )
+        return typ
+
+    return item["name"] + "(" + ",".join(type_str(arg) for arg in item["inputs"]) + ")"
+
+
+@dataclass(frozen=True)
+class FunctionEntry:
+    contract: str
+    name: str
+    sig: str
+    inputs_json: str  # the ABI inputs, as json text
+    payable: bool
+    has_code: bool
+
+    @property
+    def params(self) -> AbiType:
+        return params_type(json.loads(self.inputs_json))
+
+
+class SelectorIndex:
+    """Functions of the compiled contracts, by selector"""
+
+    def __init__(self, contracts: Iterable[tuple[str, dict]] = ()):
+        self.by_selector: dict[bytes, list[FunctionEntry]] = {}
+        self.functions_by_contract: dict[str, list[FunctionEntry]] = {}
+        for contract_name, contract_json in contracts:
+            self.add_contract(contract_name, contract_json)
+
+    def add_contract(self, contract_name: str, contract_json: dict) -> None:
+        deployed = contract_json.get("deployedBytecode") or {}
+        has_code = len(deployed.get("object", "0x") or "0x") > 2
+        entries = self.functions_by_contract.setdefault(contract_name, [])
+        for item in contract_json.get("abi") or []:
+            if item.get("type") != "function":
+                continue
+            try:
+                sig = function_signature(item)
+            except (KeyError, TypeError):
+                continue
+            entry = FunctionEntry(
+                contract=contract_name,
+                name=item["name"],
+                sig=sig,
+                inputs_json=json.dumps(item.get("inputs", [])),
+                payable=item.get("stateMutability") == "payable",
+                has_code=has_code,
+            )
+            entries.append(entry)
+            self.by_selector.setdefault(selector_of(sig), []).append(entry)
+
+    def lookup(
+        self, selector: bytes, preferred: Iterable[str] = ()
+    ) -> list[FunctionEntry]:
+        """Candidates for the selector: contracts of the test first, then deployable contracts"""
+        preferred = set(preferred)
+        candidates = self.by_selector.get(bytes(selector), [])
+        return sorted(
+            candidates,
+            key=lambda e: (e.contract not in preferred, not e.has_code, e.contract),
+        )
+
+    def is_overloaded(self, contract_name: str, name: str) -> bool:
+        functions = self.functions_by_contract.get(contract_name, [])
+        return sum(1 for f in functions if f.name == name) > 1
+
+    def function(self, contract_name: str, sig: str) -> FunctionEntry | None:
+        for entry in self.functions_by_contract.get(contract_name, []):
+            if entry.sig == sig:
+                return entry
+        return None
+
+
+_index_cache: dict[int, tuple[object, SelectorIndex]] = {}
+_index_lock = threading.Lock()
+
+
+def selector_index(build_out_map: dict | None) -> SelectorIndex:
+    """The SelectorIndex of a build output map ({filename: {contract: (json, type, natspec)}})"""
+    if not build_out_map:
+        return SelectorIndex()
+
+    with _index_lock:
+        cached = _index_cache.get(id(build_out_map))
+        if cached and cached[0] is build_out_map:
+            return cached[1]
+
+        contracts = []
+        for file_map in build_out_map.values():
+            for contract_name, entry in file_map.items():
+                contract_json = entry[0] if isinstance(entry, tuple | list) else entry
+                if isinstance(contract_json, dict):
+                    contracts.append((contract_name, contract_json))
+
+        index = SelectorIndex(contracts)
+        _index_cache[id(build_out_map)] = (build_out_map, index)
+        return index
+
+
+#
+# rendering of values
+#
+
+
+def checksum_address(value: int) -> str:
+    """EIP-55 checksummed address"""
+    hex_addr = f"{value % 2**160:040x}"
+    digest = keccak(hex_addr.encode()).hex()
+    return "0x" + "".join(
+        c.upper() if c.isalpha() and int(digest[i], 16) >= 8 else c
+        for i, c in enumerate(hex_addr)
+    )
+
+
+def uint_hint(value: int, bits: int = WORD_BITS) -> str | None:
+    """A readable form of remarkable unsigned values"""
+    max_value = 2**bits - 1
+    if value == max_value and bits >= 8:
+        return f"type(uint{bits}).max"
+    if bits >= 64 and max_value - value < 2**16:
+        return f"type(uint{bits}).max - {max_value - value}"
+    if value >= 2**32 and value & (value - 1) == 0:
+        return f"2**{value.bit_length() - 1}"
+    if value >= 10**9:
+        digits = str(value)
+        stripped = digits.rstrip("0")
+        zeros = len(digits) - len(stripped)
+        if zeros >= 6 and len(stripped) <= 6:
+            mantissa = (
+                stripped if len(stripped) == 1 else f"{stripped[0]}.{stripped[1:]}"
+            )
+            return f"{mantissa}e{len(digits) - 1}"
+    if value >= 2**64:
+        return hex(value)
+    return None
+
+
+def int_hint(value: int, bits: int = WORD_BITS) -> str | None:
+    if value == -(2 ** (bits - 1)):
+        return f"type(int{bits}).min"
+    if value == 2 ** (bits - 1) - 1:
+        return f"type(int{bits}).max"
+    if value >= 0:
+        return uint_hint(value, bits) if value < 2 ** (bits - 1) - 1 else None
+    hint = uint_hint(-value, bits)
+    return f"-{hint}" if hint and not hint.startswith(("type", "0x")) else None
+
+
+def with_hint(text: str, hint: str | None) -> str:
+    return f"{text} ({hint})" if hint else text
+
+
+def compact_hex(data: bytes) -> str:
+    """Hex of data, with trailing zeros summarized and long values shortened"""
+    if not data:
+        return "0x"
+    stripped = data.rstrip(b"\x00")
+    zeros = len(data) - len(stripped)
+    if not stripped and zeros > 32:
+        return f"0x00…00 ({zeros} zero bytes)"
+    if zeros < 32:
+        stripped, zeros = data, 0
+
+    if len(stripped) > MAX_HEX_BYTES:
+        head = stripped[: MAX_HEX_BYTES - 32].hex()
+        tail = stripped[-16:].hex()
+        text = f"0x{head}…{tail}"
+    else:
+        text = "0x" + stripped.hex()
+
+    if zeros:
+        text += f" + {zeros} zero bytes"
+    return text
+
+
+def quoted_string(data: bytes) -> str | None:
+    """The data as a quoted string, if it is printable UTF-8"""
+    try:
+        text = data.decode("utf-8")
+    except UnicodeDecodeError:
+        return None
+    if not text.isprintable():
+        return None
+    return json.dumps(text, ensure_ascii=False)
+
+
+@dataclass(frozen=True)
+class RenderContext:
+    """What is known about the addresses and code of the counterexample"""
+
+    # contract names of deployed addresses
+    addr_names: dict = field(default_factory=dict)
+
+    # state variables of the test contract holding addresses: address -> (label, type label)
+    test_vars: dict = field(default_factory=dict)
+
+    # contracts deployed in the counterexample, preferred when decoding calldata
+    deployed: frozenset = frozenset()
+
+    index: SelectorIndex = field(default_factory=SelectorIndex)
+
+    def address_hint(self, value: int) -> str | None:
+        hints = []
+        if var := self.test_vars.get(value):
+            hints.append(var[0])
+        if name := self.addr_names.get(value):
+            hints.append(name)
+        return ", ".join(hints) or None
+
+    def selector_hint(self, selector: bytes) -> str | None:
+        candidates = self.index.lookup(selector, self.deployed)
+        if candidates:
+            first = candidates[0]
+            return f"{first.contract}.{first.sig}"
+        if selector == EMPTY_SELECTOR:
+            return "no selector: empty calldata, i.e. receive() or fallback(), e.g. a plain ether transfer"
+        return None
+
+    def render_base(self, t: AbiType, word: int) -> str:
+        """A static value, from its ABI encoded word"""
+        if not is_clean_word(t, word):
+            return f"0x{word:064x} (not a valid {t.abi})"
+
+        abi = t.abi
+        if t.internal.startswith("enum "):
+            return f"{word} ({t.internal})"
+        if abi.startswith("uint"):
+            return with_hint(str(word), uint_hint(word, t.bits))
+        if abi.startswith("int"):
+            value = signed(word)
+            return with_hint(str(value), int_hint(value, t.bits))
+        if abi == "address":
+            return with_hint(checksum_address(word), self.address_hint(word))
+        if abi == "bool":
+            return "true" if word else "false"
+        if abi.startswith("bytes"):
+            size = t.bits // 8
+            data = (word >> (WORD_BITS - t.bits)).to_bytes(size, "big")
+            text = "0x" + data.hex()
+            if size == 4:
+                return with_hint(text, self.selector_hint(data))
+            return text
+        return hex(word)
+
+    def render_bytes(self, data: bytes, depth: int = 0) -> str:
+        if not data:
+            return "0x (empty)"
+        text = compact_hex(data)
+        if not text.endswith("zero bytes)"):
+            text += f" ({len(data)} bytes)"
+        if call := self.decode_call(data, depth):
+            return f"{call}\n{text}"
+        return text
+
+    def render_string(self, data: bytes) -> str:
+        if (quoted := quoted_string(data)) is not None:
+            return quoted
+        text = compact_hex(data)
+        if not text.endswith("zero bytes)"):
+            text += f" ({len(data)} bytes)"
+        return f"{text}, not printable as a string"
+
+    def decode_call(self, data: bytes, depth: int = 0) -> str | None:
+        """Renders calldata as a function call, if its selector is known"""
+        if len(data) < 4 or depth >= MAX_DECODE_DEPTH:
+            return None
+
+        candidates = self.index.lookup(data[:4], self.deployed)
+        if not candidates:
+            return None
+
+        entry = candidates[0]
+        try:
+            params = entry.params
+            decoded = abi_decode(params, data, 4)
+        except (AbiDecodeError, UnsupportedType, ValueError):
+            return f"{entry.contract}.{entry.sig} (arguments not ABI encoded)"
+
+        args = ", ".join(
+            f"{name or f'arg{i}'}: {self.inline(item, depth + 1)}"
+            for i, (name, item) in enumerate(
+                zip(params.names, decoded.items, strict=True)
+            )
+        )
+        text = f"{entry.contract}.{entry.name}({args})"
+
+        encoded = abi_encode(decoded)
+        if data[4 : 4 + len(encoded)] != encoded:
+            text += " (non-standard encoding)"
+        elif trailing := len(data) - 4 - len(encoded):
+            zeros = data[4 + len(encoded) :].count(0) == trailing
+            text += f" + {trailing} trailing {'zero ' if zeros else ''}bytes"
+        return text
+
+    def inline(self, v: Val, depth: int = 0) -> str:
+        """A value on a single line"""
+        t = v.t
+        match t.kind:
+            case "base":
+                return self.render_base(t, v.word)
+            case "string":
+                quoted = quoted_string(v.data)
+                return quoted if quoted is not None else compact_hex(v.data)
+            case "bytes":
+                if call := self.decode_call(v.data, depth):
+                    return call
+                return compact_hex(v.data)
+            case "array" | "fixed":
+                items = [
+                    self.inline(item, depth) for item in v.items[:MAX_INLINE_ITEMS]
+                ]
+                if len(v.items) > MAX_INLINE_ITEMS:
+                    items.append(f"… {len(v.items) - MAX_INLINE_ITEMS} more")
+                return "[" + ", ".join(items) + "]"
+            case _:
+                fields = [
+                    f"{name or i}: {self.inline(item, depth)}"
+                    for i, (name, item) in enumerate(zip(t.names, v.items, strict=True))
+                ]
+                return "(" + ", ".join(fields) + ")"
+
+    def leaves(self, path: str, v: Val) -> list[tuple[str, str]]:
+        """(path, rendered value) for each leaf of a value"""
+        t = v.t
+        free = " (any value)" if v.free else ""
+        match t.kind:
+            case "base":
+                return [(path, self.render_base(t, v.word) + free)]
+            case "bytes":
+                return [(path, self.render_bytes(v.data) + free)]
+            case "string":
+                return [(path, self.render_string(v.data) + free)]
+            case "array":
+                result = [(f"{path}.length", f"{len(v.items)}{free}")]
+                for i, item in enumerate(v.items):
+                    result.extend(self.leaves(f"{path}[{i}]", item))
+                return result
+            case "fixed":
+                result = []
+                for i, item in enumerate(v.items):
+                    result.extend(self.leaves(f"{path}[{i}]", item))
+                return result
+            case _:
+                result = []
+                for i, (name, item) in enumerate(zip(t.names, v.items, strict=True)):
+                    result.extend(self.leaves(f"{path}.{name or i}", item))
+                return result
+
+
+def format_leaves(leaves: list[tuple[str, str]], indent: str) -> list[str]:
+    lines = []
+    for path, value in leaves:
+        first, *rest = value.split("\n")
+        lines.append(f"{indent}{path} = {first}")
+        pad = indent + " " * (len(path) + 3)
+        lines.extend(f"{pad}{line}" for line in rest)
+    return lines
+
+
+#
+# symbols outside of ABI encoded calls (svm.create* cheatcodes, transaction context)
+#
+
+
+def svm_value(var, typ: str) -> tuple[AbiType, int, bytes] | None:
+    """The ABI type and value of a symbol created by an svm.create* cheatcode"""
+    size = var.size_bits
+    value = var.value
+    try:
+        if typ in ("bytes", "string"):
+            return AbiType(typ, typ), 0, value.to_bytes(size // 8, "big")
+        t = _parse_abi_type(typ, None, "")
+    except (UnsupportedType, ValueError, OverflowError):
+        return None
+
+    abi = t.abi
+    if abi.startswith("int"):
+        word = signed(value, size) % WORD_MODULUS
+    elif abi.startswith("bytes"):
+        word = value << (WORD_BITS - size) if size <= WORD_BITS else value
+    else:
+        word = value
+    return t, word, b""
+
+
+def svm_cheatcode(label: str, typ: str, size_bits: int) -> str:
+    """the cheatcode that creates a symbol of this type, for the reproduction comments"""
+    quoted = json.dumps(label)
+    match typ:
+        case (
+            "uint256"
+            | "int256"
+            | "address"
+            | "bool"
+            | "bytes32"
+            | "bytes4"
+            | "bytes8"
+        ):
+            name = {"uint256": "Uint256", "int256": "Int256", "address": "Address"}.get(
+                typ, typ.capitalize()
+            )
+            return f"svm.create{name}({quoted})"
+        case "bytes" | "string":
+            return f"svm.create{typ.capitalize()}({size_bits // 8}, {quoted})"
+    if typ.startswith("uint"):
+        return f"svm.createUint({typ[4:]}, {quoted})"
+    if typ.startswith("int"):
+        return f"svm.createInt({typ[3:]}, {quoted})"
+    return f"svm.create…({quoted})"
+
+
+#
+# layout of a counterexample, collected on the main thread
+#
+
+
+@dataclass(frozen=True)
+class Ref:
+    """A value of the execution: a constant, or a symbol of the model"""
+
+    const: int | None = None
+    symbol: str | None = None
+
+    def resolve(self, model: Model, used: set | None = None) -> int | None:
+        if self.const is not None:
+            return self.const
+        if self.symbol is None:
+            return None
+        if used is not None:
+            used.add(self.symbol)
+        var = model.get(self.symbol)
+        # absent from the model: any value works
+        return var.value if var is not None else 0
+
+
+@dataclass(frozen=True)
+class CallLayout:
+    contract: str | None
+    fun_name: str | None
+    fun_sig: str | None
+
+    # ABI inputs as json text, so that the layout is plain data
+    inputs_json: str
+    payable: bool
+    target: int | None
+    sender: Ref
+    origin: Ref
+    value: Ref
+
+    # p_ symbols of the calldata: (path, type) -> names
+    symbols: dict
+
+    @property
+    def params(self) -> AbiType:
+        return params_type(json.loads(self.inputs_json))
+
+
+@dataclass(frozen=True)
+class CexLayout:
+    test_contract: str
+    test_source: str | None
+    fun_name: str
+    fun_sig: str
+    is_invariant: bool
+    is_probe: bool
+
+    # the call to the test function (None for probes)
+    test_call: CallLayout | None
+
+    # the transactions of an invariant test, in order
+    sequence: tuple[CallLayout, ...]
+
+    render_ctx: RenderContext
+
+    # whether the test function is overloaded in the test contract
+    test_overloaded: bool = False
+
+    # calls made by the test with calldata built from symbols that are not arguments of the
+    # test, e.g. by svm.createCalldata()
+    trace_calls: tuple["TraceCall", ...] = ()
+
+
+@dataclass(frozen=True)
+class Segment:
+    """A part of calldata: constant bytes, or (some bits of) a symbol"""
+
+    const: int | None = None
+    symbol: str | None = None
+
+    # bit size of the segment
+    size: int = 0
+
+    # bits of the symbol (Extract)
+    hi: int | None = None
+    lo: int | None = None
+
+    def value(self, model: Model) -> int:
+        if self.const is not None:
+            return self.const
+        var = model.get(self.symbol)
+        value = var.value if var is not None else 0
+        if self.hi is not None:
+            value = (value >> self.lo) % 2 ** (self.hi - self.lo + 1)
+        return value
+
+
+@dataclass(frozen=True)
+class TraceCall:
+    target: int | None
+    value: Ref
+    segments: tuple[Segment, ...]
+
+    @property
+    def symbols(self) -> set[str]:
+        return {s.symbol for s in self.segments if s.symbol is not None}
+
+    def calldata(self, model: Model) -> bytes:
+        result, bits = 0, 0
+        for segment in self.segments:
+            result = (result << segment.size) | segment.value(model)
+            bits += segment.size
+        return result.to_bytes(bits // 8, "big")
+
+
+#
+# rendering of a counterexample
+#
+
+
+@dataclass(frozen=True)
+class RenderedCex:
+    # the values of the counterexample, used to detect duplicates
+    body: list[str]
+
+    # body of a forge test replaying the counterexample (see repro_function)
+    repro: list[str]
+
+
+def render_counterexample(layout: CexLayout, model: Model) -> RenderedCex:
+    ctx = layout.render_ctx
+    body: list[str] = []
+    used: set[str] = set()
+    indent = " " * 4
+
+    # 1. arguments of the test
+    args_val = None
+    if layout.test_call is not None:
+        call = layout.test_call
+        reader = ModelReader(model, call.symbols)
+        try:
+            params = call.params
+            args_val = reader.read(params, "")
+            for i, (name, item) in enumerate(
+                zip(params.names, args_val.items, strict=True)
+            ):
+                body.extend(format_leaves(ctx.leaves(name or f"arg{i}", item), indent))
+        except (UnsupportedType, ValueError, KeyError) as e:
+            body.append(f"{indent}(arguments not decoded: {e})")
+            args_val = None
+        used |= reader.used
+
+    # calls made with calldata built from other symbols, e.g. by svm.createCalldata()
+    trace_lines = []
+    for trace_call in layout.trace_calls:
+        data = trace_call.calldata(model)
+        used |= trace_call.symbols
+        target = render_target(ctx, trace_call.target, None)
+        decoded = ctx.decode_call(data) or compact_hex(data)
+        value = trace_call.value.resolve(model, used)
+        value_str = f" {{value: {value}}}" if value else ""
+        trace_lines.append((target, f"{decoded}{value_str}", data))
+    if trace_lines:
+        body.append(f"{indent}Calls made with symbolic calldata:")
+        body.extend(
+            f"{indent * 2}{target} ← {decoded}" for target, decoded, _ in trace_lines
+        )
+
+    # 2. call sequence of invariant testing
+    timestamps = {}
+    for name in model:
+        if match := timestamp_symbol_pattern.match(name):
+            timestamps[int(match["depth"])] = model[name].value
+            used.add(name)
+
+    seq_vals = []
+    if layout.sequence:
+        body.append(f"{indent}Sequence:")
+        for i, call in enumerate(layout.sequence, start=1):
+            reader = ModelReader(model, call.symbols)
+            try:
+                val = reader.read(call.params, "")
+            except (UnsupportedType, ValueError, KeyError):
+                val = None
+            used |= reader.used
+            seq_vals.append(val)
+
+            sender = call.sender.resolve(model, used)
+            origin = call.origin.resolve(model, used)
+            value = call.value.resolve(model, used)
+
+            body.append(f"{indent * 2}[{i}] {render_call(ctx, call, val)}")
+            context = [f"msg.sender: {render_address(ctx, sender)}"]
+            if value:
+                context.append(f"msg.value: {with_hint(str(value), uint_hint(value))}")
+            if origin is not None and origin != sender:
+                context.append(f"tx.origin: {render_address(ctx, origin)}")
+            if i > 1 and (ts := timestamps.get(i - 1)) is not None:
+                context.append(f"block.timestamp: {ts}")
+            body.append(f"{indent * 2}    {', '.join(context)}")
+
+        ts = timestamps.get(len(layout.sequence))
+        if ts is not None and not layout.is_probe:
+            body.append(
+                f"{indent * 2}then {layout.fun_name}() at block.timestamp: {ts}"
+            )
+
+    # 3. other symbols: svm.create* cheatcodes, calldata created by svm.createCalldata, ...
+    svm_symbols = []
+    other_lines = []
+    rest = sorted(name for name in model if name not in used)
+    labels: dict[str, int] = {}
+    for name in rest:
+        if match := svm_symbol_pattern.match(name):
+            labels[match["label"]] = labels.get(match["label"], 0) + 1
+
+    # sorted names: the data of bytes/string comes before its length, and the elements of
+    # an array before its length, so that lengths are consumed with their data
+    p_reader = ModelReader(model, index_symbols(rest))
+    for name in rest:
+        if name in p_reader.used:
+            continue
+        var = model[name]
+        if match := tx_symbol_pattern.match(name):
+            what = {
+                "msg_sender": "msg.sender",
+                "msg_value": "msg.value",
+                "tx_origin": "tx.origin",
+            }
+            rendered = (
+                str(var.value)
+                if match["kind"] == "msg_value"
+                else render_address(ctx, var.value)
+            )
+            other_lines.append(
+                (f"{what[match['kind']]} (call to {match['addr']})", rendered)
+            )
+        elif match := svm_symbol_pattern.match(name):
+            label, typ = match["label"], match["typ"]
+            shown = label if labels[label] == 1 else f"{label}#{int(match['n'])}"
+            decoded = svm_value(var, typ)
+            if decoded is None:
+                rendered = hex(var.value)
+            else:
+                t, word, data = decoded
+                rendered = (
+                    ctx.render_bytes(data)
+                    if t.kind == "bytes"
+                    else ctx.render_string(data)
+                    if t.kind == "string"
+                    else ctx.render_base(t, word)
+                )
+            other_lines.append((f"{shown} ({typ})", rendered))
+            svm_symbols.append((svm_cheatcode(label, typ, var.size_bits), rendered))
+        elif match := p_symbol_pattern.match(name):
+            path, typ = match["path"], match["typ"]
+            if typ == "length":
+                p_reader.take(path, typ)
+                other_lines.append((f"{path or 'arg'}.length", str(var.value)))
+                continue
+            try:
+                val = p_reader.read(_parse_abi_type(typ, None, ""), path)
+                other_lines.extend(ctx.leaves(path or "arg", val))
+            except (UnsupportedType, ValueError):
+                p_reader.used.add(name)
+                other_lines.append((path or "arg", hex(var.value)))
+        else:
+            other_lines.append((name, hex(var.value)))
+
+    if other_lines:
+        body.append(f"{indent}Other symbols:")
+        body.extend(format_leaves(other_lines, indent * 2))
+
+    if not body:
+        body.append(f"{indent}∅")
+
+    for target, decoded, data in trace_lines:
+        svm_symbols.append(
+            (f"calldata sent to {target}", f"{decoded}, i.e. {bytes_literal(data)}")
+        )
+
+    repro = render_reproduction(
+        layout, args_val, seq_vals, model, timestamps, svm_symbols
+    )
+    return RenderedCex(body=body, repro=repro)
+
+
+def render_address(ctx: RenderContext, value: int | None) -> str:
+    if value is None:
+        return "?"
+    return with_hint(checksum_address(value), ctx.address_hint(value % 2**160))
+
+
+def render_target(ctx: RenderContext, target: int | None, contract: str | None) -> str:
+    """e.g. Vault(vault), with the state variable of the test holding the target if any"""
+    if target is None:
+        return "?"
+    contract = contract or ctx.addr_names.get(target)
+    if var := ctx.test_vars.get(target):
+        return f"{contract}({var[0]})" if contract else var[0]
+    return f"{contract or 'address'}@{checksum_address(target)}"
+
+
+def render_call(ctx: RenderContext, call: CallLayout, val: Val | None) -> str:
+    target = render_target(ctx, call.target, call.contract)
+
+    if val is None:
+        return f"{target}.{call.fun_sig}"
+
+    params = call.params
+    args = ", ".join(
+        f"{name or f'arg{i}'}: {ctx.inline(item)}"
+        for i, (name, item) in enumerate(zip(params.names, val.items, strict=True))
+    )
+    return f"{target}.{call.fun_name}({args})"
+
+
+#
+# reproduction
+#
+
+SOLIDITY_IDENTIFIER = re.compile(r"^[A-Za-z_$][A-Za-z0-9_$]*$")
+
+
+def solidity_type(t: AbiType) -> str | None:
+    """The solidity type for a declaration, from the internalType of the ABI"""
+    internal = t.internal
+    if not internal:
+        if t.kind == "tuple":
+            return None
+        if t.kind in ("array", "fixed"):
+            elem = solidity_type(t.elem)
+            if elem is None:
+                return None
+            return f"{elem}[]" if t.kind == "array" else f"{elem}[{t.length}]"
+        return t.abi
+    return re.sub(r"^(struct|enum|contract) ", "", internal)
+
+
+def bytes_literal(data: bytes) -> str:
+    if not data:
+        return '""'
+    stripped = data.rstrip(b"\x00")
+    zeros = len(data) - len(stripped)
+    if zeros >= 64:
+        if not stripped:
+            return f"new bytes({zeros})"
+        return f'abi.encodePacked(hex"{stripped.hex()}", new bytes({zeros}))'
+    return f'hex"{data.hex()}"'
+
+
+def string_literal(data: bytes) -> str:
+    try:
+        text = data.decode("ascii")
+        if text.isprintable() and '"' not in text and "\\" not in text:
+            return json.dumps(text)
+    except UnicodeDecodeError:
+        pass
+    return f"string({bytes_literal(data)})"
+
+
+def base_literal(t: AbiType, word: int) -> str | None:
+    """A solidity expression for a static value, None if it cannot be expressed"""
+    if not is_clean_word(t, word):
+        return None
+
+    abi, internal = t.abi, t.internal
+    if abi.startswith("uint"):
+        literal = str(word) if word < 2**64 else hex(word)
+    elif abi.startswith("int"):
+        value = signed(word)
+        literal = (
+            f"type(int{t.bits}).min" if value == -(2 ** (t.bits - 1)) else str(value)
+        )
+    elif abi == "address":
+        literal = "address(0)" if word == 0 else checksum_address(word)
+    elif abi == "bool":
+        literal = "true" if word else "false"
+    elif abi.startswith("bytes"):
+        size = t.bits // 8
+        literal = f"bytes{size}(0x{(word >> (WORD_BITS - t.bits)):0{2 * size}x})"
+    else:
+        return None
+
+    if not internal or internal == abi:
+        return literal
+    if internal.startswith("contract "):
+        return f"{internal[9:]}(payable({literal}))"
+    if internal.startswith("enum "):
+        return f"{internal[5:]}({literal})"
+    if internal == "address payable":
+        return f"payable({literal})"
+    if SOLIDITY_IDENTIFIER.match(internal.replace(".", "_")):
+        # user defined value type
+        return f"{internal}.wrap({literal})"
+    return literal
+
+
+class CodeGen:
+    """Solidity statements and expressions for values"""
+
+    def __init__(self):
+        self.lines: list[str] = []
+        self.ok = True
+
+    def expr(self, v: Val, local: str) -> str:
+        """an expression for v, possibly declaring a local variable for reference types"""
+        t = v.t
+        match t.kind:
+            case "base":
+                literal = base_literal(t, v.word)
+                if literal is None:
+                    self.ok = False
+                    return "0"
+                return literal
+            case "bytes":
+                return bytes_literal(v.data)
+            case "string":
+                return string_literal(v.data)
+
+        decl = solidity_type(t)
+        if decl is None:
+            self.ok = False
+            return local
+
+        if t.kind == "array":
+            self.lines.append(f"{decl} memory {local} = new {decl}({len(v.items)});")
+        else:
+            self.lines.append(f"{decl} memory {local};")
+        self.assign_items(local, v)
+        return local
+
+    def assign_items(self, lhs: str, v: Val) -> None:
+        t = v.t
+        if t.kind in ("array", "fixed"):
+            for i, item in enumerate(v.items):
+                self.assign(f"{lhs}[{i}]", item)
+        else:
+            for name, item in zip(t.names, v.items, strict=True):
+                if not name:
+                    self.ok = False
+                    return
+                self.assign(f"{lhs}.{name}", item)
+
+    def assign(self, lhs: str, v: Val) -> None:
+        t = v.t
+        match t.kind:
+            case "base":
+                if v.word == 0:
+                    return  # memory is zero-initialized
+                literal = base_literal(t, v.word)
+                if literal is None:
+                    self.ok = False
+                    return
+                self.lines.append(f"{lhs} = {literal};")
+            case "bytes" | "string":
+                if v.data:
+                    literal = (
+                        bytes_literal(v.data)
+                        if t.kind == "bytes"
+                        else string_literal(v.data)
+                    )
+                    self.lines.append(f"{lhs} = {literal};")
+            case "array":
+                if v.items:
+                    decl = solidity_type(t)
+                    if decl is None:
+                        self.ok = False
+                        return
+                    self.lines.append(f"{lhs} = new {decl}({len(v.items)});")
+                    self.assign_items(lhs, v)
+            case _:
+                self.assign_items(lhs, v)
+
+    def args(self, params: AbiType, val: Val, prefix: str = "") -> list[str]:
+        result = []
+        for i, (name, item) in enumerate(zip(params.names, val.items, strict=True)):
+            local = name if name and SOLIDITY_IDENTIFIER.match(name) else f"arg{i}"
+            result.append(self.expr(item, f"{prefix}{local}"))
+        return result
+
+
+def calldata_of(sig: str, val: Val) -> bytes:
+    return selector_of(sig) + abi_encode(val)
+
+
+def render_reproduction(
+    layout: CexLayout,
+    args_val: Val | None,
+    seq_vals: list,
+    model: Model,
+    timestamps: dict,
+    svm_symbols: list,
+) -> list[str]:
+    """Body of a forge test replaying the counterexample (without the function header)"""
+    ctx = layout.render_ctx
+    lines: list[str] = []
+    notes: list[str] = []
+
+    if svm_symbols:
+        lines.append(
+            "// values chosen for the symbols created by the test (replace the svm cheatcodes):"
+        )
+        lines.extend(
+            f"//   {cheatcode} = {value.splitlines()[0]}"
+            for cheatcode, value in svm_symbols
+        )
+
+    for i, (call, val) in enumerate(
+        zip(layout.sequence, seq_vals, strict=True), start=1
+    ):
+        sender = call.sender.resolve(model)
+        origin = call.origin.resolve(model)
+        value = call.value.resolve(model) or 0
+
+        if i > 1 and (ts := timestamps.get(i - 1)) is not None:
+            lines.append(f"vm.warp({ts});")
+        if value:
+            lines.append(f"vm.deal({address_literal(sender)}, {value});")
+        if origin is not None and origin != sender:
+            lines.append(
+                f"vm.prank({address_literal(sender)}, {address_literal(origin)});"
+            )
+        else:
+            lines.append(f"vm.prank({address_literal(sender)});")
+
+        target_var = ctx.test_vars.get(call.target) if call.target is not None else None
+        if target_var:
+            target_expr = f"address({target_var[0]})"
+        else:
+            target_expr = address_literal(call.target or 0)
+            notes.append(
+                f"call {i}: {target_expr} is the address of {call.contract or 'the target'} in dolmos; "
+                "replace it with the deployed instance"
+            )
+
+        value_opt = f"{{value: {value}}}" if value else ""
+        typed = None
+        if (
+            val is not None
+            and target_var
+            and target_var[1] == f"contract {call.contract}"
+            and call.fun_name
+            and not ctx.index.is_overloaded(call.contract, call.fun_name)
+            and (call.payable or not value)
+        ):
+            gen = CodeGen()
+            args = gen.args(call.params, val, prefix=f"c{i}_")
+            if gen.ok:
+                lines.extend(gen.lines)
+                typed = (
+                    f"{target_var[0]}.{call.fun_name}{value_opt}({', '.join(args)});"
+                )
+
+        if typed:
+            lines.append(typed)
+        elif val is not None:
+            data = calldata_of(call.fun_sig, val)
+            lines.append(
+                f"(bool ok{i},) = {target_expr}.call{value_opt}({bytes_literal(data)});"
+            )
+            lines.append(f'require(ok{i}, "call {i} reverted");')
+        else:
+            notes.append(f"call {i} ({call.fun_sig}) could not be decoded")
+
+    if layout.sequence and (ts := timestamps.get(len(layout.sequence))) is not None:
+        lines.append(f"vm.warp({ts});")
+
+    if layout.test_call is not None:
+        call = layout.test_call
+        if args_val is None:
+            notes.append(f"the arguments of {layout.fun_sig} could not be decoded")
+        else:
+            gen = CodeGen()
+            args = gen.args(call.params, args_val)
+            if gen.ok and not layout.test_overloaded:
+                lines.extend(gen.lines)
+                lines.append(f"this.{layout.fun_name}({', '.join(args)});")
+            else:
+                data = calldata_of(layout.fun_sig, args_val)
+                lines.append(f"(bool ok,) = address(this).call({bytes_literal(data)});")
+                lines.append(f'require(ok, "{layout.fun_name} failed");')
+
+    return [f"// note: {note}" for note in notes] + lines
+
+
+def address_literal(value: int | None) -> str:
+    if not value:
+        return "address(0)"
+    return checksum_address(value)
+
+
+def repro_function(layout: CexLayout, rendered: RenderedCex, number: int) -> list[str]:
+    name = f"test_pcex_{layout.fun_name}_{number}"
+    if layout.test_overloaded:
+        name = (
+            f"test_pcex_{layout.fun_name}_{selector_of(layout.fun_sig).hex()}_{number}"
+        )
+    where = layout.test_contract
+    if layout.test_source:
+        where += f" ({layout.test_source})"
+    return [
+        f"Reproduce: add to {where}, then `forge test --mt {name} -vvvv` (the test fails if the counterexample is real)",
+        f"    function {name}() public {{",
+        *(f"        {line}" for line in rendered.repro),
+        "    }",
+    ]
+
+
+#
+# duplicates
+#
+
+
+@dataclass
+class PcexState:
+    """Per-function state of pretty counterexamples, shared by the solver threads"""
+
+    lock: threading.Lock = field(default_factory=threading.Lock)
+
+    # fingerprint -> whether a valid counterexample with these values was shown
+    seen: dict = field(default_factory=dict)
+
+    # number of duplicates that were not shown
+    hidden: int = 0
+
+    # number of counterexamples shown
+    shown: int = 0
+
+    def admit(self, fingerprint: str, is_valid: bool) -> bool:
+        """Records a counterexample; returns whether it should be shown (call with the lock held)"""
+        shown_valid = self.seen.get(fingerprint)
+        if shown_valid is None or (is_valid and not shown_valid):
+            self.seen[fingerprint] = is_valid or bool(shown_valid)
+            self.shown += 1
+            return True
+        self.hidden += 1
+        return False
+
+
+#
+# collection of the layout, on the main thread
+#
+
+
+def collect_symbol_names(expr) -> list[str]:
+    """p_ and dolmos_ symbols of a z3 expression, in order of first occurrence"""
+    from z3 import Z3_OP_UNINTERPRETED, is_app
+
+    names: list[str] = []
+    seen_names: set[str] = set()
+    visited: set[int] = set()
+    stack = [expr]
+    while stack:
+        e = stack.pop()
+        if not is_app(e):
+            continue
+        eid = e.get_id()
+        if eid in visited:
+            continue
+        visited.add(eid)
+        if e.num_args() == 0:
+            decl = e.decl()
+            if decl.kind() == Z3_OP_UNINTERPRETED:
+                name = decl.name()
+                if name.startswith(("p_", "dolmos_")) and name not in seen_names:
+                    seen_names.add(name)
+                    names.append(name)
+            continue
+        stack.extend(reversed(e.children()))
+    return names
+
+
+def ref_of(x) -> Ref:
+    """A Ref for a value of the execution (int, bytes, BV, ByteVec or z3 term)"""
+    from z3 import Z3_OP_UNINTERPRETED, Z3_OP_ZERO_EXT, is_app, is_bv_value
+
+    if isinstance(x, int):
+        return Ref(const=x)
+    if hasattr(x, "as_z3"):
+        x = x.as_z3()
+    if hasattr(x, "unwrap"):
+        x = x.unwrap()
+    if isinstance(x, bytes):
+        return Ref(const=int.from_bytes(x, "big"))
+    if is_bv_value(x):
+        return Ref(const=x.as_long())
+    while is_app(x) and x.decl().kind() == Z3_OP_ZERO_EXT:
+        x = x.arg(0)
+    if is_app(x) and x.num_args() == 0 and x.decl().kind() == Z3_OP_UNINTERPRETED:
+        return Ref(symbol=x.decl().name())
+    return Ref()
+
+
+def concrete_int(x) -> int | None:
+    ref = ref_of(x)
+    return ref.const
+
+
+def call_layout(
+    message, abi_item: dict | None, contract_name: str | None
+) -> CallLayout:
+    fun_info = message.fun_info
+    data = message.data
+    try:
+        raw = data.unwrap() if hasattr(data, "unwrap") else data
+        names = [] if isinstance(raw, bytes) else collect_symbol_names(raw)
+    except Exception:
+        names = []
+
+    return CallLayout(
+        contract=contract_name or (fun_info.contract_name if fun_info else None),
+        fun_name=fun_info.name if fun_info else None,
+        fun_sig=fun_info.sig if fun_info else None,
+        inputs_json=json.dumps((abi_item or {}).get("inputs", [])),
+        payable=(abi_item or {}).get("stateMutability") == "payable",
+        target=concrete_int(message.target),
+        sender=ref_of(message.caller),
+        origin=ref_of(message.origin),
+        value=ref_of(message.value),
+        symbols=index_symbols(names),
+    )
+
+
+MAX_TRACE_CALLS = 8
+
+# cheatcode addresses: hevm, svm, console
+CHEATCODE_ADDRESSES = frozenset(
+    {
+        0x7109709ECFA91A80626FF3989D68F67F5B1DD12D,
+        0xF3993A62377BCD56AE39D773740A5390411E8BC9,
+        0x000000000000000000636F6E736F6C652E6C6F67,
+    }
+)
+
+
+def segments_of(expr) -> list[Segment] | None:
+    """The calldata as constant bytes and (bits of) symbols, None if it is more complex"""
+    from z3 import (
+        Z3_OP_CONCAT,
+        Z3_OP_EXTRACT,
+        Z3_OP_UNINTERPRETED,
+        Z3_OP_ZERO_EXT,
+        is_app,
+        is_bv_value,
+    )
+
+    if isinstance(expr, bytes):
+        return [Segment(const=int.from_bytes(expr, "big"), size=8 * len(expr))]
+
+    if is_bv_value(expr):
+        return [Segment(const=expr.as_long(), size=expr.size())]
+
+    if not is_app(expr):
+        return None
+
+    kind = expr.decl().kind()
+    if kind == Z3_OP_CONCAT:
+        result = []
+        for child in expr.children():
+            segments = segments_of(child)
+            if segments is None:
+                return None
+            result.extend(segments)
+        return result
+
+    if kind == Z3_OP_UNINTERPRETED and expr.num_args() == 0:
+        return [Segment(symbol=expr.decl().name(), size=expr.size())]
+
+    if kind == Z3_OP_EXTRACT:
+        hi, lo = expr.params()
+        child = expr.arg(0)
+        if child.decl().kind() == Z3_OP_UNINTERPRETED and child.num_args() == 0:
+            return [Segment(symbol=child.decl().name(), size=hi - lo + 1, hi=hi, lo=lo)]
+        return None
+
+    if kind == Z3_OP_ZERO_EXT:
+        (bits,) = expr.params()
+        inner = segments_of(expr.arg(0))
+        if inner is None:
+            return None
+        return [Segment(const=0, size=bits), *inner]
+
+    return None
+
+
+def collect_trace_calls(context, exclude: set[str]) -> tuple[TraceCall, ...]:
+    """
+    Calls of the trace whose calldata depends on symbols that are not in `exclude` (the
+    arguments of the test), e.g. calldata created by svm.createCalldata()
+    """
+    from dolmos.sevm import CallContext
+
+    result = []
+    stack = [context]
+    while stack and len(result) < MAX_TRACE_CALLS:
+        current = stack.pop()
+        subcalls = [e for e in current.trace if isinstance(e, CallContext)]
+        stack.extend(reversed(subcalls))
+        if current is context:
+            continue
+
+        message = current.message
+        if message.is_create():
+            continue
+        target = concrete_int(message.target)
+        if target in CHEATCODE_ADDRESSES:
+            continue
+
+        try:
+            data = message.data
+            raw = data.unwrap() if hasattr(data, "unwrap") else data
+            if isinstance(raw, bytes):
+                continue
+            segments = segments_of(raw)
+        except Exception:
+            continue
+
+        if not segments:
+            continue
+        symbols = {s.symbol for s in segments if s.symbol is not None}
+        if not symbols or symbols <= exclude:
+            continue
+        if sum(s.size for s in segments) % 8:
+            continue
+
+        result.append(TraceCall(target, ref_of(message.value), tuple(segments)))
+
+    return tuple(result)
+
+
+def collect_test_vars(contract_json: dict, storage_data) -> dict:
+    """address -> (label, type label) of the address and contract state variables of the test"""
+    result = {}
+    if storage_data is None:
+        return result
+
+    layout = contract_json.get("storageLayout") or {}
+    types = layout.get("types") or {}
+    for var in layout.get("storage") or []:
+        type_label = (types.get(var.get("type")) or {}).get("label", "")
+        if not (
+            type_label.startswith("contract ")
+            or type_label in ("address", "address payable")
+        ):
+            continue
+        try:
+            slot, offset = int(var["slot"]), int(var["offset"])
+            key = (slot, 0, 0)
+            if key not in storage_data:
+                continue
+            word = concrete_int(storage_data[key])
+        except Exception:
+            continue
+        if word is None:
+            continue
+        address = (word >> (8 * offset)) % 2**160
+        if address and address not in result:
+            result[address] = (var["label"], type_label)
+    return result
+
+
+def collect_layout(fn_ctx, ex, is_invariant: bool, is_probe: bool) -> CexLayout:
+    """
+    Collects what is needed to render a counterexample of the given execution.
+
+    Runs on the main thread, when a potential assertion violation is found. The result is
+    plain Python data, as it is used later by the solver callbacks.
+    """
+    from dolmos.build import get_source_path
+    from dolmos.calldata import get_abi
+    from dolmos.mapper import BuildOut
+    from dolmos.sevm import FOUNDRY_TEST
+
+    contract_ctx = fn_ctx.contract_ctx
+    args = fn_ctx.args
+    index = selector_index(contract_ctx.build_out_map)
+
+    # contract names of the deployed addresses
+    addr_names = {}
+    for addr, code in ex.code.items():
+        value = concrete_int(addr)
+        name = getattr(code, "contract_name", None)
+        if value is not None and name:
+            addr_names[value] = name
+    addr_names[concrete_int(FOUNDRY_TEST)] = contract_ctx.name
+
+    # state variables of the test contract that hold the deployed contracts
+    test_vars = {}
+    if args.storage_layout == "solidity":
+        state = fn_ctx.setup_ex or ex
+        try:
+            storage = state.storage.get(FOUNDRY_TEST)
+            test_vars = collect_test_vars(contract_ctx.contract_json, storage)
+        except Exception:
+            test_vars = {}
+
+    def abi_item_of(addr, fun_info) -> dict | None:
+        if fun_info is None or not fun_info.contract_name or not fun_info.sig:
+            return None
+        try:
+            code = ex.code.get(addr)
+            filename = getattr(code, "filename", None)
+            contract_json = BuildOut().get_by_name(fun_info.contract_name, filename)
+            return get_abi(contract_json).get(fun_info.sig)
+        except Exception:
+            return None
+
+    sequence = []
+    if is_invariant:
+        for call_ctx in ex.call_sequence:
+            message = call_ctx.message
+            item = abi_item_of(message.target, message.fun_info)
+            sequence.append(call_layout(message, item, None))
+
+    message = ex.context.message
+    if is_probe:
+        # the failing call is the last call of the sequence
+        fun_info = message.fun_info
+        fun_name = fun_info.name if fun_info and fun_info.name else "probe"
+        fun_sig = fun_info.sig if fun_info and fun_info.sig else fun_name
+        test_call = None
+        test_overloaded = False
+    else:
+        fun_info = fn_ctx.info
+        fun_name, fun_sig = fun_info.name, fun_info.sig
+        test_call = call_layout(
+            message, contract_ctx.abi.get(fun_sig), contract_ctx.name
+        )
+        test_overloaded = index.is_overloaded(contract_ctx.name, fun_name)
+
+    trace_calls = ()
+    if test_call is not None:
+        params = {name for names in test_call.symbols.values() for name in names}
+        try:
+            trace_calls = collect_trace_calls(ex.context, params)
+        except Exception:
+            trace_calls = ()
+
+    try:
+        test_source = get_source_path(contract_ctx.contract_json)
+    except Exception:
+        test_source = None
+
+    return CexLayout(
+        test_contract=contract_ctx.name,
+        test_source=test_source,
+        fun_name=fun_name,
+        fun_sig=fun_sig,
+        is_invariant=is_invariant,
+        is_probe=is_probe,
+        test_call=test_call,
+        sequence=tuple(sequence),
+        render_ctx=RenderContext(
+            addr_names=addr_names,
+            test_vars=test_vars,
+            deployed=frozenset(addr_names.values()),
+            index=index,
+        ),
+        test_overloaded=test_overloaded,
+        trace_calls=trace_calls,
+    )
diff --git a/src/dolmos/precompiles.py b/src/dolmos/precompiles.py
new file mode 100644
index 000000000..26fdd9f39
--- /dev/null
+++ b/src/dolmos/precompiles.py
@@ -0,0 +1,187 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+"""
+Models for the hashing and modular exponentiation precompiles.
+
+The precompile input is a ByteVec whose length is in *bytes*, while z3 sorts are
+sized in *bits*. Mixing the two up produced sort mismatches for every symbolic
+call to SHA256, RIPEMD160 and MODEXP (halmos issue #402).
+
+Concrete inputs are evaluated exactly. Symbolic inputs are modeled with
+uninterpreted functions constrained by the properties that always hold.
+"""
+
+import hashlib
+
+from z3 import (
+    ULT,
+    BitVecRef,
+    Extract,
+    Function,
+    If,
+    Implies,
+    Or,
+    ZeroExt,
+    is_bv,
+)
+
+from dolmos.bytevec import ByteVec
+from dolmos.utils import BitVecSorts, bytes_to_bv_value, con
+
+# EIP-7823 (osaka): each length field of a MODEXP input is capped at 1024 bytes;
+# larger inputs make the precompile fail
+MODEXP_MAX_INPUT_SIZE = 1024
+
+# ripemd160(b"")
+EMPTY_RIPEMD160 = bytes.fromhex("9c1185a5c5e9fc54612808977ee8f548b2258d31")
+
+
+def _as_bv(data: bytes | BitVecRef) -> BitVecRef:
+    """Convert non-empty unwrapped bytes to a bitvector."""
+    return data if is_bv(data) else bytes_to_bv_value(data)
+
+
+def _ripemd160(data: bytes) -> bytes | None:
+    if not data:
+        return EMPTY_RIPEMD160
+    try:
+        return hashlib.new("ripemd160", data).digest()
+    except ValueError:
+        # not available in some OpenSSL 3 builds
+        return None
+
+
+def sha256(arg: ByteVec) -> ByteVec:
+    data = arg.unwrap()
+
+    if not is_bv(data):
+        return ByteVec(hashlib.sha256(data).digest())
+
+    size_bits = len(arg) * 8
+    f_sha256 = Function(
+        f"f_sha256_{len(arg)}", BitVecSorts[size_bits], BitVecSorts[256]
+    )
+    return ByteVec(f_sha256(data))
+
+
+def ripemd160(arg: ByteVec) -> ByteVec:
+    data = arg.unwrap()
+
+    # the 20-byte digest is returned left-padded to 32 bytes
+    if not is_bv(data) and (digest := _ripemd160(data)) is not None:
+        return ByteVec(bytes(12) + digest)
+
+    size_bits = len(arg) * 8
+    f_ripemd160 = Function(
+        f"f_ripemd160_{len(arg)}", BitVecSorts[size_bits], BitVecSorts[160]
+    )
+    return ByteVec(ZeroExt(96, f_ripemd160(_as_bv(data))))
+
+
+def modexp(ex, arg: ByteVec) -> ByteVec | None:
+    """
+    Returns the output of MODEXP, or None if the precompile fails.
+
+    Input layout (EIP-198):
+        <len(B)> <len(E)> <len(M)> <B> <E> <M>
+    each length is a 32-byte word; missing input bytes are read as zeros.
+    The output is (B ** E) % M, encoded on len(M) bytes (0 if M == 0).
+    """
+
+    b_size = ex.int_of(arg.get_word(0), "symbolic MODEXP base length")
+    e_size = ex.int_of(arg.get_word(32), "symbolic MODEXP exponent length")
+    m_size = ex.int_of(arg.get_word(64), "symbolic MODEXP modulus length")
+
+    if max(b_size, e_size, m_size) > MODEXP_MAX_INPUT_SIZE:
+        return None
+
+    if m_size == 0:
+        return ByteVec()
+
+    b_start = 96
+    e_start = b_start + b_size
+    m_start = e_start + e_size
+
+    b = arg.slice(b_start, e_start).unwrap() if b_size else b""
+    e = arg.slice(e_start, m_start).unwrap() if e_size else b""
+    m = arg.slice(m_start, m_start + m_size).unwrap()
+
+    # fully concrete: compute the exact result
+    if not any(is_bv(x) for x in (b, e, m)):
+        m_int = int.from_bytes(m, "big")
+        if m_int == 0:
+            return ByteVec(bytes(m_size))
+        b_int = int.from_bytes(b, "big")
+        e_int = int.from_bytes(e, "big")
+        return ByteVec(pow(b_int, e_int, m_int).to_bytes(m_size, "big"))
+
+    m_bits = m_size * 8
+    m_bv = _as_bv(m)
+    zero_m, one_m = con(0, m_bits), con(1, m_bits)
+
+    # x ** 0 == 1, and 1 % 1 == 0
+    one_mod_m = If(m_bv == one_m, zero_m, one_m)
+
+    # b % m, computed on a common width.
+    # like the MOD opcode, the (nonlinear) remainder is abstracted with an
+    # uninterpreted function: z3 rewrites a guarded URem into its internal
+    # `bvurem_i` operator, which external solvers don't understand.
+    width = max(b_size, m_size) * 8
+
+    def mod_m(x: BitVecRef, x_bits: int) -> BitVecRef:
+        x_ext = ZeroExt(width - x_bits, x) if width > x_bits else x
+        m_ext = ZeroExt(width - m_bits, m_bv) if width > m_bits else m_bv
+        f_rem = Function(
+            f"f_evm_bvurem_{width}",
+            BitVecSorts[width],
+            BitVecSorts[width],
+            BitVecSorts[width],
+        )
+        r = f_rem(x_ext, m_ext)
+        ex.path.append(Implies(m_ext != 0, ULT(r, m_ext)))
+        return r if width == m_bits else Extract(m_bits - 1, 0, r)
+
+    b_bv = _as_bv(b) if b_size else None
+    b_mod_m = mod_m(b_bv, b_size * 8) if b_size else zero_m
+
+    e_is_concrete = not is_bv(e)
+    e_int = int.from_bytes(e, "big") if e_is_concrete else None
+
+    if e_is_concrete and e_int == 0:
+        result = one_mod_m
+
+    elif e_is_concrete and e_int == 1:
+        result = b_mod_m
+
+    elif b_size == 0:
+        # 0 ** e == 0 for e > 0
+        result = zero_m if e_is_concrete else If(_as_bv(e) == 0, one_mod_m, zero_m)
+
+    else:
+        e_bv = con(e_int, e_size * 8) if e_is_concrete else _as_bv(e)
+        f_modexp = Function(
+            f"f_modexp_{b_size}_{e_size}_{m_size}",
+            BitVecSorts[b_size * 8],
+            BitVecSorts[e_size * 8],
+            BitVecSorts[m_bits],
+            BitVecSorts[m_bits],
+        )
+        f_val = f_modexp(b_bv, e_bv, m_bv)
+
+        # properties of the abstraction:
+        #   - the result is reduced modulo m
+        #   - base 0 or 1, and exponent 1, are computed exactly
+        ex.path.append(Implies(m_bv != zero_m, ULT(f_val, m_bv)))
+
+        result = If(
+            e_bv == 0,
+            one_mod_m,
+            If(
+                Or(b_bv == 0, b_bv == 1, e_bv == 1),
+                b_mod_m,
+                f_val,
+            ),
+        )
+
+    result = If(m_bv == zero_m, zero_m, result)
+    return ByteVec(result)
diff --git a/src/halmos/processes.py b/src/dolmos/processes.py
similarity index 98%
rename from src/halmos/processes.py
rename to src/dolmos/processes.py
index 377827568..30764e23a 100644
--- a/src/halmos/processes.py
+++ b/src/dolmos/processes.py
@@ -80,7 +80,7 @@ def run():
                 self.set_result((self.stdout, self.stderr, self.returncode))
 
         # avoid daemon threads because they can cause issues during shutdown
-        # we don't expect them to actually prevent halmos from terminating,
+        # we don't expect them to actually prevent dolmos from terminating,
         # as long as the underlying processes are terminated (either by natural
         # causes or by forceful termination)
         threading.Thread(target=run, daemon=False).start()
@@ -117,7 +117,7 @@ def cancel(self):
 
         # ensure file descriptors are closed after process termination.
         # note: when a process is killed via psutil, the file descriptors remain open on the Python side,
-        # leading to resource leaks. see: https://github.com/a16z/halmos/issues/523
+        # leading to resource leaks. see upstream halmos issue #523
         if self.process:
             for stream in [
                 self.process.stdout,
diff --git a/src/halmos/sevm.py b/src/dolmos/sevm.py
similarity index 77%
rename from src/halmos/sevm.py
rename to src/dolmos/sevm.py
index 3d2ead175..b63f96a8c 100644
--- a/src/halmos/sevm.py
+++ b/src/dolmos/sevm.py
@@ -5,7 +5,7 @@
 from collections import Counter, defaultdict
 from collections.abc import Callable, Iterator
 from copy import deepcopy
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from datetime import timedelta
 from functools import reduce
 from timeit import default_timer as timer
@@ -29,6 +29,7 @@
     ArrayRef,
     BitVec,
     BitVecRef,
+    BitVecVal,
     BoolRef,
     BoolVal,
     CheckSatResult,
@@ -53,16 +54,17 @@
 )
 from z3.z3util import is_expr_var
 
-from halmos.bitvec import ONE, ZERO, is_power_of_two
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bitvec import HalmosBool as Bool
-from halmos.bytevec import ByteVec, SymbolicChunk
-from halmos.calldata import FunctionInfo
-from halmos.cheatcodes import Prank, halmos_cheat_code, hevm_cheat_code
-from halmos.config import Config as HalmosConfig
-from halmos.console import console
-from halmos.constants import MAX_ETH, MAX_MEMORY_SIZE
-from halmos.contract import (
+from dolmos import lasso, precompiles
+from dolmos.bitvec import ONE, ZERO, is_power_of_two
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bitvec import DolmosBool as Bool
+from dolmos.bytevec import ByteVec, SymbolicChunk
+from dolmos.calldata import FunctionInfo
+from dolmos.cheatcodes import Prank, hevm_cheat_code, svm_cheat_code
+from dolmos.config import Config as DolmosConfig
+from dolmos.console import console
+from dolmos.constants import MAX_ETH, MAX_MEMORY_SIZE
+from dolmos.contract import (
     CALL_OPCODES,
     CREATE_OPCODES,
     OP_ADD,
@@ -71,6 +73,8 @@
     OP_AND,
     OP_BALANCE,
     OP_BASEFEE,
+    OP_BLOBBASEFEE,
+    OP_BLOBHASH,
     OP_BLOCKHASH,
     OP_BYTE,
     OP_CALL,
@@ -80,6 +84,7 @@
     OP_CALLER,
     OP_CALLVALUE,
     OP_CHAINID,
+    OP_CLZ,
     OP_CODECOPY,
     OP_CODESIZE,
     OP_COINBASE,
@@ -132,6 +137,7 @@
     OP_SAR,
     OP_SDIV,
     OP_SELFBALANCE,
+    OP_SELFDESTRUCT,
     OP_SGT,
     OP_SHA3,
     OP_SHL,
@@ -156,11 +162,18 @@
     Instruction,
     mnemonic,
 )
-from halmos.exceptions import (
+from dolmos.evm_version import (
+    EVM_VERSIONS,
+    LATEST_EVM_VERSION,
+    is_at_least,
+    normalize_evm_version,
+    unavailable_opcodes,
+)
+from dolmos.exceptions import (
     AddressCollision,
+    DolmosException,
     EvmException,
     FailCheatcode,
-    HalmosException,
     InfeasiblePath,
     InsufficientFunds,
     InvalidJumpDestError,
@@ -174,16 +187,24 @@
     StackUnderflowError,
     WriteInStaticContext,
 )
-from halmos.logs import (
+from dolmos.expectations import (
+    DUMMY_CALL_OUTPUT,
+    Expectations,
+    as_z3_word,
+    emits_match,
+    find_reverter,
+    revert_reason_matches,
+)
+from dolmos.logs import (
     INTERNAL_ERROR,
     debug,
     debug_once,
     warn,
     warn_code,
 )
-from halmos.mapper import BuildOut
-from halmos.ui import ui
-from halmos.utils import (
+from dolmos.mapper import BuildOut
+from dolmos.ui import ui
+from dolmos.utils import (
     Address,
     BitVecSort160,
     BitVecSort256,
@@ -259,7 +280,7 @@
 
 CHEATCODE_ADDRESSES: tuple[BV, ...] = (
     hevm_cheat_code.address,
-    halmos_cheat_code.address,
+    svm_cheat_code.address,
     console.address,
 )
 
@@ -296,9 +317,76 @@
 
 create2_magic_address: int = 0xBBBB0000
 
+create_magic_address: int = 0xCCCC0000
+
 new_address_offset: int = 1
 
 
+def rlp_create_preimage(sender: Address, nonce: int) -> BitVecRef:
+    """
+    Returns the RLP encoding of [sender, nonce], i.e. the preimage of the keccak hash
+    that determines the address of a contract deployed with CREATE.
+
+    This is the encoding that contracts use to predict CREATE addresses themselves,
+    e.g. CREATE3 libraries computing keccak256(abi.encodePacked(hex"d694", proxy, hex"01")).
+    """
+
+    if nonce < 0:
+        raise ValueError(nonce)
+
+    if nonce == 0:
+        # the empty string is encoded as 0x80
+        nonce_rlp = con(0x80, 8)
+    elif nonce < 0x80:
+        # a single byte below 0x80 is its own encoding
+        nonce_rlp = con(nonce, 8)
+    else:
+        num_bytes = (nonce.bit_length() + 7) // 8
+        nonce_rlp = Concat(con(0x80 + num_bytes, 8), con(nonce, 8 * num_bytes))
+
+    # 1 byte for the address prefix (0x94) + 20 address bytes + the encoded nonce
+    payload_size = 21 + nonce_rlp.size() // 8
+
+    return simplify(
+        Concat(
+            con(0xC0 + payload_size, 8),
+            con(0x94, 8),
+            uint160(sender).as_z3(),
+            nonce_rlp,
+        )
+    )
+
+
+def is_rlp_create_preimage(data: Bytes, size: int) -> bool:
+    """
+    Returns true if the given data looks like the RLP encoding of [address, nonce],
+    i.e. `0xc0+n 0x94 <20-byte address> <encoded nonce>`.
+    """
+
+    # 23 bytes for a nonce in [0, 0x7f], more for larger nonces
+    if not (23 <= size <= 32):
+        return False
+
+    data = ByteVec(data)
+    list_prefix = unbox_int(data.get_byte(0))
+    addr_prefix = unbox_int(data.get_byte(1))
+
+    return (
+        isinstance(list_prefix, int)
+        and isinstance(addr_prefix, int)
+        and list_prefix == 0xC0 + size - 1
+        and addr_prefix == 0x94
+    )
+
+
+def lasso_jumpid_tokens(ex) -> tuple:
+    """Jump destinations below the operands of the JUMPI about to be executed."""
+    valid_jumpdests = ex.pgm.valid_jumpdests()
+    return tuple(
+        value for x in ex.st.stack[:-2] if (value := x.value) in valid_jumpdests
+    )
+
+
 def jumpid_str(jumpid: JumpID) -> str:
     pc, jumpdests = jumpid
     return f"{pc}:{','.join(str(j) for j in jumpdests)}"
@@ -459,7 +547,7 @@ class CallOutput:
 
     data: ByteVec | None = None
     accounts_to_delete: set[Address] = field(default_factory=set)
-    error: EvmException | HalmosException | None = None
+    error: EvmException | DolmosException | None = None
     return_scheme: int | None = None
 
     # TODO:
@@ -518,6 +606,11 @@ class CallContext:
     depth: int = 1
     trace: list[TraceElement] = field(default_factory=list)
     prank: Prank = field(default_factory=Prank)
+    # pending vm.expectRevert / vm.expectEmit expectations of this frame
+    expectations: Expectations = field(default_factory=Expectations)
+    # return data seen by the caller, if different from output.data
+    # (a call that reverted as expected is reported as successful)
+    returndata_override: ByteVec | None = None
 
     def subcalls(self) -> Iterator["CallContext"]:
         return iter(t for t in self.trace if isinstance(t, CallContext))
@@ -544,13 +637,13 @@ def is_stuck(self) -> bool:
         This is meaningless during execution, because the call may not yet have an output
         """
         data, error = self.output.data, self.output.error
-        return data is None or isinstance(error, HalmosException)
+        return data is None or isinstance(error, DolmosException)
 
-    def get_stuck_reason(self) -> HalmosException | None:
+    def get_stuck_reason(self) -> DolmosException | None:
         """
         Returns the first internal error encountered during the execution of the call.
         """
-        if isinstance(self.output.error, HalmosException):
+        if isinstance(self.output.error, DolmosException):
             return self.output.error
 
         if self.output.data is not None:
@@ -710,6 +803,8 @@ class Block:
     gaslimit: BitVecRef
     number: BitVecRef
     timestamp: BitVecRef
+    blobbasefee: BitVecRef  # EIP-4844 / Cancun — opcode 0x4A
+    blobhashes: list  # EIP-4844 / Cancun — opcode 0x49, list of BitVecRef (256-bit)
 
     def __init__(self, **kwargs) -> None:
         self.basefee = kwargs["basefee"]
@@ -719,6 +814,8 @@ def __init__(self, **kwargs) -> None:
         self.gaslimit = kwargs["gaslimit"]
         self.number = kwargs["number"]
         self.timestamp = kwargs["timestamp"]
+        self.blobbasefee = kwargs.get("blobbasefee", ZERO)  # 0 par défaut
+        self.blobhashes = kwargs.get("blobhashes", [])  # pas de blobs par défaut
 
         assert_address(self.coinbase)
 
@@ -1175,6 +1272,7 @@ class Exec:  # an execution path
     st: State  # stack and memory
     jumpis: dict[JumpID, dict[bool, int]]  # for loop detection
     addresses_to_delete: set[Address]
+    created_in_tx: set[Address]  # accounts created in the current transaction
 
     # path
     path: Path  # path conditions
@@ -1182,6 +1280,7 @@ class Exec:  # an execution path
 
     # internal bookkeeping
     cnts: dict[str, int]  # counters
+    nonces: dict[str, int]  # account nonces, used for CREATE address derivation
     sha3s: KeccakRegistry  # sha3 hashes generated
     storages: dict[Any, Any]  # storage updates
     balances: dict[Any, Any]  # balance updates
@@ -1212,12 +1311,22 @@ def __init__(self, **kwargs) -> None:
         )
         self.st = kwargs["st"]
         self.jumpis = kwargs["jumpis"]
+        # stack snapshots at symbolic JUMPIs, only recorded with --dump-lassos
+        self.loop_snapshots = kwargs.get("loop_snapshots") or {}
         self.addresses_to_delete = kwargs.get("addresses_to_delete") or set()
+        # accounts created in the current transaction (EIP-6780, SELFDESTRUCT).
+        # note: an empty set must be preserved as-is, so that sub-contexts share it
+        created_in_tx = kwargs.get("created_in_tx")
+        self.created_in_tx = created_in_tx if created_in_tx is not None else set()
         #
         self.path = kwargs["path"]
         self.alias = kwargs["alias"]
         #
         self.cnts = kwargs["cnts"]
+        # note: an empty dict must be preserved as-is, so that sub-contexts keep
+        # sharing the same nonce map as their parent frame
+        nonces = kwargs.get("nonces")
+        self.nonces = nonces if nonces is not None else defaultdict(int)
         self.sha3s = kwargs["sha3s"]
         self.storages = kwargs["storages"]
         self.balances = kwargs["balances"]
@@ -1248,10 +1357,10 @@ def halt(
     ) -> None:
         output = self.context.output
         if output.data is not None:
-            raise HalmosException("output already set")
+            raise DolmosException("output already set")
 
         if data is not None and not isinstance(data, ByteVec):
-            raise HalmosException(f"invalid output data {data}")
+            raise DolmosException(f"invalid output data {data}")
 
         output.data = data
         output.error = error
@@ -1436,13 +1545,13 @@ def balance_of(self, addr: Word) -> Word:
         # practical assumption on the max balance per account
         if is_bv_value(value):
             if (v := value.as_long()) > MAX_ETH:
-                raise HalmosException(f"balance {v} > MAX_ETH")
+                raise DolmosException(f"balance {v} > MAX_ETH")
         else:
             cond = simplify(ULE(value, con(MAX_ETH)))
 
             # stop the current path if we know the balance is definitely greater than MAX_ETH
             if is_false(cond):
-                raise HalmosException(f"balance {value} > MAX_ETH")
+                raise DolmosException(f"balance {value} > MAX_ETH")
 
             self.path.append(cond)
 
@@ -1527,7 +1636,7 @@ def sha3_data(self, data: Bytes) -> Word:
             sha3_hash_int = int.from_bytes(sha3_hash, "big")
             if sha3_hash_int == 0 or sha3_hash_int > 2**256 - 2**64:
                 error_msg = f"hash value outside expected range: {sha3_hash.hex()}"
-                raise HalmosException(error_msg)
+                raise DolmosException(error_msg)
 
         else:
             # assume hash values are non-zero and sufficiently small to prevent overflow when adding reasonable offsets
@@ -1547,6 +1656,12 @@ def sha3_data(self, data: Bytes) -> Word:
             if isinstance(first_byte, int) and first_byte == 0xFF:
                 return con(create2_magic_address + self.sha3s.get_id(sha3_expr))
 
+        # handle create hash: keccak256(rlp([sender, nonce]))
+        # Exec.new_address() returns the same magic address, so that contracts
+        # predicting CREATE addresses (e.g. CREATE3 libraries) agree with the executor
+        if is_rlp_create_preimage(data, size):
+            return con(create_magic_address + self.sha3s.get_id(sha3_expr))
+
         # return the concrete hash value if available, otherwise return the hash expression
         return sha3_hash_bv if sha3_hash is not None else sha3_expr
 
@@ -1587,9 +1702,36 @@ def new_gas_id(self) -> int:
         self.cnts["gas"] += 1
         return self.cnts["gas"]
 
-    def new_address(self) -> Address:
-        self.cnts["address"] += 1
-        return con_addr(magic_address + new_address_offset + self.cnts["address"])
+    def nonce_key(self, addr: Address) -> str:
+        # normalize the address, so that BV and z3 representations map to the same key
+        return str(uint160(addr).as_z3())
+
+    def nonce_of(self, addr: Address) -> int:
+        return self.nonces[self.nonce_key(addr)]
+
+    def set_nonce(self, addr: Address, nonce: int) -> None:
+        self.nonces[self.nonce_key(addr)] = nonce
+
+    def bump_nonce(self, addr: Address) -> None:
+        self.nonces[self.nonce_key(addr)] += 1
+
+    def new_address(self, sender: Address | None = None) -> Address:
+        """
+        Returns the address of the contract to be created by `sender` with CREATE.
+
+        The address is derived from keccak256(rlp([sender, nonce])) as in the EVM,
+        except that sha3_data() maps the hash to a magic address (see sha3_data).
+        This keeps addresses concrete and short while staying consistent with
+        contracts that predict CREATE addresses themselves.
+        """
+
+        if sender is None:
+            # legacy behavior, used when no sender is available (e.g. library deployment)
+            self.cnts["address"] += 1
+            return con_addr(magic_address + new_address_offset + self.cnts["address"])
+
+        preimage = rlp_create_preimage(sender, self.nonce_of(sender))
+        return uint160(self.sha3_data(preimage)).as_z3()
 
     def new_symbol_id(self) -> int:
         self.cnts["symbol"] += 1
@@ -1608,6 +1750,9 @@ def returndata(self) -> ByteVec | None:
         if not last_subcall:
             return EMPTY_BYTES
 
+        if last_subcall.returndata_override is not None:
+            return last_subcall.returndata_override
+
         output = last_subcall.output
         if last_subcall.message.is_create() and not output.error:
             return EMPTY_BYTES
@@ -1796,6 +1941,7 @@ def init(
     def load(cls, ex: Exec, storage: dict, addr: Any, loc: Word) -> Word:
         (slot, keys, num_keys, size_keys) = cls.get_key_structure(ex, loc)
 
+        cls.migrate_flat_slot(ex, storage, addr, loc, slot, keys)
         cls.init(ex, storage, addr, slot, keys, num_keys, size_keys)
 
         storage_addr = storage[addr]
@@ -1818,6 +1964,7 @@ def load(cls, ex: Exec, storage: dict, addr: Any, loc: Word) -> Word:
     def store(cls, ex: Exec, storage: dict, addr: Any, loc: Any, val: Any) -> None:
         (slot, keys, num_keys, size_keys) = cls.get_key_structure(ex, loc)
 
+        cls.migrate_flat_slot(ex, storage, addr, loc, slot, keys)
         cls.init(ex, storage, addr, slot, keys, num_keys, size_keys)
 
         storage_addr = storage[addr]
@@ -1837,6 +1984,51 @@ def store(cls, ex: Exec, storage: dict, addr: Any, loc: Any, val: Any) -> None:
         storage_addr[slot, num_keys, size_keys] = new_storage_var
         ex.storages[new_storage_var] = new_storage
 
+    @classmethod
+    def migrate_flat_slot(
+        cls, ex: Exec, storage: dict, addr: Any, loc: Any, slot: int, keys: tuple
+    ) -> None:
+        """
+        Move a value stored under a raw concrete slot to its structured location.
+
+        A concrete slot is decoded as `(slot, keys)` only if the keccak preimage of
+        the slot is known, i.e. once a SHA3 producing it has been executed (or it is
+        in the precomputed registry). The optimizer (notably via-IR) may constant-fold
+        `keccak256(k . p)` into a PUSH32 literal, e.g. in a constructor writing
+        `m[k] = v`, while the runtime code computes the same slot with SHA3.
+        The first access is then stored under the flat key `(0x<hash>,)` and the
+        later ones under `(p, k)`, so the value written by the former is lost
+        (a16z/halmos#579). When a structured access is resolved from a concrete
+        slot, the flat entry, if any, is moved to the structured location first.
+        """
+        if not keys:
+            return
+
+        loc = normalize(loc)
+        if not is_bv_value(loc):
+            return
+
+        flat_key = (loc.as_long(), 0, 0)
+        storage_addr = storage[addr]
+        if flat_key not in storage_addr:
+            return
+
+        val = storage_addr._mapping.pop(flat_key)
+        num_keys = len(keys)
+        size_keys = cls.bitsize(keys)
+        cls.init(ex, storage, addr, slot, keys, num_keys, size_keys)
+
+        new_storage_var = Array(
+            f"storage_{id_str(addr)}_{slot}_{num_keys}_{size_keys}_{uid()}_{1 + len(ex.storages):>02}",
+            BitVecSorts[size_keys],
+            BitVecSort256,
+        )
+        new_storage = Store(storage_addr[slot, num_keys, size_keys], concat(keys), val)
+        ex.path.append(new_storage_var == new_storage)
+
+        storage_addr[slot, num_keys, size_keys] = new_storage_var
+        ex.storages[new_storage_var] = new_storage
+
     @classmethod
     def get_key_structure(cls, ex, loc) -> tuple:
         offsets = cls.decode(ex, loc)
@@ -1951,8 +2143,10 @@ def init(
 
     @classmethod
     def load(cls, ex: Exec, storage: dict, addr: Any, loc: Word) -> Word:
+        raw_loc = loc
         loc = cls.decode(ex, loc)
         size_keys = loc.size()
+        cls.migrate_flat_slot(ex, storage, addr, raw_loc, loc)
 
         cls.init(ex, storage, addr, loc, size_keys)
 
@@ -1968,8 +2162,10 @@ def load(cls, ex: Exec, storage: dict, addr: Any, loc: Word) -> Word:
 
     @classmethod
     def store(cls, ex: Exec, storage: dict, addr: Any, loc: Any, val: Any) -> None:
+        raw_loc = loc
         loc = cls.decode(ex, loc)
         size_keys = loc.size()
+        cls.migrate_flat_slot(ex, storage, addr, raw_loc, loc)
 
         cls.init(ex, storage, addr, loc, size_keys)
 
@@ -1986,6 +2182,58 @@ def store(cls, ex: Exec, storage: dict, addr: Any, loc: Any, val: Any) -> None:
         storage_addr[size_keys] = new_storage_var
         ex.storages[new_storage_var] = new_storage
 
+    @classmethod
+    def migrate_flat_slot(
+        cls, ex: Exec, storage: dict, addr: Any, raw_loc: Any, loc: BitVecRef
+    ) -> None:
+        """
+        Same as SolidityStorage.migrate_flat_slot (a16z/halmos#579): a value written
+        under the raw 256-bit concrete slot, before its keccak preimage was known,
+        is copied to the decoded location. Each raw slot is migrated at most once,
+        so that later writes to the decoded location are not overwritten.
+        """
+        raw_loc = normalize(raw_loc)
+        if not is_bv_value(raw_loc) or eq(raw_loc, loc):
+            return
+
+        storage_addr = storage[addr]
+        flat_size = raw_loc.size()
+        if flat_size not in storage_addr:
+            return
+
+        migrated = storage_addr.__dict__.setdefault("migrated_slots", set())
+        raw_int = raw_loc.as_long()
+        if raw_int in migrated:
+            return
+
+        # only migrate slots that were explicitly written under the raw key
+        arr = storage_addr[flat_size]
+        written = False
+        while arr in ex.storages:
+            store = ex.storages[arr]
+            if store.decl().name() != "store" or store.num_args() != 3:
+                break
+            if eq(store.arg(1), raw_loc):
+                written = True
+                break
+            arr = store.arg(0)
+        if not written:
+            return
+
+        migrated.add(raw_int)
+        val = ex.select(storage_addr[flat_size], raw_loc, ex.storages)
+        size_keys = loc.size()
+        cls.init(ex, storage, addr, loc, size_keys)
+        new_storage_var = Array(
+            f"storage_{id_str(addr)}_{size_keys}_{uid()}_{1 + len(ex.storages):>02}",
+            BitVecSorts[size_keys],
+            BitVecSort256,
+        )
+        new_storage = Store(storage_addr[size_keys], loc, val)
+        ex.path.append(new_storage_var == new_storage)
+        storage_addr[size_keys] = new_storage_var
+        ex.storages[new_storage_var] = new_storage
+
     @classmethod
     def decode(cls, ex, loc: Any) -> Any:
         loc = normalize(loc)
@@ -2057,14 +2305,16 @@ def bitwise(op, x: Word, y: Word) -> Word:
         raise ValueError(op, x, y)
 
 
-class HalmosLogs:
+class DolmosLogs:
     bounded_loops: list[JumpID]
 
     def __init__(self) -> None:
         self.bounded_loops = []
+        self.lassos: list[lasso.LassoResult] = []
 
-    def extend(self, logs: "HalmosLogs") -> None:
+    def extend(self, logs: "DolmosLogs") -> None:
         self.bounded_loops.extend(logs.bounded_loops)
+        self.lassos.extend(logs.lassos)
 
 
 @dataclass(slots=True, eq=False, order=False)
@@ -2087,21 +2337,45 @@ def __len__(self) -> int:
         return len(self.stack)
 
 
+def resolve_evm_version(name: str) -> str:
+    if not name:
+        return LATEST_EVM_VERSION
+
+    version = normalize_evm_version(name)
+    if version is None:
+        raise DolmosException(
+            f"unsupported EVM version: {name} (supported: {', '.join(EVM_VERSIONS)})"
+        )
+    return version
+
+
 class SEVM:
-    options: HalmosConfig
+    options: DolmosConfig
     fun_info: FunctionInfo
     storage_model: type[SomeStorage]
-    logs: HalmosLogs
+    logs: DolmosLogs
 
-    def __init__(self, options: HalmosConfig, fun_info: FunctionInfo) -> None:
+    def __init__(self, options: DolmosConfig, fun_info: FunctionInfo) -> None:
         self.options = options
         self.fun_info = fun_info
-        self.logs = HalmosLogs()
+        self.logs = DolmosLogs()
+
+        # lasso extraction (--dump-lassos): the loop being probed, if any
+        self._probe = None
+        self._probe_steps = 0
+        self._probe_flags: set[str] = set()
+        self._lasso_count = 0
+        self._lassos_done: set = set()
 
         # init storage model
         is_generic = self.options.storage_layout == "generic"
         self.storage_model = GenericStorage if is_generic else SolidityStorage
 
+        # EVM version (a16z/halmos#128)
+        self.evm_version = resolve_evm_version(self.options.evm_version)
+        self.unavailable_opcodes = unavailable_opcodes(self.evm_version)
+        self.eip6780 = is_at_least(self.evm_version, "cancun")
+
     def div_xy_y(self, w1: Word, w2: Word) -> Word:
         # return the number of bits required to represent the given value. default = 256
         def bitsize(w: Word) -> int:
@@ -2262,7 +2536,7 @@ def resolve_address_alias(
         head, *tail = potential_aliases
 
         if not allow_branching and tail:
-            raise HalmosException(f"multiple aliases exist: {hexify(target)}")
+            raise DolmosException(f"multiple aliases exist: {hexify(target)}")
 
         for addr, cond in tail:
             new_ex = self.create_branch(ex, cond, ex.pc)
@@ -2274,8 +2548,106 @@ def resolve_address_alias(
         ex.alias[target] = addr
         return addr
 
+    def resolve_expectations(
+        self,
+        ex: Exec,
+        stack: Worklist,
+        expected: Expectations,
+        reverted: bool,
+        ret_loc: int = 0,
+        ret_size: int = 0,
+    ) -> Exec | None:
+        """
+        Checks the vm.expectRevert / vm.expectEmit expectations against the call
+        that just returned (the last subcall of `ex`), before `ex` advances.
+
+        Forks a failing path whenever an expectation may not be met. Returns the
+        state to continue with, or None if the expectations can't be met.
+        """
+        subcall = ex.context.last_subcall()
+        checks: list[tuple[BoolRef, str]] = []
+
+        exp_revert = expected.revert
+        reverted_as_expected = False
+
+        if exp_revert is not None:
+            if exp_revert.count == 0:
+                if reverted:
+                    checks.append((BoolVal(False), f"{exp_revert}: the call reverted"))
+            elif not reverted:
+                checks.append(
+                    (BoolVal(False), f"{exp_revert}: next call did not revert")
+                )
+            else:
+                data = (
+                    subcall.output.data
+                    if subcall.output.data is not None
+                    else ByteVec()
+                )
+                cond = revert_reason_matches(exp_revert, data)
+                if exp_revert.reverter is not None:
+                    reverter = as_z3_word(find_reverter(subcall))
+                    cond = And(cond, reverter == as_z3_word(exp_revert.reverter))
+                checks.append(
+                    (cond, f"{exp_revert}: the revert data or reverter differs")
+                )
+                reverted_as_expected = True
+
+        if expected.emits:
+            cond, err = emits_match(expected.emits, subcall)
+            msg = err or (
+                f"{', '.join(map(str, expected.emits))}: "
+                "the expected events were not emitted by the next call"
+            )
+            checks.append((cond, msg))
+
+        for cond, msg in checks:
+            cond = simplify(cond)
+            if is_true(cond):
+                continue
+
+            if is_false(cond) or ex.check(cond) == unsat:
+                ex.halt(data=ByteVec(), error=FailCheatcode(msg))
+                stack.push(ex)
+                return None
+
+            not_cond = simplify(Not(cond))
+            if ex.check(not_cond) != unsat:
+                fail_ex = self.create_branch(ex, not_cond, ex.pc)
+                fail_ex.halt(data=ByteVec(), error=FailCheatcode(msg))
+                stack.push(fail_ex)
+
+            ex.path.append(cond, branching=True)
+
+        if reverted_as_expected:
+            # like foundry, report the call as successful: status 1 (address(1)
+            # for a creation) and dummy return data. The state stays reverted.
+            ex.st.pop()
+            ex.st.push(ONE)
+            if subcall.message.is_create():
+                subcall.returndata_override = EMPTY_BYTES
+            else:
+                subcall.returndata_override = DUMMY_CALL_OUTPUT
+                copy_returndata_to_memory(DUMMY_CALL_OUTPUT, ret_loc, ret_size, ex)
+
+            # expectRevert with a count applies to the following calls as well
+            if exp_revert.count > 1:
+                ex.context.expectations.revert = replace(
+                    exp_revert, count=exp_revert.count - 1
+                )
+
+        return ex
+
     def handle_insufficient_fund_case(
-        self, caller: Address, value: BV, message: Message, ex: Exec, stack: Worklist
+        self,
+        caller: Address,
+        value: BV,
+        message: Message,
+        ex: Exec,
+        stack: Worklist,
+        expected: Expectations | None = None,
+        ret_loc: int = 0,
+        ret_size: int = 0,
     ):
         if value == ZERO:
             return
@@ -2295,6 +2667,12 @@ def handle_insufficient_fund_case(
                 )
             )
             fail_ex.st.push(ZERO)
+            if expected is not None:
+                fail_ex = self.resolve_expectations(
+                    fail_ex, stack, expected, True, ret_loc, ret_size
+                )
+                if fail_ex is None:
+                    return
             fail_ex.advance()
             stack.push(fail_ex)
 
@@ -2358,6 +2736,9 @@ def call(
         pranked_caller, pranked_origin = ex.resolve_prank(to)
         arg = ex.st.mslice(arg_loc, arg_size)
 
+        # vm.expectRevert / vm.expectEmit apply to the next non-cheatcode call
+        expected = None if to in CHEATCODE_ADDRESSES else ex.context.expectations.take()
+
         resolved_to = to_alias if to_alias is not None else to
         message = Message(
             target=resolved_to if op in [OP_CALL, OP_STATICCALL] else ex.this(),
@@ -2369,7 +2750,9 @@ def call(
             call_scheme=op,
         )
 
-        self.handle_insufficient_fund_case(pranked_caller, fund, message, ex, stack)
+        self.handle_insufficient_fund_case(
+            pranked_caller, fund, message, ex, stack, expected, ret_loc, ret_size
+        )
 
         def send_callvalue(condition: BoolRef | None = None) -> None:
             # no balance update for CALLCODE which transfers to itself
@@ -2411,6 +2794,7 @@ def callback(new_ex: Exec, stack):
                 new_ex.insn = ex.insn
                 new_ex.st = deepcopy(ex.st)
                 new_ex.jumpis = deepcopy(ex.jumpis)
+                new_ex.loop_snapshots = dict(ex.loop_snapshots)
 
                 returndata = subcall.output.data
                 copy_returndata_to_memory(returndata, ret_loc, ret_size, new_ex)
@@ -2419,6 +2803,12 @@ def callback(new_ex: Exec, stack):
                 subcall_success = subcall.output.error is None
                 new_ex.st.push(ONE if subcall_success else ZERO)
 
+                if subcall_success:
+                    # accounts self-destructed in the subcall are deleted at the end of the transaction
+                    new_ex.context.output.accounts_to_delete |= (
+                        subcall.output.accounts_to_delete
+                    )
+
                 if not subcall_success:
                     # revert network states
                     new_ex.code = orig_code.copy()
@@ -2426,6 +2816,13 @@ def callback(new_ex: Exec, stack):
                     new_ex.transient_storage = deepcopy(orig_transient_storage)
                     new_ex.balance = orig_balance
 
+                if expected is not None:
+                    new_ex = self.resolve_expectations(
+                        new_ex, stack, expected, not subcall_success, ret_loc, ret_size
+                    )
+                    if new_ex is None:
+                        return
+
                 # add to worklist even if it reverted during the external call
                 new_ex.advance()
                 stack.push(new_ex)
@@ -2451,6 +2848,8 @@ def callback(new_ex: Exec, stack):
                 alias=ex.alias,
                 #
                 cnts=ex.cnts,
+                nonces=ex.nonces,
+                created_in_tx=ex.created_in_tx,
                 sha3s=ex.sha3s,
                 storages=ex.storages,
                 balances=ex.balances,
@@ -2482,46 +2881,25 @@ def call_unknown() -> None:
 
             elif to == SHA256_PRECOMPILE:
                 exit_code = ONE
-                f_sha256 = Function(
-                    f"f_sha256_{arg_size}", BitVecSorts[arg_size], BitVecSort256
-                )
-
-                unwrapped = arg.unwrap()
-                wrapped = (
-                    unwrapped if is_bv(unwrapped) else bytes_to_bv_value(unwrapped)
-                )
-                ret = ByteVec(f_sha256(wrapped))
+                ret = precompiles.sha256(arg)
 
             elif to == RIPEMD160_PRECOMPILE:
                 exit_code = ONE
-                f_ripemd160 = Function(
-                    f"f_ripemd160_{arg_size}", BitVecSorts[arg_size], BitVecSort160
-                )
-
-                unwrapped = arg.unwrap()
-                wrapped = (
-                    unwrapped if is_bv(unwrapped) else bytes_to_bv_value(unwrapped)
-                )
-                ret = ByteVec(uint256(f_ripemd160(wrapped)))
+                ret = precompiles.ripemd160(arg)
 
             elif to == IDENTITY_PRECOMPILE:
                 exit_code = ONE
                 ret = arg
 
             elif to == MODEXP_PRECOMPILE:
-                exit_code = ONE
-                modulus_size = ex.int_of(arg.get_word(64))
-                f_modexp = Function(
-                    f"f_modexp_{arg_size}_{modulus_size}",
-                    BitVecSorts[arg_size],
-                    BitVecSorts[modulus_size],
-                )
-
-                unwrapped = arg.unwrap()
-                wrapped = (
-                    unwrapped if is_bv(unwrapped) else bytes_to_bv_value(unwrapped)
-                )
-                ret = ByteVec(f_modexp(wrapped))
+                modexp_ret = precompiles.modexp(ex, arg)
+                if modexp_ret is None:
+                    # invalid input (EIP-7823): the call fails with empty returndata
+                    exit_code = ZERO
+                    ret = ByteVec()
+                else:
+                    exit_code = ONE
+                    ret = modexp_ret
 
             elif to == ECADD_PRECOMPILE:
                 exit_code = ONE
@@ -2577,10 +2955,10 @@ def call_unknown() -> None:
                 )
                 ret = ByteVec(f_point_evaluation(wrapped))
 
-            # halmos cheat code
-            elif to == halmos_cheat_code.address:
+            # svm cheat code
+            elif to == svm_cheat_code.address:
                 exit_code = ONE
-                ret = halmos_cheat_code.handle(self, ex, arg, stack)
+                ret = svm_cheat_code.handle(self, ex, arg, stack)
 
             # vm cheat code
             elif to == hevm_cheat_code.address:
@@ -2622,7 +3000,7 @@ def call_unknown() -> None:
             last_idx = len(ret_lst) - 1
             for idx, ret_ in enumerate(ret_lst):
                 if not isinstance(ret_, ByteVec):
-                    raise HalmosException(f"Invalid return value: {ret_}")
+                    raise DolmosException(f"Invalid return value: {ret_}")
 
                 new_ex = (
                     self.create_branch(ex, BoolVal(True), ex.pc)
@@ -2638,6 +3016,14 @@ def call_unknown() -> None:
                     )
                 )
 
+                if expected is not None:
+                    reverted = exit_code.is_concrete and exit_code.value == 0
+                    new_ex = self.resolve_expectations(
+                        new_ex, stack, expected, reverted, ret_loc, ret_size
+                    )
+                    if new_ex is None:
+                        continue
+
                 new_ex.advance()
                 stack.push(new_ex)
 
@@ -2680,7 +3066,7 @@ def create(
 
         # new account address
         if op == OP_CREATE:
-            new_addr = ex.new_address()
+            new_addr = ex.new_address(pranked_caller)
         elif op == OP_CREATE2:  # OP_CREATE2
             # create_hexcode must be z3 expression to be passed into sha3_data
             create_hexcode = create_hexcode.unwrap()
@@ -2701,7 +3087,11 @@ def create(
             )
             new_addr = uint160(ex.sha3_data(hash_data)).as_z3()
         else:
-            raise HalmosException(f"Unknown CREATE opcode: {op}")
+            raise DolmosException(f"Unknown CREATE opcode: {op}")
+
+        # both CREATE and CREATE2 increment the creator's nonce,
+        # regardless of whether the creation succeeds
+        ex.bump_nonce(pranked_caller)
 
         message = Message(
             target=new_addr,
@@ -2713,12 +3103,16 @@ def create(
             call_scheme=op,
         )
 
-        self.handle_insufficient_fund_case(pranked_caller, value, message, ex, stack)
+        # vm.expectRevert / vm.expectEmit also apply to contract creations
+        expected = ex.context.expectations.take()
+
+        self.handle_insufficient_fund_case(
+            pranked_caller, value, message, ex, stack, expected
+        )
 
         if new_addr in ex.code:
             # address conflicts don't revert, they push 0 on the stack and continue
             ex.st.push(ZERO)
-            ex.advance()
 
             # add a virtual subcontext to the trace for debugging purposes
             subcall = CallContext(message=message, depth=ex.context.depth + 1)
@@ -2726,6 +3120,12 @@ def create(
             subcall.output.error = AddressCollision()
             ex.context.trace.append(subcall)
 
+            if expected is not None:
+                ex = self.resolve_expectations(ex, stack, expected, True)
+                if ex is None:
+                    return
+
+            ex.advance()
             stack.push(ex)
             return
 
@@ -2741,6 +3141,12 @@ def create(
         # setup new account
         ex.set_code(new_addr, Contract(b""))  # existing code must be empty
 
+        # a newly created account starts with nonce 1 (EIP-161)
+        ex.set_nonce(new_addr, 1)
+
+        # SELFDESTRUCT deletes the account only if it was created in the same transaction (EIP-6780)
+        ex.created_in_tx.add(new_addr)
+
         # existing storage may not be empty and reset here
         ex.storage[new_addr] = self.mk_storagedata()
         ex.transient_storage[new_addr] = self.mk_storagedata()
@@ -2763,6 +3169,7 @@ def callback(new_ex: Exec, stack):
             new_ex.insn = ex.insn
             new_ex.st = deepcopy(ex.st)
             new_ex.jumpis = deepcopy(ex.jumpis)
+            new_ex.loop_snapshots = dict(ex.loop_snapshots)
 
             if subcall.is_stuck():
                 # internal errors abort the current path,
@@ -2773,6 +3180,11 @@ def callback(new_ex: Exec, stack):
             elif subcall.output.error is None:
                 deployed_bytecode = subcall.output.data
 
+                # accounts self-destructed in the subcall are deleted at the end of the transaction
+                new_ex.context.output.accounts_to_delete |= (
+                    subcall.output.accounts_to_delete
+                )
+
                 # new contract code, will revert if data is None
                 new_code = Contract(deployed_bytecode)
                 new_ex.try_resolve_contract_info(new_code, self.options.coverage_output)
@@ -2792,6 +3204,13 @@ def callback(new_ex: Exec, stack):
                 new_ex.transient_storage = deepcopy(orig_transient_storage)
                 new_ex.balance = orig_balance
 
+            if expected is not None:
+                new_ex = self.resolve_expectations(
+                    new_ex, stack, expected, subcall.output.error is not None
+                )
+                if new_ex is None:
+                    return
+
             # add to worklist
             new_ex.advance()
             stack.push(new_ex)
@@ -2817,6 +3236,8 @@ def callback(new_ex: Exec, stack):
             alias=ex.alias,
             #
             cnts=ex.cnts,
+            nonces=ex.nonces,
+            created_in_tx=ex.created_in_tx,
             sha3s=ex.sha3s,
             storages=ex.storages,
             balances=ex.balances,
@@ -2859,6 +3280,11 @@ def jumpi(
         jid = ex.jumpid()
         visited = ex.jumpis.get(jid, {True: 0, False: 0})
 
+        dump_lassos = self.options.dump_lassos and self._probe is None
+        if is_symbolic_cond and dump_lassos:
+            prev_snapshot = ex.loop_snapshots.get(jid)
+            ex.loop_snapshots[jid] = lasso.LoopSnapshot(tuple(ex.st.stack), cond_true)
+
         if is_symbolic_cond:
             # for loop unrolling
             follow_true = potential_true and visited[True] < self.options.loop
@@ -2870,6 +3296,18 @@ def jumpi(
             if unroll_limit_reached_true or unroll_limit_reached_false:
                 self.logs.bounded_loops.append(jid)
 
+                if dump_lassos:
+                    for direction, reached in (
+                        (True, unroll_limit_reached_true),
+                        (False, unroll_limit_reached_false),
+                    ):
+                        if reached and (jid, direction) not in self._lassos_done:
+                            self._lassos_done.add((jid, direction))
+                            result = self.extract_lasso(
+                                ex, jid, direction, target, cond_true, prev_snapshot
+                            )
+                            self.logs.lassos.append(result)
+
                 # rendering ex.path to string can be expensive, so only do it if debug is enabled
                 if self.options.debug:
                     debug(
@@ -2918,6 +3356,228 @@ def jumpi(
                 }
             stack.push(new_ex_false)
 
+    def extract_lasso(
+        self,
+        ex: Exec,
+        jid: JumpID,
+        direction: bool,
+        target: int,
+        cond: BoolRef,
+        prev: "lasso.LoopSnapshot | None",
+    ) -> "lasso.LassoResult":
+        """
+        Exports the loop at `jid` as a lasso program (see dolmos.lasso), and
+        optionally runs PaSTTeL on it. `ex` is at the JUMPI, operands popped.
+        """
+        result = lasso.LassoResult(
+            test=self.fun_info.sig, jumpid=jumpid_str(jid), direction=direction
+        )
+        try:
+            if prev is None:
+                raise lasso.LassoError("no snapshot of the previous iteration")
+
+            stack_now = list(ex.st.stack)
+            if len(prev.stack) != len(stack_now):
+                raise lasso.LassoError("the stack height changes between iterations")
+
+            carried = [
+                i
+                for i in range(len(stack_now))
+                if not lasso.same_term(prev.stack[i], stack_now[i])
+            ]
+
+            self._lasso_count += 1
+            uid = self._lasso_count
+
+            # extend the loop variables until the generalized iteration is closed
+            for _ in range(3):
+                bodies, extra, flags = self._generalized_iteration(
+                    ex, jid, carried, direction, target, uid
+                )
+                if not extra:
+                    break
+                carried = sorted(set(carried) | extra)
+            else:
+                raise lasso.LassoError("the loop variables could not be determined")
+
+            if not bodies:
+                raise lasso.LassoError(
+                    "no path of the loop body returns to the loop head"
+                    + (f" ({'; '.join(sorted(flags))})" if flags else "")
+                )
+
+            result.warnings = sorted(flags)
+
+            # the cut point is right after the JUMPI: the stem ends by taking
+            # the loop branch, and each iteration ends by taking it again
+            loop_vars = [f"{lasso.LOOP_VAR_PREFIX}{uid}_{i}" for i in carried]
+            initial_values = [lasso.as_z3(stack_now[i]) for i in carried]
+            widths = [256] * len(loop_vars)
+
+            stem_context = [*ex.path.conditions, lasso.branch_taken(cond, direction)]
+            stem_conditions = lasso.slice_conditions(stem_context, initial_values)
+            result.approximate, lasso_json = lasso.build_lasso(
+                loop_vars,
+                widths,
+                initial_values,
+                stem_conditions,
+                None,
+                bodies,
+                exact_constants=self.options.lasso_exact_constants,
+                stem_context=stem_context,
+                complete=not flags,
+                prover_timeout_ms=int(self.options.solver_timeout_branching * 1000),
+            )
+
+            name = re.sub(
+                r"[^A-Za-z0-9_]+", "_", f"{self.fun_info.name}_{jumpid_str(jid)}"
+            )
+            name = f"{name}_{'t' if direction else 'f'}"
+            meta = {
+                "test": self.fun_info.sig,
+                "jumpid": jumpid_str(jid),
+                "loop_branch": direction,
+                "loop_bound": self.options.loop,
+                "loop_variables": {
+                    f"v{k}": f"stack[{i}]" for k, i in enumerate(carried)
+                },
+                "body_paths": len(bodies),
+                "encoding": (
+                    "exact" if self.options.lasso_exact_constants else "small-constants"
+                ),
+                "warnings": result.warnings,
+                "sound": not result.warnings,
+                # termination proofs are valid either way; non-termination
+                # witnesses are only meaningful for an exact lasso
+                "exact": not result.approximate and not result.warnings,
+            }
+            result.path = lasso.write_lasso(
+                self.options.dump_lassos, name, lasso_json, meta
+            )
+
+            if self.options.pasttel:
+                result.verdict, result.proof = lasso.run_pasttel(
+                    self.options.pasttel, result.path, self.options.pasttel_timeout
+                )
+
+        except lasso.LassoError as err:
+            result.error = str(err)
+        except Exception as err:  # the extraction must never break the test
+            result.error = f"{type(err).__name__}: {err}"
+            debug(f"lasso extraction failed: {err!r}")
+        finally:
+            self._probe = None
+
+        return result
+
+    def _generalized_iteration(
+        self,
+        ex: Exec,
+        jid: JumpID,
+        carried: list[int],
+        direction: bool,
+        target: int,
+        uid: int,
+    ) -> tuple[list["lasso.BodyPath"], set[int], set[str]]:
+        """
+        Runs one iteration of the loop from a state where the loop-carried stack
+        slots and the branching condition are fresh symbols, on a separate solver.
+        Returns the body paths, the stack slots that turned out to change as
+        well, and warning flags.
+        """
+        stack = list(ex.st.stack)
+        for i in carried:
+            stack[i] = BV(lasso.fresh_loop_var(i, uid))
+
+        timeout_ms = int(self.options.solver_timeout_branching * 1000)
+        path = Path(create_solver(timeout=timeout_ms))
+        path.extend_path(ex.path)
+        stem_ids = {c.get_id() for c in path.conditions}
+
+        gen_ex = Exec(
+            code=ex.code.copy(),
+            storage=deepcopy(ex.storage),
+            transient_storage=deepcopy(ex.transient_storage),
+            balance=ex.balance,
+            block=deepcopy(ex.block),
+            context=deepcopy(ex.context),
+            callback=None,  # leaving the frame ends the iteration
+            pgm=ex.pgm,
+            pc=ex.pc,
+            st=State(stack=list(stack), memory=ex.st.memory.copy()),
+            jumpis={},  # nested loops get a fresh unrolling budget
+            path=path,
+            alias=ex.alias.copy(),
+            cnts=deepcopy(ex.cnts),
+            nonces=deepcopy(ex.nonces),
+            created_in_tx=set(ex.created_in_tx),
+            sha3s=ex.sha3s.copy(),
+            storages=ex.storages.copy(),
+            balances=ex.balances.copy(),
+            known_keys=ex.known_keys,
+            known_sigs=ex.known_sigs,
+            call_sequence=ex.call_sequence,
+        )
+        if direction:
+            gen_ex.advance(pc=target + 1)
+        else:
+            gen_ex.advance()
+
+        bodies: list[lasso.BodyPath] = []
+        extra: set[int] = set()
+        # the loop head is identified like the unrolling counters (pc and jump
+        # destinations on the stack), plus the stack height (with the JUMPI
+        # operands), to tell apart the call sites of shared internal functions
+        self._probe = (ex.pc, ex.pgm, ex.context.depth, jid[1], len(stack) + 2)
+        self._probe_steps = 0
+        self._probe_flags = set()
+        try:
+            for end_ex in self.run(gen_ex):
+                if not getattr(end_ex, "lasso_at_head", False):
+                    if end_ex.context.output.data is None:
+                        # stuck path, e.g. symbolic memory offset
+                        self._probe_flags.add(
+                            f"body path not explored: {end_ex.context.output.error}"
+                        )
+                    continue  # the path leaves the loop
+
+                end_stack = end_ex.st.stack
+                if len(end_stack) != len(stack) + 2:
+                    self._probe_flags.add(
+                        f"stack height differs on a body path ({len(end_stack)} vs {len(stack)}+2)"
+                    )
+                    continue
+
+                # the iteration continues if the loop branch is taken again
+                again = lasso.branch_taken(lasso.as_z3(end_stack[-2]), direction)
+                if end_ex.check(again) == unsat:
+                    continue  # this path leaves the loop at the head
+
+                below = end_stack[:-2]
+                outputs = [lasso.as_z3(below[i]) for i in carried]
+                extra |= {
+                    j
+                    for j in range(len(stack))
+                    if j not in carried and not lasso.same_term(below[j], stack[j])
+                }
+                conditions = [
+                    c for c in end_ex.path.conditions if c.get_id() not in stem_ids
+                ]
+                conditions.append(again)
+                bodies.append(
+                    lasso.BodyPath(
+                        conditions, outputs, [*end_ex.path.conditions, again]
+                    )
+                )
+
+                if len(bodies) >= lasso.MAX_BODY_PATHS:
+                    self._probe_flags.add("too many body paths")
+                    break
+        finally:
+            self._probe = None
+
+        return bodies, extra, set(self._probe_flags)
+
     def create_branch(self, ex: Exec, cond: BitVecRef, target: int) -> Exec:
         new_path = ex.path.branch(cond)
         new_ex = Exec(
@@ -2935,11 +3595,14 @@ def create_branch(self, ex: Exec, cond: BitVecRef, target: int) -> Exec:
             pc=target,
             st=deepcopy(ex.st),
             jumpis=deepcopy(ex.jumpis),
+            loop_snapshots=dict(ex.loop_snapshots),
             #
             path=new_path,
             alias=ex.alias.copy(),
             #
             cnts=deepcopy(ex.cnts),
+            nonces=deepcopy(ex.nonces),
+            created_in_tx=set(ex.created_in_tx),
             sha3s=ex.sha3s.copy(),
             storages=ex.storages.copy(),
             balances=ex.balances.copy(),
@@ -3004,6 +3667,43 @@ def gen_nested_ite(curr: int) -> BitVecRef:
         # If(idx == 0, Extract(255, 248, w), If(idx == 1, Extract(247, 240, w), ..., If(idx == 31, Extract(7, 0, w), 0)...))
         return ZeroExt(248, gen_nested_ite(0))
 
+    def selfdestruct(self, ex: Exec) -> None:
+        """
+        Before Cancun, the account is always deleted at the end of the transaction, and
+        a balance sent to itself is burnt.
+
+        From Cancun, SELFDESTRUCT follows EIP-6780:
+        - the whole balance of the executing account is sent to the beneficiary;
+        - the account is deleted, at the end of the transaction, only if it was
+          created in the same transaction. In that case, a balance sent to itself
+          is burnt. Otherwise, code, storage and nonce are left untouched.
+        - the current frame halts successfully with empty return data.
+        """
+        beneficiary = uint160(ex.st.pop())
+
+        if ex.message().is_static:
+            raise WriteInStaticContext(ex.context_str())
+
+        this = ex.this()
+        balance = BV(ex.balance_of(this))
+        self.transfer_value(ex, this, beneficiary.as_z3(), balance)
+
+        if not self.eip6780 or this in ex.created_in_tx:
+            ex.context.output.accounts_to_delete.add(this)
+
+        ex.halt(data=ByteVec())
+
+    def delete_accounts(self, ex: Exec, addrs: set[Address]) -> None:
+        """Deletes the accounts self-destructed in the transaction that just ended."""
+        for addr in addrs:
+            if addr in ex.code:
+                del ex.code[addr]
+            ex.storage[addr] = self.mk_storagedata()
+            ex.transient_storage[addr] = self.mk_storagedata()
+            ex.balance_update(addr, ZERO)
+            ex.set_nonce(addr, 0)
+            ex.created_in_tx.discard(addr)
+
     def run_message(self, pre_ex: Exec, message: Message, path: Path) -> Iterator[Exec]:
         """
         Executes the given transaction from the given input state.
@@ -3031,6 +3731,7 @@ def run_message(self, pre_ex: Exec, message: Message, path: Path) -> Iterator[Ex
             alias=pre_ex.alias.copy(),
             #
             cnts=deepcopy(pre_ex.cnts),
+            nonces=deepcopy(pre_ex.nonces),
             sha3s=pre_ex.sha3s.copy(),
             storages=pre_ex.storages.copy(),
             balances=pre_ex.balances.copy(),
@@ -3038,12 +3739,32 @@ def run_message(self, pre_ex: Exec, message: Message, path: Path) -> Iterator[Ex
         yield from self.run(ex0)
 
     def run(self, ex0: Exec) -> Iterator[Exec]:
+        # each call to run() executes a new transaction
+        ex0.created_in_tx = set()
+
         next_ex: Exec | None = ex0
         stack: Worklist = Worklist()
 
         def finalize(ex: Exec):
+            # a frame that returns successfully must not leave expectations pending
+            output = ex.context.output
+            if (
+                output.error is None
+                and output.data is not None
+                and ex.context.expectations
+            ):
+                pending = ex.context.expectations.describe()
+                output.error = FailCheatcode(
+                    f"{pending}: the expected call never happened"
+                )
+                stack.completed_paths += 1
+                yield ex  # early exit, like other cheatcode failures
+                return
+
             # if it's at the top-level, there is no callback; yield the current execution state
             if ex.callback is None:
+                if output.error is None and output.accounts_to_delete:
+                    self.delete_accounts(ex, output.accounts_to_delete)
                 stack.completed_paths += 1
                 yield ex
 
@@ -3054,6 +3775,7 @@ def finalize(ex: Exec):
 
         # cache config options out of the hot loop
         no_status = self.options.no_status
+        unavailable = self.unavailable_opcodes
         max_depth = self.options.depth
         print_steps = self.options.print_steps
         print_mem = self.options.print_mem
@@ -3080,6 +3802,9 @@ def finalize(ex: Exec):
         # not strictly necessary, but helps type checking
         ex: Exec | None = None
 
+        # set when this run is the generalized iteration of a loop (lasso extraction)
+        probe = self._probe
+
         while (ex := next_ex or stack.pop()) is not None:
             try:
                 next_ex = None
@@ -3112,6 +3837,23 @@ def finalize(ex: Exec):
                 if ex.context.depth > MAX_CALL_DEPTH:
                     raise MessageDepthLimitError(ex.context)
 
+                # lasso extraction: stop when the probed loop comes back to its head
+                if probe is not None:
+                    if (
+                        ex.pc == probe[0]
+                        and ex.pgm is probe[1]
+                        and ex.context.depth == probe[2]
+                        and len(ex.st.stack) == probe[4]
+                        and lasso_jumpid_tokens(ex) == probe[3]
+                    ):
+                        ex.lasso_at_head = True
+                        yield ex
+                        continue
+                    self._probe_steps += 1
+                    if self._probe_steps > lasso.MAX_BODY_STEPS:
+                        self._probe_flags.add("step budget exhausted")
+                        return
+
                 insn: Instruction = ex.insn
                 opcode: int = insn.opcode
                 state: State = ex.st
@@ -3136,6 +3878,12 @@ def finalize(ex: Exec):
                 if print_steps:
                     print(ex.dump(print_mem=print_mem))
 
+                # opcodes introduced after the selected EVM version are invalid
+                if unavailable and opcode in unavailable:
+                    ex.halt(data=ByteVec(), error=InvalidOpcode(opcode))
+                    yield from finalize(ex)
+                    continue
+
                 # Reordered based on frequency data
                 if OP_PUSH1 <= opcode <= OP_PUSH31:
                     state.push(insn.operand)
@@ -3326,6 +4074,8 @@ def finalize(ex: Exec):
                     state.set_top(BV(value, size=256))
 
                 elif opcode == OP_SSTORE:
+                    if probe is not None:
+                        self._probe_flags.add("storage written in the loop body")
                     slot: Word = state.popi()
                     value: Word = state.popi()
                     self.sstore(ex, ex.this(), slot, value)
@@ -3397,7 +4147,9 @@ def finalize(ex: Exec):
                     size: int = ex.int_of(state.pop(), "symbolic LOG data size")
                     topics = list(state.pop() for _ in range(num_topics))
                     data = state.mslice(loc, size)
-                    ex.emit_log(EventLog(ex.this(), topics, data))
+                    log = EventLog(ex.this(), topics, data)
+                    ex.emit_log(log)
+                    ex.context.expectations.capture_log(log)
 
                 elif opcode in CALL_OPCODES:
                     to = uint160(state.peek(2))
@@ -3448,13 +4200,13 @@ def finalize(ex: Exec):
                     if account_alias is not None:
                         codesize = BV(len(ex.code[account_alias]))
                     else:
-                        # NOTE: the codesize of halmos cheatcode should be non-zero to pass the extcodesize check
+                        # NOTE: the codesize of the svm cheatcode should be non-zero to pass the extcodesize check
                         # for external calls with non-empty return types. this behavior differs from foundry.
                         # the codesize of console is considered zero in foundry
                         codesize = (
                             ONE  # dummy arbitrary value, consistent with foundry
                             if account
-                            in [hevm_cheat_code.address, halmos_cheat_code.address]
+                            in [hevm_cheat_code.address, svm_cheat_code.address]
                             else ZERO
                         )
 
@@ -3531,6 +4283,30 @@ def finalize(ex: Exec):
                 elif opcode == OP_BASEFEE:
                     state.push_any(ex.block.basefee)
 
+                elif opcode == OP_BLOBBASEFEE:
+                    # EIP-4844 / Cancun (0x4A): blob base fee du bloc courant.
+                    state.push_any(ex.block.blobbasefee)
+
+                elif opcode == OP_BLOBHASH:
+                    # EIP-4844 / Cancun (0x49): versioned hash du blob a l'index i.
+                    # L'index peut etre symbolique : on construit un If-tree sur la
+                    # liste des blobs. Retourne 0 si hors range ou liste vide.
+                    index = state.popi()
+                    blobhashes = ex.block.blobhashes
+                    if not blobhashes:
+                        # Pas de blobs dans cette tx -> toujours 0
+                        state.push_any(ZERO)
+                    else:
+                        # Construire: If(i==0, h0, If(i==1, h1, ..., 0))
+                        result = ZERO
+                        for i in range(len(blobhashes) - 1, -1, -1):
+                            result = If(
+                                index.as_z3() == BitVecVal(i, 256),
+                                blobhashes[i],
+                                result,
+                            )
+                        state.push_any(result)
+
                 elif opcode == OP_PC:
                     state.push_any(ex.pc)
 
@@ -3559,6 +4335,10 @@ def finalize(ex: Exec):
                     state.push_any(self.sload(ex, ex.this(), slot, transient=True))
 
                 elif opcode == OP_TSTORE:
+                    if probe is not None:
+                        self._probe_flags.add(
+                            "transient storage written in the loop body"
+                        )
                     slot: Word = state.popi()
                     value: Word = state.popi()
                     self.sstore(ex, ex.this(), slot, value, transient=True)
@@ -3578,6 +4358,11 @@ def finalize(ex: Exec):
                     w2 = state.popi()
                     state.push(w2.ashr(w1))  # bvashr
 
+                elif opcode == OP_CLZ:
+                    # EIP-7939 / Fusaka (0x1E): count leading zeros.
+                    w1 = state.popi()
+                    state.push(w1.clz())
+
                 elif opcode == OP_ADDMOD:
                     w1 = state.popi()
                     w2 = state.popi()
@@ -3608,10 +4393,15 @@ def finalize(ex: Exec):
                     w2 = state.popi()
                     state.push(w2.signextend(w1))
 
+                elif opcode == OP_SELFDESTRUCT:
+                    self.selfdestruct(ex)
+                    yield from finalize(ex)
+                    continue
+
                 else:
                     # TODO: switch to InvalidOpcode when we have full opcode coverage
                     # this halts the path, but we should only halt the current context
-                    raise HalmosException(f"Unsupported opcode {mnemonic(opcode)}")
+                    raise DolmosException(f"Unsupported opcode {mnemonic(opcode)}")
 
                 ex.advance(pc=insn.next_pc)
                 next_ex = ex
@@ -3625,7 +4415,7 @@ def finalize(ex: Exec):
                 yield from finalize(ex)
                 continue
 
-            except HalmosException as err:
+            except DolmosException as err:
                 debug(err)
                 ex.halt(data=None, error=err)
                 yield from finalize(ex)
@@ -3676,6 +4466,7 @@ def mk_exec(
             #
             log=[],
             cnts=defaultdict(int),
+            nonces=defaultdict(int),
             sha3s=KeccakRegistry(),
             storages={},
             balances={},
diff --git a/src/dolmos/solve.py b/src/dolmos/solve.py
new file mode 100644
index 000000000..aa7f19625
--- /dev/null
+++ b/src/dolmos/solve.py
@@ -0,0 +1,1214 @@
+# SPDX-License-Identifier: AGPL-3.0
+
+import re
+import shlex
+import subprocess
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from types import MappingProxyType
+from typing import Literal
+
+from eth_hash.auto import keccak
+from z3 import CheckSatResult, Solver, is_app, sat, unknown, unsat
+
+from dolmos.calldata import FunctionInfo
+from dolmos.config import Config as DolmosConfig
+from dolmos.logs import (
+    debug,
+    error,
+    warn,
+)
+from dolmos.pcex import PcexState
+from dolmos.processes import (
+    ExecutorRegistry,
+    PopenExecutor,
+    PopenFuture,
+)
+from dolmos.sevm import Address, Exec, SMTQuery
+from dolmos.utils import f_sha3_name, hexify, is_bv_value, is_f_sha3_name
+
+EXIT_TIMEDOUT = 124
+
+
+# Type alias for directory used for dumping SMT files
+DumpDirectory = TemporaryDirectory | Path
+
+
+def dirname(dump_dir: DumpDirectory) -> str:
+    """Get the directory name from a DumpDirectory."""
+    match dump_dir:
+        case TemporaryDirectory():
+            return dump_dir.name
+        case Path():
+            return str(dump_dir)
+        case _:
+            raise ValueError(f"Unexpected dump directory type: {type(dump_dir)}")
+
+
+@dataclass
+class ModelVariable:
+    full_name: str
+    variable_name: str
+    solidity_type: str
+    smt_type: str
+    size_bits: int
+    value: int
+
+
+ModelVariables = dict[str, ModelVariable]
+
+# Regular expression for capturing dolmos variables
+dolmos_var_pattern = re.compile(
+    r"""
+    \(\s*define-fun\s+               # Match "(define-fun"
+    \|?((?:dolmos_|p_)[^ |]+)\|?\s+  # Capture either dolmos_* or p_*, optionally wrapped in "|"
+    \(\)\s+\(_\s+([^ ]+)\s+          # Capture the SMTLIB type (e.g., "BitVec 256")
+    (\d+)\)\s+                       # Capture the bit-width or type argument
+    (                                # Group for the value
+        \#b[01]+                     # Binary value (e.g., "#b1010")
+        |\#x[0-9a-fA-F]+             # Hexadecimal value (e.g., "#xFF")
+        |\(_\s+bv\d+\s+\d+\)         # Decimal value (e.g., "(_ bv42 256)")
+    )
+    """,
+    re.VERBOSE,
+)
+
+
+@dataclass(frozen=True, slots=True)
+class PotentialModel:
+    model: ModelVariables
+    is_valid: bool
+
+    def __str__(self) -> str:
+        formatted = []
+        for v in self.model.values():
+            # TODO: parse type and render accordingly
+            formatted.append(f"\n    {v.full_name} = {hexify(v.value)}")
+        return "".join(sorted(formatted)) if formatted else "∅"
+
+
+@dataclass(frozen=True, slots=True)
+class InvariantTestingContext:
+    # explicitly included targets
+    target_senders: frozenset[Address]
+    target_contracts: frozenset[Address]
+    target_selectors: MappingProxyType[Address, frozenset[bytes]]
+
+    # explicitly excluded targets
+    excluded_senders: frozenset[Address]
+    excluded_contracts: frozenset[Address]
+    excluded_selectors: MappingProxyType[Address, frozenset[bytes]]
+
+    # whether to print debug information
+    debug: bool = False
+
+    @staticmethod
+    def empty() -> "InvariantTestingContext":
+        return empty_invariant_testing_context
+
+
+empty_invariant_testing_context = InvariantTestingContext(
+    target_senders=frozenset(),
+    target_contracts=frozenset(),
+    target_selectors=MappingProxyType({}),  # read-only empty dict
+    excluded_senders=frozenset(),
+    excluded_contracts=frozenset(),
+    excluded_selectors=MappingProxyType({}),
+)
+
+
+@dataclass(frozen=True, slots=True)
+class ContractContext:
+    # config with contract-specific overrides
+    args: DolmosConfig
+
+    # name of this contract
+    name: str
+
+    # signatures of test functions to run
+    funsigs: list[str]
+
+    # data parsed from the build output for this contract
+    creation_hexcode: str
+    deployed_hexcode: str
+    abi: dict
+    method_identifiers: dict[str, str]
+    contract_json: dict
+    libs: dict
+
+    # note: build_out_map is shared across all contracts compiled using the same compiler version
+    # so in principle, we could consider having another context, say CompileUnitContext, and put build_out_map there
+    build_out_map: dict
+
+    # map from depth to frontier states
+    frontier_states: dict[int, list[Exec]] = field(default_factory=dict)
+
+    # set of visited state ids, to be updated during the invariant testing run
+    visited: set[bytes] = field(default_factory=set)
+
+    # the function info for the invariant test
+    probes_reported: set[FunctionInfo] = field(default_factory=set)
+
+    # the invariant testing context for this contract
+    # the empty context is used as a placeholder, it can be set later
+    inv_ctx: InvariantTestingContext = field(
+        default_factory=InvariantTestingContext.empty
+    )
+
+    def set_invariant_testing_context(self, ctx: InvariantTestingContext) -> None:
+        if self.inv_ctx != InvariantTestingContext.empty():
+            raise ValueError("invariant testing context already set")
+
+        # bypass the frozen dataclass check
+        object.__setattr__(self, "inv_ctx", ctx)
+
+
+@dataclass(frozen=True)
+class SolvingContext:
+    # directory for dumping solver files
+    dump_dir: DumpDirectory
+
+    # shared solver executor for all paths in the same function
+    executor: PopenExecutor = field(default_factory=PopenExecutor)
+
+    # list of unsat cores
+    unsat_cores: list[list] = field(default_factory=list)
+
+
+@dataclass(frozen=True)
+class FunctionContext:
+    # config with function-specific overrides
+    args: DolmosConfig
+
+    # function name, signature, and selector
+    info: FunctionInfo
+
+    # solver using the function-specific config
+    solver: Solver
+
+    # backlink to the parent contract context
+    contract_ctx: ContractContext
+
+    # optional starting state
+    setup_ex: Exec | None = None
+
+    # optional max call depth for frontier states (for invariant testing)
+    max_call_depth: int = 0
+
+    # function-level solving context
+    # the FunctionContext initializes and owns the SolvingContext
+    solving_ctx: SolvingContext = field(init=False)
+
+    # function-level thread pool that drives assertion solving
+    thread_pool: ThreadPoolExecutor = field(init=False)
+
+    # list of solver outputs for this function
+    solver_outputs: list["SolverOutput"] = field(default_factory=list)
+
+    # list of valid counterexamples for this function
+    valid_counterexamples: list[PotentialModel] = field(default_factory=list)
+
+    # list of potentially invalid counterexamples for this function
+    invalid_counterexamples: list[PotentialModel] = field(default_factory=list)
+
+    # map from path id to trace and call sequence
+    traces: dict[int, str] = field(default_factory=dict)
+    call_sequences: dict[int, str] = field(default_factory=dict)
+
+    # map from path id to execution
+    exec_cache: dict[int, Exec] = field(default_factory=dict)
+
+    # shown and hidden counterexamples, with --pretty-counterexamples
+    pcex: PcexState = field(default_factory=PcexState)
+
+    def __post_init__(self):
+        args = self.args
+
+        # create a directory for dumping solver files
+        prefix = (
+            f"{self.info.name}-"
+            if self.info.name
+            else f"{self.contract_ctx.name}-constructor-"
+        )
+
+        if args.dump_smt_directory:
+            # use custom directory specified by user
+            custom_dir = Path(args.dump_smt_directory)
+
+            # create the directory if it doesn't exist
+            custom_dir.mkdir(parents=True, exist_ok=True)
+
+            # create a subdirectory with the prefix for this function/contract
+            function_dir = custom_dir / prefix.rstrip("-")
+            function_dir.mkdir(parents=True, exist_ok=True)
+
+            dump_dir = function_dir
+
+            if args.verbose >= 1 or args.dump_smt_queries:
+                print(f"Generating SMT queries in {function_dir}")
+        else:
+            # use temporary directory (existing behavior)
+            # if the user explicitly enabled dumping, we don't want to delete the directory on exit
+            delete = not self.args.dump_smt_queries
+
+            # ideally we would pass `delete=delete` to the constructor, but it's in >=3.12
+            temp_dir = TemporaryDirectory(prefix=prefix, ignore_cleanup_errors=True)
+
+            # If user wants to keep the files, prevent cleanup on exit
+            if not delete:
+                temp_dir._finalizer.detach()
+
+            dump_dir = temp_dir
+
+            if args.verbose >= 1 or args.dump_smt_queries:
+                print(f"Generating SMT queries in {temp_dir.name}")
+
+        solving_ctx = SolvingContext(dump_dir=dump_dir)
+        object.__setattr__(self, "solving_ctx", solving_ctx)
+
+        thread_pool = ThreadPoolExecutor(
+            max_workers=self.args.solver_threads,
+            thread_name_prefix=f"{self.info.name}-",
+        )
+        object.__setattr__(self, "thread_pool", thread_pool)
+
+        # register the solver executor to be shutdown on exit
+        ExecutorRegistry().register(solving_ctx.executor)
+
+    def append_unsat_core(self, unsat_core: list[str]) -> None:
+        self.solving_ctx.unsat_cores.append(unsat_core)
+
+
+@dataclass(frozen=True)
+class PathContext:
+    args: DolmosConfig
+    path_id: int
+    solving_ctx: SolvingContext
+    query: SMTQuery
+    is_refined: bool = False
+
+    # symbolic keccak preimages of the path, as (bitsize, smtlib term); see mk_sha3_args()
+    sha3_args: tuple[tuple[int, str], ...] = ()
+
+    # applications of the EXP abstraction in the path, checked against the real
+    # exponentiation with --pretty-counterexamples; see mk_exp_apps() and refine_exp()
+    exp_apps: "ExpApps | None" = None
+
+    # distinguishes the query files of keccak refinement rounds
+    suffix: str = ""
+
+    @property
+    def dump_file(self) -> Path:
+        refined_str = ".refined" if self.is_refined else ""
+        filename = f"{self.path_id}{refined_str}{self.suffix}.smt2"
+
+        return Path(dirname(self.solving_ctx.dump_dir)) / filename
+
+    def refine(self) -> "PathContext":
+        return PathContext(
+            args=self.args,
+            path_id=self.path_id,
+            solving_ctx=self.solving_ctx,
+            query=refine(self.query),
+            is_refined=True,
+            sha3_args=self.sha3_args,
+            exp_apps=self.exp_apps,
+            suffix=self.suffix,
+        )
+
+
+@dataclass(frozen=True, slots=True)
+class SolverOutput:
+    # solver result (sat, unsat, unknown, err)
+    result: CheckSatResult | Literal["err"]
+
+    # solver return code
+    returncode: int
+
+    # we don't backlink to the parent path context to avoid extra
+    # references to Exec objects past the lifetime of the path
+    path_id: int
+
+    # input query file path
+    query_file: str
+
+    # solver model
+    model: PotentialModel | None = None
+
+    # optional unsat core
+    unsat_core: list[str] | None = None
+
+    # solver error
+    error: str | None = None
+
+    # why the model is potentially invalid, when known (shown by --pretty-counterexamples)
+    invalid_reason: str | None = None
+
+    @staticmethod
+    def from_result(
+        stdout: str, stderr: str, returncode: int, path_ctx: PathContext
+    ) -> "SolverOutput":
+        # extract the first line (we expect sat/unsat/unknown)
+        newline_idx = stdout.find("\n")
+        first_line = stdout[:newline_idx] if newline_idx != -1 else stdout
+
+        args, path_id = path_ctx.args, path_ctx.path_id
+        query_file = str(path_ctx.dump_file)
+
+        if args.verbose >= 1:
+            debug(f"    {first_line}")
+
+        match first_line:
+            case "unsat":
+                unsat_core = parse_unsat_core(stdout) if args.cache_solver else None
+                return SolverOutput(
+                    unsat, returncode, path_id, query_file, unsat_core=unsat_core
+                )
+            case "sat":
+                is_valid = is_model_valid(stdout)
+                model = PotentialModel(model=parse_model_str(stdout), is_valid=is_valid)
+                return SolverOutput(sat, returncode, path_id, query_file, model=model)
+            case "unknown":
+                return SolverOutput(unknown, returncode, path_id, query_file)
+            case _:
+                return SolverOutput(
+                    "err", returncode, path_id, query_file, error=stderr
+                )
+
+    @staticmethod
+    def from_error(
+        error: Exception | str,
+        path_id: int,
+        query_file: str,
+        returncode: int = -1,
+    ) -> "SolverOutput":
+        return SolverOutput(
+            result="err",
+            returncode=returncode,
+            path_id=path_id,
+            query_file=query_file,
+            error=str(error),
+        )
+
+
+def parse_const_value(value: str) -> int:
+    match value[:2]:
+        case "#b":
+            return int(value[2:], 2)
+        case "#x":
+            return int(value[2:], 16)
+        case "bv":
+            return int(value[2:])
+        case _:
+            # we may have a group like (_ bv123 256)
+            tokens = value.split()
+            for token in tokens:
+                if token.startswith("bv"):
+                    return int(token[2:])
+
+    raise ValueError(f"unknown value format: {value}")
+
+
+def _parse_dolmos_var_match(match: re.Match) -> ModelVariable:
+    full_name = match.group(1).strip()
+    smt_type = f"{match.group(2)} {match.group(3)}"
+    size_bits = int(match.group(3))
+    value = parse_const_value(match.group(4))
+
+    # Extract name and typename from the variable name
+    parts = full_name.split("_")
+    variable_name = parts[1]
+    solidity_type = parts[2]
+
+    return ModelVariable(
+        full_name=full_name,
+        variable_name=variable_name,
+        solidity_type=solidity_type,
+        smt_type=smt_type,
+        size_bits=size_bits,
+        value=value,
+    )
+
+
+def parse_model_str(smtlib_str: str) -> ModelVariables:
+    """Expects a whole smtlib model output file, as produced by a solver
+    in response to a `(check-sat)` + `(get-model)` command.
+
+    Extracts dolmos variables and returns them grouped by their full name"""
+
+    model_variables: dict[str, ModelVariable] = {}
+
+    # use a regex to find all the variables
+    # for now we explicitly don't try to properly parse the smtlib output
+    # because of idiosyncrasies of different solvers:
+    # - ignores the initial sat/unsat on the first line
+    # - ignores the occasional `(model)` command used by yices, stp, cvc4, etc.
+
+    for match in dolmos_var_pattern.finditer(smtlib_str):
+        try:
+            variable = _parse_dolmos_var_match(match)
+            model_variables[variable.full_name] = variable
+        except Exception as e:
+            error(f"error parsing smtlib string '{match.string.strip()}': {e}")
+            raise e
+
+    return model_variables
+
+
+def parse_model_file(file_path: str) -> ModelVariables:
+    with open(file_path) as file:
+        return parse_model_str(file.read())
+
+
+def parse_unsat_core(output: str) -> list[str] | None:
+    # parsing example:
+    #   unsat
+    #   (error "the context is unsatisfiable")  # <-- this line is optional
+    #   (<41702> <37030> <36248> <47880>)
+    # result:
+    #   [41702, 37030, 36248, 47880]
+    pattern = r"unsat\s*(\(\s*error\s+[^)]*\)\s*)?\(\s*((<[0-9]+>\s*)*)\)"
+    match = re.search(pattern, output)
+    if match:
+        result = [re.sub(r"<([0-9]+)>", r"\1", name) for name in match.group(2).split()]
+        return result
+    else:
+        warn(f"error in parsing unsat core: {output}")
+        return None
+
+
+def dump(
+    path_ctx: PathContext,
+) -> tuple[CheckSatResult, PotentialModel | None, list | None]:
+    args, query, dump_file = path_ctx.args, path_ctx.query, path_ctx.dump_file
+
+    if args.verbose >= 1:
+        debug(f"Writing SMT query to {dump_file}")
+
+    # for each implication assertion, `(assert (=> |id| c))`, in query.smtlib,
+    # generate a corresponding named assertion, `(assert (! |id| :named <id>))`.
+    # see `svem.Path.to_smt2()` for more details.
+    if args.cache_solver:
+        named_assertions = "".join(
+            [
+                f"(assert (! |{assert_id}| :named <{assert_id}>))\n"
+                for assert_id in query.assertions
+            ]
+        )
+
+        dump_file.write_text(
+            "(set-option :produce-unsat-cores true)\n"
+            "(set-logic QF_AUFBV)\n"
+            f"{query.smtlib}\n"
+            f"{named_assertions}"
+            "(check-sat)\n"
+            "(get-model)\n"
+            "(get-unsat-core)\n"
+        )
+
+    else:
+        dump_file.write_text(
+            f"(set-logic QF_AUFBV)\n{query.smtlib}\n(check-sat)\n(get-model)\n"
+        )
+
+
+def is_model_valid(solver_stdout: str) -> bool:
+    # TODO: evaluate the path condition against the given model after excluding f_evm_* symbols,
+    #       since the f_evm_* symbols may still appear in valid models.
+
+    return "f_evm_" not in solver_stdout
+
+
+def solve_low_level(path_ctx: PathContext) -> SolverOutput:
+    """Invokes an external solver process to solve the given query.
+
+    Can raise TimeoutError or some Exception raised during execution"""
+
+    args, smt2_filename = path_ctx.args, str(path_ctx.dump_file)
+
+    # make sure the smt2 file has been written
+    dump(path_ctx)
+
+    solver_command = args.resolved_solver_command + [smt2_filename]
+    if args.verbose >= 1:
+        print("  Checking with external solver process")
+        print(f"    {shlex.join(solver_command)} > {smt2_filename}.out")
+
+    # solver_timeout_assertion == 0 means no timeout,
+    # which translates to timeout_seconds=None for subprocess.run
+    timeout_seconds = t if (t := args.solver_timeout_assertion) else None
+    future = PopenFuture(solver_command, timeout=timeout_seconds)
+
+    # starts the subprocess asynchronously
+    path_ctx.solving_ctx.executor.submit(future)
+
+    # block until the external solver returns, times out, is interrupted, fails, etc.
+    try:
+        stdout, stderr, returncode = future.result()
+    except subprocess.TimeoutExpired:
+        return SolverOutput(
+            result=unknown,
+            returncode=EXIT_TIMEDOUT,
+            path_id=path_ctx.path_id,
+            query_file=smt2_filename,
+        )
+
+    # save solver stdout to file
+    with open(f"{smt2_filename}.out", "w") as f:
+        f.write(stdout)
+
+    # save solver stderr to file (only if there is an error)
+    if stderr:
+        with open(f"{smt2_filename}.err", "w") as f:
+            f.write(stderr)
+
+    return SolverOutput.from_result(stdout, stderr, returncode, path_ctx)
+
+
+def solve_end_to_end(ctx: PathContext) -> SolverOutput:
+    """Solves the given query, then checks the keccak values the model relies on (see refine_keccak)."""
+    if ctx.exp_apps:
+        return solve_with_exp_refinement(ctx)
+
+    if not ctx.sha3_args or ctx.args.keccak_refinement_rounds <= 0:
+        return _solve_end_to_end(ctx)
+
+    # expose the keccak preimages in the model with definitional (hence unsat-core neutral) constraints
+    ctx = replace(
+        ctx,
+        query=SMTQuery(
+            ctx.query.smtlib + sha3_arg_decls(ctx.sha3_args), ctx.query.assertions
+        ),
+    )
+    solver_output = _solve_end_to_end(ctx)
+    return refine_keccak(ctx, solver_output)
+
+
+def _solve_end_to_end(ctx: PathContext) -> SolverOutput:
+    """Synchronously resolves a query in a given context, which may result in 0, 1 or multiple solver invocations.
+
+    - may result in 0 invocations if the query contains a known unsat core (hence the need for the context)
+    - may result in exactly 1 invocation if the query is unsat, or sat with a valid model
+    - may result in multiple invocations if the query is sat and the model is invalid (needs refinement)
+
+    If this produces a model, it _should_ be valid.
+    """
+    path_id, query = ctx.path_id, ctx.query
+
+    verbose = print if ctx.args.verbose >= 1 else lambda *args, **kwargs: None
+    verbose(f"Checking path condition {path_id=}")
+
+    # if the query contains an unsat-core, it is unsat; no need to run the solver
+    if check_unsat_cores(query, ctx.solving_ctx.unsat_cores):
+        verbose("  Already proven unsat")
+        return SolverOutput(unsat, 0, path_id, str(ctx.dump_file))
+
+    solver_output = solve_low_level(ctx)
+    result, model = solver_output.result, solver_output.model
+
+    # if the ctx is already refined, we don't need to solve again
+    if result == sat and not model.is_valid and not ctx.is_refined:
+        verbose("  Checking again with refinement")
+
+        refined_ctx = ctx.refine()
+
+        if refined_ctx.query.smtlib != query.smtlib:
+            # note that check_unsat_cores cannot return true for the refined query, because it relies on only
+            # constraint ids, which don't change after refinement
+            # therefore we can skip the unsat core check in solve_end_to_end and go directly to solve_low_level
+            return solve_low_level(refined_ctx)
+        else:
+            verbose("    Refinement did not change the query, no need to solve again")
+
+    return solver_output
+
+
+# keccak refinement (a16z/halmos#562)
+#
+# keccak256 is modeled as uninterpreted functions f_sha3_N, constrained only by the
+# injectivity and range axioms, and by the concrete values of hashes of concrete data.
+# A model may thus assign to a symbolic preimage x a hash value f_sha3_N(x) that differs
+# from the real keccak256(x), e.g. the solver may pick x = 0 and "decide" that its hash
+# is the key of a storage entry written in setUp. Such a counterexample does not replay.
+#
+# When the query is sat, the value of every symbolic preimage is read from the model, and
+# the real hashes of these values are asserted, `f_sha3_N(v) == keccak256(v)`. These facts
+# are true of the real hash function, so the refined query keeps every real counterexample:
+# - if the model agrees with the real hashes, the counterexample is kept as is;
+# - otherwise the query is solved again with the new facts: unsat means that no counterexample
+#   exists under the real hash values (modulo the usual keccak assumptions), and a new model is
+#   checked again, up to --keccak-refinement-rounds times; a model that still disagrees is
+#   reported as potentially invalid.
+
+SHA3_ARG_PREFIX = "sha3arg_"
+
+sha3_arg_pattern = re.compile(
+    rf"\(\s*define-fun\s+\|?({SHA3_ARG_PREFIX}\d+)\|?\s+\(\)\s+\(_\s+BitVec\s+(\d+)\)\s+"
+    r"(#x[0-9a-fA-F]+|#b[01]+|\(_\s+bv\d+\s+\d+\))\s*\)"
+)
+
+MAX_SHA3_ARGS = 64
+
+
+def mk_sha3_args(sha3s) -> tuple[tuple[int, str], ...]:
+    """
+    Returns the symbolic keccak preimages registered in the given KeccakRegistry, as
+    (bitsize, smtlib term) pairs. Strings only: the result crosses thread boundaries.
+    """
+    result = []
+    for expr in sha3s:
+        if expr.num_args() != 1 or not is_f_sha3_name(expr.decl().name()):
+            continue
+        data = expr.arg(0)
+        if is_bv_value(data):
+            continue
+        result.append((data.size(), data.sexpr()))
+        if len(result) >= MAX_SHA3_ARGS:
+            break
+    return tuple(result)
+
+
+def sha3_arg_decls(sha3_args) -> str:
+    return "".join(
+        f"(declare-fun {SHA3_ARG_PREFIX}{i} () (_ BitVec {size}))\n"
+        f"(assert (= {SHA3_ARG_PREFIX}{i} {term}))\n"
+        for i, (size, term) in enumerate(sha3_args)
+    )
+
+
+def parse_sha3_arg_values(solver_stdout: str) -> dict[int, tuple[int, int]]:
+    """Returns {index: (bitsize, value)} for the sha3arg_* constants of the model"""
+    values = {}
+    for match in sha3_arg_pattern.finditer(solver_stdout):
+        index = int(match.group(1)[len(SHA3_ARG_PREFIX) :])
+        values[index] = (int(match.group(2)), parse_const_value(match.group(3)))
+    return values
+
+
+def keccak_fact(size: int, value: int) -> tuple[str, int] | None:
+    """Returns the assertion `f_sha3_<size>(value) == keccak256(value)`, and the hash"""
+    hash_value = int.from_bytes(keccak(value.to_bytes(size // 8, "big")), "big")
+
+    # outside of the range assumed for hash values; see Exec.sha3_data()
+    if hash_value == 0 or hash_value > 2**256 - 2**64:
+        return None
+
+    fact = f"(assert (= ({f_sha3_name(size)} (_ bv{value} {size})) (_ bv{hash_value} 256)))\n"
+    return fact, hash_value
+
+
+def refine_keccak(ctx: PathContext, solver_output: SolverOutput) -> SolverOutput:
+    verbose = print if ctx.args.verbose >= 1 else lambda *args, **kwargs: None
+
+    facts: dict[tuple[int, int], str] = {}
+    base_smtlib = ctx.query.smtlib
+    max_rounds = ctx.args.keccak_refinement_rounds
+
+    for round in range(max_rounds + 1):
+        result, model = solver_output.result, solver_output.model
+        if result != sat or model is None or not model.is_valid:
+            return solver_output
+
+        try:
+            with open(f"{solver_output.query_file}.out") as f:
+                values = parse_sha3_arg_values(f.read())
+        except OSError:
+            return solver_output
+
+        new_facts = {}
+        consistent = True
+        for size, value in values.values():
+            if size % 8 or (size, value) in facts:
+                continue
+            fact = keccak_fact(size, value)
+            if fact is None:
+                consistent = False
+                continue
+            new_facts[size, value] = fact[0]
+
+        if not new_facts:
+            if consistent:
+                return solver_output
+            break
+
+        if round == max_rounds:
+            break
+
+        facts.update(new_facts)
+        verbose(
+            f"  Checking again with {len(facts)} keccak value(s) (round {round + 1})"
+        )
+
+        refined_ctx = replace(
+            ctx,
+            query=SMTQuery(base_smtlib + "".join(facts.values()), ctx.query.assertions),
+            suffix=f".keccak{round + 1}",
+        )
+        last_sat_output = solver_output
+        solver_output = solve_low_level(refined_ctx)
+
+        # an unsat core of the refined query may depend on the (unnamed) keccak facts,
+        # so it cannot be reused for other queries
+        if solver_output.unsat_core is not None:
+            solver_output = replace(solver_output, unsat_core=None)
+
+        # if the refined query cannot be decided (timeout, solver error), keep the last
+        # counterexample rather than dropping it: only unsat proves its absence
+        if solver_output.result not in (sat, unsat):
+            verbose(f"  Refined query result: {solver_output.result}")
+            solver_output = last_sat_output
+            break
+
+    # the model still relies on keccak values that may not exist
+    verbose("  Keccak values of the model are not consistent with keccak256")
+    potential_model = PotentialModel(model=solver_output.model.model, is_valid=False)
+    return replace(
+        solver_output, model=potential_model, invalid_reason=KECCAK_INVALID_REASON
+    )
+
+
+KECCAK_INVALID_REASON = (
+    "relies on keccak256 values that differ from the real hash function "
+    "(rerun with a larger --keccak-refinement-rounds)"
+)
+
+
+# EXP refinement (a16z/halmos#280), with --pretty-counterexamples
+#
+# EXP is modeled by the uninterpreted function f_evm_exp_256 when the exponent is symbolic,
+# or when it is a constant above --smt-exp-by-const and the base is symbolic. A model may
+# thus give `x ** 3` any value, and the counterexample is only reported as "potentially
+# invalid", without saying why.
+#
+# With --pretty-counterexamples, each application `r = f_evm_exp_256(b, e)` of the path and
+# its operands are exposed in the model, and compared with the real exponentiation:
+# - if `r == b ** e mod 2**256` for every application, the model does not depend on the
+#   abstraction, and the counterexample is valid;
+# - otherwise the query is solved again with facts that hold for the real EXP, so that every
+#   real counterexample is kept, and unsat proves that there is none:
+#   - exact encodings, added once: a constant exponent is expanded by square and multiply,
+#     and a constant base is tabulated over the exponents below 256 (an even base is then
+#     exact, as b ** e == 0 mod 2**256 for e >= 256);
+#   - the real value at the operands of each disagreeing application, `f(b, e) == b ** e`;
+#   up to PCEX_EXP_REFINEMENT_ROUNDS times. Keccak values are checked in the same loop
+#   (see refine_keccak), with --keccak-refinement-rounds additional rounds.
+# A model that still disagrees is reported as potentially invalid, with the reason.
+
+EXP_NAME = "f_evm_exp_256"
+PCEX_EXP_REFINEMENT_ROUNDS = 3
+MAX_EXP_APPS = 128
+
+# constant exponents up to this bound are expanded by square and multiply
+MAX_EXPANDED_EXPONENT = 2**64
+
+WORD_MODULUS = 2**256
+
+exp_arg_pattern = re.compile(
+    r"\(\s*define-fun\s+\|?pcex_exp([ber])_(\d+)\|?\s+\(\)\s+\(_\s+BitVec\s+256\)\s+"
+    r"(#x[0-9a-fA-F]+|#b[01]+|\(_\s+bv\d+\s+\d+\))\s*\)"
+)
+
+abstraction_name_pattern = re.compile(r"f_evm_[a-z]+_\d+")
+
+UNDECIDED_REASON = (
+    "the refined query could not be decided "
+    "(rerun with a larger --solver-timeout-assertion)"
+)
+
+
+@dataclass(frozen=True)
+class ExpApp:
+    """An application of the EXP abstraction, as smtlib terms (no z3 object: crosses threads)"""
+
+    base: str
+    exponent: str
+
+    # values of the operands, when they are constants
+    base_value: int | None = None
+    exponent_value: int | None = None
+
+    def describe(self) -> str:
+        base = "x" if self.base_value is None else str(self.base_value)
+        exponent = "y" if self.exponent_value is None else str(self.exponent_value)
+        return f"{base} ** {exponent}"
+
+
+@dataclass(frozen=True)
+class ExpApps:
+    apps: tuple[ExpApp, ...] = ()
+
+    # false if the path has more applications than MAX_EXP_APPS
+    complete: bool = True
+
+    def __bool__(self) -> bool:
+        return bool(self.apps)
+
+    def __len__(self) -> int:
+        return len(self.apps)
+
+
+def mk_exp_apps(conditions) -> ExpApps:
+    """Returns the applications of the EXP abstraction in the given path conditions"""
+    apps: dict[tuple[int, int], ExpApp] = {}
+    complete = True
+    visited = set()
+    stack = list(conditions)
+    while stack:
+        expr = stack.pop()
+        expr_id = expr.get_id()
+        if expr_id in visited:
+            continue
+        visited.add(expr_id)
+
+        if not is_app(expr):
+            continue
+
+        if expr.num_args() == 2 and expr.decl().name() == EXP_NAME:
+            base, exponent = expr.arg(0), expr.arg(1)
+            key = (base.get_id(), exponent.get_id())
+            if key not in apps:
+                if len(apps) >= MAX_EXP_APPS:
+                    complete = False
+                else:
+                    apps[key] = ExpApp(
+                        base=base.sexpr(),
+                        exponent=exponent.sexpr(),
+                        base_value=base.as_long() if is_bv_value(base) else None,
+                        exponent_value=(
+                            exponent.as_long() if is_bv_value(exponent) else None
+                        ),
+                    )
+
+        stack.extend(expr.children())
+
+    return ExpApps(tuple(apps.values()), complete)
+
+
+def exp_names(i: int) -> tuple[str, str, str]:
+    """names of the constants holding the base, exponent and result of the i-th application"""
+    return f"pcex_expb_{i}", f"pcex_expe_{i}", f"pcex_expr_{i}"
+
+
+def exp_arg_decls(apps: ExpApps) -> str:
+    result = []
+    for i, app in enumerate(apps.apps):
+        b, e, r = exp_names(i)
+        result.append(
+            f"(declare-fun {b} () (_ BitVec 256))\n"
+            f"(assert (= {b} {app.base}))\n"
+            f"(declare-fun {e} () (_ BitVec 256))\n"
+            f"(assert (= {e} {app.exponent}))\n"
+            f"(declare-fun {r} () (_ BitVec 256))\n"
+            f"(assert (= {r} ({EXP_NAME} {b} {e})))\n"
+        )
+    return "".join(result)
+
+
+def parse_exp_arg_values(solver_stdout: str) -> dict[int, dict[str, int]]:
+    """Returns {index: {"b": base, "e": exponent, "r": result}} from the model"""
+    values: dict[int, dict[str, int]] = {}
+    for match in exp_arg_pattern.finditer(solver_stdout):
+        kind, index = match.group(1), int(match.group(2))
+        values.setdefault(index, {})[kind] = parse_const_value(match.group(3))
+    return values
+
+
+def bv256(value: int) -> str:
+    return f"(_ bv{value % WORD_MODULUS} 256)"
+
+
+def exp_table(base: int, exponent: str, otherwise: str) -> str:
+    """
+    `base ** exponent` for a constant base, as a nested ite over the exponents below 256.
+
+    For an even base, the table is exact: b ** e == 0 mod 2**256 for e >= 256. For an odd
+    base, larger exponents fall back to `otherwise`.
+    """
+    if base % WORD_MODULUS == 1:
+        return bv256(1)
+
+    entries = []
+    value = 1
+    for _ in range(256):
+        entries.append(value)
+        value = value * base % WORD_MODULUS
+
+    if base % 2 == 0:
+        while entries and entries[-1] == 0:
+            entries.pop()
+        result = bv256(0)
+    else:
+        result = otherwise
+
+    for k in reversed(range(len(entries))):
+        result = f"(ite (= {exponent} {bv256(k)}) {bv256(entries[k])} {result})"
+    return result
+
+
+def exp_square_and_multiply(i: int, exponent: int) -> str:
+    """`pcex_expr_i == pcex_expb_i ** exponent`, with O(log exponent) multiplications"""
+    b, _, r = exp_names(i)
+
+    if exponent == 0:
+        return f"(assert (= {r} {bv256(1)}))\n"
+
+    lines = []
+    square, acc, bit = b, None, 0
+    while True:
+        if (exponent >> bit) & 1:
+            if acc is None:
+                acc = square
+            else:
+                product = f"pcex_expm_{i}_{bit}"
+                lines.append(
+                    f"(declare-fun {product} () (_ BitVec 256))\n"
+                    f"(assert (= {product} (bvmul {acc} {square})))\n"
+                )
+                acc = product
+        bit += 1
+        if exponent >> bit == 0:
+            break
+        next_square = f"pcex_exps_{i}_{bit}"
+        lines.append(
+            f"(declare-fun {next_square} () (_ BitVec 256))\n"
+            f"(assert (= {next_square} (bvmul {square} {square})))\n"
+        )
+        square = next_square
+
+    lines.append(f"(assert (= {r} {acc}))\n")
+    return "".join(lines)
+
+
+def exact_exp_fact(i: int, app: ExpApp) -> str:
+    """Exact (or partial, for an odd constant base) definition of the i-th application"""
+    _, e, r = exp_names(i)
+    if app.base_value is not None:
+        return f"(assert (= {r} {exp_table(app.base_value, e, r)}))\n"
+    if app.exponent_value is not None and app.exponent_value < MAX_EXPANDED_EXPONENT:
+        return exp_square_and_multiply(i, app.exponent_value)
+    return ""
+
+
+def exp_point_fact(base: int, exponent: int) -> str:
+    result = pow(base, exponent, WORD_MODULUS)
+    return (
+        f"(assert (= ({EXP_NAME} {bv256(base)} {bv256(exponent)}) {bv256(result)}))\n"
+    )
+
+
+def short_int(value: int) -> str:
+    return str(value) if value < 10**20 else hex(value)
+
+
+def exp_invalid_reason(
+    apps: ExpApps, values: dict, disagree: list[int], missing: list[int]
+) -> str:
+    details = []
+    advice = set()
+    for i in (missing + disagree)[:2]:
+        app = apps.apps[i]
+        what = app.describe()
+        if app.base_value is None and app.exponent_value is None:
+            what += " (symbolic base and exponent)"
+            advice.add(
+                "constrain the operands with vm.assume (e.g. exponent < 256) "
+                "or make the base or the exponent constant"
+            )
+        elif app.base_value is not None:
+            advice.add("constrain the exponent with vm.assume (e.g. exponent < 256)")
+        else:
+            what += " (exponent too large to expand)"
+
+        v = values.get(i, {})
+        if {"b", "e", "r"} <= v.keys():
+            b, e, r = v["b"], v["e"], v["r"]
+            real = pow(b, e, WORD_MODULUS)
+            details.append(
+                f"{what}: the model takes {short_int(b)} ** {short_int(e)} = "
+                f"{short_int(r)} instead of {short_int(real)}"
+            )
+        else:
+            details.append(f"{what}: the solver did not report its operands")
+
+    more = len(missing) + len(disagree) - len(details)
+    if more > 0:
+        details.append(f"and {more} more")
+
+    reason = "EXP is approximated: " + "; ".join(details)
+    if advice:
+        reason += " (" + "; ".join(sorted(advice)) + ")"
+    return reason
+
+
+def solve_with_exp_refinement(ctx: PathContext) -> SolverOutput:
+    """solve_end_to_end() for paths with EXP applications, with --pretty-counterexamples"""
+    decls = exp_arg_decls(ctx.exp_apps)
+    if ctx.sha3_args and ctx.args.keccak_refinement_rounds > 0:
+        decls += sha3_arg_decls(ctx.sha3_args)
+
+    ctx = replace(ctx, query=SMTQuery(ctx.query.smtlib + decls, ctx.query.assertions))
+    return refine_exp(ctx, _solve_end_to_end(ctx))
+
+
+def refine_exp(ctx: PathContext, solver_output: SolverOutput) -> SolverOutput:
+    verbose = print if ctx.args.verbose >= 1 else lambda *args, **kwargs: None
+
+    apps = ctx.exp_apps
+    use_keccak = bool(ctx.sha3_args) and ctx.args.keccak_refinement_rounds > 0
+    max_rounds = PCEX_EXP_REFINEMENT_ROUNDS + (
+        ctx.args.keccak_refinement_rounds if use_keccak else 0
+    )
+
+    # the abstractions of multiplication and division are replaced by their definitions
+    base_smtlib = refine(ctx.query).smtlib
+
+    exact, points, keccaks = None, {}, {}
+    solved_refined = False
+    last_sat = None
+    reasons = []
+
+    values, disagree, missing, others = {}, [], [], []
+    new_keccaks, keccak_consistent = {}, True
+
+    for round in range(max_rounds + 1):
+        result, model = solver_output.result, solver_output.model
+        if result == unsat:
+            return solver_output
+
+        if result != sat or model is None:
+            if last_sat is None:
+                return solver_output
+            # keep the last counterexample rather than dropping it: only unsat proves its absence
+            verbose(f"  Refined query result: {result}")
+            reasons.append(UNDECIDED_REASON)
+            break
+
+        last_sat = solver_output
+
+        try:
+            with open(f"{solver_output.query_file}.out") as f:
+                stdout = f.read()
+        except OSError:
+            reasons.append("the solver output could not be read")
+            break
+
+        values = parse_exp_arg_values(stdout)
+        disagree, missing = [], []
+        for i in range(len(apps)):
+            v = values.get(i, {})
+            if not {"b", "e", "r"} <= v.keys():
+                missing.append(i)
+            elif pow(v["b"], v["e"], WORD_MODULUS) != v["r"]:
+                disagree.append(i)
+
+        others = sorted(set(abstraction_name_pattern.findall(stdout)) - {EXP_NAME})
+
+        new_keccaks, keccak_consistent = {}, True
+        if use_keccak:
+            for size, value in parse_sha3_arg_values(stdout).values():
+                if size % 8 or (size, value) in keccaks:
+                    continue
+                fact = keccak_fact(size, value)
+                if fact is None:
+                    keccak_consistent = False
+                    continue
+                new_keccaks[size, value] = fact[0]
+
+        exp_ok = apps.complete and not disagree and not missing
+        if exp_ok and not others and not new_keccaks and keccak_consistent:
+            verbose("  The model agrees with the real EXP")
+            return replace(
+                solver_output,
+                model=PotentialModel(model=model.model, is_valid=True),
+            )
+
+        if round == max_rounds or not apps.complete:
+            break
+
+        added = False
+        if exact is None and (disagree or missing):
+            exact = "".join(exact_exp_fact(i, app) for i, app in enumerate(apps.apps))
+            added = bool(exact)
+
+        for i in disagree:
+            key = (values[i]["b"], values[i]["e"])
+            if key not in points:
+                points[key] = exp_point_fact(*key)
+                added = True
+
+        if new_keccaks:
+            keccaks.update(new_keccaks)
+            added = True
+
+        # the first refined query also replaces the abstractions of mul/div by their definitions
+        if not added and (solved_refined or not others):
+            break
+
+        verbose(
+            f"  Checking again with {len(points)} EXP value(s), "
+            f"{len(keccaks)} keccak value(s) (round {round + 1})"
+        )
+        refined_ctx = replace(
+            ctx,
+            query=SMTQuery(
+                base_smtlib
+                + (exact or "")
+                + "".join(points.values())
+                + "".join(keccaks.values()),
+                ctx.query.assertions,
+            ),
+            suffix=f".pcex{round + 1}",
+        )
+        solver_output = solve_low_level(refined_ctx)
+        solved_refined = True
+
+        # an unsat core of the refined query may depend on the (unnamed) facts,
+        # so it cannot be reused for other queries
+        if solver_output.unsat_core is not None:
+            solver_output = replace(solver_output, unsat_core=None)
+
+    if not apps.complete:
+        reasons.append(f"too many exponentiations to check (more than {MAX_EXP_APPS})")
+    if others:
+        reasons.append(f"relies on {', '.join(others)}, which is not modeled exactly")
+    if disagree or missing:
+        reasons.append(exp_invalid_reason(apps, values, disagree, missing))
+    if use_keccak and (new_keccaks or not keccak_consistent):
+        reasons.append(KECCAK_INVALID_REASON)
+
+    reason = "; ".join(reasons) or "relies on an approximation of the EVM semantics"
+    verbose(f"  Potentially invalid counterexample: {reason}")
+    potential_model = PotentialModel(model=last_sat.model.model, is_valid=False)
+    return replace(last_sat, model=potential_model, invalid_reason=reason)
+
+
+def check_unsat_cores(query: SMTQuery, unsat_cores: list[list]) -> bool:
+    # return true if the given query contains any given unsat core
+    for unsat_core in unsat_cores:
+        if all(core in query.assertions for core in unsat_core):
+            return True
+    return False
+
+
+def refine(query: SMTQuery) -> SMTQuery:
+    smtlib = query.smtlib
+
+    # replace uninterpreted abstraction with actual symbols for assertion solving
+    smtlib = re.sub(
+        r"\(declare-fun f_evm_(bvmul)_([0-9]+) \(\(_ BitVec \2\) \(_ BitVec \2\)\) \(_ BitVec \2\)\)",
+        r"(define-fun f_evm_\1_\2 ((x (_ BitVec \2)) (y (_ BitVec \2))) (_ BitVec \2) (\1 x y))",
+        smtlib,
+    )
+
+    # replace `(f_evm_bvudiv_N x y)` with `(ite (= y (_ bv0 N)) (_ bv0 N) (bvudiv x y))`
+    # similarly for bvurem, bvsdiv, and bvsrem
+    # NOTE: (bvudiv x (_ bv0 N)) is *defined* to (bvneg (_ bv1 N)); while (div x 0) is undefined
+    smtlib = re.sub(
+        r"\(declare-fun f_evm_(bvudiv|bvurem|bvsdiv|bvsrem)_([0-9]+) \(\(_ BitVec \2\) \(_ BitVec \2\)\) \(_ BitVec \2\)\)",
+        r"(define-fun f_evm_\1_\2 ((x (_ BitVec \2)) (y (_ BitVec \2))) (_ BitVec \2) (ite (= y (_ bv0 \2)) (_ bv0 \2) (\1 x y)))",
+        smtlib,
+    )
+
+    return SMTQuery(smtlib, query.assertions)
diff --git a/src/halmos/solvers.py b/src/dolmos/solvers.py
similarity index 96%
rename from src/halmos/solvers.py
rename to src/dolmos/solvers.py
index 2c9ad4689..1287c47ff 100644
--- a/src/halmos/solvers.py
+++ b/src/dolmos/solvers.py
@@ -14,11 +14,11 @@
 
 import requests
 
-from halmos.logs import debug, error
-from halmos.ui import ui
-from halmos.utils import format_size, synchronized
+from dolmos.logs import debug, error
+from dolmos.ui import ui
+from dolmos.utils import format_size, synchronized
 
-# not defaulting to latest because of https://github.com/a16z/halmos/issues/492
+# not defaulting to latest because of upstream halmos issue #492
 DEFAULT_YICES_VERSION = "2.6.4"
 
 DEFAULT_CVC5_VERSION = "1.2.1"
@@ -26,11 +26,13 @@
 DEFAULT_BITWUZLA_VERSION = "0.8.1"
 
 # Define the cache directory for solvers
-SOLVER_CACHE_DIR = Path.home() / ".halmos" / "solvers"
+SOLVER_CACHE_DIR = Path.home() / ".dolmos" / "solvers"
 SOLVER_CACHE_DIR.mkdir(parents=True, exist_ok=True)
 
 # environment variable to bypass the interactive download confirmation prompt
-ALLOW_DOWNLOAD_VAR = "HALMOS_ALLOW_DOWNLOAD"
+# (HALMOS_ALLOW_DOWNLOAD is still honored for existing setups)
+ALLOW_DOWNLOAD_VAR = "DOLMOS_ALLOW_DOWNLOAD"
+LEGACY_ALLOW_DOWNLOAD_VAR = "HALMOS_ALLOW_DOWNLOAD"
 
 
 def yices_base_url(version: str) -> str:
@@ -349,7 +351,10 @@ def download_allowed(solver: SolverInfo, download_info: DownloadInfo) -> bool:
     Checks if the download is allowed.
     """
 
-    bypass = os.environ.get(ALLOW_DOWNLOAD_VAR, "false").lower() in ["true", "1"]
+    bypass = any(
+        os.environ.get(var, "false").lower() in ["true", "1"]
+        for var in (ALLOW_DOWNLOAD_VAR, LEGACY_ALLOW_DOWNLOAD_VAR)
+    )
     if bypass:
         return True
 
@@ -502,7 +507,7 @@ def get_solver_command(solver_name: str) -> list[str]:
     if not solver_info:
         # should have been caught by the config parsing:
         #   `--solver <solver_name>` is a high level command that expects a supported solver
-        # solvers not managed by halmos can be accessed with the low-level
+        # solvers not managed by dolmos can be accessed with the low-level
         #   `--solver-command "solver_binary <args>"`
         raise ValueError(f"Unsupported solver: {solver_name}")
 
@@ -515,7 +520,7 @@ def get_solver_command(solver_name: str) -> list[str]:
     return command
 
 
-# python -m halmos.solvers <solver_name>
+# python -m dolmos.solvers <solver_name>
 # useful when adding a new solver:
 # - tests the download for all platforms
 # - prints the checksums,
diff --git a/src/halmos/traces.py b/src/dolmos/traces.py
similarity index 95%
rename from src/halmos/traces.py
rename to src/dolmos/traces.py
index 1a24c19c4..1f328ec9c 100644
--- a/src/halmos/traces.py
+++ b/src/dolmos/traces.py
@@ -6,11 +6,11 @@
 
 from z3 import Z3_OP_CONCAT, BitVecNumRef, BitVecRef, is_app
 
-from halmos.bytevec import ByteVec
-from halmos.config import Config, TraceEvent
-from halmos.exceptions import HalmosException
-from halmos.mapper import DeployAddressMapper, Mapper
-from halmos.sevm import (
+from dolmos.bytevec import ByteVec
+from dolmos.config import Config, TraceEvent
+from dolmos.exceptions import DolmosException
+from dolmos.mapper import DeployAddressMapper, Mapper
+from dolmos.sevm import (
     CallContext,
     CallSequence,
     EventLog,
@@ -18,7 +18,7 @@
     StorageWrite,
     mnemonic,
 )
-from halmos.utils import (
+from dolmos.utils import (
     Address,
     byte_length,
     cyan,
@@ -158,7 +158,7 @@ def rendered_calldata(calldata: ByteVec, contract_name: str | None = None) -> st
 def render_trace(context: CallContext, file=sys.stdout) -> None:
     config: Config = config_context.get()
     if config is None:
-        raise HalmosException("config not set")
+        raise DolmosException("config not set")
 
     message = context.message
     addr_str = rendered_address(message.target)
@@ -219,7 +219,7 @@ def render_trace(context: CallContext, file=sys.stdout) -> None:
                 if TraceEvent.SSTORE in config.trace_events:
                     print(f"{log_indent}{rendered_sstore(trace_element)}", file=file)
             case _:
-                raise HalmosException(f"unexpected trace element: {trace_element}")
+                raise DolmosException(f"unexpected trace element: {trace_element}")
 
     render_output(context, file=file)
 
diff --git a/src/halmos/ui.py b/src/dolmos/ui.py
similarity index 100%
rename from src/halmos/ui.py
rename to src/dolmos/ui.py
diff --git a/src/halmos/utils.py b/src/dolmos/utils.py
similarity index 96%
rename from src/halmos/utils.py
rename to src/dolmos/utils.py
index b2b212785..0f32bc0b2 100644
--- a/src/halmos/utils.py
+++ b/src/dolmos/utils.py
@@ -43,12 +43,12 @@
     substitute,
 )
 
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bitvec import HalmosBool as Bool
-from halmos.exceptions import HalmosException, NotConcreteError
-from halmos.hashes import keccak256_256, keccak256_512
-from halmos.logs import warn
-from halmos.mapper import Mapper
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bitvec import DolmosBool as Bool
+from dolmos.exceptions import DolmosException, NotConcreteError
+from dolmos.hashes import keccak256_256, keccak256_512
+from dolmos.logs import warn
+from dolmos.mapper import Mapper
 
 # order of the secp256k1 curve
 secp256k1n = (
@@ -56,7 +56,7 @@
 )
 
 if TYPE_CHECKING:
-    from halmos.bytevec import ByteVec
+    from dolmos.bytevec import ByteVec
 
 Byte = int | BitVecRef | BV  # uint8
 Bytes4 = int | BitVecRef | BV  # uint32
@@ -437,7 +437,7 @@ def byte_length(x: Any, strict=True) -> int:
 
     if is_bv(x):
         if x.size() % 8 != 0 and strict:
-            raise HalmosException(f"byte_length({x}) with bit size {x.size()}")
+            raise DolmosException(f"byte_length({x}) with bit size {x.size()}")
         return math.ceil(x.size() / 8)
 
     raise TypeError(f"byte_length({x}) of type {type(x)}")
@@ -691,6 +691,7 @@ class EVM:
     SHL = 0x1B
     SHR = 0x1C
     SAR = 0x1D
+    CLZ = 0x1E
     SHA3 = 0x20
     ADDRESS = 0x30
     BALANCE = 0x31
@@ -717,6 +718,8 @@ class EVM:
     CHAINID = 0x46
     SELFBALANCE = 0x47
     BASEFEE = 0x48
+    BLOBHASH = 0x49
+    BLOBBASEFEE = 0x4A
     POP = 0x50
     MLOAD = 0x51
     MSTORE = 0x52
@@ -841,6 +844,7 @@ class EVM:
     EVM.SHL: "SHL",
     EVM.SHR: "SHR",
     EVM.SAR: "SAR",
+    EVM.CLZ: "CLZ",
     EVM.SHA3: "SHA3",
     EVM.ADDRESS: "ADDRESS",
     EVM.BALANCE: "BALANCE",
@@ -867,6 +871,8 @@ class EVM:
     EVM.CHAINID: "CHAINID",
     EVM.SELFBALANCE: "SELFBALANCE",
     EVM.BASEFEE: "BASEFEE",
+    EVM.BLOBHASH: "BLOBHASH",
+    EVM.BLOBBASEFEE: "BLOBBASEFEE",
     EVM.POP: "POP",
     EVM.MCOPY: "MCOPY",
     EVM.MLOAD: "MLOAD",
@@ -1415,14 +1421,6 @@ def wrapper(*args, **kwargs):
     0xE13A1834: "expectCallMinGas(address,uint256,uint64,bytes,uint64)",
     0x73CDCE36: "expectCreate(bytes,address)",
     0xEA54A472: "expectCreate2(bytes,address)",
-    0xB43AECE3: "expectEmit(address,uint64)",
-    0xC339D02C: "expectEmit(bool,bool,bool,bool,address,uint64)",
-    0x5E1D1C33: "expectEmit(bool,bool,bool,bool,uint64)",
-    0x4C74A335: "expectEmit(uint64)",
-    0x2E5F270C: "expectEmitAnonymous()",
-    0x6FC68705: "expectEmitAnonymous(address)",
-    0xC948DB5E: "expectEmitAnonymous(bool,bool,bool,bool,bool)",
-    0x71C95899: "expectEmitAnonymous(bool,bool,bool,bool,bool,address)",
     0x6D016688: "expectSafeMemory(uint64,uint64)",
     0x05838BF4: "expectSafeMemoryCall(uint64,uint64)",
     0x6248BE1F: "foundryVersionAtLeast(string)",
@@ -1546,24 +1544,6 @@ def wrapper(*args, **kwargs):
     0xC1ADBBFF: "expectCall(address,bytes,uint64)",
     0xF30C7BA3: "expectCall(address,uint256,bytes)",
     0xA2B1A1AE: "expectCall(address,uint256,bytes,uint64)",
-    0x440ED10D: "expectEmit()",
-    0x86B9620D: "expectEmit(address)",
-    0x491CC7C2: "expectEmit(bool,bool,bool,bool)",
-    0x81BAD6F3: "expectEmit(bool,bool,bool,bool,address)",
-    0x11FB5B9C: "expectPartialRevert(bytes4)",
-    0x51AA008A: "expectPartialRevert(bytes4,address)",
-    0xF4844814: "expectRevert()",
-    0xD814F38A: "expectRevert(address)",
-    0x1FF5F952: "expectRevert(address,uint64)",
-    0xF28DCEB3: "expectRevert(bytes)",
-    0x61EBCF12: "expectRevert(bytes,address)",
-    0xD345FB1F: "expectRevert(bytes,address,uint64)",
-    0x4994C273: "expectRevert(bytes,uint64)",
-    0xC31EB0E0: "expectRevert(bytes4)",
-    0x260BC5DE: "expectRevert(bytes4,address)",
-    0xB0762D73: "expectRevert(bytes4,address,uint64)",
-    0xE45CA72D: "expectRevert(bytes4,uint64)",
-    0x4EE38244: "expectRevert(uint64)",
     0x65BC9481: "accesses(address)",
     0xAFC98040: "broadcast()",
     0xE6962CDB: "broadcast(address)",
@@ -1646,7 +1626,6 @@ def wrapper(*args, **kwargs):
     0x592151F0: "parseToml(string)",
     0x37736E08: "parseToml(string,string)",
     0x812A44B2: "parseTomlKeys(string,string)",
-    0xD930A0E6: "projectRoot()",
     0x47EAF474: "prompt(string)",
     0x1E279D41: "promptSecret(string)",
     0x69CA02B7: "promptSecretUint(string)",
@@ -1688,7 +1667,6 @@ def wrapper(*args, **kwargs):
     0x28A249B0: "getLabel(address)",
     0xC6CE059D: "parseAddress(string)",
     0x974EF924: "parseBool(string)",
-    0x8F5D232D: "parseBytes(string)",
     0x087E6E81: "parseBytes32(string)",
     0x42346C5E: "parseInt(string)",
     0xFA91454D: "parseUint(string)",
@@ -1707,8 +1685,6 @@ def wrapper(*args, **kwargs):
     0x7D15D019: "isDir(string)",
     0xE0EB04D4: "isFile(string)",
     0xC4BC59E0: "readDir(string)",
-    0x60F9BB11: "readFile(string)",
-    0x16ED7BC4: "readFileBinary(string)",
     0x70F55728: "readLine(string)",
     0x9F5684A2: "readLink(string)",
     0xF1AFE04D: "removeFile(string)",
diff --git a/src/halmos/build.py b/src/halmos/build.py
deleted file mode 100644
index d0457b2e5..000000000
--- a/src/halmos/build.py
+++ /dev/null
@@ -1,194 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0
-
-import json
-import os
-import re
-import traceback
-
-from halmos.config import Config as HalmosConfig
-from halmos.logs import PARSING_ERROR, debug, warn_code
-from halmos.mapper import Mapper, SourceFileMap
-from halmos.ui import ui
-
-
-def get_contract_type(
-    ast_nodes: list, contract_name: str
-) -> tuple[str | None, str | None]:
-    for node in ast_nodes:
-        if node["nodeType"] == "ContractDefinition" and node["name"] == contract_name:
-            abstract = "abstract " if node.get("abstract") else ""
-            contract_type = abstract + node["contractKind"]
-            natspec = node.get("documentation")
-            return contract_type, natspec
-
-    return None, None
-
-
-def parse_build_out(args: HalmosConfig) -> dict:
-    result = {}  # compiler version -> source filename -> contract name -> (json, type)
-
-    coverage_output = args.coverage_output
-    root = args.root
-
-    if coverage_output:
-        SourceFileMap().set_root(root)
-
-    out_path = os.path.join(root, args.forge_build_out)
-    if not os.path.exists(out_path):
-        raise FileNotFoundError(
-            f"The build output directory `{out_path}` does not exist"
-        )
-
-    ui.update_status(f"Parsing {out_path}")
-    for sol_dirname in os.listdir(out_path):  # for each source filename
-        if not sol_dirname.endswith(".sol"):
-            continue
-
-        sol_path = os.path.join(out_path, sol_dirname)
-        if not os.path.isdir(sol_path):
-            continue
-
-        for json_filename in os.listdir(sol_path):  # for each contract name
-            try:
-                if not json_filename.endswith(".json"):
-                    continue
-                if json_filename.startswith("."):
-                    continue
-
-                json_path = os.path.join(sol_path, json_filename)
-                with open(json_path, encoding="utf8") as f:
-                    json_out = json.load(f)
-
-                ast = json_out["ast"]
-
-                if coverage_output:
-                    # record the mapping between file id and file path
-                    SourceFileMap().add_mapping(json_out["id"], ast["absolutePath"])
-
-                # cut off compiler version number as well
-                contract_name = json_filename.split(".")[0]
-                ast_nodes = ast["nodes"]
-                contract_type, natspec = get_contract_type(ast_nodes, contract_name)
-
-                # can happen to solidity files for multiple reasons:
-                # - import only (like console2.log)
-                # - defines only structs or enums
-                # - defines only free functions
-                # - ...
-                if contract_type is None:
-                    debug(f"Skipped {json_filename}, no contract definition found")
-                    continue
-
-                compiler_version = json_out["metadata"]["compiler"]["version"]
-                result.setdefault(compiler_version, {})
-                result[compiler_version].setdefault(sol_dirname, {})
-                contract_map = result[compiler_version][sol_dirname]
-
-                if contract_name in contract_map:
-                    raise ValueError(
-                        "duplicate contract names in the same file",
-                        contract_name,
-                        sol_dirname,
-                    )
-
-                contract_map[contract_name] = (json_out, contract_type, natspec)
-                parse_symbols(args, contract_map, contract_name)
-
-            except Exception as err:
-                warn_code(
-                    PARSING_ERROR,
-                    f"Skipped {json_filename} due to parsing failure: {type(err).__name__}: {err}",
-                )
-                if args.debug:
-                    traceback.print_exc()
-                continue
-
-    ui.stop_status()
-    return result
-
-
-def parse_symbols(args: HalmosConfig, contract_map: dict, contract_name: str) -> None:
-    try:
-        json_out = contract_map[contract_name][0]
-
-        # workaround: solx does not emit bytecode at all for library contracts
-        # default to an empty object to emulate solc behavior
-        bytecode = json_out.get("bytecode", {"object": "0x"})["object"]
-        contract_mapping_info = Mapper().get_or_create(contract_name)
-        contract_mapping_info.bytecode = bytecode
-
-        Mapper().parse_ast(json_out["ast"])
-
-    except Exception:
-        debug(f"error parsing symbols for contract {contract_name}")
-        debug(traceback.format_exc())
-
-        # we parse symbols as best effort, don't propagate exceptions
-        pass
-
-
-def parse_devdoc(funsig: str, contract_json: dict) -> str | None:
-    try:
-        return contract_json["metadata"]["output"]["devdoc"]["methods"][funsig][
-            "custom:halmos"
-        ]
-    except KeyError:
-        return None
-
-
-def parse_natspec(natspec: dict) -> str:
-    # This parsing scheme is designed to handle:
-    #
-    # - multiline tags:
-    #   /// @custom:halmos --x
-    #   ///                --y
-    #
-    # - multiple tags:
-    #   /// @custom:halmos --x
-    #   /// @custom:halmos --y
-    #
-    # - tags that start in the middle of line:
-    #   /// blah blah @custom:halmos --x
-    #   /// --y
-    #
-    # In all the above examples, this scheme returns "--x (whitespaces) --y"
-    isHalmosTag = False
-    result = ""
-    for item in re.split(r"(@\S+)", natspec.get("text", "")):
-        if item == "@custom:halmos":
-            isHalmosTag = True
-        elif re.match(r"^@\S", item):
-            isHalmosTag = False
-        elif isHalmosTag:
-            result += item
-    return result.strip()
-
-
-def import_libs(build_out_map: dict, hexcode: str, linkReferences: dict) -> dict:
-    libs = {}
-
-    for filepath in linkReferences:
-        file_name = filepath.split("/")[-1]
-
-        for lib_name in linkReferences[filepath]:
-            (lib_json, _, _) = build_out_map[file_name][lib_name]
-            lib_hexcode = lib_json["deployedBytecode"]["object"]
-
-            # in bytes, multiply indices by 2 and offset 0x
-            placeholder_index = linkReferences[filepath][lib_name][0]["start"] * 2 + 2
-            placeholder = hexcode[placeholder_index : placeholder_index + 40]
-
-            libs[f"{filepath}:{lib_name}"] = {
-                "placeholder": placeholder,
-                "hexcode": lib_hexcode,
-            }
-
-    return libs
-
-
-def build_output_iterator(build_out: dict):
-    for compiler_version in sorted(build_out):
-        build_out_map = build_out[compiler_version]
-        for filename in sorted(build_out_map):
-            for contract_name in sorted(build_out_map[filename]):
-                yield (build_out_map, filename, contract_name)
diff --git a/src/halmos/solve.py b/src/halmos/solve.py
deleted file mode 100644
index a167811d1..000000000
--- a/src/halmos/solve.py
+++ /dev/null
@@ -1,615 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0
-
-import re
-import shlex
-import subprocess
-from concurrent.futures import ThreadPoolExecutor
-from dataclasses import dataclass, field
-from pathlib import Path
-from tempfile import TemporaryDirectory
-from types import MappingProxyType
-from typing import Literal
-
-from z3 import CheckSatResult, Solver, sat, unknown, unsat
-
-from halmos.calldata import FunctionInfo
-from halmos.config import Config as HalmosConfig
-from halmos.logs import (
-    debug,
-    error,
-    warn,
-)
-from halmos.processes import (
-    ExecutorRegistry,
-    PopenExecutor,
-    PopenFuture,
-)
-from halmos.sevm import Address, Exec, SMTQuery
-from halmos.utils import hexify
-
-EXIT_TIMEDOUT = 124
-
-
-# Type alias for directory used for dumping SMT files
-DumpDirectory = TemporaryDirectory | Path
-
-
-def dirname(dump_dir: DumpDirectory) -> str:
-    """Get the directory name from a DumpDirectory."""
-    match dump_dir:
-        case TemporaryDirectory():
-            return dump_dir.name
-        case Path():
-            return str(dump_dir)
-        case _:
-            raise ValueError(f"Unexpected dump directory type: {type(dump_dir)}")
-
-
-@dataclass
-class ModelVariable:
-    full_name: str
-    variable_name: str
-    solidity_type: str
-    smt_type: str
-    size_bits: int
-    value: int
-
-
-ModelVariables = dict[str, ModelVariable]
-
-# Regular expression for capturing halmos variables
-halmos_var_pattern = re.compile(
-    r"""
-    \(\s*define-fun\s+               # Match "(define-fun"
-    \|?((?:halmos_|p_)[^ |]+)\|?\s+  # Capture either halmos_* or p_*, optionally wrapped in "|"
-    \(\)\s+\(_\s+([^ ]+)\s+          # Capture the SMTLIB type (e.g., "BitVec 256")
-    (\d+)\)\s+                       # Capture the bit-width or type argument
-    (                                # Group for the value
-        \#b[01]+                     # Binary value (e.g., "#b1010")
-        |\#x[0-9a-fA-F]+             # Hexadecimal value (e.g., "#xFF")
-        |\(_\s+bv\d+\s+\d+\)         # Decimal value (e.g., "(_ bv42 256)")
-    )
-    """,
-    re.VERBOSE,
-)
-
-
-@dataclass(frozen=True, slots=True)
-class PotentialModel:
-    model: ModelVariables
-    is_valid: bool
-
-    def __str__(self) -> str:
-        formatted = []
-        for v in self.model.values():
-            # TODO: parse type and render accordingly
-            formatted.append(f"\n    {v.full_name} = {hexify(v.value)}")
-        return "".join(sorted(formatted)) if formatted else "∅"
-
-
-@dataclass(frozen=True, slots=True)
-class InvariantTestingContext:
-    # explicitly included targets
-    target_senders: frozenset[Address]
-    target_contracts: frozenset[Address]
-    target_selectors: MappingProxyType[Address, frozenset[bytes]]
-
-    # explicitly excluded targets
-    excluded_senders: frozenset[Address]
-    excluded_contracts: frozenset[Address]
-    excluded_selectors: MappingProxyType[Address, frozenset[bytes]]
-
-    # whether to print debug information
-    debug: bool = False
-
-    @staticmethod
-    def empty() -> "InvariantTestingContext":
-        return empty_invariant_testing_context
-
-
-empty_invariant_testing_context = InvariantTestingContext(
-    target_senders=frozenset(),
-    target_contracts=frozenset(),
-    target_selectors=MappingProxyType({}),  # read-only empty dict
-    excluded_senders=frozenset(),
-    excluded_contracts=frozenset(),
-    excluded_selectors=MappingProxyType({}),
-)
-
-
-@dataclass(frozen=True, slots=True)
-class ContractContext:
-    # config with contract-specific overrides
-    args: HalmosConfig
-
-    # name of this contract
-    name: str
-
-    # signatures of test functions to run
-    funsigs: list[str]
-
-    # data parsed from the build output for this contract
-    creation_hexcode: str
-    deployed_hexcode: str
-    abi: dict
-    method_identifiers: dict[str, str]
-    contract_json: dict
-    libs: dict
-
-    # note: build_out_map is shared across all contracts compiled using the same compiler version
-    # so in principle, we could consider having another context, say CompileUnitContext, and put build_out_map there
-    build_out_map: dict
-
-    # map from depth to frontier states
-    frontier_states: dict[int, list[Exec]] = field(default_factory=dict)
-
-    # set of visited state ids, to be updated during the invariant testing run
-    visited: set[bytes] = field(default_factory=set)
-
-    # the function info for the invariant test
-    probes_reported: set[FunctionInfo] = field(default_factory=set)
-
-    # the invariant testing context for this contract
-    # the empty context is used as a placeholder, it can be set later
-    inv_ctx: InvariantTestingContext = field(
-        default_factory=InvariantTestingContext.empty
-    )
-
-    def set_invariant_testing_context(self, ctx: InvariantTestingContext) -> None:
-        if self.inv_ctx != InvariantTestingContext.empty():
-            raise ValueError("invariant testing context already set")
-
-        # bypass the frozen dataclass check
-        object.__setattr__(self, "inv_ctx", ctx)
-
-
-@dataclass(frozen=True)
-class SolvingContext:
-    # directory for dumping solver files
-    dump_dir: DumpDirectory
-
-    # shared solver executor for all paths in the same function
-    executor: PopenExecutor = field(default_factory=PopenExecutor)
-
-    # list of unsat cores
-    unsat_cores: list[list] = field(default_factory=list)
-
-
-@dataclass(frozen=True)
-class FunctionContext:
-    # config with function-specific overrides
-    args: HalmosConfig
-
-    # function name, signature, and selector
-    info: FunctionInfo
-
-    # solver using the function-specific config
-    solver: Solver
-
-    # backlink to the parent contract context
-    contract_ctx: ContractContext
-
-    # optional starting state
-    setup_ex: Exec | None = None
-
-    # optional max call depth for frontier states (for invariant testing)
-    max_call_depth: int = 0
-
-    # function-level solving context
-    # the FunctionContext initializes and owns the SolvingContext
-    solving_ctx: SolvingContext = field(init=False)
-
-    # function-level thread pool that drives assertion solving
-    thread_pool: ThreadPoolExecutor = field(init=False)
-
-    # list of solver outputs for this function
-    solver_outputs: list["SolverOutput"] = field(default_factory=list)
-
-    # list of valid counterexamples for this function
-    valid_counterexamples: list[PotentialModel] = field(default_factory=list)
-
-    # list of potentially invalid counterexamples for this function
-    invalid_counterexamples: list[PotentialModel] = field(default_factory=list)
-
-    # map from path id to trace and call sequence
-    traces: dict[int, str] = field(default_factory=dict)
-    call_sequences: dict[int, str] = field(default_factory=dict)
-
-    # map from path id to execution
-    exec_cache: dict[int, Exec] = field(default_factory=dict)
-
-    def __post_init__(self):
-        args = self.args
-
-        # create a directory for dumping solver files
-        prefix = (
-            f"{self.info.name}-"
-            if self.info.name
-            else f"{self.contract_ctx.name}-constructor-"
-        )
-
-        if args.dump_smt_directory:
-            # use custom directory specified by user
-            custom_dir = Path(args.dump_smt_directory)
-
-            # create the directory if it doesn't exist
-            custom_dir.mkdir(parents=True, exist_ok=True)
-
-            # create a subdirectory with the prefix for this function/contract
-            function_dir = custom_dir / prefix.rstrip("-")
-            function_dir.mkdir(parents=True, exist_ok=True)
-
-            dump_dir = function_dir
-
-            if args.verbose >= 1 or args.dump_smt_queries:
-                print(f"Generating SMT queries in {function_dir}")
-        else:
-            # use temporary directory (existing behavior)
-            # if the user explicitly enabled dumping, we don't want to delete the directory on exit
-            delete = not self.args.dump_smt_queries
-
-            # ideally we would pass `delete=delete` to the constructor, but it's in >=3.12
-            temp_dir = TemporaryDirectory(prefix=prefix, ignore_cleanup_errors=True)
-
-            # If user wants to keep the files, prevent cleanup on exit
-            if not delete:
-                temp_dir._finalizer.detach()
-
-            dump_dir = temp_dir
-
-            if args.verbose >= 1 or args.dump_smt_queries:
-                print(f"Generating SMT queries in {temp_dir.name}")
-
-        solving_ctx = SolvingContext(dump_dir=dump_dir)
-        object.__setattr__(self, "solving_ctx", solving_ctx)
-
-        thread_pool = ThreadPoolExecutor(
-            max_workers=self.args.solver_threads,
-            thread_name_prefix=f"{self.info.name}-",
-        )
-        object.__setattr__(self, "thread_pool", thread_pool)
-
-        # register the solver executor to be shutdown on exit
-        ExecutorRegistry().register(solving_ctx.executor)
-
-    def append_unsat_core(self, unsat_core: list[str]) -> None:
-        self.solving_ctx.unsat_cores.append(unsat_core)
-
-
-@dataclass(frozen=True)
-class PathContext:
-    args: HalmosConfig
-    path_id: int
-    solving_ctx: SolvingContext
-    query: SMTQuery
-    is_refined: bool = False
-
-    @property
-    def dump_file(self) -> Path:
-        refined_str = ".refined" if self.is_refined else ""
-        filename = f"{self.path_id}{refined_str}.smt2"
-
-        return Path(dirname(self.solving_ctx.dump_dir)) / filename
-
-    def refine(self) -> "PathContext":
-        return PathContext(
-            args=self.args,
-            path_id=self.path_id,
-            solving_ctx=self.solving_ctx,
-            query=refine(self.query),
-            is_refined=True,
-        )
-
-
-@dataclass(frozen=True, slots=True)
-class SolverOutput:
-    # solver result (sat, unsat, unknown, err)
-    result: CheckSatResult | Literal["err"]
-
-    # solver return code
-    returncode: int
-
-    # we don't backlink to the parent path context to avoid extra
-    # references to Exec objects past the lifetime of the path
-    path_id: int
-
-    # input query file path
-    query_file: str
-
-    # solver model
-    model: PotentialModel | None = None
-
-    # optional unsat core
-    unsat_core: list[str] | None = None
-
-    # solver error
-    error: str | None = None
-
-    @staticmethod
-    def from_result(
-        stdout: str, stderr: str, returncode: int, path_ctx: PathContext
-    ) -> "SolverOutput":
-        # extract the first line (we expect sat/unsat/unknown)
-        newline_idx = stdout.find("\n")
-        first_line = stdout[:newline_idx] if newline_idx != -1 else stdout
-
-        args, path_id = path_ctx.args, path_ctx.path_id
-        query_file = str(path_ctx.dump_file)
-
-        if args.verbose >= 1:
-            debug(f"    {first_line}")
-
-        match first_line:
-            case "unsat":
-                unsat_core = parse_unsat_core(stdout) if args.cache_solver else None
-                return SolverOutput(
-                    unsat, returncode, path_id, query_file, unsat_core=unsat_core
-                )
-            case "sat":
-                is_valid = is_model_valid(stdout)
-                model = PotentialModel(model=parse_model_str(stdout), is_valid=is_valid)
-                return SolverOutput(sat, returncode, path_id, query_file, model=model)
-            case "unknown":
-                return SolverOutput(unknown, returncode, path_id, query_file)
-            case _:
-                return SolverOutput(
-                    "err", returncode, path_id, query_file, error=stderr
-                )
-
-    @staticmethod
-    def from_error(
-        error: Exception | str,
-        path_id: int,
-        query_file: str,
-        returncode: int = -1,
-    ) -> "SolverOutput":
-        return SolverOutput(
-            result="err",
-            returncode=returncode,
-            path_id=path_id,
-            query_file=query_file,
-            error=str(error),
-        )
-
-
-def parse_const_value(value: str) -> int:
-    match value[:2]:
-        case "#b":
-            return int(value[2:], 2)
-        case "#x":
-            return int(value[2:], 16)
-        case "bv":
-            return int(value[2:])
-        case _:
-            # we may have a group like (_ bv123 256)
-            tokens = value.split()
-            for token in tokens:
-                if token.startswith("bv"):
-                    return int(token[2:])
-
-    raise ValueError(f"unknown value format: {value}")
-
-
-def _parse_halmos_var_match(match: re.Match) -> ModelVariable:
-    full_name = match.group(1).strip()
-    smt_type = f"{match.group(2)} {match.group(3)}"
-    size_bits = int(match.group(3))
-    value = parse_const_value(match.group(4))
-
-    # Extract name and typename from the variable name
-    parts = full_name.split("_")
-    variable_name = parts[1]
-    solidity_type = parts[2]
-
-    return ModelVariable(
-        full_name=full_name,
-        variable_name=variable_name,
-        solidity_type=solidity_type,
-        smt_type=smt_type,
-        size_bits=size_bits,
-        value=value,
-    )
-
-
-def parse_model_str(smtlib_str: str) -> ModelVariables:
-    """Expects a whole smtlib model output file, as produced by a solver
-    in response to a `(check-sat)` + `(get-model)` command.
-
-    Extracts halmos variables and returns them grouped by their full name"""
-
-    model_variables: dict[str, ModelVariable] = {}
-
-    # use a regex to find all the variables
-    # for now we explicitly don't try to properly parse the smtlib output
-    # because of idiosyncrasies of different solvers:
-    # - ignores the initial sat/unsat on the first line
-    # - ignores the occasional `(model)` command used by yices, stp, cvc4, etc.
-
-    for match in halmos_var_pattern.finditer(smtlib_str):
-        try:
-            variable = _parse_halmos_var_match(match)
-            model_variables[variable.full_name] = variable
-        except Exception as e:
-            error(f"error parsing smtlib string '{match.string.strip()}': {e}")
-            raise e
-
-    return model_variables
-
-
-def parse_model_file(file_path: str) -> ModelVariables:
-    with open(file_path) as file:
-        return parse_model_str(file.read())
-
-
-def parse_unsat_core(output: str) -> list[str] | None:
-    # parsing example:
-    #   unsat
-    #   (error "the context is unsatisfiable")  # <-- this line is optional
-    #   (<41702> <37030> <36248> <47880>)
-    # result:
-    #   [41702, 37030, 36248, 47880]
-    pattern = r"unsat\s*(\(\s*error\s+[^)]*\)\s*)?\(\s*((<[0-9]+>\s*)*)\)"
-    match = re.search(pattern, output)
-    if match:
-        result = [re.sub(r"<([0-9]+)>", r"\1", name) for name in match.group(2).split()]
-        return result
-    else:
-        warn(f"error in parsing unsat core: {output}")
-        return None
-
-
-def dump(
-    path_ctx: PathContext,
-) -> tuple[CheckSatResult, PotentialModel | None, list | None]:
-    args, query, dump_file = path_ctx.args, path_ctx.query, path_ctx.dump_file
-
-    if args.verbose >= 1:
-        debug(f"Writing SMT query to {dump_file}")
-
-    # for each implication assertion, `(assert (=> |id| c))`, in query.smtlib,
-    # generate a corresponding named assertion, `(assert (! |id| :named <id>))`.
-    # see `svem.Path.to_smt2()` for more details.
-    if args.cache_solver:
-        named_assertions = "".join(
-            [
-                f"(assert (! |{assert_id}| :named <{assert_id}>))\n"
-                for assert_id in query.assertions
-            ]
-        )
-
-        dump_file.write_text(
-            "(set-option :produce-unsat-cores true)\n"
-            "(set-logic QF_AUFBV)\n"
-            f"{query.smtlib}\n"
-            f"{named_assertions}"
-            "(check-sat)\n"
-            "(get-model)\n"
-            "(get-unsat-core)\n"
-        )
-
-    else:
-        dump_file.write_text(
-            f"(set-logic QF_AUFBV)\n{query.smtlib}\n(check-sat)\n(get-model)\n"
-        )
-
-
-def is_model_valid(solver_stdout: str) -> bool:
-    # TODO: evaluate the path condition against the given model after excluding f_evm_* symbols,
-    #       since the f_evm_* symbols may still appear in valid models.
-
-    return "f_evm_" not in solver_stdout
-
-
-def solve_low_level(path_ctx: PathContext) -> SolverOutput:
-    """Invokes an external solver process to solve the given query.
-
-    Can raise TimeoutError or some Exception raised during execution"""
-
-    args, smt2_filename = path_ctx.args, str(path_ctx.dump_file)
-
-    # make sure the smt2 file has been written
-    dump(path_ctx)
-
-    solver_command = args.resolved_solver_command + [smt2_filename]
-    if args.verbose >= 1:
-        print("  Checking with external solver process")
-        print(f"    {shlex.join(solver_command)} > {smt2_filename}.out")
-
-    # solver_timeout_assertion == 0 means no timeout,
-    # which translates to timeout_seconds=None for subprocess.run
-    timeout_seconds = t if (t := args.solver_timeout_assertion) else None
-    future = PopenFuture(solver_command, timeout=timeout_seconds)
-
-    # starts the subprocess asynchronously
-    path_ctx.solving_ctx.executor.submit(future)
-
-    # block until the external solver returns, times out, is interrupted, fails, etc.
-    try:
-        stdout, stderr, returncode = future.result()
-    except subprocess.TimeoutExpired:
-        return SolverOutput(
-            result=unknown,
-            returncode=EXIT_TIMEDOUT,
-            path_id=path_ctx.path_id,
-            query_file=smt2_filename,
-        )
-
-    # save solver stdout to file
-    with open(f"{smt2_filename}.out", "w") as f:
-        f.write(stdout)
-
-    # save solver stderr to file (only if there is an error)
-    if stderr:
-        with open(f"{smt2_filename}.err", "w") as f:
-            f.write(stderr)
-
-    return SolverOutput.from_result(stdout, stderr, returncode, path_ctx)
-
-
-def solve_end_to_end(ctx: PathContext) -> SolverOutput:
-    """Synchronously resolves a query in a given context, which may result in 0, 1 or multiple solver invocations.
-
-    - may result in 0 invocations if the query contains a known unsat core (hence the need for the context)
-    - may result in exactly 1 invocation if the query is unsat, or sat with a valid model
-    - may result in multiple invocations if the query is sat and the model is invalid (needs refinement)
-
-    If this produces a model, it _should_ be valid.
-    """
-    path_id, query = ctx.path_id, ctx.query
-
-    verbose = print if ctx.args.verbose >= 1 else lambda *args, **kwargs: None
-    verbose(f"Checking path condition {path_id=}")
-
-    # if the query contains an unsat-core, it is unsat; no need to run the solver
-    if check_unsat_cores(query, ctx.solving_ctx.unsat_cores):
-        verbose("  Already proven unsat")
-        return SolverOutput(unsat, 0, path_id, str(ctx.dump_file))
-
-    solver_output = solve_low_level(ctx)
-    result, model = solver_output.result, solver_output.model
-
-    # if the ctx is already refined, we don't need to solve again
-    if result == sat and not model.is_valid and not ctx.is_refined:
-        verbose("  Checking again with refinement")
-
-        refined_ctx = ctx.refine()
-
-        if refined_ctx.query.smtlib != query.smtlib:
-            # note that check_unsat_cores cannot return true for the refined query, because it relies on only
-            # constraint ids, which don't change after refinement
-            # therefore we can skip the unsat core check in solve_end_to_end and go directly to solve_low_level
-            return solve_low_level(refined_ctx)
-        else:
-            verbose("    Refinement did not change the query, no need to solve again")
-
-    return solver_output
-
-
-def check_unsat_cores(query: SMTQuery, unsat_cores: list[list]) -> bool:
-    # return true if the given query contains any given unsat core
-    for unsat_core in unsat_cores:
-        if all(core in query.assertions for core in unsat_core):
-            return True
-    return False
-
-
-def refine(query: SMTQuery) -> SMTQuery:
-    smtlib = query.smtlib
-
-    # replace uninterpreted abstraction with actual symbols for assertion solving
-    smtlib = re.sub(
-        r"\(declare-fun f_evm_(bvmul)_([0-9]+) \(\(_ BitVec \2\) \(_ BitVec \2\)\) \(_ BitVec \2\)\)",
-        r"(define-fun f_evm_\1_\2 ((x (_ BitVec \2)) (y (_ BitVec \2))) (_ BitVec \2) (\1 x y))",
-        smtlib,
-    )
-
-    # replace `(f_evm_bvudiv_N x y)` with `(ite (= y (_ bv0 N)) (_ bv0 N) (bvudiv x y))`
-    # similarly for bvurem, bvsdiv, and bvsrem
-    # NOTE: (bvudiv x (_ bv0 N)) is *defined* to (bvneg (_ bv1 N)); while (div x 0) is undefined
-    smtlib = re.sub(
-        r"\(declare-fun f_evm_(bvudiv|bvurem|bvsdiv|bvsrem)_([0-9]+) \(\(_ BitVec \2\) \(_ BitVec \2\)\) \(_ BitVec \2\)\)",
-        r"(define-fun f_evm_\1_\2 ((x (_ BitVec \2)) (y (_ BitVec \2))) (_ BitVec \2) (ite (= y (_ bv0 \2)) (_ bv0 \2) (\1 x y)))",
-        smtlib,
-    )
-
-    return SMTQuery(smtlib, query.assertions)
diff --git a/tests/conftest.py b/tests/conftest.py
index 5b057506e..f3658cad5 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -5,8 +5,8 @@
 
 def pytest_addoption(parser):
     parser.addoption(
-        "--halmos-options",
+        "--dolmos-options",
         metavar="OPTIONS",
         default="",
-        help="Halmos commandline options",
+        help="dolmos command line options",
     )
diff --git a/tests/expected/all.json b/tests/expected/all.json
index b9cb7594a..c53953363 100644
--- a/tests/expected/all.json
+++ b/tests/expected/all.json
@@ -528,7 +528,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_call0_halmos_exception()",
+                "name": "check_call0_dolmos_exception()",
                 "exitcode": 3,
                 "num_models": 0,
                 "models": null,
@@ -555,7 +555,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_call1_halmos_exception(uint256)",
+                "name": "check_call1_dolmos_exception(uint256)",
                 "exitcode": 3,
                 "num_models": 0,
                 "models": null,
@@ -582,7 +582,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_create_halmos_exception()",
+                "name": "check_create_dolmos_exception()",
                 "exitcode": 3,
                 "num_models": 0,
                 "models": null,
@@ -858,10 +858,10 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/Deal.t.sol:DealTest": [
+        "test/Create3.t.sol:Create3Test": [
             {
-                "name": "check_concretized_transfer_over_max_eth(bytes)",
-                "exitcode": 3,
+                "name": "check_create3(uint256)",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -869,7 +869,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_1(address,uint256)",
+                "name": "check_create_address_prediction()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -878,16 +878,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_2(address,uint256,uint256)",
+                "name": "check_create_address_prediction_nonce2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Create3.t.sol:NonceTest": [
             {
-                "name": "check_deal_new()",
+                "name": "check_nonce_of_created_contract()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -896,8 +898,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_over_max_eth()",
-                "exitcode": 3,
+                "name": "check_nonce_of_test_contract()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -905,8 +907,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_over_max_eth(address)",
-                "exitcode": 3,
+                "name": "check_resetNonce_of_contract()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -914,8 +916,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_over_max_eth(address,uint256)",
-                "exitcode": 3,
+                "name": "check_setNonce()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -923,36 +925,36 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deal_over_max_eth(uint256)",
-                "exitcode": 3,
+                "name": "check_setNonce_changes_create_address()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Deal.t.sol:DealTest": [
             {
-                "name": "check_deal_under_max_eth_mixed(address)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_concretized_transfer_over_max_eth(bytes)",
+                "exitcode": 3,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_implicit_transfer_over_max_eth(uint256)",
+                "name": "check_deal_1(address,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Extcodehash.t.sol:ExtcodehashTest": [
+            },
             {
-                "name": "check_extcodehash_a1_eq_a2()",
+                "name": "check_deal_2(address,uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -961,7 +963,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_a1_eq_directHash()",
+                "name": "check_deal_new()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -970,8 +972,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_a1_eq_runtimeCodeHash()",
-                "exitcode": 0,
+                "name": "check_deal_over_max_eth()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -979,8 +981,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_a1_ne_b1()",
-                "exitcode": 0,
+                "name": "check_deal_over_max_eth(address)",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -988,8 +990,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_after_etch()",
-                "exitcode": 0,
+                "name": "check_deal_over_max_eth(address,uint256)",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -997,8 +999,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_cheatcode()",
-                "exitcode": 0,
+                "name": "check_deal_over_max_eth(uint256)",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1006,52 +1008,69 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_empty_contract()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_deal_under_max_eth_mixed(address)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_eq_directHash()",
+                "name": "check_implicit_transfer_over_max_eth(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/EvmVersion.t.sol:EvmVersionDefaultTest": [
             {
-                "name": "check_extcodehash_nonexisting_account()",
+                "name": "check_all_available()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/EvmVersion.t.sol:EvmVersionPragueTest": [
             {
-                "name": "check_extcodehash_precompiles(address)",
+                "name": "check_clz_invalid()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
+            }
+        ],
+        "test/EvmVersion.t.sol:EvmVersionShanghaiTest": [
+            {
+                "name": "check_tstore_available_fail()",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_symbolic_address(address)",
+                "name": "check_tstore_invalid()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Expect.t.sol:ExpectTest": [
             {
-                "name": "check_extcodehash_symbolic_address_empty(address)",
+                "name": "check_expectEmit(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1060,7 +1079,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodehash_symbolic_address_not_empty(address)",
+                "name": "check_expectEmit_anonymous(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1069,7 +1088,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodesize_cheatcode()",
+                "name": "check_expectEmit_count(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1078,16 +1097,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodesize_precompiles(address)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_count_fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodesize_symbolic_address(address)",
+                "name": "check_expectEmit_emitter(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1096,85 +1115,79 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodesize_symbolic_address_empty(address)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_no_emit_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_extcodesize_symbolic_address_not_empty(address)",
+                "name": "check_expectEmit_ordered(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Foundry.t.sol:DeepFailer": [
+            },
             {
-                "name": "check_fail_cheatcode()",
+                "name": "check_expectEmit_pending_fail(uint256,uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Foundry.t.sol:EarlyFailTest": [
+            },
             {
-                "name": "check_early_fail_cheatcode(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_expectEmit_skip_data(uint256,uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_failed_cheatcode()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_wrong_data_fail(uint256,uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Foundry.t.sol:FoundryTest": [
+            },
             {
-                "name": "check_assertEqCall(uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_wrong_emitter_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assume(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_wrong_order_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_caller()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectEmit_wrong_topic_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_deployCode(uint256)",
+                "name": "check_expectPartialRevert(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1183,7 +1196,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_Concrete()",
+                "name": "check_expectRevert_any(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1192,16 +1205,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_Overwrite()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_any_fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_emptyBytecode()",
+                "name": "check_expectRevert_count()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1210,16 +1223,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_initial_balance(address)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_count_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_origin()",
+                "name": "check_expectRevert_count_zero()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1228,18 +1241,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_this()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_count_zero_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Foundry.t.sol:TestNotEtchFriendly": [
+            },
             {
-                "name": "check_etch_no_owner(address)",
+                "name": "check_expectRevert_create()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1248,7 +1259,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_then_load()",
+                "name": "check_expectRevert_custom_error(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1257,36 +1268,34 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_then_sload()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_custom_error_symbolic_fail(address,address)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_then_store()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_no_revert_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_etch_then_tstore()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_pending_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Getter.t.sol:GetterTest": [
+            },
             {
-                "name": "check_Getter(uint256)",
+                "name": "check_expectRevert_returns_success()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1295,27 +1304,25 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_externalGetter(uint256)",
+                "name": "check_expectRevert_reverter()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/HalmosCheatCode.t.sol:HalmosCheatCodeTest": [
+            },
             {
-                "name": "check_FailUnknownCheatcode()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "check_expectRevert_reverter_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_SymbolLabel()",
+                "name": "check_expectRevert_selector()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1324,16 +1331,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createAddress()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_expectRevert_selector_with_args_fail(address)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createBool()",
+                "name": "check_expectRevert_state_is_reverted(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1342,7 +1349,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createBytes()",
+                "name": "check_expectRevert_string(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1351,7 +1358,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createBytes32()",
+                "name": "check_expectRevert_string_bytes(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1360,7 +1367,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createBytes4_basic()",
+                "name": "check_expectRevert_with_prank()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1369,16 +1376,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createBytes4_finds_selector()",
+                "name": "check_expectRevert_wrong_string_fail(uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Extcodehash.t.sol:ExtcodehashTest": [
             {
-                "name": "check_createBytes_empty()",
+                "name": "check_extcodehash_a1_eq_a2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1387,7 +1396,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createInt()",
+                "name": "check_extcodehash_a1_eq_directHash()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1396,7 +1405,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createInt256()",
+                "name": "check_extcodehash_a1_eq_runtimeCodeHash()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1405,7 +1414,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createString()",
+                "name": "check_extcodehash_a1_ne_b1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1414,7 +1423,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createString_empty()",
+                "name": "check_extcodehash_after_etch()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1423,7 +1432,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createUint()",
+                "name": "check_extcodehash_cheatcode()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1432,7 +1441,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createUint256()",
+                "name": "check_extcodehash_empty_contract()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1441,17 +1450,17 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_enableSymbolicStorage_fail()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_extcodehash_eq_directHash()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_enableSymbolicStorage_nonexistent()",
-                "exitcode": 3,
+                "name": "check_extcodehash_nonexisting_account()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1459,7 +1468,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_enableSymbolicStorage_pass(uint256)",
+                "name": "check_extcodehash_precompiles(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1468,7 +1477,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_address()",
+                "name": "check_extcodehash_symbolic_address(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1477,7 +1486,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_address_array()",
+                "name": "check_extcodehash_symbolic_address_empty(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1486,7 +1495,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bool()",
+                "name": "check_extcodehash_symbolic_address_not_empty(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1495,7 +1504,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bool_array()",
+                "name": "check_extcodesize_cheatcode()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1504,7 +1513,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bytes()",
+                "name": "check_extcodesize_precompiles(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1513,7 +1522,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bytes32()",
+                "name": "check_extcodesize_symbolic_address(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1522,7 +1531,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bytes32_array()",
+                "name": "check_extcodesize_symbolic_address_empty(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1531,16 +1540,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_bytes_array()",
+                "name": "check_extcodesize_symbolic_address_not_empty(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/File.t.sol:FileTest": [
             {
-                "name": "check_env_exists()",
+                "name": "check_deployedFromFile(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1549,7 +1560,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_int()",
+                "name": "check_parseBytes()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1558,8 +1569,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_int_array()",
-                "exitcode": 0,
+                "name": "check_parseBytes_oddLength()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1567,17 +1578,17 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_missing_fail()",
-                "exitcode": 5,
-                "num_models": null,
+                "name": "check_parseBytes_symbolic(string)",
+                "exitcode": 3,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_address()",
-                "exitcode": 0,
+                "name": "check_parseBytes_whitespace()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1585,7 +1596,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_address_array()",
+                "name": "check_projectRoot()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1594,7 +1605,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_address_array_without_env_var()",
+                "name": "check_readFile()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1603,7 +1614,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_address_without_env_var()",
+                "name": "check_readFileBinary()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1612,8 +1623,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bool()",
-                "exitcode": 0,
+                "name": "check_readFile_escape()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1621,8 +1632,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bool_array()",
-                "exitcode": 0,
+                "name": "check_readFile_invalidUtf8()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1630,8 +1641,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bool_array_without_env_var()",
-                "exitcode": 0,
+                "name": "check_readFile_missing()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1639,8 +1650,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bool_without_env_var(bool)",
-                "exitcode": 0,
+                "name": "check_readFile_nestedDenial()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1648,7 +1659,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bytes()",
+                "name": "check_readFile_normalizedPath()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1657,43 +1668,49 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bytes32()",
-                "exitcode": 0,
+                "name": "check_readFile_notPermitted()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Foundry.t.sol:DeepFailer": [
             {
-                "name": "check_env_or_bytes32_array()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_fail_cheatcode()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Foundry.t.sol:EarlyFailTest": [
             {
-                "name": "check_env_or_bytes32_array_without_env_var()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_early_fail_cheatcode(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bytes32_without_env_var()",
+                "name": "check_failed_cheatcode()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Foundry.t.sol:FoundryTest": [
             {
-                "name": "check_env_or_bytes_array()",
+                "name": "check_assertEqCall(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1702,7 +1719,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bytes_array_without_env_var()",
+                "name": "check_assume(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1711,7 +1728,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_bytes_without_env_var()",
+                "name": "check_caller()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1720,7 +1737,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_int(int256)",
+                "name": "check_deployCode(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1729,7 +1746,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_int_array()",
+                "name": "check_etch_Concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1738,7 +1755,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_int_array_without_env_var()",
+                "name": "check_etch_Overwrite()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1747,7 +1764,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_string()",
+                "name": "check_etch_emptyBytecode()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1756,7 +1773,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_string_array()",
+                "name": "check_initial_balance(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1765,7 +1782,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_string_array_without_env_var()",
+                "name": "check_origin()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1774,16 +1791,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_string_without_env_var()",
+                "name": "check_this()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Foundry.t.sol:TestNotEtchFriendly": [
             {
-                "name": "check_env_or_uint(uint256)",
+                "name": "check_etch_no_owner(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1792,7 +1811,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_uint_array()",
+                "name": "check_etch_then_load()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1801,7 +1820,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_or_uint_array_without_env_var()",
+                "name": "check_etch_then_sload()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1810,7 +1829,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_string()",
+                "name": "check_etch_then_store()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1819,16 +1838,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_string_array()",
+                "name": "check_etch_then_tstore()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Getter.t.sol:GetterTest": [
             {
-                "name": "check_env_uint()",
+                "name": "check_Getter(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1837,17 +1858,19 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_env_uint_array()",
+                "name": "check_externalGetter(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Invariant.t.sol:InvariantProxyTest": [
             {
-                "name": "check_extract_string_argument_fail(string)",
-                "exitcode": 3,
+                "name": "invariant_proxy_1()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1855,16 +1878,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_randomAddress()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_proxy_2()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Invariant.t.sol:InvariantTest": [
             {
-                "name": "check_randomBool()",
+                "name": "invariant_1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1873,61 +1898,73 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_randomBytes()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_2()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantProbes.t.sol:InvariantProbesTest": [
             {
-                "name": "check_randomBytes4()",
+                "name": "invariant_probes_found()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender.t.sol:InvariantSenderTest_all": [
             {
-                "name": "check_randomBytes8()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num()",
+                "exitcode": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender.t.sol:InvariantSenderTest_non_owner_1": [
             {
-                "name": "check_randomBytes_empty()",
+                "name": "invariant_num()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender.t.sol:InvariantSenderTest_non_owner_2": [
             {
-                "name": "check_randomInt()",
+                "name": "invariant_num()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender.t.sol:InvariantSenderTest_owner": [
             {
-                "name": "check_randomInt256()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num()",
+                "exitcode": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_0": [
             {
-                "name": "check_randomUint()",
+                "name": "invariant_num1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1936,35 +1973,37 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_randomUint256()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num2()",
+                "exitcode": 1,
+                "num_models": 4,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_random_uint_range_concrete_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num3()",
+                "exitcode": 1,
+                "num_models": 4,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_1": [
             {
-                "name": "check_random_uint_range_max_greaterthan_min_fail()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "invariant_num1()",
+                "exitcode": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_random_uint_range_symbolic_fail(uint256,uint256)",
-                "exitcode": 3,
+                "name": "invariant_num2()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -1972,25 +2011,27 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setArbitraryStorage_fail()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "invariant_num3()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_2": [
             {
-                "name": "check_setArbitraryStorage_nonexistent()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "invariant_num1()",
+                "exitcode": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setArbitraryStorage_pass(uint256)",
+                "name": "invariant_num2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -1999,8 +2040,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_unsupported_cheatcode_fail()",
-                "exitcode": 3,
+                "name": "invariant_num3()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -2008,10 +2049,10 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/HalmosCheatCode.t.sol:HalmosCreateCalldataTest": [
+        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_3": [
             {
-                "name": "check_createCalldata_Beep_0_excluding_pure()",
-                "exitcode": 4,
+                "name": "invariant_num1()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -2019,7 +2060,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Beep_0_including_pure()",
+                "name": "invariant_num2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2028,52 +2069,56 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Beep_1_excluding_pure()",
-                "exitcode": 4,
-                "num_models": 0,
+                "name": "invariant_num3()",
+                "exitcode": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_empty": [
             {
-                "name": "check_createCalldata_Beep_1_including_pure()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num1()",
+                "exitcode": 1,
+                "num_models": 6,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Beep_2_excluding_pure()",
-                "exitcode": 4,
-                "num_models": 0,
+                "name": "invariant_num2()",
+                "exitcode": 1,
+                "num_models": 6,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Beep_2_including_pure()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_num3()",
+                "exitcode": 1,
+                "num_models": 6,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTarget.t.sol:InvariantTargetTest_0": [
             {
-                "name": "check_createCalldata_Dummy_fail()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "invariant_0()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Fallback()",
+                "name": "invariant_1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2082,16 +2127,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_0_excluding_view_fail()",
-                "exitcode": 1,
-                "num_models": 18,
+                "name": "invariant_2()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_0_excluding_view_pass()",
+                "name": "invariant_3()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2100,88 +2145,92 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_0_including_view_fail()",
-                "exitcode": 1,
-                "num_models": 20,
+                "name": "invariant_4()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTarget.t.sol:InvariantTargetTest_0_1_2_3": [
             {
-                "name": "check_createCalldata_Mock_0_including_view_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_0()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_1_fail()",
+                "name": "invariant_1()",
                 "exitcode": 1,
-                "num_models": 18,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_1_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_2()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_2_excluding_view_fail()",
+                "name": "invariant_3()",
                 "exitcode": 1,
-                "num_models": 18,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_2_excluding_view_pass()",
+                "name": "invariant_4()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTarget.t.sol:InvariantTargetTest_1_2": [
             {
-                "name": "check_createCalldata_Mock_2_including_view_fail()",
-                "exitcode": 1,
-                "num_models": 20,
+                "name": "invariant_0()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_2_including_view_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_1()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_3_fail()",
+                "name": "invariant_2()",
                 "exitcode": 1,
-                "num_models": 18,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_3_pass()",
+                "name": "invariant_3()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2190,16 +2239,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_4_excluding_view_fail()",
-                "exitcode": 1,
-                "num_models": 18,
+                "name": "invariant_4()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTarget.t.sol:InvariantTargetTest_3": [
             {
-                "name": "check_createCalldata_Mock_4_excluding_view_pass()",
+                "name": "invariant_0()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2208,16 +2259,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_4_including_view_fail()",
-                "exitcode": 1,
-                "num_models": 20,
+                "name": "invariant_1()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_4_including_view_pass()",
+                "name": "invariant_2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2226,90 +2277,81 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_interface_excluding_view_fail()",
+                "name": "invariant_3()",
                 "exitcode": 1,
-                "num_models": 18,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_interface_excluding_view_pass()",
+                "name": "invariant_4()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTarget.t.sol:InvariantTargetTest_all": [
             {
-                "name": "check_createCalldata_Mock_interface_including_view_fail()",
+                "name": "invariant_0()",
                 "exitcode": 1,
-                "num_models": 20,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_Mock_interface_including_view_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_1()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_NestedArrays_1_fail()",
+                "name": "invariant_2()",
                 "exitcode": 1,
-                "num_models": 541,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_NestedArrays_1_pass()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_3()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_createCalldata_unknown_fail()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "invariant_4()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/Invariant.t.sol:InvariantProxyTest": [
-            {
-                "name": "invariant_proxy_1()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
+        "test/InvariantTarget.t.sol:InvariantTargetTest_target_contract_this": [
             {
-                "name": "invariant_proxy_2()",
+                "name": "invariant_0()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Invariant.t.sol:InvariantTest": [
+            },
             {
                 "name": "invariant_1()",
                 "exitcode": 0,
@@ -2321,39 +2363,24 @@
             },
             {
                 "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantProbes.t.sol:InvariantProbesTest": [
-            {
-                "name": "invariant_probes_found()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender.t.sol:InvariantSenderTest_all": [
+            },
             {
-                "name": "invariant_num()",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "invariant_3()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender.t.sol:InvariantSenderTest_non_owner_1": [
+            },
             {
-                "name": "invariant_num()",
+                "name": "invariant_4()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2362,69 +2389,65 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantSender.t.sol:InvariantSenderTest_non_owner_2": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_0": [
             {
-                "name": "invariant_num()",
+                "name": "invariant_0()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender.t.sol:InvariantSenderTest_owner": [
+            },
             {
-                "name": "invariant_num()",
+                "name": "invariant_1()",
                 "exitcode": 1,
-                "num_models": 2,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_0": [
+            },
             {
-                "name": "invariant_num1()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_2()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num2()",
+                "name": "invariant_3()",
                 "exitcode": 1,
-                "num_models": 4,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num3()",
+                "name": "invariant_4()",
                 "exitcode": 1,
-                "num_models": 4,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_1": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_1": [
             {
-                "name": "invariant_num1()",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "invariant_0()",
+                "exitcode": 5,
+                "num_models": null,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num2()",
+                "name": "invariant_1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2433,27 +2456,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num3()",
+                "name": "invariant_2()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_2": [
-            {
-                "name": "invariant_num1()",
-                "exitcode": 1,
-                "num_models": 2,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
             },
             {
-                "name": "invariant_num2()",
+                "name": "invariant_3()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2462,7 +2474,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num3()",
+                "name": "invariant_4()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2471,9 +2483,9 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_3": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_2": [
             {
-                "name": "invariant_num1()",
+                "name": "invariant_0()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2482,7 +2494,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num2()",
+                "name": "invariant_1()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2491,49 +2503,38 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num3()",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "invariant_2()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantSender2.t.sol:InvariantSenderTest_excludeSender_empty": [
+            },
             {
-                "name": "invariant_num1()",
+                "name": "invariant_3()",
                 "exitcode": 1,
-                "num_models": 6,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_num2()",
+                "name": "invariant_4()",
                 "exitcode": 1,
-                "num_models": 6,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
-            {
-                "name": "invariant_num3()",
-                "exitcode": 1,
-                "num_models": 6,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_0": [
+            }
+        ],
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_3": [
             {
                 "name": "invariant_0()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2541,8 +2542,8 @@
             },
             {
                 "name": "invariant_1()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2576,11 +2577,11 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_0_1_2_3": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_4": [
             {
                 "name": "invariant_0()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2597,8 +2598,8 @@
             },
             {
                 "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2615,15 +2616,15 @@
             },
             {
                 "name": "invariant_4()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_1_2": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_1": [
             {
                 "name": "invariant_0()",
                 "exitcode": 0,
@@ -2670,7 +2671,7 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_3": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_2": [
             {
                 "name": "invariant_0()",
                 "exitcode": 0,
@@ -2682,8 +2683,8 @@
             },
             {
                 "name": "invariant_1()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2691,8 +2692,8 @@
             },
             {
                 "name": "invariant_2()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2700,8 +2701,8 @@
             },
             {
                 "name": "invariant_3()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2717,11 +2718,11 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_all": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_1": [
             {
                 "name": "invariant_0()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2764,11 +2765,11 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget.t.sol:InvariantTargetTest_target_contract_this": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_2": [
             {
                 "name": "invariant_0()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2776,8 +2777,8 @@
             },
             {
                 "name": "invariant_1()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2785,8 +2786,8 @@
             },
             {
                 "name": "invariant_2()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2794,8 +2795,8 @@
             },
             {
                 "name": "invariant_3()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2803,15 +2804,15 @@
             },
             {
                 "name": "invariant_4()",
-                "exitcode": 0,
-                "num_models": 0,
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_0": [
+        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_3": [
             {
                 "name": "invariant_0()",
                 "exitcode": 0,
@@ -2823,8 +2824,8 @@
             },
             {
                 "name": "invariant_1()",
-                "exitcode": 1,
-                "num_models": 1,
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
@@ -2858,18 +2859,9 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_1": [
-            {
-                "name": "invariant_0()",
-                "exitcode": 5,
-                "num_models": null,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
+        "test/InvariantTargetThis.t.sol:InvariantTargetBase": [
             {
-                "name": "invariant_1()",
+                "name": "check_foo()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2878,7 +2870,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
+                "name": "check_foo_called()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2887,27 +2879,27 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_this()",
+                "exitcode": 5,
+                "num_models": null,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTargetThis.t.sol:InvariantTargetThis": [
             {
-                "name": "invariant_4()",
+                "name": "check_foo()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_2": [
+            },
             {
-                "name": "invariant_0()",
+                "name": "check_foo_called()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2916,25 +2908,25 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_targets_foo_included()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_targets_inception_afterInvariant_included()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
+                "name": "invariant_targets_inception_check_included()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -2943,27 +2935,25 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
+                "name": "invariant_targets_inception_invariant_included()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_3": [
+            },
             {
-                "name": "invariant_0()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_targets_inception_setUp_included()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
+                "name": "invariant_targets_inception_test_included()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -2972,7 +2962,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
+                "name": "invariant_targets_special_functions_excluded()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -2981,27 +2971,36 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
+                "name": "invariant_this()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/InvariantTimestamp.t.sol:InvariantTimestampTest": [
             {
-                "name": "invariant_4()",
+                "name": "check_timestamp_setup()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_0_4": [
+            },
             {
-                "name": "invariant_0()",
+                "name": "invariant_timestamp_can_change()",
+                "exitcode": 1,
+                "num_models": 2,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "invariant_timestamp_can_only_move_forward()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3010,16 +3009,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
+                "name": "invariant_timestamp_does_not_have_to_change()",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
+                "name": "invariant_timestamp_is_bounded()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3028,27 +3027,27 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
+                "name": "invariant_timestamp_setup()",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 3,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
+                "name": "invariant_timestamp_timekeeper(address)",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_1": [
+        "test/KeccakRefinement.t.sol:KeccakRefinementTest": [
             {
-                "name": "invariant_0()",
+                "name": "check_keccak_injective(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3057,7 +3056,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
+                "name": "check_keccak_known_preimage(uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -3066,25 +3065,29 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
+                "name": "check_keccak_unknown_preimage(uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Library.t.sol:LibraryTest": [
             {
-                "name": "invariant_3()",
+                "name": "check_add(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/LibraryLinking.t.sol:LibTest": [
             {
-                "name": "invariant_4()",
+                "name": "check_foo()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3093,36 +3096,29 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeContract_2": [
+        "test/LibraryLinking.t.sol:LibTest2": [
             {
-                "name": "invariant_0()",
+                "name": "check_bar()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
-            {
-                "name": "invariant_1()",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/List.t.sol:ListTest": [
             {
-                "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_add(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
+                "name": "check_remove()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3131,7 +3127,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
+                "name": "check_set(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3140,9 +3136,9 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_1": [
+        "test/List.t.sol:ListTestTest": [
             {
-                "name": "invariant_0()",
+                "name": "check_add(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3151,45 +3147,45 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_remove()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_set(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/MegaMem.t.sol:MegaMemTest": [
             {
-                "name": "invariant_3()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_call_in_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_call_in_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_2": [
+            },
             {
-                "name": "invariant_0()",
+                "name": "check_megaMem_call_out_len_ok()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3198,45 +3194,34 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_call_out_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_calldatacopy_dst_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_calldatacopy_src_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTarget2.t.sol:InvariantTargetTest_excludeSelector_3": [
-            {
-                "name": "invariant_0()",
+                "name": "check_megaMem_calldatacopy_src_ptr_ok()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3245,7 +3230,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_1()",
+                "name": "check_megaMem_calldataload_ok()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3254,36 +3239,25 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_2()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_codecopy_dst_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_3()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_codecopy_src_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_4()",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTargetThis.t.sol:InvariantTargetBase": [
-            {
-                "name": "check_foo()",
+                "name": "check_megaMem_codecopy_src_ptr_ok()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3292,7 +3266,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_foo_called()",
+                "name": "check_megaMem_create2_src_len_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3301,18 +3275,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_this()",
-                "exitcode": 5,
-                "num_models": null,
+                "name": "check_megaMem_create2_src_ptr_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTargetThis.t.sol:InvariantTargetThis": [
+            },
             {
-                "name": "check_foo()",
+                "name": "check_megaMem_create_src_len_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3321,7 +3293,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_foo_called()",
+                "name": "check_megaMem_create_src_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3330,61 +3302,61 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_foo_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_extcodecopy_dst_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_inception_afterInvariant_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_extcodecopy_src_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_inception_check_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_extcodecopy_src_ptr_ok()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_inception_invariant_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_keccak256_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_inception_setUp_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_keccak256_ptr_reverts(bool)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_inception_test_included()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_megaMem_log0_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_targets_special_functions_excluded()",
+                "name": "check_megaMem_log0_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3393,18 +3365,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_this()",
+                "name": "check_megaMem_mcopy_dst_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/InvariantTimestamp.t.sol:InvariantTimestampTest": [
+            },
             {
-                "name": "check_timestamp_setup()",
+                "name": "check_megaMem_mcopy_src_len_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3413,16 +3383,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_can_change()",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "check_megaMem_mcopy_src_ptr_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_can_only_move_forward()",
+                "name": "check_megaMem_mload_src_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3431,16 +3401,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_does_not_have_to_change()",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "check_megaMem_mstore8_dst_ptr_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_is_bounded()",
+                "name": "check_megaMem_mstore_dst_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3449,60 +3419,52 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_setup()",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_megaMem_new_bytes_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "invariant_timestamp_timekeeper(address)",
-                "exitcode": 1,
-                "num_models": 2,
+                "name": "check_megaMem_return_len_reverts()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Library.t.sol:LibraryTest": [
+            },
             {
-                "name": "check_add(uint256,uint256)",
+                "name": "check_megaMem_return_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/LibraryLinking.t.sol:LibTest": [
+            },
             {
-                "name": "check_foo()",
+                "name": "check_megaMem_returndatacopy_dst_ptr_reverts(bool)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/LibraryLinking.t.sol:LibTest2": [
+            },
             {
-                "name": "check_bar()",
+                "name": "check_megaMem_returndatacopy_src_len_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/List.t.sol:ListTest": [
+            },
             {
-                "name": "check_add(uint256)",
+                "name": "check_megaMem_returndatacopy_src_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3511,7 +3473,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_remove()",
+                "name": "check_megaMem_revert_len_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3520,7 +3482,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_set(uint256,uint256)",
+                "name": "check_megaMem_revert_ptr_reverts()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3529,9 +3491,9 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/List.t.sol:ListTestTest": [
+        "test/Natspec.t.sol:NatspecTestContract": [
             {
-                "name": "check_add(uint256)",
+                "name": "check_Loop3(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3540,36 +3502,36 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_remove()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop3Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Natspec.t.sol:NatspecTestFunction": [
             {
-                "name": "check_set(uint256,uint256)",
+                "name": "check_Loop2(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/MegaMem.t.sol:MegaMemTest": [
+            },
             {
-                "name": "check_megaMem_call_in_len_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop2Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_call_in_ptr_reverts(bool)",
+                "name": "check_Loop3(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3578,16 +3540,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_call_out_len_ok()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop3Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Natspec.t.sol:NatspecTestLegacyTag": [
             {
-                "name": "check_megaMem_call_out_ptr_reverts(bool)",
+                "name": "check_Loop3(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3596,25 +3560,27 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_calldatacopy_dst_ptr_reverts(bool)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop3Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_calldatacopy_src_len_reverts()",
+                "name": "check_Loop4(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Natspec.t.sol:NatspecTestNone": [
             {
-                "name": "check_megaMem_calldatacopy_src_ptr_ok()",
+                "name": "check_Loop2(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3623,16 +3589,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_calldataload_ok()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop2Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Natspec.t.sol:NatspecTestOverwrite": [
             {
-                "name": "check_megaMem_codecopy_dst_ptr_reverts(bool)",
+                "name": "check_Loop3(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3641,16 +3609,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_codecopy_src_len_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop3Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_codecopy_src_ptr_ok()",
+                "name": "check_Loop4(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3659,70 +3627,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_create2_src_len_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_create2_src_ptr_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_create_src_len_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_create_src_ptr_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_extcodecopy_dst_ptr_reverts(bool)",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_extcodecopy_src_len_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_megaMem_extcodecopy_src_ptr_ok()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop4Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Natspec.t.sol:NatspecTestSetup": [
             {
-                "name": "check_megaMem_keccak256_len_reverts()",
+                "name": "check_Loop2(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3731,16 +3647,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_keccak256_ptr_reverts(bool)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_Loop2Fail(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/OpCodesBlobBaseFee_BlobHash.t.sol:BlobBaseFeeTest": [
             {
-                "name": "check_megaMem_log0_len_reverts()",
+                "name": "check_blobbasefee_affordable(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3749,7 +3667,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_log0_ptr_reverts()",
+                "name": "check_blobbasefee_no_revert()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3758,7 +3676,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_mcopy_dst_ptr_reverts()",
+                "name": "check_blobbasefee_solidity_matches_opcode()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3767,16 +3685,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_mcopy_src_len_reverts()",
+                "name": "check_blobbasefee_zero_in_test_env()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/OpCodesBlobBaseFee_BlobHash.t.sol:BlobHashTest": [
             {
-                "name": "check_megaMem_mcopy_src_ptr_reverts()",
+                "name": "check_blobhash_contiguous(uint8)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3785,7 +3705,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_mload_src_ptr_reverts()",
+                "name": "check_blobhash_deterministic(uint8)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3794,7 +3714,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_mstore8_dst_ptr_reverts()",
+                "name": "check_blobhash_no_revert(uint8)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3803,7 +3723,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_mstore_dst_ptr_reverts()",
+                "name": "check_blobhash_out_of_range()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3812,7 +3732,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_new_bytes_reverts()",
+                "name": "check_blobhash_version_byte(uint8)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3821,16 +3741,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_return_len_reverts()",
+                "name": "check_blobhash_zero_no_blob_tx()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/OpCodesCLZ.sol:ClzTest": [
             {
-                "name": "check_megaMem_return_ptr_reverts()",
+                "name": "check_clz_byte()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3839,7 +3761,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_returndatacopy_dst_ptr_reverts(bool)",
+                "name": "check_clz_lower_bound(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3848,7 +3770,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_returndatacopy_src_len_reverts()",
+                "name": "check_clz_max()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3857,7 +3779,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_returndatacopy_src_ptr_reverts()",
+                "name": "check_clz_monotone(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3866,7 +3788,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_revert_len_reverts()",
+                "name": "check_clz_msb()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3875,18 +3797,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_megaMem_revert_ptr_reverts()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/Natspec.t.sol:NatspecTestContract": [
-            {
-                "name": "check_Loop3(uint256)",
+                "name": "check_clz_one()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3895,18 +3806,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop3Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/Natspec.t.sol:NatspecTestFunction": [
-            {
-                "name": "check_Loop2(uint256)",
+                "name": "check_clz_power_of_two(uint8)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3915,16 +3815,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop2Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_Loop3(uint256)",
+                "name": "check_clz_range(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3933,18 +3824,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop3Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/Natspec.t.sol:NatspecTestNone": [
-            {
-                "name": "check_Loop2(uint256)",
+                "name": "check_clz_two()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3953,18 +3833,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop2Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/Natspec.t.sol:NatspecTestOverwrite": [
-            {
-                "name": "check_Loop3(uint256)",
+                "name": "check_clz_upper_bound(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3973,16 +3842,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop3Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_Loop4(uint256)",
+                "name": "check_clz_zero()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -3991,33 +3851,13 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Loop4Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/Natspec.t.sol:NatspecTestSetup": [
-            {
-                "name": "check_Loop2(uint256)",
+                "name": "check_clz_zero_symbolic()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
-            {
-                "name": "check_Loop2Fail(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
             }
         ],
         "test/Opcode.t.sol:OpcodeTest": [
@@ -4388,38 +4228,27 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/Proxy.t.sol:ProxyTest": [
+        "test/Precompiles.t.sol:PrecompilesTest": [
             {
-                "name": "check_foo(uint256,uint256,address)",
+                "name": "check_modexp_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Revert.t.sol:CTest": [
-            {
-                "name": "check_BalanceTransfer_Known(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
             },
             {
-                "name": "check_BalanceTransfer_Unknown(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_modexp_empty_modulus(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Revert1(uint256)",
+                "name": "check_modexp_exp_zero(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4428,7 +4257,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_Revert2(uint256)",
+                "name": "check_modexp_mod_zero(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4437,7 +4266,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_RevertBalance_Known(bool,uint256)",
+                "name": "check_modexp_oversized_input()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4446,7 +4275,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_RevertBalance_Unknown(uint256,uint256)",
+                "name": "check_modexp_short_input()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4455,27 +4284,25 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_RevertCode(address)",
+                "name": "check_modexp_symbolic(uint256,uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Send.t.sol:SendTest": [
+            },
             {
-                "name": "check_create(uint256,bytes32,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_modexp_symbolic_fail(uint256,uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_send(uint256,uint256)",
+                "name": "check_ripemd160_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4484,63 +4311,54 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_transfer(uint256)",
+                "name": "check_ripemd160_symbolic(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Setup.t.sol:SetupFailTest": [],
-        "test/Setup.t.sol:SetupTest": [
+            },
             {
-                "name": "check_True()",
+                "name": "check_sha256_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/SetupPlus.t.sol:SetupPlusTest": [
+            },
             {
-                "name": "check_Setup()",
+                "name": "check_sha256_symbolic(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/SetupPlus.t.sol:SetupPlusTestB": [
+            },
             {
-                "name": "check_Setup()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_sha256_symbolic_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/SetupSymbolic.t.sol:SetupSymbolicTest": [
+        "test/PrecomputedSlots.t.sol:PrecomputedSlotsTest": [
             {
-                "name": "check_True()",
+                "name": "check_mapping_literal_slot()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Sha3.t.sol:Sha3Test": [
+            },
             {
-                "name": "check_address_collision_pass(uint256,uint256)",
+                "name": "check_nested_mapping_literal_slot()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4549,7 +4367,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_concrete_keccak_does_not_split_paths()",
+                "name": "check_struct_field_literal_slot()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4558,61 +4376,36 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_concrete_keccak_memory_lookup()",
+                "name": "check_write_after_literal_slot()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/PrettyCex.t.sol:PrettyCexTest": [
             {
-                "name": "check_empty_hash_value()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_pcex_calldata(bytes)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_hash()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_hash_collision_with_empty()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_no_hash_collision_assumption()",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            },
-            {
-                "name": "check_only_empty_bytes_matches_empty_hash(bytes)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_pcex_duplicates(uint256)",
+                "exitcode": 1,
+                "num_models": 3,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_uint128_collision_fail(uint256,uint256)",
+                "name": "check_pcex_exp(uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -4621,27 +4414,27 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_uint160_collision_pass(uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_pcex_selector(bytes)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_uint256_collision(uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_pcex_balance()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/SignExtend.t.sol:SignExtendTest": [
+        "test/Proxy.t.sol:ProxyTest": [
             {
-                "name": "check_SIGNEXTEND(int16)",
+                "name": "check_foo(uint256,uint256,address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4650,18 +4443,18 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/Signature.t.sol:SignatureTest": [
+        "test/Revert.t.sol:CTest": [
             {
-                "name": "check_ecrecover(bytes32,uint8,bytes32,bytes32)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_BalanceTransfer_Known(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_concrete_args()",
+                "name": "check_BalanceTransfer_Unknown(uint256,uint256)",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -4670,7 +4463,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_distinctKeysSameDigestCorrectRecovery(uint256,uint256,bytes32)",
+                "name": "check_Revert1(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4679,7 +4472,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_distinctKeysSameDigestDistinctAddrs(uint256,uint256,bytes32)",
+                "name": "check_Revert2(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4688,7 +4481,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_eip2098CompactSignatures(uint256,bytes32)",
+                "name": "check_RevertBalance_Known(bool,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4697,7 +4490,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_explicitMalleability(uint256,bytes32)",
+                "name": "check_RevertBalance_Unknown(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4706,16 +4499,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_sameKeyDistinctDigestsCorrectRecovery(uint256,bytes32,bytes32)",
+                "name": "check_RevertCode(address)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SelfDestruct.t.sol:SelfDestructDeletedTest": [
             {
-                "name": "check_ecrecover_sameKeyDistinctDigestsUniqueRecovery(uint256,bytes32,bytes32)",
+                "name": "check_call_to_deleted_account()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4724,43 +4519,49 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_ecrecover_solveForMalleability(uint256,bytes32)",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_deleted_after_tx()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SelfDestruct.t.sol:SelfDestructShanghaiDeletedTest": [
             {
-                "name": "check_isValidERC1271SignatureNow(bytes32,bytes)",
+                "name": "check_preexisting_deleted_after_tx()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SelfDestruct.t.sol:SelfDestructShanghaiTest": [
             {
-                "name": "check_isValidSignatureNow(bytes32,bytes)",
+                "name": "check_preexisting_alive_until_end_of_tx()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SelfDestruct.t.sol:SelfDestructTest": [
             {
-                "name": "check_makeAddrAndKey_consistent_concrete()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_balance_moved_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_makeAddrAndKey_consistent_symbolic()",
+                "name": "check_created_in_tx_alive_until_end_of_tx()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4769,7 +4570,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_makeAddrAndKey_noCollision_concrete()",
+                "name": "check_destroy_in_constructor()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4778,7 +4579,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_makeAddrAndKey_noCollision_symbolic()",
+                "name": "check_halts_successfully()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4787,7 +4588,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_makeAddrAndKey_vmsign_ecrecover_e2e_concrete()",
+                "name": "check_preexisting_keeps_code_and_storage()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4796,7 +4597,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_makeAddrAndKey_vmsign_ecrecover_e2e_symbolic(string,bytes32)",
+                "name": "check_preexisting_self_beneficiary()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4805,7 +4606,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_tryRecover(address,bytes32,bytes)",
+                "name": "check_reverted_selfdestruct()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4814,52 +4615,59 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmaddr_canFindKeyForAddr_concrete(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_symbolic_beneficiary(address)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Send.t.sol:SendTest": [
             {
-                "name": "check_vmaddr_canFindKeyForAddr_mixed(uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_create(uint256,bytes32,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmaddr_canFindKeyForAddr_symbolic(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_send(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmaddr_consistent(uint256)",
+                "name": "check_transfer(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Setup.t.sol:SetupFailTest": [],
+        "test/Setup.t.sol:SetupTest": [
             {
-                "name": "check_vmaddr_noCollision_concrete(uint256,uint256)",
+                "name": "check_True()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SetupMulti.t.sol:SetupMultiTest": [
             {
-                "name": "check_vmaddr_noCollision_symbolic(uint256,uint256)",
+                "name": "check_fee_bounded()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4868,16 +4676,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_canFindKeyForGivenSig(uint256,uint256,bytes32)",
+                "name": "check_fee_small_fail()",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 2,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_consistent(uint256,bytes32)",
+                "name": "check_mode_consistent()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4886,16 +4694,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_ecrecover_e2e_recoveredCanNotMatchOtherAddr(uint256,bytes32,address)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_not_paused_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_ecrecover_e2e_recoveredMatches(uint256,bytes32)",
+                "name": "check_setFee(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4904,7 +4712,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_noDigestCollision(uint256,bytes32,bytes32)",
+                "name": "invariant_fee_bounded()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4913,16 +4721,18 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_noKeyCollision(uint256,uint256,bytes32)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "invariant_fee_unchanged_fail()",
+                "exitcode": 1,
+                "num_models": 4,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SetupMulti.t.sol:SetupSymbolicMultiTest": [
             {
-                "name": "check_vmsign_tryRecover(uint256,bytes32)",
+                "name": "check_value()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4931,47 +4741,40 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_vmsign_valuesInExpectedRange(uint256,bytes32)",
-                "exitcode": 0,
-                "num_models": 0,
-                "models": null,
-                "num_paths": null,
-                "time": null,
-                "num_bounded_loops": null
-            }
-        ],
-        "test/SimpleState.t.sol:SimpleStateTest": [
-            {
-                "name": "check_buggy_excluding_view()",
+                "name": "check_value_fail()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SetupPlus.t.sol:SetupPlusTest": [
             {
-                "name": "check_buggy_with_state_snapshot()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_Setup()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SetupPlus.t.sol:SetupPlusTestB": [
             {
-                "name": "check_buggy_with_storage_snapshot()",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_Setup()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/SmolWETH.t.sol:SmolWETHTest": [
+        "test/SetupSymbolic.t.sol:SetupSymbolicTest": [
             {
-                "name": "check_deposit_once(address,uint256)",
+                "name": "check_True()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4980,9 +4783,9 @@
                 "num_bounded_loops": null
             }
         ],
-        "test/Snapshot.t.sol:SnapshotTest": [
+        "test/Sha3.t.sol:Sha3Test": [
             {
-                "name": "check_balance_snapshot()",
+                "name": "check_address_collision_pass(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -4991,7 +4794,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_new_account_snapshot()",
+                "name": "check_concrete_keccak_does_not_split_paths()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5000,7 +4803,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_snapshot()",
+                "name": "check_concrete_keccak_memory_lookup()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5009,7 +4812,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_this_balance_snapshot()",
+                "name": "check_empty_hash_value()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5018,18 +4821,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_this_storage_snapshot()",
+                "name": "check_hash()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Solver.t.sol:SolverTest": [
+            },
             {
-                "name": "check_dynamic_array_overflow()",
+                "name": "check_hash_collision_with_empty()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5038,18 +4839,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_too_many_open_files()",
-                "exitcode": 2,
+                "name": "check_no_hash_collision_assumption()",
+                "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/SortMismatch.t.sol:SortMismatchTest": [
+            },
             {
-                "name": "check_add(uint256)",
+                "name": "check_only_empty_bytes_matches_empty_hash(bytes)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5058,16 +4857,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_addmod(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_uint128_collision_fail(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_and(uint256)",
+                "name": "check_uint160_collision_pass(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5076,25 +4875,29 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_div(uint256)",
+                "name": "check_uint256_collision(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SignExtend.t.sol:SignExtendTest": [
             {
-                "name": "check_eq(uint256)",
+                "name": "check_SIGNEXTEND(int16)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Signature.t.sol:SignatureTest": [
             {
-                "name": "check_exp(uint256)",
+                "name": "check_ecrecover(bytes32,uint8,bytes32,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5103,16 +4906,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_gt(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_ecrecover_concrete_args()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_iszero(uint256)",
+                "name": "check_ecrecover_distinctKeysSameDigestCorrectRecovery(uint256,uint256,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5121,7 +4924,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_lt(uint256)",
+                "name": "check_ecrecover_distinctKeysSameDigestDistinctAddrs(uint256,uint256,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5130,7 +4933,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_mod(uint256)",
+                "name": "check_ecrecover_eip2098CompactSignatures(uint256,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5139,7 +4942,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_mul(uint256)",
+                "name": "check_ecrecover_explicitMalleability(uint256,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5148,7 +4951,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_mulmod(uint256)",
+                "name": "check_ecrecover_sameKeyDistinctDigestsCorrectRecovery(uint256,bytes32,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5157,7 +4960,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_not(uint256)",
+                "name": "check_ecrecover_sameKeyDistinctDigestsUniqueRecovery(uint256,bytes32,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5166,16 +4969,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_or(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_ecrecover_solveForMalleability(uint256,bytes32)",
+                "exitcode": 1,
+                "num_models": 3,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_return()",
+                "name": "check_isValidERC1271SignatureNow(bytes32,bytes)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5184,7 +4987,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_revert()",
+                "name": "check_isValidSignatureNow(bytes32,bytes)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5193,7 +4996,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_sar(uint256)",
+                "name": "check_makeAddrAndKey_consistent_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5202,7 +5005,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_sdiv(uint256)",
+                "name": "check_makeAddrAndKey_consistent_symbolic()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5211,7 +5014,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_sgt(uint256)",
+                "name": "check_makeAddrAndKey_noCollision_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5220,7 +5023,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_shl(uint256)",
+                "name": "check_makeAddrAndKey_noCollision_symbolic()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5229,7 +5032,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_shr(uint256)",
+                "name": "check_makeAddrAndKey_vmsign_ecrecover_e2e_concrete()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5238,7 +5041,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_signextend(uint256)",
+                "name": "check_makeAddrAndKey_vmsign_ecrecover_e2e_symbolic(string,bytes32)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5247,7 +5050,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_slt(uint256)",
+                "name": "check_tryRecover(address,bytes32,bytes)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5256,36 +5059,34 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_smod(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_vmaddr_canFindKeyForAddr_concrete(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_sub(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_vmaddr_canFindKeyForAddr_mixed(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_xor(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_vmaddr_canFindKeyForAddr_symbolic(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/StaticContexts.t.sol:StaticContextsTest": [
+            },
             {
-                "name": "check_create2_fails()",
+                "name": "check_vmaddr_consistent(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5294,7 +5095,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_create_fails()",
+                "name": "check_vmaddr_noCollision_concrete(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5303,7 +5104,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_log_fails()",
+                "name": "check_vmaddr_noCollision_symbolic(uint256,uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5312,81 +5113,81 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_sstore_fails()",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_vmsign_canFindKeyForGivenSig(uint256,uint256,bytes32)",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/StdAssertTest.t.sol:StdAssertFailLogTest": [
+            },
             {
-                "name": "check_assertEq(address,address)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_vmsign_consistent(uint256,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(address[],address[])",
-                "exitcode": 1,
-                "num_models": 8,
+                "name": "check_vmsign_ecrecover_e2e_recoveredCanNotMatchOtherAddr(uint256,bytes32,address)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bool,bool)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_vmsign_ecrecover_e2e_recoveredMatches(uint256,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bool[],bool[])",
-                "exitcode": 1,
-                "num_models": 8,
+                "name": "check_vmsign_noDigestCollision(uint256,bytes32,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes,bytes)",
-                "exitcode": 1,
-                "num_models": 8,
+                "name": "check_vmsign_noKeyCollision(uint256,uint256,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes32,bytes32)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_vmsign_tryRecover(uint256,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes32[],bytes32[])",
-                "exitcode": 1,
-                "num_models": 8,
+                "name": "check_vmsign_valuesInExpectedRange(uint256,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SimpleState.t.sol:SimpleStateTest": [
             {
-                "name": "check_assertEq(int256,int256)",
+                "name": "check_buggy_excluding_view()",
                 "exitcode": 1,
                 "num_models": 1,
                 "models": null,
@@ -5395,241 +5196,386 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(int256[],int256[])",
+                "name": "check_buggy_with_state_snapshot()",
                 "exitcode": 1,
-                "num_models": 8,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(string,string)",
+                "name": "check_buggy_with_storage_snapshot()",
                 "exitcode": 1,
-                "num_models": 8,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SmolWETH.t.sol:SmolWETHTest": [
             {
-                "name": "check_assertEq(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_deposit_once(address,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Snapshot.t.sol:SnapshotTest": [
             {
-                "name": "check_assertEq(uint256[],uint256[])",
-                "exitcode": 1,
-                "num_models": 8,
+                "name": "check_balance_snapshot()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertFalse(bool)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_new_account_snapshot()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGe(int256,int256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_snapshot()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGe(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_this_balance_snapshot()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGt(int256,int256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_this_storage_snapshot()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/Solver.t.sol:SolverTest": [
             {
-                "name": "check_assertGt(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_dynamic_array_overflow()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLe(int256,int256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_too_many_open_files()",
+                "exitcode": 2,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SortMismatch.t.sol:SortMismatchTest": [
             {
-                "name": "check_assertLe(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_add(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLt(int256,int256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_addmod(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLt(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_and(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(address,address)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_div(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(address[],address[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_eq(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bool,bool)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_exp(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bool[],bool[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_gt(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes,bytes)",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_iszero(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes32,bytes32)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_lt(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes32[],bytes32[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_mod(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(int256,int256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_mul(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(int256[],int256[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_mulmod(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(string,string)",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_not(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_or(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256[],uint256[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_return()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertTrue(bool)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_revert()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_sar(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_sdiv(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_sgt(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_shl(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_shr(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_signextend(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_slt(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_smod(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_sub(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_xor(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             }
         ],
-        "test/StdAssertTest.t.sol:StdAssertFailTest": [
+        "test/StaticContexts.t.sol:StaticContextsTest": [
+            {
+                "name": "check_create2_fails()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_create_fails()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_log_fails()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_selfdestruct_fails()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_sstore_fails()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/StdAssertTest.t.sol:StdAssertFailLogTest": [
             {
                 "name": "check_assertEq(address,address)",
                 "exitcode": 1,
@@ -5910,36 +5856,1345 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256,uint256)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_assertNotEq(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(uint256[],uint256[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertTrue(bool)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/StdAssertTest.t.sol:StdAssertFailTest": [
+            {
+                "name": "check_assertEq(address,address)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(address[],address[])",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bool,bool)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bool[],bool[])",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes,bytes)",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes32,bytes32)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes32[],bytes32[])",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(int256[],int256[])",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(string,string)",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(uint256[],uint256[])",
+                "exitcode": 1,
+                "num_models": 8,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertFalse(bool)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGe(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGe(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGt(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGt(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLe(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLe(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLt(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLt(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(address,address)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(address[],address[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bool,bool)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bool[],bool[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes,bytes)",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes32,bytes32)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes32[],bytes32[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(int256,int256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(int256[],int256[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(string,string)",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(uint256,uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(uint256[],uint256[])",
+                "exitcode": 1,
+                "num_models": 3,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertTrue(bool)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/StdAssertTest.t.sol:StdAssertPassTest": [
+            {
+                "name": "check_assertEq(address,address)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(address[],address[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bool,bool)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bool[],bool[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes,bytes)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes32,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(bytes32[],bytes32[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(int256[],int256[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(string,string)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertEq(uint256[],uint256[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertFalse(bool)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGe(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGe(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGt(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertGt(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLe(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLe(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLt(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertLt(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(address,address)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(address[],address[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bool,bool)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bool[],bool[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes,bytes)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes32,bytes32)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(bytes32[],bytes32[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(int256,int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(int256[],int256[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(string,string)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertNotEq(uint256[],uint256[])",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_assertTrue(bool)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Storage.t.sol:StorageTest": [
+            {
+                "name": "check_addArr1(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_addArr2(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_addMap1Arr1(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_setMap1(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_setMap2(uint256,uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_setMap3(uint256,uint256,uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Storage2.t.sol:Storage2Test": [
+            {
+                "name": "check_set((uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256))",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Storage3.t.sol:Storage3Test": [
+            {
+                "name": "check_set((bytes1,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256))",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Storage4.t.sol:Storage4Test": [
+            {
+                "name": "check_add_1(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_add_2(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Storage5.t.sol:Storage5Test": [
+            {
+                "name": "check_array_access(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/StorageSlot.t.sol:StorageSlotTest": [
+            {
+                "name": "check_keccak_slot_1_pass(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_keccak_slot_2_beyond_precomputed_pass(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_keccak_slot_2_pass(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_keccak_slot_3_pass(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_setup()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Store.t.sol:StoreTest": [
+            {
+                "name": "check_load_nonexistent_account(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_store_Array(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_store_Mapping(uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_store_Scalar(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_store_nonexistent_account()",
+                "exitcode": 3,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Struct.t.sol:StructTest": [
+            {
+                "name": "check_Struct((uint256,uint256))",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_StructArray((uint256,uint256)[],(uint256,uint256)[2])",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_StructArrayArray((uint256,uint256)[][],(uint256,uint256)[2][],(uint256,uint256)[][2],(uint256,uint256)[2][2])",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/Struct.t.sol:StructTest2": [
+            {
+                "name": "check_S((uint256,uint256[],uint256),(uint256,(uint256,uint256[],uint256),uint256[],(uint256,uint256[],uint256)[],uint256[1],(uint256,uint256[],uint256)[][])[])",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/SvmCheatCode.t.sol:SvmCheatCodeTest": [
+            {
+                "name": "check_FailUnknownCheatcode()",
+                "exitcode": 3,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_SymbolLabel()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createAddress()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBool()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBytes()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBytes32()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBytes4_basic()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBytes4_finds_selector()",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createBytes_empty()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createInt()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createInt256()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createString()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createString_empty()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createUint()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_createUint256()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_enableSymbolicStorage_fail()",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_enableSymbolicStorage_nonexistent()",
+                "exitcode": 3,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_enableSymbolicStorage_pass(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_address()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_address_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bool()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bool_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bytes()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bytes32()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bytes32_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_bytes_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_exists()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_int()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_int_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_missing_fail()",
+                "exitcode": 5,
+                "num_models": null,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_address()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_address_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_address_array_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_address_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bool()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bool_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bool_array_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bool_without_env_var(bool)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes32()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes32_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes32_array_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes32_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes_array()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes_array_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_bytes_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_int(int256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_env_or_int_array()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256[],uint256[])",
-                "exitcode": 1,
-                "num_models": 3,
+                "name": "check_env_or_int_array_without_env_var()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertTrue(bool)",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_env_or_string()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/StdAssertTest.t.sol:StdAssertPassTest": [
+            },
             {
-                "name": "check_assertEq(address,address)",
+                "name": "check_env_or_string_array()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5948,7 +7203,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(address[],address[])",
+                "name": "check_env_or_string_array_without_env_var()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5957,7 +7212,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bool,bool)",
+                "name": "check_env_or_string_without_env_var()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5966,7 +7221,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bool[],bool[])",
+                "name": "check_env_or_uint(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5975,7 +7230,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes,bytes)",
+                "name": "check_env_or_uint_array()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5984,7 +7239,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes32,bytes32)",
+                "name": "check_env_or_uint_array_without_env_var()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -5993,7 +7248,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(bytes32[],bytes32[])",
+                "name": "check_env_string()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6002,7 +7257,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(int256,int256)",
+                "name": "check_env_string_array()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6011,7 +7266,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(int256[],int256[])",
+                "name": "check_env_uint()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6020,7 +7275,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(string,string)",
+                "name": "check_env_uint_array()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6029,8 +7284,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(uint256,uint256)",
-                "exitcode": 0,
+                "name": "check_extract_string_argument_fail(string)",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6038,7 +7293,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertEq(uint256[],uint256[])",
+                "name": "check_randomAddress()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6047,7 +7302,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertFalse(bool)",
+                "name": "check_randomBool()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6056,7 +7311,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGe(int256,int256)",
+                "name": "check_randomBytes()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6065,7 +7320,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGe(uint256,uint256)",
+                "name": "check_randomBytes4()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6074,7 +7329,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGt(int256,int256)",
+                "name": "check_randomBytes8()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6083,7 +7338,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertGt(uint256,uint256)",
+                "name": "check_randomBytes_empty()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6092,7 +7347,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLe(int256,int256)",
+                "name": "check_randomInt()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6101,7 +7356,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLe(uint256,uint256)",
+                "name": "check_randomInt256()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6110,7 +7365,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLt(int256,int256)",
+                "name": "check_randomUint()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6119,7 +7374,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertLt(uint256,uint256)",
+                "name": "check_randomUint256()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6128,7 +7383,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(address,address)",
+                "name": "check_random_uint_range_concrete_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6137,8 +7392,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(address[],address[])",
-                "exitcode": 0,
+                "name": "check_random_uint_range_max_greaterthan_min_fail()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6146,8 +7401,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bool,bool)",
-                "exitcode": 0,
+                "name": "check_random_uint_range_symbolic_fail(uint256,uint256)",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6155,17 +7410,17 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bool[],bool[])",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_setArbitraryStorage_fail()",
+                "exitcode": 1,
+                "num_models": 1,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes,bytes)",
-                "exitcode": 0,
+                "name": "check_setArbitraryStorage_nonexistent()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6173,7 +7428,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes32,bytes32)",
+                "name": "check_setArbitraryStorage_pass(uint256)",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6182,17 +7437,19 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(bytes32[],bytes32[])",
-                "exitcode": 0,
+                "name": "check_unsupported_cheatcode_fail()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            },
+            }
+        ],
+        "test/SvmCheatCode.t.sol:SvmCreateCalldataTest": [
             {
-                "name": "check_assertNotEq(int256,int256)",
-                "exitcode": 0,
+                "name": "check_createCalldata_Beep_0_excluding_pure()",
+                "exitcode": 4,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6200,7 +7457,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(int256[],int256[])",
+                "name": "check_createCalldata_Beep_0_including_pure()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6209,8 +7466,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(string,string)",
-                "exitcode": 0,
+                "name": "check_createCalldata_Beep_1_excluding_pure()",
+                "exitcode": 4,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6218,7 +7475,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256,uint256)",
+                "name": "check_createCalldata_Beep_1_including_pure()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6227,8 +7484,8 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertNotEq(uint256[],uint256[])",
-                "exitcode": 0,
+                "name": "check_createCalldata_Beep_2_excluding_pure()",
+                "exitcode": 4,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6236,19 +7493,17 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_assertTrue(bool)",
+                "name": "check_createCalldata_Beep_2_including_pure()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Storage.t.sol:StorageTest": [
+            },
             {
-                "name": "check_addArr1(uint256)",
-                "exitcode": 0,
+                "name": "check_createCalldata_Dummy_fail()",
+                "exitcode": 3,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
@@ -6256,7 +7511,7 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_addArr2(uint256,uint256)",
+                "name": "check_createCalldata_Fallback()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6265,16 +7520,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_addMap1Arr1(uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_0_excluding_view_fail()",
+                "exitcode": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setMap1(uint256,uint256)",
+                "name": "check_createCalldata_Mock_0_excluding_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6283,80 +7538,70 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setMap2(uint256,uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_0_including_view_fail()",
+                "exitcode": 1,
+                "num_models": 20,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setMap3(uint256,uint256,uint256,uint256)",
+                "name": "check_createCalldata_Mock_0_including_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Storage2.t.sol:Storage2Test": [
+            },
             {
-                "name": "check_set((uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint32,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256,uint32,uint256))",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_1_fail()",
+                "exitcode": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Storage3.t.sol:Storage3Test": [
+            },
             {
-                "name": "check_set((bytes1,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256))",
+                "name": "check_createCalldata_Mock_1_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Storage4.t.sol:Storage4Test": [
+            },
             {
-                "name": "check_add_1(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_2_excluding_view_fail()",
+                "exitcode": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_add_2(uint256)",
+                "name": "check_createCalldata_Mock_2_excluding_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Storage5.t.sol:Storage5Test": [
+            },
             {
-                "name": "check_array_access(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_2_including_view_fail()",
+                "exitcode": 1,
+                "num_models": 20,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/StorageSlot.t.sol:StorageSlotTest": [
+            },
             {
-                "name": "check_keccak_slot_1_pass(uint256)",
+                "name": "check_createCalldata_Mock_2_including_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6365,16 +7610,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_keccak_slot_2_fail(uint256)",
+                "name": "check_createCalldata_Mock_3_fail()",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_keccak_slot_2_pass(uint256)",
+                "name": "check_createCalldata_Mock_3_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6383,36 +7628,34 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_keccak_slot_3_pass(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_4_excluding_view_fail()",
+                "exitcode": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_setup()",
+                "name": "check_createCalldata_Mock_4_excluding_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Store.t.sol:StoreTest": [
+            },
             {
-                "name": "check_load_nonexistent_account(uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_4_including_view_fail()",
+                "exitcode": 1,
+                "num_models": 20,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_store_Array(uint256,uint256)",
+                "name": "check_createCalldata_Mock_4_including_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6421,16 +7664,16 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_store_Mapping(uint256,uint256)",
-                "exitcode": 0,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_interface_excluding_view_fail()",
+                "exitcode": 1,
+                "num_models": 18,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_store_Scalar(uint256)",
+                "name": "check_createCalldata_Mock_interface_excluding_view_pass()",
                 "exitcode": 0,
                 "num_models": 0,
                 "models": null,
@@ -6439,49 +7682,45 @@
                 "num_bounded_loops": null
             },
             {
-                "name": "check_store_nonexistent_account()",
-                "exitcode": 3,
-                "num_models": 0,
+                "name": "check_createCalldata_Mock_interface_including_view_fail()",
+                "exitcode": 1,
+                "num_models": 20,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Struct.t.sol:StructTest": [
+            },
             {
-                "name": "check_Struct((uint256,uint256))",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_createCalldata_Mock_interface_including_view_pass()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_StructArray((uint256,uint256)[],(uint256,uint256)[2])",
+                "name": "check_createCalldata_NestedArrays_1_fail()",
                 "exitcode": 1,
-                "num_models": 1,
+                "num_models": 541,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
             },
             {
-                "name": "check_StructArrayArray((uint256,uint256)[][],(uint256,uint256)[2][],(uint256,uint256)[][2],(uint256,uint256)[2][2])",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_createCalldata_NestedArrays_1_pass()",
+                "exitcode": 0,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
                 "num_bounded_loops": null
-            }
-        ],
-        "test/Struct.t.sol:StructTest2": [
+            },
             {
-                "name": "check_S((uint256,uint256[],uint256),(uint256,(uint256,uint256[],uint256),uint256[],(uint256,uint256[],uint256)[],uint256[1],(uint256,uint256[],uint256)[][])[])",
-                "exitcode": 1,
-                "num_models": 1,
+                "name": "check_createCalldata_unknown_fail()",
+                "exitcode": 3,
+                "num_models": 0,
                 "models": null,
                 "num_paths": null,
                 "time": null,
diff --git a/tests/expected/vyper.json b/tests/expected/vyper.json
new file mode 100644
index 000000000..45e2b2e72
--- /dev/null
+++ b/tests/expected/vyper.json
@@ -0,0 +1,108 @@
+{
+    "exitcode": 1,
+    "test_results": {
+        "test/VyperTarget.t.sol:VyperTargetTest": [
+            {
+                "name": "check_counter(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_hashmap(address,address,uint256,uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_immutable(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_unreachable_caught(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_unreachable_in_target(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ],
+        "test/CounterTest.vy:CounterTest": [
+            {
+                "name": "check_add_cheatcode(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_add_ok(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_add_unreachable(uint256)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_bytes_annotated(bytes)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_bytes_default(bytes)",
+                "exitcode": 1,
+                "num_models": 1,
+                "models": null,
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            },
+            {
+                "name": "check_plain_assert(uint256)",
+                "exitcode": 0,
+                "num_models": 0,
+                "models": [],
+                "num_paths": null,
+                "time": null,
+                "num_bounded_loops": null
+            }
+        ]
+    }
+}
diff --git a/tests/ffi/foundry.toml b/tests/ffi/foundry.toml
index 570716663..7b3022dd8 100644
--- a/tests/ffi/foundry.toml
+++ b/tests/ffi/foundry.toml
@@ -6,5 +6,5 @@ libs = ['../lib', 'lib']
 evm_version = 'cancun'
 
 force = false
-# compile options used by halmos (to prevent unnecessary recompilation when running forge test and halmos together)
+# compile options used by dolmos (to prevent unnecessary recompilation when running forge test and dolmos together)
 extra_output = ["storageLayout", "metadata"]
diff --git a/tests/regression/halmos.toml b/tests/regression/dolmos.toml
similarity index 92%
rename from tests/regression/halmos.toml
rename to tests/regression/dolmos.toml
index 4e4f3bd78..7761597eb 100644
--- a/tests/regression/halmos.toml
+++ b/tests/regression/dolmos.toml
@@ -1,10 +1,4 @@
-#     ___       ___       ___       ___       ___       ___
-#    /\__\     /\  \     /\__\     /\__\     /\  \     /\  \
-#   /:/__/_   /::\  \   /:/  /    /::L_L_   /::\  \   /::\  \
-#  /::\/\__\ /::\:\__\ /:/__/    /:/L:\__\ /:/\:\__\ /\:\:\__\
-#  \/\::/  / \/\::/  / \:\  \    \/_/:/  / \:\/:/  / \:\:\/__/
-#    /:/  /    /:/  /   \:\__\     /:/  /   \::/  /   \::/  /
-#    \/__/     \/__/     \/__/     \/__/     \/__/     \/__/
+# dolmos configuration, generated by `python -m dolmos.config`
 
 [global]
 
diff --git a/tests/regression/foundry.toml b/tests/regression/foundry.toml
index 18e028e35..6f289892b 100644
--- a/tests/regression/foundry.toml
+++ b/tests/regression/foundry.toml
@@ -3,11 +3,19 @@ src = 'src'
 out = 'out'
 libs = ['../lib', 'lib']
 
-evm_version = 'cancun'
+evm_version = 'osaka'
 
 optimizer = true
 
 force = false
 
-# compile options used by halmos (to prevent unnecessary recompilation when running forge test and halmos together)
+# file cheatcodes (test/File.t.sol): `out` is foundry's default, test/data is read by
+# the tests, and test/data/private checks that a nested denial overrides it
+fs_permissions = [
+    { access = "read", path = "./out" },
+    { access = "read", path = "./test/data" },
+    { access = "none", path = "./test/data/private" },
+]
+
+# compile options used by dolmos (to prevent unnecessary recompilation when running forge test and dolmos together)
 extra_output = ["storageLayout", "metadata"]
diff --git a/tests/regression/src/Create.sol b/tests/regression/src/Create.sol
index c5a6103d5..fc32fc679 100644
--- a/tests/regression/src/Create.sol
+++ b/tests/regression/src/Create.sol
@@ -3,12 +3,12 @@ pragma solidity >=0.8.0 <0.9.0;
 
 contract Create {
     uint public value;
-    uint public immutable halmos;
+    uint public immutable dolmos;
     uint public initialized = 7;
     uint public constant const = 11;
 
     constructor(uint qed) {
-        halmos = qed;
+        dolmos = qed;
     }
 
     function set(uint x) public {
diff --git a/tests/regression/test/Arith.t.sol b/tests/regression/test/Arith.t.sol
index e49b53daf..967240d48 100644
--- a/tests/regression/test/Arith.t.sol
+++ b/tests/regression/test/Arith.t.sol
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-/// @custom:halmos --solver bitwuzla-abs
+/// @custom:dolmos --solver bitwuzla-abs
 contract ArithTest {
     function unchecked_div(uint x, uint y) public pure returns (uint ret) {
         assembly {
diff --git a/tests/regression/test/AssertTest.t.sol b/tests/regression/test/AssertTest.t.sol
index bfbfbc77c..2b007c18c 100644
--- a/tests/regression/test/AssertTest.t.sol
+++ b/tests/regression/test/AssertTest.t.sol
@@ -30,7 +30,7 @@ contract AssertTest is Test {
 
     function check_symbolic_revert(uint256 x) public {
         // reverts with Concat(0x4e487b71, p_x_uint256())
-        // halmos only considers reverts with explicit revert codes so we expect a PASS here
+        // dolmos only considers reverts with explicit revert codes so we expect a PASS here
         // this is really to make sure we handle symbolic reverts gracefully
         if (x > 0) {
             bytes memory data = abi.encodeWithSignature("Panic(uint256)", x);
diff --git a/tests/regression/test/Context.t.sol b/tests/regression/test/Context.t.sol
index 513289fa4..f76870cbb 100644
--- a/tests/regression/test/Context.t.sol
+++ b/tests/regression/test/Context.t.sol
@@ -40,7 +40,7 @@ contract Context is Test {
             }
         } else if (mode == 9) {
             vm.prank(address(0));
-            vm.prank(address(0)); // HalmosException
+            vm.prank(address(0)); // DolmosException
         } else if (mode == 10) {
             fail();
         }
@@ -179,7 +179,7 @@ contract ContextTest is Test {
         ensure_test_context();
     }
 
-    function check_create_halmos_exception() public payable {
+    function check_create_dolmos_exception() public payable {
         assert(returndatasize() == 0); // empty initial returndata
         ensure_test_context();
 
@@ -198,7 +198,7 @@ contract ContextTest is Test {
         _check_call0(mode0);
     }
 
-    function check_call0_halmos_exception() public payable {
+    function check_call0_dolmos_exception() public payable {
         _check_call0(9);
     }
 
@@ -231,7 +231,7 @@ contract ContextTest is Test {
         _check_call1(mode1, mode0);
     }
 
-    function check_call1_halmos_exception(uint mode1) public payable {
+    function check_call1_dolmos_exception(uint mode1) public payable {
         _check_call1(mode1, 9);
     }
 
diff --git a/tests/regression/test/Counter.t.sol b/tests/regression/test/Counter.t.sol
index 0f0ab95b2..e8a7eb5c2 100644
--- a/tests/regression/test/Counter.t.sol
+++ b/tests/regression/test/Counter.t.sol
@@ -4,7 +4,7 @@ pragma solidity >=0.8.0 <0.9.0;
 import "../src/Counter.sol";
 import {SymTest} from "halmos-cheatcodes/SymTest.sol";
 
-/// @custom:halmos --loop 4
+/// @custom:dolmos --loop 4
 contract CounterTest is Counter, SymTest {
     function setUp() public {
         svm.enableSymbolicStorage(address(this));
diff --git a/tests/regression/test/Create.t.sol b/tests/regression/test/Create.t.sol
index 4c32e3053..687f4a9da 100644
--- a/tests/regression/test/Create.t.sol
+++ b/tests/regression/test/Create.t.sol
@@ -23,7 +23,7 @@ contract CreateTest is Test {
     }
 
     function check_immutable() public {
-        assertEq(create.halmos(), 0x220E);
+        assertEq(create.dolmos(), 0x220E);
     }
 
     function check_initialized() public {
diff --git a/tests/regression/test/Create3.t.sol b/tests/regression/test/Create3.t.sol
new file mode 100644
index 000000000..6d7cddd62
--- /dev/null
+++ b/tests/regression/test/Create3.t.sol
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+
+/// @notice minimal CREATE3 library, as found in 0xsequence/create3, solmate and solady
+/// @dev see upstream halmos issue #217
+library Create3 {
+    bytes internal constant PROXY_CHILD_BYTECODE = hex"67363d3d37363d34f03d5260086018f3";
+
+    bytes32 internal constant KECCAK256_PROXY_CHILD_BYTECODE =
+        0x21c35dbe1b344a2488cf3321d6ce542f8e9f305544ff09e4993a62319a497c1f;
+
+    /// @dev keccak256(rlp([keccak256(0xff ++ address(this) ++ salt ++ keccak256(childBytecode))[12:], 0x01]))
+    function addressOf(bytes32 salt) internal view returns (address) {
+        address proxy = address(
+            uint160(uint256(keccak256(abi.encodePacked(hex"ff", address(this), salt, KECCAK256_PROXY_CHILD_BYTECODE))))
+        );
+
+        return address(uint160(uint256(keccak256(abi.encodePacked(hex"d694", proxy, hex"01")))));
+    }
+
+    function create3(bytes32 salt, bytes memory creationCode) internal returns (address addr) {
+        bytes memory proxyCode = PROXY_CHILD_BYTECODE;
+
+        addr = addressOf(salt);
+        require(addr.code.length == 0, "TargetAlreadyExists");
+
+        address proxy;
+        assembly {
+            proxy := create2(0, add(proxyCode, 32), mload(proxyCode), salt)
+        }
+        require(proxy != address(0), "ErrorCreatingProxy");
+
+        (bool success,) = proxy.call(creationCode);
+        require(success && addr.code.length != 0, "ErrorCreatingContract");
+    }
+}
+
+contract Counter {
+    uint256 public number;
+
+    constructor(uint256 _number) {
+        number = _number;
+    }
+
+    function increment() public {
+        number++;
+    }
+}
+
+contract Create3Test is Test {
+    function check_create3(uint256 initial) public {
+        vm.assume(initial < type(uint256).max);
+
+        bytes32 salt = keccak256("counter");
+
+        address predicted = Create3.addressOf(salt);
+        address deployed = Create3.create3(salt, abi.encodePacked(type(Counter).creationCode, abi.encode(initial)));
+
+        assertEq(deployed, predicted);
+        assertEq(Counter(deployed).number(), initial);
+
+        Counter(deployed).increment();
+        assertEq(Counter(deployed).number(), initial + 1);
+    }
+
+    /// @notice a CREATE deployment must land on keccak256(rlp([sender, nonce]))
+    function check_create_address_prediction() public {
+        // the test contract has nonce 1 before its first deployment
+        address predicted = address(uint160(uint256(keccak256(abi.encodePacked(hex"d694", address(this), hex"01")))));
+
+        Counter c = new Counter(0);
+
+        assertEq(address(c), predicted);
+    }
+
+    function check_create_address_prediction_nonce2() public {
+        new Counter(0);
+
+        address predicted = address(uint160(uint256(keccak256(abi.encodePacked(hex"d694", address(this), hex"02")))));
+
+        Counter c = new Counter(0);
+
+        assertEq(address(c), predicted);
+    }
+}
+
+contract NonceTest is Test {
+    function check_nonce_of_test_contract() public {
+        assertEq(vm.getNonce(address(this)), 1);
+
+        new Counter(0);
+        assertEq(vm.getNonce(address(this)), 2);
+
+        new Counter(0);
+        assertEq(vm.getNonce(address(this)), 3);
+    }
+
+    function check_nonce_of_created_contract() public {
+        Counter c = new Counter(0);
+
+        // a newly created account starts at nonce 1 (EIP-161)
+        assertEq(vm.getNonce(address(c)), 1);
+    }
+
+    function check_setNonce() public {
+        address eoa = address(0x1234);
+        assertEq(vm.getNonce(eoa), 0);
+
+        vm.setNonce(eoa, 7);
+        assertEq(vm.getNonce(eoa), 7);
+
+        // setNonce() can only increase the nonce, setNonceUnsafe() can decrease it
+        vm.setNonceUnsafe(eoa, 3);
+        assertEq(vm.getNonce(eoa), 3);
+
+        vm.resetNonce(eoa);
+        assertEq(vm.getNonce(eoa), 0);
+    }
+
+    function check_resetNonce_of_contract() public {
+        Counter c = new Counter(0);
+
+        vm.setNonce(address(c), 9);
+        assertEq(vm.getNonce(address(c)), 9);
+
+        // resets to 1 for contract accounts
+        vm.resetNonce(address(c));
+        assertEq(vm.getNonce(address(c)), 1);
+    }
+
+    /// @notice setNonce() must change the address of the next deployment
+    function check_setNonce_changes_create_address() public {
+        vm.setNonce(address(this), 42);
+
+        address predicted =
+            address(uint160(uint256(keccak256(abi.encodePacked(hex"d694", address(this), bytes1(0x2a))))));
+
+        Counter c = new Counter(0);
+
+        assertEq(address(c), predicted);
+    }
+}
diff --git a/tests/regression/test/EvmVersion.t.sol b/tests/regression/test/EvmVersion.t.sol
new file mode 100644
index 000000000..ae4439b5d
--- /dev/null
+++ b/tests/regression/test/EvmVersion.t.sol
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+// EVM version setting (a16z/halmos#128): opcodes introduced after the selected fork are
+// invalid. The probed opcodes run in contracts deployed from raw bytecode, so that the
+// test contracts themselves (compiled for the default evm_version) are not affected.
+abstract contract EvmVersionBase {
+    function run(uint256 initcode, uint256 size) internal returns (bool success) {
+        assembly {
+            mstore(0, initcode)
+            let target := create(0, 0, size)
+            success := call(gas(), target, 0, 0, 0, 0, 0)
+        }
+    }
+
+    // runtime: PUSH0 PUSH0 SSTORE STOP
+    function push0() internal returns (bool) {
+        return run(0x6004600a5f3960045ff35f5f5500000000000000000000000000000000000000, 14);
+    }
+
+    // runtime: PUSH1 1 PUSH0 TSTORE STOP
+    function tstore() internal returns (bool) {
+        return run(0x6005600a5f3960055ff360015f5d000000000000000000000000000000000000, 15);
+    }
+
+    // runtime: PUSH1 1 CLZ STOP
+    function clz() internal returns (bool) {
+        return run(0x6004600a5f3960045ff360011e00000000000000000000000000000000000000, 14);
+    }
+}
+
+// default: the evm_version of the build (osaka)
+contract EvmVersionDefaultTest is EvmVersionBase {
+    function check_all_available() public {
+        assert(push0());
+        assert(tstore());
+        assert(clz());
+    }
+}
+
+/// @custom:dolmos --evm-version prague
+contract EvmVersionPragueTest is EvmVersionBase {
+    function check_clz_invalid() public {
+        assert(push0());
+        assert(tstore());
+        assert(!clz());
+    }
+}
+
+/// @custom:dolmos --evm-version shanghai
+contract EvmVersionShanghaiTest is EvmVersionBase {
+    function check_tstore_invalid() public {
+        assert(push0());
+        assert(!tstore());
+        assert(!clz());
+    }
+
+    // expected failure: TSTORE is not available in shanghai
+    function check_tstore_available_fail() public {
+        assert(tstore());
+    }
+}
diff --git a/tests/regression/test/Expect.t.sol b/tests/regression/test/Expect.t.sol
new file mode 100644
index 000000000..f3164f130
--- /dev/null
+++ b/tests/regression/test/Expect.t.sol
@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+
+contract Target {
+    error Unauthorized(address who);
+    error Plain();
+
+    event Deposit(address indexed from, uint256 indexed id, uint256 amount);
+    event Other(uint256 x);
+    event Anon(uint256 indexed a, uint256 b) anonymous;
+
+    uint256 public total;
+
+    function requireLt(uint256 x, uint256 bound) external pure returns (uint256) {
+        require(x < bound, "too big");
+        return x;
+    }
+
+    function onlyOwner(address caller) external pure {
+        if (caller != address(0xbeef)) revert Unauthorized(caller);
+    }
+
+    function plain(bool fail) external pure {
+        if (fail) revert Plain();
+    }
+
+    function ok() external pure returns (uint256) {
+        return 42;
+    }
+
+    function deposit(uint256 id, uint256 amount) external {
+        total += amount;
+        emit Other(amount);
+        emit Deposit(msg.sender, id, amount);
+    }
+
+    function anon(uint256 a, uint256 b) external {
+        emit Anon(a, b);
+    }
+
+    function depositTwice(uint256 amount) external {
+        emit Other(amount);
+        emit Other(amount);
+    }
+}
+
+contract Inner {
+    function boom() external pure {
+        revert("inner");
+    }
+}
+
+contract Outer {
+    Inner public inner = new Inner();
+
+    function callInner() external view {
+        inner.boom();
+    }
+}
+
+contract Reverting {
+    constructor(bool fail) {
+        require(!fail, "ctor");
+    }
+}
+
+/// @dev overloads with a count, missing from the pinned forge-std
+interface VmCount {
+    function expectRevert(uint64 count) external;
+    function expectRevert(bytes4 revertData, uint64 count) external;
+    function expectEmit(uint64 count) external;
+}
+
+/// @dev regression tests for halmos issue #409: vm.expectRevert / vm.expectEmit
+contract ExpectTest is Test {
+    Target target;
+    Outer outer;
+    VmCount vmc = VmCount(address(vm));
+
+    event Deposit(address indexed from, uint256 indexed id, uint256 amount);
+    event Other(uint256 x);
+    event Anon(uint256 indexed a, uint256 b) anonymous;
+
+    function setUp() public {
+        target = new Target();
+        outer = new Outer();
+    }
+
+    //
+    // expectRevert
+    //
+
+    function check_expectRevert_any(uint256 x) public {
+        vm.assume(x >= 10);
+        vm.expectRevert();
+        target.requireLt(x, 10);
+    }
+
+    function check_expectRevert_any_fail(uint256 x) public {
+        // fails for x < 10
+        vm.expectRevert();
+        target.requireLt(x, 10);
+    }
+
+    function check_expectRevert_string(uint256 x) public {
+        vm.assume(x >= 10);
+        vm.expectRevert("too big");
+        target.requireLt(x, 10);
+    }
+
+    function check_expectRevert_string_bytes(uint256 x) public {
+        vm.assume(x >= 10);
+        vm.expectRevert(abi.encodeWithSignature("Error(string)", "too big"));
+        target.requireLt(x, 10);
+    }
+
+    function check_expectRevert_wrong_string_fail(uint256 x) public {
+        vm.assume(x >= 10);
+        vm.expectRevert("wrong message");
+        target.requireLt(x, 10);
+    }
+
+    function check_expectRevert_custom_error(address who) public {
+        vm.assume(who != address(0xbeef));
+        vm.expectRevert(abi.encodeWithSelector(Target.Unauthorized.selector, who));
+        target.onlyOwner(who);
+    }
+
+    function check_expectRevert_custom_error_symbolic_fail(address who, address expected) public {
+        // fails when who != expected
+        vm.assume(who != address(0xbeef));
+        vm.expectRevert(abi.encodeWithSelector(Target.Unauthorized.selector, expected));
+        target.onlyOwner(who);
+    }
+
+    function check_expectRevert_selector() public {
+        vm.expectRevert(Target.Plain.selector);
+        target.plain(true);
+    }
+
+    function check_expectRevert_selector_with_args_fail(address who) public {
+        // the full revert data is compared: the arguments are missing
+        vm.assume(who != address(0xbeef));
+        vm.expectRevert(Target.Unauthorized.selector);
+        target.onlyOwner(who);
+    }
+
+    function check_expectPartialRevert(address who) public {
+        vm.assume(who != address(0xbeef));
+        vm.expectPartialRevert(Target.Unauthorized.selector);
+        target.onlyOwner(who);
+    }
+
+    function check_expectRevert_no_revert_fail() public {
+        vm.expectRevert();
+        target.plain(false);
+    }
+
+    function check_expectRevert_returns_success() public {
+        // the call is reported as successful to the caller
+        vm.expectRevert();
+        (bool success,) = address(target).call(abi.encodeCall(Target.plain, (true)));
+        assertTrue(success);
+    }
+
+    function check_expectRevert_state_is_reverted(uint256 amount) public {
+        uint256 before = target.total();
+        vm.expectRevert();
+        this.depositAndRevert(amount);
+        assertEq(target.total(), before);
+    }
+
+    function depositAndRevert(uint256 amount) external {
+        target.deposit(1, amount);
+        revert("rollback");
+    }
+
+    function check_expectRevert_with_prank() public {
+        // cheatcode calls in between don't consume the expectation
+        vm.expectRevert(abi.encodeWithSelector(Target.Unauthorized.selector, address(this)));
+        vm.prank(address(0x1234));
+        target.onlyOwner(address(this));
+    }
+
+    function check_expectRevert_reverter() public {
+        vm.expectRevert("inner", address(outer.inner()));
+        outer.callInner();
+    }
+
+    function check_expectRevert_reverter_fail() public {
+        vm.expectRevert(address(outer));
+        outer.callInner();
+    }
+
+    function check_expectRevert_count() public {
+        vmc.expectRevert(Target.Plain.selector, 2);
+        target.plain(true);
+        target.plain(true);
+    }
+
+    function check_expectRevert_count_fail() public {
+        vmc.expectRevert(Target.Plain.selector, 2);
+        target.plain(true);
+        target.plain(false);
+    }
+
+    function check_expectRevert_count_zero() public {
+        vmc.expectRevert(0);
+        target.plain(false);
+    }
+
+    function check_expectRevert_count_zero_fail() public {
+        vmc.expectRevert(0);
+        target.plain(true);
+    }
+
+    function check_expectRevert_create() public {
+        vm.expectRevert(bytes("ctor"));
+        new Reverting(true);
+    }
+
+    function check_expectRevert_pending_fail() public {
+        // the expected call never happens
+        vm.expectRevert();
+    }
+
+    //
+    // expectEmit
+    //
+
+    function check_expectEmit(uint256 id, uint256 amount) public {
+        vm.expectEmit();
+        emit Deposit(address(this), id, amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_wrong_data_fail(uint256 id, uint256 amount, uint256 other) public {
+        // fails when other != amount
+        vm.expectEmit();
+        emit Deposit(address(this), id, other);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_skip_data(uint256 id, uint256 amount, uint256 other) public {
+        vm.expectEmit(true, true, false, false);
+        emit Deposit(address(this), id, other);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_wrong_topic_fail(uint256 id, uint256 amount) public {
+        vm.expectEmit(true, false, false, true);
+        emit Deposit(address(0xdead), id, amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_emitter(uint256 id, uint256 amount) public {
+        vm.expectEmit(address(target));
+        emit Deposit(address(this), id, amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_wrong_emitter_fail(uint256 id, uint256 amount) public {
+        vm.expectEmit(address(outer));
+        emit Deposit(address(this), id, amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_ordered(uint256 id, uint256 amount) public {
+        vm.expectEmit();
+        emit Other(amount);
+        vm.expectEmit();
+        emit Deposit(address(this), id, amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_wrong_order_fail(uint256 id, uint256 amount) public {
+        vm.expectEmit();
+        emit Deposit(address(this), id, amount);
+        vm.expectEmit();
+        emit Other(amount);
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_anonymous(uint256 a, uint256 b) public {
+        vm.expectEmitAnonymous();
+        emit Anon(a, b);
+        target.anon(a, b);
+    }
+
+    function check_expectEmit_count(uint256 amount) public {
+        vmc.expectEmit(2);
+        emit Other(amount);
+        target.depositTwice(amount);
+    }
+
+    function check_expectEmit_count_fail(uint256 amount) public {
+        vmc.expectEmit(1);
+        emit Other(amount);
+        target.depositTwice(amount);
+    }
+
+    function check_expectEmit_no_emit_fail(uint256 id, uint256 amount) public {
+        // the expected event is not emitted before the call
+        vm.expectEmit();
+        target.deposit(id, amount);
+    }
+
+    function check_expectEmit_pending_fail(uint256 id, uint256 amount) public {
+        // the expected call never happens
+        vm.expectEmit();
+        emit Deposit(address(this), id, amount);
+    }
+}
diff --git a/tests/regression/test/File.t.sol b/tests/regression/test/File.t.sol
new file mode 100644
index 000000000..c16ec89e0
--- /dev/null
+++ b/tests/regression/test/File.t.sol
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+
+/// File cheatcodes (halmos#213): vm.readFile, vm.readFileBinary, vm.parseBytes, vm.projectRoot.
+/// Access follows fs_permissions in foundry.toml: test/data is readable, test/data/private is not.
+contract FileTest is Test {
+    address deployed;
+
+    // initcode of a contract that returns 42 for any call (as compiled by huff, say)
+    bytes constant INITCODE = hex"600a600c600039600a6000f3602a60005260206000f3";
+
+    function setUp() public {
+        // the scenario from halmos#213: deploy bytecode that is not compiled by solc
+        bytes memory initcode = vm.parseBytes(vm.readFile("test/data/initcode.hex"));
+        address addr;
+        assembly {
+            addr := create(0, add(initcode, 0x20), mload(initcode))
+        }
+        require(addr != address(0), "deployment failed");
+        deployed = addr;
+    }
+
+    function check_deployedFromFile(uint256 x) public {
+        (bool success, bytes memory ret) = deployed.call(abi.encode(x));
+        assert(success);
+        assert(abi.decode(ret, (uint256)) == 42);
+    }
+
+    function check_readFile() public view {
+        // returned as is, trailing newline included
+        string memory text = vm.readFile("test/data/hello.txt");
+        assert(keccak256(bytes(text)) == keccak256("hello\nworld\n"));
+    }
+
+    function check_readFileBinary() public view {
+        bytes memory data = vm.readFileBinary("test/data/binary.bin");
+        assert(keccak256(data) == keccak256(hex"00ff80"));
+    }
+
+    function check_readFile_normalizedPath() public view {
+        string memory text = vm.readFile("test/data/private/../hello.txt");
+        assert(keccak256(bytes(text)) == keccak256("hello\nworld\n"));
+    }
+
+    function check_projectRoot() public view {
+        string memory path = string.concat(vm.projectRoot(), "/test/data/hello.txt");
+        assert(keccak256(bytes(vm.readFile(path))) == keccak256("hello\nworld\n"));
+    }
+
+    function check_parseBytes() public view {
+        assert(keccak256(vm.parseBytes("0x600a6000F3")) == keccak256(hex"600a6000f3"));
+        assert(keccak256(vm.parseBytes("600a6000f3")) == keccak256(hex"600a6000f3"));
+        assert(vm.parseBytes("0x").length == 0);
+        assert(keccak256(vm.parseBytes(vm.readFile("test/data/initcode.hex"))) == keccak256(INITCODE));
+    }
+
+    // the following must error, as they do under forge test
+
+    function check_readFile_notPermitted() public view {
+        vm.readFile("foundry.toml");
+    }
+
+    function check_readFile_nestedDenial() public view {
+        vm.readFile("test/data/private/secret.txt");
+    }
+
+    function check_readFile_escape() public view {
+        vm.readFile("test/data/../../foundry.toml");
+    }
+
+    function check_readFile_missing() public view {
+        vm.readFile("test/data/missing.txt");
+    }
+
+    function check_readFile_invalidUtf8() public view {
+        vm.readFile("test/data/binary.bin");
+    }
+
+    function check_parseBytes_whitespace() public view {
+        vm.parseBytes("0x600a\n");
+    }
+
+    function check_parseBytes_oddLength() public view {
+        vm.parseBytes("0x123");
+    }
+
+    function check_parseBytes_symbolic(string memory s) public view {
+        vm.parseBytes(s);
+    }
+}
diff --git a/tests/regression/test/Foundry.t.sol b/tests/regression/test/Foundry.t.sol
index 80f9b0e28..d2ac0a3e4 100644
--- a/tests/regression/test/Foundry.t.sol
+++ b/tests/regression/test/Foundry.t.sol
@@ -185,7 +185,7 @@ contract TestNotEtchFriendly is Test {
     NotEtchFriendly target;
 
     function setUp() public {
-        /// @dev this is supported in foundry, but not halmos (can't vm.store to uninitialized account)
+        /// @dev this is supported in foundry, but not dolmos (can't vm.store to uninitialized account)
         // make address(this) the owner of the yet-to-be-deployed contract
         // vm.store(address(42), 0, bytes32(uint256(uint160(address(this)))));
 
diff --git a/tests/regression/test/Getter.t.sol b/tests/regression/test/Getter.t.sol
index 9eb9bdcfd..fec3c051e 100644
--- a/tests/regression/test/Getter.t.sol
+++ b/tests/regression/test/Getter.t.sol
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-// from https://github.com/a16z/halmos/issues/82
+// from upstream halmos issue #82
 
-/// @custom:halmos --storage-layout=generic
+/// @custom:dolmos --storage-layout=generic
 contract GetterTest {
     uint256[3] public v;
     uint w;
diff --git a/tests/regression/test/Invalid.t.sol b/tests/regression/test/Invalid.t.sol
index 2014ec6fb..7792ad5a3 100644
--- a/tests/regression/test/Invalid.t.sol
+++ b/tests/regression/test/Invalid.t.sol
@@ -5,12 +5,12 @@ contract OldCompilerTest {
 
     function check_assert(uint x) public pure {
         if (x == 0) return;
-        assert(false); // old compiler versions don't revert with panic; instead, they run invalid opcode, which halmos ignores, resulting in no error here.
+        assert(false); // old compiler versions don't revert with panic; instead, they run invalid opcode, which dolmos ignores, resulting in no error here.
     }
 
     function check_myAssert(uint x) public pure {
         if (x == 0) return;
-        myAssert(false); // you can use your own assertion that panic-reverts if assertion fails, when using halmos for old version code.
+        myAssert(false); // you can use your own assertion that panic-reverts if assertion fails, when using dolmos for old version code.
     }
 
     function myAssert(bool cond) internal pure {
diff --git a/tests/regression/test/InvariantProbes.t.sol b/tests/regression/test/InvariantProbes.t.sol
index ae99ecf16..4af08e0a8 100644
--- a/tests/regression/test/InvariantProbes.t.sol
+++ b/tests/regression/test/InvariantProbes.t.sol
@@ -43,7 +43,7 @@ contract InvariantProbesTest is Test {
     }
 
     // XFAIL: we should report failures when asserts are hit in the target contract
-    /// @custom:halmos --invariant-depth 4
+    /// @custom:dolmos --invariant-depth 4
     function invariant_probes_found() public {
         assertGe(c.num(), 0);
     }
diff --git a/tests/regression/test/InvariantTarget.t.sol b/tests/regression/test/InvariantTarget.t.sol
index bc369aada..408f75c15 100644
--- a/tests/regression/test/InvariantTarget.t.sol
+++ b/tests/regression/test/InvariantTarget.t.sol
@@ -86,7 +86,7 @@ contract InvariantTargetTest_target_contract_this is InvariantTargetTest {
         c = new C();
         d = new D();
 
-        // https://github.com/a16z/halmos/issues/506
+        // upstream halmos issue #506
         // C and D are not set as a targets, because targetContract(address(this)) is used
         targetContract(address(this));
     }
diff --git a/tests/regression/test/InvariantTargetThis.t.sol b/tests/regression/test/InvariantTargetThis.t.sol
index 90330345e..0cff5170a 100644
--- a/tests/regression/test/InvariantTargetThis.t.sol
+++ b/tests/regression/test/InvariantTargetThis.t.sol
@@ -38,13 +38,13 @@ contract InvariantTargetBase {
     }
 }
 
-// https://github.com/a16z/halmos/issues/514
+// upstream halmos issue #514
 // special functions like test_, check_, setUp(), invariant_, etc.
 // should not be considered as targets when selecting targetContract(address(this))
 
 // FIXME: this test generates 1 model with the solidity storage layout, but 2 models (at depth 2)
 //        with the generic storage layout, so we set depth to 1 for consistent results
-/// @custom:halmos --invariant-depth 1
+/// @custom:dolmos --invariant-depth 1
 contract InvariantTargetThis is InvariantTargetBase, Test {
     // not a test contract, but deployed by the test contract
     // so it should be included, and its target functions included even if they
diff --git a/tests/regression/test/KeccakRefinement.t.sol b/tests/regression/test/KeccakRefinement.t.sol
new file mode 100644
index 000000000..3983cd92c
--- /dev/null
+++ b/tests/regression/test/KeccakRefinement.t.sol
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+// a16z/halmos#562: keccak256 is uninterpreted, so the solver may assign to a symbolic
+// preimage a hash value that differs from the real one. Such counterexamples are checked
+// against the real keccak256 values, and reported as potentially invalid if they do not agree.
+//
+// The solidity storage layout is required: the generic layout decodes hashed storage keys
+// structurally, so a hash can never be equal to the plain key written in setUp, and the
+// counterexample path is pruned during exploration.
+/// @custom:dolmos --storage-layout solidity
+contract KeccakRefinementTest {
+    mapping(uint256 => uint256) balances;
+
+    // not a constant, to prevent the optimizer from folding the slot computation
+    uint256 key = 0xfaaaaaffafafafafaaaaa472134;
+
+    function setUp() public {
+        balances[key] = 50;
+    }
+
+    // the only counterexamples need a preimage of `key`, which is not known:
+    // the counterexample must not be reported as valid
+    function check_keccak_unknown_preimage(uint256 amt) public view {
+        bytes32 hash = keccak256(abi.encodePacked(amt));
+        uint256 balance = balances[uint256(hash)];
+        assert(balance != 50);
+    }
+
+    // a genuine counterexample involving keccak256 is still reported as valid: amt == 42
+    function check_keccak_known_preimage(uint256 amt) public pure {
+        bytes32 hash = keccak256(abi.encodePacked(amt));
+        assert(hash != keccak256(abi.encodePacked(uint256(42))));
+    }
+
+    // properties that hold are not affected
+    function check_keccak_injective(uint256 a, uint256 b) public pure {
+        if (a != b) {
+            assert(keccak256(abi.encodePacked(a)) != keccak256(abi.encodePacked(b)));
+        }
+    }
+}
diff --git a/tests/regression/test/MegaMem.t.sol b/tests/regression/test/MegaMem.t.sol
index 2657d5eee..917ab9edc 100644
--- a/tests/regression/test/MegaMem.t.sol
+++ b/tests/regression/test/MegaMem.t.sol
@@ -6,7 +6,7 @@ import {console2} from "forge-std/console2.sol";
 
 import {SymTest} from "halmos-cheatcodes/SymTest.sol";
 
-/// @dev This checks that halmos can handle large memory operations without raising
+/// @dev This checks that dolmos can handle large memory operations without raising
 /// internal errors like "cannot fit 'int' into an index-sized integer".
 /// Instead, we should catch the error and revert the current path, but letting other
 /// paths continue. This is why these tests do a symbolic coinflip, we case split:
diff --git a/tests/regression/test/Natspec.t.sol b/tests/regression/test/Natspec.t.sol
index 1e4000bdd..d94551ddd 100644
--- a/tests/regression/test/Natspec.t.sol
+++ b/tests/regression/test/Natspec.t.sol
@@ -16,7 +16,7 @@ contract NatspecTestNone {
     }
 }
 
-/// @custom:halmos --loop 3
+/// @custom:dolmos --loop 3
 contract NatspecTestContract {
     Loop l;
 
@@ -35,7 +35,7 @@ contract NatspecTestContract {
 contract NatspecTestSetup {
     Loop l;
 
-    /// @custom:halmos --loop 3
+    /// @custom:dolmos --loop 3
     function setUp() public {
         l = new Loop();
     }
@@ -55,11 +55,11 @@ contract NatspecTestFunction {
         l = new Loop();
     }
 
-    /// @custom:halmos --loop 3
+    /// @custom:dolmos --loop 3
     function check_Loop3(uint n) public view {
         assert(l.iter(n) <= 3); // pass
     }
-    /// @custom:halmos --loop 3
+    /// @custom:dolmos --loop 3
     function check_Loop3Fail(uint n) public view {
         assert(l.iter(n) <= 2); // fail
     }
@@ -72,7 +72,7 @@ contract NatspecTestFunction {
     }
 }
 
-/// @custom:halmos --loop 4
+/// @custom:dolmos --loop 4
 contract NatspecTestOverwrite {
     Loop l;
 
@@ -87,16 +87,38 @@ contract NatspecTestOverwrite {
         assert(l.iter(n) <= 3); // fail // inherited from contract
     }
 
-    /// @custom:halmos --loop 3
+    /// @custom:dolmos --loop 3
     function check_Loop3(uint n) public view {
         assert(l.iter(n) <= 3); // pass // overwrite
     }
-    /// @custom:halmos --loop 3
+    /// @custom:dolmos --loop 3
     function check_Loop3Fail(uint n) public view {
         assert(l.iter(n) <= 2); // fail // overwrite
     }
 }
 
+// the legacy tag used by test suites written for halmos is still honored
+/// @custom:halmos --loop 3
+contract NatspecTestLegacyTag {
+    Loop l;
+
+    function setUp() public {
+        l = new Loop();
+    }
+
+    function check_Loop3(uint n) public view {
+        assert(l.iter(n) <= 3); // pass // inherited from contract (legacy tag)
+    }
+    function check_Loop3Fail(uint n) public view {
+        assert(l.iter(n) <= 2); // fail // inherited from contract (legacy tag)
+    }
+
+    /// @custom:halmos --loop 4
+    function check_Loop4(uint n) public view {
+        assert(l.iter(n) <= 4); // pass // legacy tag on the function
+    }
+}
+
 contract Loop {
     function iter(uint n) public pure returns (uint) {
         uint cnt = 0;
diff --git a/tests/regression/test/OpCodesBlobBaseFee_BlobHash.t.sol b/tests/regression/test/OpCodesBlobBaseFee_BlobHash.t.sol
new file mode 100644
index 000000000..4fe2994f6
--- /dev/null
+++ b/tests/regression/test/OpCodesBlobBaseFee_BlobHash.t.sol
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.24 <0.9.0;
+
+import "forge-std/Test.sol";
+import {SymTest} from "halmos-cheatcodes/SymTest.sol";
+
+// =============================================================================
+// BLOBBASEFEE (0x4A) — EIP-4844 / Cancun
+// =============================================================================
+
+contract BlobBaseFeeTest is SymTest, Test {
+
+    /// In foundry env test, blobbasefee == 0
+    function check_blobbasefee_zero_in_test_env() public view {
+        uint256 fee;
+        assembly { fee := blobbasefee() }
+        assertEq(fee, 0);
+    }
+
+    /// block.blobbasefee  == opcode 0x4A
+    function check_blobbasefee_solidity_matches_opcode() public view {
+        uint256 via_opcode;
+        assembly { via_opcode := blobbasefee() }
+        assertEq(via_opcode, block.blobbasefee);
+    }
+
+    // -------------------------------------------------------------------------
+    // Formal properties
+    // -------------------------------------------------------------------------
+
+    function check_blobbasefee_no_revert() public view {
+        uint256 fee;
+        assembly { fee := blobbasefee() }
+        assert(fee == fee);
+    }
+
+    function check_blobbasefee_affordable(uint256 maxFee) public view {
+        uint256 fee;
+        assembly { fee := blobbasefee() }
+        if (fee <= maxFee) {
+            assert(fee <= maxFee);
+        }
+    }
+}
+
+// =============================================================================
+// BLOBHASH (0x49) — EIP-4844 / Cancun
+// =============================================================================
+
+contract BlobHashTest is SymTest, Test {
+
+    // -------------------------------------------------------------------------
+    // Cas concrets (pas de blob dans l'env de test → toujours 0)
+    // -------------------------------------------------------------------------
+
+    function check_blobhash_zero_no_blob_tx() public view {
+        bytes32 h0;
+        bytes32 h5;
+        assembly {
+            h0 := blobhash(0)
+            h5 := blobhash(5)
+        }
+        assertEq(h0, bytes32(0));
+        assertEq(h5, bytes32(0));
+    }
+
+    function check_blobhash_out_of_range() public view {
+        bytes32 h;
+        assembly { h := blobhash(6) }
+        assertEq(h, bytes32(0));
+    }
+
+    // -------------------------------------------------------------------------
+    // Formal properties
+    // -------------------------------------------------------------------------
+
+    function check_blobhash_version_byte(uint8 index) public view {
+        if (index > 5) return;
+        bytes32 h;
+        uint256 idx = uint256(index);
+        assembly { h := blobhash(idx) }
+        if (h != bytes32(0)) {
+            // Premier octet == 0x01 (KZG commitment version)
+            uint8 version = uint8(uint256(h) >> 248);
+            assert(version == 0x01);
+        }
+    }
+
+    /// blobhash never revert
+    function check_blobhash_no_revert(uint8 index) public view {
+        bytes32 h;
+        uint256 idx = uint256(index);
+        assembly { h := blobhash(idx) }
+        // reachable sans revert
+        assert(h == h);
+    }
+
+    /// Deterministic
+    function check_blobhash_deterministic(uint8 index) public view {
+        if (index > 5) return;
+        uint256 idx = uint256(index);
+        bytes32 h1;
+        bytes32 h2;
+        assembly {
+            h1 := blobhash(idx)
+            h2 := blobhash(idx)
+        }
+        assert(h1 == h2);
+    }
+
+    function check_blobhash_contiguous(uint8 index) public view {
+        if (index >= 5) return;
+        uint256 idx = uint256(index);
+        bytes32 hi;
+        bytes32 hi1;
+        assembly {
+            hi  := blobhash(idx)
+            hi1 := blobhash(add(idx, 1))
+        }
+        if (hi == bytes32(0)) {
+            assert(hi1 == bytes32(0));
+        }
+    }
+}
diff --git a/tests/regression/test/OpCodesCLZ.sol b/tests/regression/test/OpCodesCLZ.sol
new file mode 100644
index 000000000..24fe1fb24
--- /dev/null
+++ b/tests/regression/test/OpCodesCLZ.sol
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.24 <0.9.0;
+
+import "forge-std/Test.sol";
+import {SymTest} from "halmos-cheatcodes/SymTest.sol";
+
+// =============================================================================
+// CLZ (0x1E) — Count Leading Zeros (EIP-7939 / Fusaka)
+// =============================================================================
+
+
+contract ClzTest is SymTest, Test {
+
+    function check_clz_zero() public pure {
+        uint256 result;
+        assembly { result := clz(0) }
+        assert(result == 256);
+    }
+
+    function check_clz_one() public pure {
+        uint256 result;
+        assembly { result := clz(1) }
+        assert(result == 255);
+    }
+
+    function check_clz_two() public pure {
+        uint256 result;
+        assembly { result := clz(2) }
+        assert(result == 254);
+    }
+
+    function check_clz_msb() public pure {
+        // 2^255 
+        uint256 x = 1 << 255;
+        uint256 result;
+        assembly { result := clz(x) }
+        assert(result == 0);
+    }
+
+    function check_clz_max() public pure {
+        // type(uint256).max
+        uint256 x = type(uint256).max;
+        uint256 result;
+        assembly { result := clz(x) }
+        assert(result == 0);
+    }
+
+    function check_clz_byte() public pure {
+        // 0xFF = 8 bits → 256 - 8 = 248 zéros
+        uint256 result;
+        assembly { result := clz(0xFF) }
+        assert(result == 248);
+    }
+
+    // -------------------------------------------------------------------------
+    // Formal properties of the CLZ opcode
+    // -------------------------------------------------------------------------
+
+    /// clz(0) == 256
+    function check_clz_zero_symbolic() public pure {
+        uint256 x = 0;
+        uint256 result;
+        assembly { result := clz(x) }
+        assert(result == 256);
+    }
+
+    ///  x != 0 : clz(x) ∈ [0, 255]
+    function check_clz_range(uint256 x) public pure {
+        if (x == 0) return;
+        uint256 result;
+        assembly { result := clz(x) }
+        assert(result <= 255);
+    }
+
+    ///  x != 0 : 2^(255 - clz(x)) <= x 
+    function check_clz_lower_bound(uint256 x) public pure {
+        if (x == 0) return;
+        uint256 c;
+        assembly { c := clz(x) }
+        assert((uint256(1) << (255 - c)) <= x);
+    }
+
+    ///  x != 0 et clz(x) > 0 : x < 2^(256 - clz(x))
+    function check_clz_upper_bound(uint256 x) public pure {
+        if (x == 0) return;
+        uint256 c;
+        assembly { c := clz(x) }
+        if (c > 0) {
+            assert(x < (uint256(1) << (256 - c)));
+        }
+    }
+
+    /// clz(2^k) == 255 - k pour k ∈ [0, 255]
+    function check_clz_power_of_two(uint8 k) public pure {
+        if (k > 255) return;
+        uint256 p = uint256(1) << k;
+        uint256 result;
+        assembly { result := clz(p) }
+        assert(result == 255 - uint256(k));
+    }
+
+    /// Monotony : a <= b ⟹ clz(a) >= clz(b)
+    function check_clz_monotone(uint256 a, uint256 b) public pure {
+        if (a == 0 || b == 0) return;
+        if (a <= b) {
+            uint256 ca; uint256 cb;
+            assembly {
+                ca := clz(a)
+                cb := clz(b)
+            }
+            assert(ca >= cb);
+        }
+    }
+
+}
diff --git a/tests/regression/test/Panic.t.sol b/tests/regression/test/Panic.t.sol
index 0d67aa45c..0e6fc2828 100644
--- a/tests/regression/test/Panic.t.sol
+++ b/tests/regression/test/Panic.t.sol
@@ -43,7 +43,7 @@ contract PanicTest is Test {
         }
     }
 
-    /// @custom:halmos --panic-error-codes 0x00
+    /// @custom:dolmos --panic-error-codes 0x00
     function check_panic_0_fail(bool x) public {
         if (x) _panic(0);
     }
@@ -56,7 +56,7 @@ contract PanicTest is Test {
         if (x) _panic(1); // default error code is 1
     }
 
-    /// @custom:halmos --panic-error-codes 0x00
+    /// @custom:dolmos --panic-error-codes 0x00
     function check_panic_1_pass(bool x) public {
         if (x) _panic(1);
     }
@@ -65,17 +65,17 @@ contract PanicTest is Test {
     // multiple error codes
     //
 
-    /// @custom:halmos --panic-error-codes 0x02,0x03
+    /// @custom:dolmos --panic-error-codes 0x02,0x03
     function check_panic_2_or_3_fail_2(bool x) public {
         if (x) _panic(2);
     }
 
-    /// @custom:halmos --panic-error-codes 0x02,0x03
+    /// @custom:dolmos --panic-error-codes 0x02,0x03
     function check_panic_2_or_3_fail_3(bool x) public {
         if (x) _panic(3);
     }
 
-    /// @custom:halmos --panic-error-codes *
+    /// @custom:dolmos --panic-error-codes *
     function check_panic_any_fail_4(bool x) public {
         if (x) _panic(4);
     }
@@ -84,7 +84,7 @@ contract PanicTest is Test {
     // old compiler revert
     //
 
-    /// @custom:halmos --panic-error-codes 0x05
+    /// @custom:dolmos --panic-error-codes 0x05
     function check_panic_5_fail_old(bool x) public {
         if (x) _panic_old_compiler(5);
     }
@@ -94,25 +94,25 @@ contract PanicTest is Test {
     //
 
     // binary
-    /// @custom:halmos --panic-error-codes 0b111
+    /// @custom:dolmos --panic-error-codes 0b111
     function check_panic_7_fail(bool x) public {
         if (x) _panic(7);
     }
 
     // octal
-    /// @custom:halmos --panic-error-codes 0o10
+    /// @custom:dolmos --panic-error-codes 0o10
     function check_panic_8_fail(bool x) public {
         if (x) _panic(8);
     }
 
     // decimal
-    /// @custom:halmos --panic-error-codes 10
+    /// @custom:dolmos --panic-error-codes 10
     function check_panic_10_fail(bool x) public {
         if (x) _panic(10);
     }
 
     // hex
-    /// @custom:halmos --panic-error-codes 0x10
+    /// @custom:dolmos --panic-error-codes 0x10
     function check_panic_16_fail(bool x) public {
         if (x) _panic(16);
     }
@@ -121,7 +121,7 @@ contract PanicTest is Test {
     // panic error code semantics
     //
 
-    /// @custom:halmos --panic-error-codes 0x11
+    /// @custom:dolmos --panic-error-codes 0x11
     function check_panic_0x11_fail(uint x) public returns (uint) {
         // 0x11: overflow
         return x + 1; // counterexample: x == 2^256 - 1
@@ -131,7 +131,7 @@ contract PanicTest is Test {
         return x + 1;
     }
 
-    /// @custom:halmos --panic-error-codes 0x12
+    /// @custom:dolmos --panic-error-codes 0x12
     function check_panic_0x12_fail(uint x) public returns (uint) {
         // 0x12: div-by-zero
         return 10 / x; // counterexample: x == 0
@@ -145,7 +145,7 @@ contract PanicTest is Test {
     // panic propagation
     //
 
-    /// @custom:halmos --panic-error-codes 0x11
+    /// @custom:dolmos --panic-error-codes 0x11
     function check_panic_inc_fail(uint x) public returns (uint) {
         // 0x11: overflow
         return c.inc(x); // counterexample: x == 2^256 - 1
@@ -155,7 +155,7 @@ contract PanicTest is Test {
     // capturing different types of reverts
     //
 
-    /// @custom:halmos --panic-error-codes 0x11
+    /// @custom:dolmos --panic-error-codes 0x11
     function check_panic_inc_overflow_fail(uint x) public returns (uint) {
         // fail due to overflow, Panic(0x11)
         // but no assertion violation
@@ -175,7 +175,7 @@ contract PanicTest is Test {
         }
     }
 
-    /// @custom:halmos --panic-error-codes 0x11
+    /// @custom:dolmos --panic-error-codes 0x11
     function check_panic_inc_assert_pass(uint x) public returns (uint) {
         // pass because the assertion violation error code is ignored, and there's no overflow
         unchecked {
@@ -183,7 +183,7 @@ contract PanicTest is Test {
         }
     }
 
-    /// @custom:halmos --panic-error-codes 0xff
+    /// @custom:dolmos --panic-error-codes 0xff
     function check_panic_inc_cheatcode_fail(uint x) public returns (uint) {
         // fail even if Panic(1) is ignored,
         // because assertion cheatcode failures are handled separately and are always captured
diff --git a/tests/regression/test/Precompiles.t.sol b/tests/regression/test/Precompiles.t.sol
new file mode 100644
index 000000000..86cab2dd3
--- /dev/null
+++ b/tests/regression/test/Precompiles.t.sol
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+
+/// @dev regression tests for halmos issue #402: symbolic inputs to the SHA256,
+/// RIPEMD160 and MODEXP precompiles used to crash with a z3 sort mismatch
+contract PrecompilesTest is Test {
+    function modexp(uint256 b, uint256 e, uint256 m) internal view returns (bool ok, uint256 r) {
+        bytes memory input = abi.encodePacked(uint256(32), uint256(32), uint256(32), b, e, m);
+        bytes memory out;
+        (ok, out) = address(5).staticcall(input);
+        if (ok && out.length == 32) r = abi.decode(out, (uint256));
+    }
+
+    //
+    // sha256
+    //
+
+    function check_sha256_concrete() public pure {
+        assertEq(sha256(""), 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855);
+        assertEq(sha256("abc"), 0xba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad);
+    }
+
+    function check_sha256_symbolic(uint256 x, uint256 y) public pure {
+        vm.assume(x == y);
+        assertEq(sha256(abi.encode(x)), sha256(abi.encode(y)));
+    }
+
+    function check_sha256_symbolic_fail(uint256 x, uint256 y) public pure {
+        // uninterpreted: dolmos can't rule out a collision
+        assertTrue(sha256(abi.encode(x)) != sha256(abi.encode(y)));
+    }
+
+    //
+    // ripemd160
+    //
+
+    function check_ripemd160_concrete() public pure {
+        assertEq(ripemd160(""), bytes20(hex"9c1185a5c5e9fc54612808977ee8f548b2258d31"));
+        assertEq(ripemd160("abc"), bytes20(hex"8eb208f7e05d987a9b044a8e98c6b087f15a0bfc"));
+    }
+
+    function check_ripemd160_symbolic(uint256 x, uint256 y) public pure {
+        vm.assume(x == y);
+        assertEq(ripemd160(abi.encode(x)), ripemd160(abi.encode(y)));
+    }
+
+    //
+    // modexp
+    //
+
+    function check_modexp_concrete() public view {
+        (bool ok, uint256 r) = modexp(3, 5, 7);
+        assertTrue(ok);
+        assertEq(r, 5); // 243 % 7
+    }
+
+    function check_modexp_mod_zero(uint256 b, uint256 e) public view {
+        (bool ok, uint256 r) = modexp(b, e, 0);
+        assertTrue(ok);
+        assertEq(r, 0);
+    }
+
+    function check_modexp_exp_zero(uint256 b, uint256 m) public view {
+        vm.assume(m > 1);
+        (bool ok, uint256 r) = modexp(b, 0, m);
+        assertTrue(ok);
+        assertEq(r, 1);
+    }
+
+    function check_modexp_symbolic(uint256 b, uint256 e, uint256 m) public view {
+        vm.assume(m != 0);
+        (bool ok, uint256 r) = modexp(b, e, m);
+        assertTrue(ok);
+        assertLt(r, m);
+    }
+
+    function check_modexp_symbolic_fail(uint256 b, uint256 e, uint256 m) public view {
+        vm.assume(m > 2);
+        (, uint256 r) = modexp(b, e, m);
+        assertEq(r, 1); // counterexample expected
+    }
+
+    function check_modexp_short_input() public view {
+        // missing bytes are zeros: base = 2, exponent = 3, modulus = 0x05 << 8
+        (bool ok, bytes memory out) = address(5).staticcall(
+            abi.encodePacked(uint256(1), uint256(1), uint256(2), uint8(2), uint8(3), uint8(5))
+        );
+        assertTrue(ok);
+        assertEq(out.length, 2);
+        assertEq(uint16(bytes2(out)), 8);
+    }
+
+    function check_modexp_empty_modulus(uint256 b, uint256 e) public view {
+        (bool ok, bytes memory out) =
+            address(5).staticcall(abi.encodePacked(uint256(32), uint256(32), uint256(0), b, e));
+        assertTrue(ok);
+        assertEq(out.length, 0);
+    }
+
+    function check_modexp_oversized_input() public view {
+        // EIP-7823: length fields above 1024 bytes make the precompile fail
+        (bool ok,) = address(5).staticcall(abi.encodePacked(uint256(1025), uint256(1), uint256(1)));
+        assertFalse(ok);
+    }
+}
diff --git a/tests/regression/test/PrecomputedSlots.t.sol b/tests/regression/test/PrecomputedSlots.t.sol
new file mode 100644
index 000000000..372c0f30c
--- /dev/null
+++ b/tests/regression/test/PrecomputedSlots.t.sol
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+// a16z/halmos#579: the optimizer (notably via-IR) may constant-fold the keccak of a
+// storage slot into a PUSH32 literal, e.g. in a constructor, while the runtime code
+// computes the same slot with SHA3. Both accesses must hit the same storage cell.
+// The literal slots below are written with inline assembly to emulate that folding.
+contract PrecomputedSlots {
+    struct S {
+        uint256 a;
+        uint256 b;
+    }
+
+    mapping(uint256 => uint256) public m; // slot 0
+    mapping(uint256 => S) public ms; // slot 1
+    mapping(uint256 => mapping(uint256 => uint256)) public mm; // slot 2
+
+    constructor() {
+        assembly {
+            // m[76] = 890: keccak256(abi.encode(76, 0))
+            sstore(0xfec8fc345c07e1cb780845776a87475444a9ad5d006d1c0ba391a7299932fc3d, 890)
+            // ms[76].b = 7: keccak256(abi.encode(76, 1)) + 1
+            sstore(0x1ed6ba569b422e6ce8625b852f3078402250527a73572e6a816cf9263aceeba2, 7)
+            // mm[76][5] = 42: keccak256(abi.encode(5, keccak256(abi.encode(76, 2))))
+            sstore(0x9da36e986660358a9db129a989c5480cefb4582a99ba5113d8d083b4a63c69d7, 42)
+        }
+    }
+
+    function incr() external {
+        m[76] += 1;
+    }
+}
+
+contract PrecomputedSlotsTest {
+    PrecomputedSlots c;
+
+    function setUp() public {
+        c = new PrecomputedSlots();
+    }
+
+    function check_mapping_literal_slot() public view {
+        assert(c.m(76) == 890);
+    }
+
+    function check_struct_field_literal_slot() public view {
+        (uint256 a, uint256 b) = c.ms(76);
+        assert(a == 0);
+        assert(b == 7);
+    }
+
+    function check_nested_mapping_literal_slot() public view {
+        assert(c.mm(76, 5) == 42);
+    }
+
+    function check_write_after_literal_slot() public {
+        c.incr();
+        c.incr();
+        assert(c.m(76) == 892);
+    }
+}
diff --git a/tests/regression/test/PrettyCex.t.sol b/tests/regression/test/PrettyCex.t.sol
new file mode 100644
index 000000000..dea4dcf5f
--- /dev/null
+++ b/tests/regression/test/PrettyCex.t.sol
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+import {SymTest} from "halmos-cheatcodes/SymTest.sol";
+
+contract PcexToken {
+    mapping(address => uint256) public balanceOf;
+
+    constructor() {
+        balanceOf[msg.sender] = 1000;
+    }
+
+    function transfer(address to, uint256 amount) external returns (bool) {
+        balanceOf[msg.sender] -= amount;
+        balanceOf[to] += amount;
+        return true;
+    }
+
+    receive() external payable {}
+}
+
+/// counterexamples of the issues addressed by --pretty-counterexamples, see tests/test_pcex.py
+/// @custom:dolmos --solver-timeout-assertion 0 --invariant-depth 1
+contract PrettyCexTest is Test, SymTest {
+    PcexToken token;
+
+    function setUp() public {
+        token = new PcexToken();
+    }
+
+    // halmos#398: the same counterexample for 3 paths
+    function check_pcex_duplicates(uint256 x) external pure {
+        uint256 mul = x * 42;
+        assertNotEq(mul, 0);
+        assertNotEq(mul, 0);
+        assertNotEq(mul, 0);
+    }
+
+    // halmos#280: x ** 3 is approximated, the only real counterexample is x == 3
+    function check_pcex_exp(uint256 x) external pure {
+        assert(x ** 3 != 27);
+    }
+
+    // halmos#369: arbitrary calldata
+    function check_pcex_calldata(bytes calldata data) external {
+        (bool ok,) = address(token).call(data);
+        assert(!ok || token.balanceOf(address(this)) == 1000);
+    }
+
+    // halmos#419: the empty selector of plain ether transfers
+    function check_pcex_selector(bytes calldata data) external {
+        bytes4 selector = svm.createBytes4("selector");
+        vm.assume(bytes4(data) == selector);
+        (bool ok,) = address(token).call(data);
+        assert(!(ok && data.length == 0));
+    }
+
+    // call sequence with concrete values
+    function invariant_pcex_balance() public view {
+        assertGe(token.balanceOf(address(this)), 1000);
+    }
+}
diff --git a/tests/regression/test/Revert.t.sol b/tests/regression/test/Revert.t.sol
index cc9b5d10c..babf2789e 100644
--- a/tests/regression/test/Revert.t.sol
+++ b/tests/regression/test/Revert.t.sol
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-// from https://github.com/a16z/halmos/issues/109
+// from upstream halmos issue #109
 
 import "forge-std/Test.sol";
 
@@ -86,7 +86,7 @@ contract CTest is Test {
         (bool success, ) = address(c).call{value: amount}(abi.encodeWithSignature("deposit(bool)", false));
 
         // we are looking for a counterexample here
-        // i.e., halmos should find the case amount > balance
+        // i.e., dolmos should find the case amount > balance
         assert(success);
     }
 
@@ -97,7 +97,7 @@ contract CTest is Test {
         (bool success, ) = address(42).call{value: amount}("");
 
         // we are looking for a counterexample here
-        // i.e., halmos should find the case amount > balance
+        // i.e., dolmos should find the case amount > balance
         assert(success);
     }
 
diff --git a/tests/regression/test/SelfDestruct.t.sol b/tests/regression/test/SelfDestruct.t.sol
new file mode 100644
index 000000000..7636b9b3a
--- /dev/null
+++ b/tests/regression/test/SelfDestruct.t.sol
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+
+// SELFDESTRUCT with the EIP-6780 semantics (a16z/halmos#411)
+
+contract Destructible {
+    uint256 public x = 1;
+
+    constructor() payable {}
+
+    function destroy(address payable beneficiary) external {
+        selfdestruct(beneficiary);
+    }
+
+    function destroyThenRevert(address payable beneficiary) external {
+        this.destroy(beneficiary);
+        revert("undo");
+    }
+
+    receive() external payable {}
+}
+
+contract DestroyInConstructor {
+    constructor(address payable beneficiary) payable {
+        selfdestruct(beneficiary);
+    }
+}
+
+contract SelfDestructTest is Test {
+    Destructible preexisting; // created in setUp, i.e. in a previous transaction
+    address payable constant BENEFICIARY = payable(address(0xbeef));
+
+    function setUp() public {
+        preexisting = new Destructible{value: 1 ether}();
+    }
+
+    // not created in the current transaction: only the balance is transferred
+    function check_preexisting_keeps_code_and_storage() public {
+        uint256 before = BENEFICIARY.balance;
+        preexisting.destroy(BENEFICIARY);
+
+        assertEq(address(preexisting).balance, 0);
+        assertEq(BENEFICIARY.balance, before + 1 ether);
+        assertGt(address(preexisting).code.length, 0);
+        assertEq(preexisting.x(), 1);
+    }
+
+    // the frame halts: code after selfdestruct is not executed, and the call succeeds
+    function check_halts_successfully() public {
+        (bool success, bytes memory ret) =
+            address(preexisting).call(abi.encodeCall(Destructible.destroy, (BENEFICIARY)));
+        assertTrue(success);
+        assertEq(ret.length, 0);
+    }
+
+    // sending the balance to itself is a no-op for a preexisting account
+    function check_preexisting_self_beneficiary() public {
+        preexisting.destroy(payable(address(preexisting)));
+        assertEq(address(preexisting).balance, 1 ether);
+    }
+
+    // created in the current transaction: the account is deleted at the end of the transaction,
+    // so it is still alive until then
+    function check_created_in_tx_alive_until_end_of_tx() public {
+        Destructible d = new Destructible{value: 2 ether}();
+        d.destroy(BENEFICIARY);
+
+        assertEq(address(d).balance, 0);
+        assertEq(BENEFICIARY.balance, 2 ether);
+        assertGt(address(d).code.length, 0);
+        assertEq(d.x(), 1);
+    }
+
+    // selfdestruct in the constructor: the value is forwarded, and the address still has code
+    // until the end of the transaction
+    function check_destroy_in_constructor() public {
+        address a = address(new DestroyInConstructor{value: 3 ether}(BENEFICIARY));
+        assertEq(a.balance, 0);
+        assertEq(BENEFICIARY.balance, 3 ether);
+    }
+
+    // a reverted selfdestruct has no effect
+    function check_reverted_selfdestruct() public {
+        try preexisting.destroyThenRevert(BENEFICIARY) {
+            assert(false);
+        } catch {}
+        assertEq(address(preexisting).balance, 1 ether);
+        assertEq(BENEFICIARY.balance, 0);
+    }
+
+    // symbolic beneficiary
+    function check_symbolic_beneficiary(address payable to) public {
+        vm.assume(to != address(preexisting));
+        uint256 before = to.balance;
+        vm.assume(before <= 100 ether);
+        preexisting.destroy(to);
+        assertEq(to.balance, before + 1 ether);
+    }
+
+    // expected failure: sanity check that assertions on the transfer are meaningful
+    function check_balance_moved_fail() public {
+        preexisting.destroy(BENEFICIARY);
+        assertEq(address(preexisting).balance, 1 ether);
+    }
+}
+
+// accounts created and self-destructed in the same transaction (here, setUp) are deleted
+// at the end of that transaction (EIP-6780)
+contract SelfDestructDeletedTest is Test {
+    Destructible d;
+    Destructible kept;
+    address payable constant BENEFICIARY = payable(address(0xbeef));
+
+    function setUp() public {
+        d = new Destructible{value: 1 ether}();
+        d.destroy(BENEFICIARY);
+        kept = new Destructible();
+    }
+
+    function check_deleted_after_tx() public view {
+        assertEq(address(d).code.length, 0);
+        assertEq(address(d).balance, 0);
+        assertEq(BENEFICIARY.balance, 1 ether);
+        assertGt(address(kept).code.length, 0);
+    }
+
+    function check_call_to_deleted_account() public {
+        (bool success, bytes memory ret) = address(d).call(abi.encodeWithSignature("x()"));
+        assertTrue(success); // call to an account without code succeeds
+        assertEq(ret.length, 0);
+    }
+}
+
+// before Cancun, SELFDESTRUCT deletes the account at the end of the transaction,
+// even if it was not created in that transaction (a16z/halmos#128)
+/// @custom:dolmos --evm-version shanghai
+contract SelfDestructShanghaiTest {
+    Destructible preexisting;
+    address payable constant BENEFICIARY = payable(address(0xbeef));
+
+    function setUp() public {
+        preexisting = new Destructible{value: 1 ether}();
+    }
+
+    // still alive until the end of the transaction
+    function check_preexisting_alive_until_end_of_tx() public {
+        preexisting.destroy(BENEFICIARY);
+        assert(address(preexisting).balance == 0);
+        assert(BENEFICIARY.balance == 1 ether);
+        assert(address(preexisting).code.length > 0);
+    }
+}
+
+/// @custom:dolmos --evm-version shanghai
+contract SelfDestructShanghaiDeletedTest {
+    Destructible preexisting;
+
+    // the account is created in the constructor (first transaction), and destroyed in setUp
+    constructor() {
+        preexisting = new Destructible();
+    }
+
+    function setUp() public {
+        preexisting.destroy(payable(address(0xbeef)));
+    }
+
+    function check_preexisting_deleted_after_tx() public view {
+        assert(address(preexisting).code.length == 0);
+    }
+}
diff --git a/tests/regression/test/Send.t.sol b/tests/regression/test/Send.t.sol
index 5b6eef72b..7c5f64e81 100644
--- a/tests/regression/test/Send.t.sol
+++ b/tests/regression/test/Send.t.sol
@@ -8,7 +8,7 @@ contract C {
     constructor() payable { }
 }
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract SendTest is Test, SymTest {
     address sender;
     address payable receiver;
@@ -96,7 +96,7 @@ contract SendTest is Test, SymTest {
     }
 
     function check_create(uint amount, bytes32 salt, uint mode) public {
-        // note: deployer is set to concrete, to prevent halmos from treating the contract creation target as aliasing with the deployer
+        // note: deployer is set to concrete, to prevent dolmos from treating the contract creation target as aliasing with the deployer
         address deployer = address(0xbeef);
         vm.deal(deployer, svm.createUint(96, "deployer.balance"));
 
diff --git a/tests/regression/test/SetupMulti.t.sol b/tests/regression/test/SetupMulti.t.sol
new file mode 100644
index 000000000..cde269b9f
--- /dev/null
+++ b/tests/regression/test/SetupMulti.t.sol
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import "forge-std/Test.sol";
+import {SymTest} from "halmos-cheatcodes/SymTest.sol";
+
+contract Vault {
+    uint256 public fee;
+    bool public paused;
+
+    constructor(uint256 _fee, bool _paused) {
+        fee = _fee;
+        paused = _paused;
+    }
+
+    function setFee(uint256 _fee) external {
+        require(!paused, "paused");
+        require(_fee <= 1000, "fee too high");
+        fee = _fee;
+    }
+}
+
+/// @dev regression tests for halmos issue #186: setUp() with several paths
+/// used to fail with "Multiple paths were found in setUp()"
+contract SetupMultiTest is Test, SymTest {
+    Vault vault;
+    uint256 mode;
+
+    function setUp() public {
+        // symbolic branching in setUp: three setup states
+        mode = svm.createUint256("mode");
+        if (mode == 0) {
+            vault = new Vault(10, false);
+        } else if (mode == 1) {
+            vault = new Vault(500, false);
+        } else {
+            vault = new Vault(1000, true);
+        }
+        targetContract(address(vault));
+    }
+
+    function check_fee_bounded() public view {
+        // holds in every setup state
+        assertLe(vault.fee(), 1000);
+    }
+
+    function check_fee_small_fail() public view {
+        // only holds in the first setup state: counterexample with mode != 0
+        assertLe(vault.fee(), 10);
+    }
+
+    function check_not_paused_fail() public view {
+        // violated in the third setup state only
+        assertFalse(vault.paused());
+    }
+
+    function check_setFee(uint256 newFee) public {
+        vault.setFee(newFee);
+        // setFee only succeeds when not paused, and keeps the fee bounded
+        assertFalse(vault.paused());
+        assertLe(vault.fee(), 1000);
+    }
+
+    function invariant_fee_bounded() public view {
+        // explored from each setup state, including through setFee() calls
+        assertLe(vault.fee(), 1000);
+    }
+
+    function invariant_fee_unchanged_fail() public view {
+        // setFee() can change the fee in the unpaused setup states
+        assertTrue(vault.fee() == 10 || vault.fee() == 500 || vault.fee() == 1000);
+    }
+
+    function check_mode_consistent() public view {
+        // the test runs against the matching state for each setUp path
+        if (mode == 0) assertEq(vault.fee(), 10);
+        else if (mode == 1) assertEq(vault.fee(), 500);
+        else assertEq(vault.fee(), 1000);
+    }
+}
+
+/// @dev setUpSymbolic with several successful paths
+contract SetupSymbolicMultiTest {
+    uint256 public value;
+
+    function setUpSymbolic(uint256 x) public {
+        if (x > 10) value = 1;
+        else value = 2;
+    }
+
+    function check_value() public view {
+        assert(value == 1 || value == 2);
+    }
+
+    function check_value_fail() public view {
+        assert(value == 1);
+    }
+}
diff --git a/tests/regression/test/SetupPlus.t.sol b/tests/regression/test/SetupPlus.t.sol
index e527029fd..f78a535fa 100644
--- a/tests/regression/test/SetupPlus.t.sol
+++ b/tests/regression/test/SetupPlus.t.sol
@@ -18,7 +18,7 @@ contract SetupPlusTest {
         a = new A(11, 200);
     }
 
-    // if setUpSymbolic() is provided, Halmos uses setUpSymbolic() instead of setUp().
+    // if setUpSymbolic() is provided, Dolmos uses setUpSymbolic() instead of setUp().
     // setUpSymbolic() is symbolically executed.
 
     // if multiple setUpSymbolic() functions are provided, the last one in the lexicographical order will be used.
diff --git a/tests/regression/test/Sha3.t.sol b/tests/regression/test/Sha3.t.sol
index 054c58396..649ec698b 100644
--- a/tests/regression/test/Sha3.t.sol
+++ b/tests/regression/test/Sha3.t.sol
@@ -90,7 +90,7 @@ contract Sha3Test is Test, SymTest {
     }
 
     // we assume that the lower 160-bit parts do not collide
-    // see: https://github.com/a16z/halmos/issues/347
+    // see: upstream halmos issue #347
     function check_address_collision_pass(uint256 x, uint256 y) public {
         vm.assume(x != y);
         assertNotEq(to_address(x), to_address(y)); // pass
diff --git a/tests/regression/test/Signature.t.sol b/tests/regression/test/Signature.t.sol
index 67f8fd088..da1144311 100644
--- a/tests/regression/test/Signature.t.sol
+++ b/tests/regression/test/Signature.t.sol
@@ -398,7 +398,7 @@ contract SignatureTest is SymTest, Test {
     }
 
     // TODO: remove the following option after fixing issue in case of empty keyName
-    /// @custom:halmos --array-lengths keyName={65,1024}
+    /// @custom:dolmos --array-lengths keyName={65,1024}
     function check_makeAddrAndKey_vmsign_ecrecover_e2e_symbolic(
         string memory keyName,
         bytes32 digest
diff --git a/tests/regression/test/SmolWETH.t.sol b/tests/regression/test/SmolWETH.t.sol
index c89285757..4b60b750b 100644
--- a/tests/regression/test/SmolWETH.t.sol
+++ b/tests/regression/test/SmolWETH.t.sol
@@ -39,7 +39,7 @@ contract SmolWETH {
     }
 }
 
-/// @custom:halmos --storage-layout=generic
+/// @custom:dolmos --storage-layout=generic
 contract SmolWETHTest is Test, SymTest {
     SmolWETH weth;
 
diff --git a/tests/regression/test/Snapshot.t.sol b/tests/regression/test/Snapshot.t.sol
index a203f2446..3beb9e6cb 100644
--- a/tests/regression/test/Snapshot.t.sol
+++ b/tests/regression/test/Snapshot.t.sol
@@ -14,7 +14,7 @@ contract C {
     }
 }
 
-/// @custom:halmos --storage-layout solidity
+/// @custom:dolmos --storage-layout solidity
 contract SnapshotTest is SymTest, Test {
     C c;
 
@@ -22,7 +22,7 @@ contract SnapshotTest is SymTest, Test {
         c = new C();
     }
 
-    // NOTE: In halmos, the state snapshot ID is constructed by concatenating three hashes of: balance (64 bits), code (64 bits), and storage (128 bits).
+    // NOTE: In dolmos, the state snapshot ID is constructed by concatenating three hashes of: balance (64 bits), code (64 bits), and storage (128 bits).
 
     function check_snapshot() public {
         uint storage0 = svm.snapshotStorage(address(c));
diff --git a/tests/regression/test/Solver.t.sol b/tests/regression/test/Solver.t.sol
index 496665b39..dcf7edaa0 100644
--- a/tests/regression/test/Solver.t.sol
+++ b/tests/regression/test/Solver.t.sol
@@ -11,9 +11,9 @@ contract SolverTest is SymTest, Test {
         numbers = new uint[](5); // shouldn't generate loop bounds warning
     }
 
-    /// @custom:halmos --solver-timeout-assertion 1
+    /// @custom:dolmos --solver-timeout-assertion 1
     function check_too_many_open_files() public {
-        // regression test for too many open files error: https://github.com/a16z/halmos/issues/523
+        // regression test for too many open files error: upstream halmos issue #523
         // this test simulates a situation where many solver processes are killed due to timeout.
         // if file descriptors are not properly closed, this test will fail with "Too many open files" error.
         if (svm.createBool("*")) { some_hard_query(); } else { some_hard_query(); }
diff --git a/tests/regression/test/StaticContexts.t.sol b/tests/regression/test/StaticContexts.t.sol
index d63f3da14..11fdab584 100644
--- a/tests/regression/test/StaticContexts.t.sol
+++ b/tests/regression/test/StaticContexts.t.sol
@@ -64,9 +64,8 @@ contract StaticContextsTest is Test {
     //     assertFalse(success);
     // }
 
-    // TODO: selfdestruct not implemented yet
-    // function check_selfdestruct_fails() public {
-    //     (bool success, ) = address(this).staticcall(abi.encodeWithSignature("do_selfdestruct()"));
-    //     assertFalse(success);
-    // }
+    function check_selfdestruct_fails() public {
+        (bool success, ) = address(this).staticcall(abi.encodeWithSignature("do_selfdestruct()"));
+        assertFalse(success);
+    }
 }
diff --git a/tests/regression/test/StdAssertTest.t.sol b/tests/regression/test/StdAssertTest.t.sol
index db0b9746e..6d148e479 100644
--- a/tests/regression/test/StdAssertTest.t.sol
+++ b/tests/regression/test/StdAssertTest.t.sol
@@ -43,14 +43,14 @@ contract StdAssertPassTest is Test {
     }
 
     // times out after 1min with yices and --cache-solver
-    /// @custom:halmos --solver z3
+    /// @custom:dolmos --solver z3
     function check_assertEq(string memory x, string memory y) public {
         vm.assume(keccak256(bytes(x)) == keccak256(bytes(y)));
         assertEq(x, y);
     }
 
     // times out after 1min with yices and --cache-solver
-    /// @custom:halmos --solver z3
+    /// @custom:dolmos --solver z3
     function check_assertEq(bytes memory x, bytes memory y) public {
         vm.assume(keccak256(x) == keccak256(y));
         assertEq(x, y);
@@ -517,14 +517,14 @@ contract StdAssertFailLogTest is Test {
     }
 
     // times out after 1min with yices and --cache-solver
-    /// @custom:halmos --solver z3
+    /// @custom:dolmos --solver z3
     function check_assertNotEq(string memory x, string memory y) public {
         vm.assume(!(keccak256(bytes(x)) != keccak256(bytes(y))));
         assertNotEq(x, y, "");
     }
 
     // times out after 1min with yices and --cache-solver
-    /// @custom:halmos --solver z3
+    /// @custom:dolmos --solver z3
     function check_assertNotEq(bytes memory x, bytes memory y) public {
         vm.assume(!(keccak256(x) != keccak256(y)));
         assertNotEq(x, y, "");
diff --git a/tests/regression/test/Storage5.t.sol b/tests/regression/test/Storage5.t.sol
index f1518a754..1cd826b11 100644
--- a/tests/regression/test/Storage5.t.sol
+++ b/tests/regression/test/Storage5.t.sol
@@ -44,7 +44,7 @@ contract Storage5Test {
         // the form of an addition, `keccak(x) + (index % y)`, is automatically
         // simplified to a concatenation form when the keccak value ends with
         // zero bits and y is a power of two. This simplified form is not
-        // currently supported by the decoding logic of halmos.
+        // currently supported by the decoding logic of dolmos.
 
         assert(arr0[index % 1] == 0); // sload(keccak(0) + (index % 1))
         assert(arr0[index % 2] == 0); // sload(keccak(0) + (index % 2))
diff --git a/tests/regression/test/StorageSlot.t.sol b/tests/regression/test/StorageSlot.t.sol
index a111debc2..7335bf2fd 100644
--- a/tests/regression/test/StorageSlot.t.sol
+++ b/tests/regression/test/StorageSlot.t.sol
@@ -29,8 +29,7 @@ contract StorageSlotTest {
         assert(map[one] == value); // sload with keccak expression
     }
 
-    // this test passes because halmos internally precomputes the slots for m[0] and m[1], for any m where slot(m) < 256.
-    // in general, however, directly initializing storage with a precomputed hash is not supported by halmos. see the test below.
+    // this test passes because dolmos internally precomputes the slots for m[0] and m[1], for any m where slot(m) < 256.
     function check_keccak_slot_2_pass(uint value) public {
         sstore(slot_map_one, value); // sstore with precomputed hash
 
@@ -38,8 +37,9 @@ contract StorageSlotTest {
         assert(map[one] == value); // sload with keccak expression
     }
 
-    // this test failed due to m[2] beyond the scope of halmos internal precomputation. see the above test for comparison.
-    function check_keccak_slot_2_fail(uint value) public {
+    // m[2] is beyond the scope of dolmos internal precomputation: the value written under the raw slot is
+    // moved to the decoded location once the keccak expression is evaluated (a16z/halmos#579).
+    function check_keccak_slot_2_beyond_precomputed_pass(uint value) public {
         sstore(slot_map_two, value); // sstore with precomputed hash
 
         assert(sload(slot_map_two) == value); // sload with precomputed hash
diff --git a/tests/regression/test/Store.t.sol b/tests/regression/test/Store.t.sol
index 67c5602bb..300e266af 100644
--- a/tests/regression/test/Store.t.sol
+++ b/tests/regression/test/Store.t.sol
@@ -50,7 +50,7 @@ contract StoreTest is Test {
 
     function check_store_nonexistent_account() public {
         // vm.store() is not allowed for a nonexistent account
-        vm.store(address(0xdeadbeef), bytes32(0), bytes32(0)); // HalmosException
+        vm.store(address(0xdeadbeef), bytes32(0), bytes32(0)); // DolmosException
     }
 
     function check_load_nonexistent_account(uint slot) public {
diff --git a/tests/regression/test/Struct.t.sol b/tests/regression/test/Struct.t.sol
index fbb0ed711..7b465e3e8 100644
--- a/tests/regression/test/Struct.t.sol
+++ b/tests/regression/test/Struct.t.sol
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract StructTest {
     struct Point {
         uint x;
@@ -15,7 +15,7 @@ contract StructTest {
         assert(result == 0); // expected to fail and generate a counterexample that incorporates all calldata symbols
     }
 
-    /// @custom:halmos --array-lengths p=1
+    /// @custom:dolmos --array-lengths p=1
     function check_StructArray(Point[] memory p, Point[2] memory q) public pure returns (uint result) {
         for (uint i = 0; i < p.length; i++) {
             unchecked {
@@ -30,7 +30,7 @@ contract StructTest {
         assert(result == 0); // expected to fail and generate a counterexample that incorporates all calldata symbols
     }
 
-    /// @custom:halmos --array-lengths p=1,p[0]=1 --default-array-lengths 2
+    /// @custom:dolmos --array-lengths p=1,p[0]=1 --default-array-lengths 2
     function check_StructArrayArray(
         Point[][] memory p,
         Point[2][] memory q,
@@ -69,7 +69,7 @@ contract StructTest {
     }
 }
 
-/// @custom:halmos --solver-timeout-assertion 0 --default-array-lengths 2
+/// @custom:dolmos --solver-timeout-assertion 0 --default-array-lengths 2
 contract StructTest2 {
     struct P {
         uint x;
@@ -86,7 +86,7 @@ contract StructTest2 {
         P[][] f6;
     }
 
-    /// @custom:halmos --array-lengths s=1
+    /// @custom:dolmos --array-lengths s=1
     function check_S(P memory p, S[] memory s) public pure returns (uint result) {
         unchecked {
             result += sum_P(p);
diff --git a/tests/regression/test/HalmosCheatCode.t.sol b/tests/regression/test/SvmCheatCode.t.sol
similarity index 96%
rename from tests/regression/test/HalmosCheatCode.t.sol
rename to tests/regression/test/SvmCheatCode.t.sol
index e1a3b7600..e77540271 100644
--- a/tests/regression/test/HalmosCheatCode.t.sol
+++ b/tests/regression/test/SvmCheatCode.t.sol
@@ -10,7 +10,7 @@ contract Beep {
     }
 }
 
-contract HalmosCheatCodeTest is SymTest, Test {
+contract SvmCheatCodeTest is SymTest, Test {
     function check_createUint() public {
         uint x = svm.createUint(256, 'x');
         uint y = svm.createUint(160, 'y');
@@ -198,12 +198,12 @@ contract HalmosCheatCodeTest is SymTest, Test {
     }
 
     function check_random_uint_range_symbolic_fail(uint256 min, uint256 max) public {
-        // expected to fail with HalmosException
+        // expected to fail with DolmosException
         vm.randomUint(min, max);
     }
 
     function check_random_uint_range_max_greaterthan_min_fail() public {
-        // expected to fail with HalmosException
+        // expected to fail with DolmosException
         vm.randomUint(1, 0);
     }
 
@@ -262,15 +262,15 @@ contract HalmosCheatCodeTest is SymTest, Test {
 
     function check_enableSymbolicStorage_nonexistent() public {
         // symbolic storage is not allowed for a nonexistent account
-        svm.enableSymbolicStorage(address(0xdeadbeef)); // HalmosException
+        svm.enableSymbolicStorage(address(0xdeadbeef)); // DolmosException
     }
 
     function check_setArbitraryStorage_nonexistent() public {
         // Arbitrary Storage is not allowed for a nonexistent account
-        vm.setArbitraryStorage(address(0xdeadbeef)); // HalmosException
+        vm.setArbitraryStorage(address(0xdeadbeef)); // DolmosException
     }
 
-    /// @custom:halmos --array-lengths name=1
+    /// @custom:dolmos --array-lengths name=1
     function check_extract_string_argument_fail(string memory name) public {
         uint x = svm.createUint256(name);
         console.log(x);
@@ -279,7 +279,7 @@ contract HalmosCheatCodeTest is SymTest, Test {
 
     function check_unsupported_cheatcode_fail() public {
         // expected to fail with unknown cheatcode
-        vm.expectRevert("will revert");
+        vm.expectCall(address(0xdead), "");
     }
 
     function check_env_missing_fail() public {
@@ -606,8 +606,8 @@ contract HalmosCheatCodeTest is SymTest, Test {
     }
 }
 
-/// @custom:halmos --default-bytes-lengths 0,65
-contract HalmosCreateCalldataTest is SymTest, Test {
+/// @custom:dolmos --default-bytes-lengths 0,65
+contract SvmCreateCalldataTest is SymTest, Test {
     Beep beep = new Beep();
     Mock mock = new Mock(false); // use Mock(true) for debugging
 
@@ -627,12 +627,12 @@ contract HalmosCreateCalldataTest is SymTest, Test {
     }
 
     function check_createCalldata_Beep_1_excluding_pure() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Beep");
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Beep");
         _check_createCalldata_Beep(data); // fail because the only function in Beep is pure, which is excluded in createCalldata()
     }
 
     function check_createCalldata_Beep_1_including_pure() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Beep", true);
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Beep", true);
         _check_createCalldata_Beep(data);
     }
 
@@ -699,29 +699,29 @@ contract HalmosCreateCalldataTest is SymTest, Test {
     }
 
     function check_createCalldata_Mock_3_pass() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock");
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock");
         _check_createCalldata_Mock(data, true);
     }
     function check_createCalldata_Mock_3_fail() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock");
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock");
         _check_createCalldata_Mock(data, false);
     }
 
     function check_createCalldata_Mock_4_excluding_view_pass() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock", false);
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock", false);
         _check_createCalldata_Mock(data, true);
     }
     function check_createCalldata_Mock_4_excluding_view_fail() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock", false);
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock", false);
         _check_createCalldata_Mock(data, false);
     }
 
     function check_createCalldata_Mock_4_including_view_pass() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock", true);
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock", true);
         _check_createCalldata_Mock(data, true);
     }
     function check_createCalldata_Mock_4_including_view_fail() public {
-        bytes memory data = svm.createCalldata("HalmosCheatCode.t.sol", "Mock", true);
+        bytes memory data = svm.createCalldata("SvmCheatCode.t.sol", "Mock", true);
         _check_createCalldata_Mock(data, false);
     }
 
diff --git a/tests/regression/test/TStore.t.sol b/tests/regression/test/TStore.t.sol
index 619b116d3..99fdf5274 100644
--- a/tests/regression/test/TStore.t.sol
+++ b/tests/regression/test/TStore.t.sol
@@ -31,7 +31,7 @@ contract C {
     }
 }
 
-/// @custom:halmos --storage-layout generic
+/// @custom:dolmos --storage-layout generic
 contract TStoreTest is Test {
     C c;
 
diff --git a/tests/regression/test/Token.t.sol b/tests/regression/test/Token.t.sol
index 8218e15fb..5c4111d70 100644
--- a/tests/regression/test/Token.t.sol
+++ b/tests/regression/test/Token.t.sol
@@ -4,7 +4,7 @@ pragma solidity >=0.8.0 <0.9.0;
 import {SymTest} from "halmos-cheatcodes/SymTest.sol";
 import {Test} from "forge-std/Test.sol";
 
-/// @custom:halmos --solver-timeout-assertion 0
+/// @custom:dolmos --solver-timeout-assertion 0
 contract TokenTest is SymTest, Test {
     Token token;
 
diff --git a/tests/regression/test/UniswapPairAddress.t.sol b/tests/regression/test/UniswapPairAddress.t.sol
index ee5a776ac..d6406eed0 100644
--- a/tests/regression/test/UniswapPairAddress.t.sol
+++ b/tests/regression/test/UniswapPairAddress.t.sol
@@ -77,7 +77,7 @@ contract UniswapPairAddressTest is Test {
         console.log("uniswapV2Factory", address(uniswapV2Factory));
     }
 
-    // https://github.com/a16z/halmos/issues/393
+    // upstream halmos issue #393
     function check_inferred_address_matches_deployed_address() public {
         // uses the actual hash of the init code
         address deployedPair = uniswapV2Factory.createPair(address(tokenA), address(tokenB));
diff --git a/tests/regression/test/UnsupportedOpcode.t.sol b/tests/regression/test/UnsupportedOpcode.t.sol
index b39815715..a320c397f 100644
--- a/tests/regression/test/UnsupportedOpcode.t.sol
+++ b/tests/regression/test/UnsupportedOpcode.t.sol
@@ -5,7 +5,11 @@ pragma solidity >=0.8.0 <0.9.0;
 contract X {
     function foo() internal {
         assembly {
-            selfdestruct(0) // unsupported opcode
+            // deploy a contract whose runtime code is the undefined opcode 0x0c, and call it
+            // initcode: PUSH1 0x0c PUSH0 MSTORE8 PUSH1 0x01 PUSH0 RETURN
+            mstore(0, shl(192, 0x600c5f5360015ff3))
+            let target := create(0, 0, 8)
+            pop(call(gas(), target, 0, 0, 0, 0, 0)) // unsupported opcode
         }
     }
 
diff --git a/tests/regression/test/data/binary.bin b/tests/regression/test/data/binary.bin
new file mode 100644
index 000000000..d90dae2bb
Binary files /dev/null and b/tests/regression/test/data/binary.bin differ
diff --git a/tests/regression/test/data/hello.txt b/tests/regression/test/data/hello.txt
new file mode 100644
index 000000000..94954abda
--- /dev/null
+++ b/tests/regression/test/data/hello.txt
@@ -0,0 +1,2 @@
+hello
+world
diff --git a/tests/regression/test/data/initcode.hex b/tests/regression/test/data/initcode.hex
new file mode 100644
index 000000000..d0d9f6a32
--- /dev/null
+++ b/tests/regression/test/data/initcode.hex
@@ -0,0 +1 @@
+0x600a600c600039600a6000f3602a60005260206000f3
\ No newline at end of file
diff --git a/tests/regression/test/data/private/secret.txt b/tests/regression/test/data/private/secret.txt
new file mode 100644
index 000000000..536aca34d
--- /dev/null
+++ b/tests/regression/test/data/private/secret.txt
@@ -0,0 +1 @@
+secret
\ No newline at end of file
diff --git a/tests/solver/foundry.toml b/tests/solver/foundry.toml
index 570716663..7b3022dd8 100644
--- a/tests/solver/foundry.toml
+++ b/tests/solver/foundry.toml
@@ -6,5 +6,5 @@ libs = ['../lib', 'lib']
 evm_version = 'cancun'
 
 force = false
-# compile options used by halmos (to prevent unnecessary recompilation when running forge test and halmos together)
+# compile options used by dolmos (to prevent unnecessary recompilation when running forge test and dolmos together)
 extra_output = ["storageLayout", "metadata"]
diff --git a/tests/solver/test/Math.t.sol b/tests/solver/test/Math.t.sol
index a56f32558..c1f470ed1 100644
--- a/tests/solver/test/Math.t.sol
+++ b/tests/solver/test/Math.t.sol
@@ -10,7 +10,7 @@ contract MathTest {
         }
     }
 
-    /// @custom:halmos --solver-timeout-assertion 10000
+    /// @custom:dolmos --solver-timeout-assertion 10000
     function check_deposit(uint a, uint A1, uint S1) public pure {
         uint s = (a * S1) / A1;
 
@@ -21,7 +21,7 @@ contract MathTest {
         assert(A1 * S2 <= A2 * S1); // no counterexample
     }
 
-    /// @custom:halmos --solver-timeout-assertion 0
+    /// @custom:dolmos --solver-timeout-assertion 0
     function check_mint(uint s, uint A1, uint S1) public pure {
         uint a = (s * A1) / S1;
 
diff --git a/tests/solver/test/Solver.t.sol b/tests/solver/test/Solver.t.sol
index df3fdce6f..80a2e32e5 100644
--- a/tests/solver/test/Solver.t.sol
+++ b/tests/solver/test/Solver.t.sol
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-// from https://github.com/a16z/halmos/issues/57
+// from upstream halmos issue #57
 
-/// @custom:halmos --solver-timeout-assertion 10000
+/// @custom:dolmos --solver-timeout-assertion 10000
 contract SolverTest {
 
     function foo(uint x) public pure returns (uint) {
diff --git a/tests/test_bitvec.py b/tests/test_bitvec.py
index 1d201f219..8bd21b43a 100644
--- a/tests/test_bitvec.py
+++ b/tests/test_bitvec.py
@@ -13,11 +13,11 @@
     simplify,
 )
 
-from halmos.bitvec import FALSE, TRUE
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bitvec import HalmosBool as Bool
-from halmos.bytevec import Chunk
-from halmos.exceptions import NotConcreteError
+from dolmos.bitvec import FALSE, TRUE
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bitvec import DolmosBool as Bool
+from dolmos.bytevec import Chunk
+from dolmos.exceptions import NotConcreteError
 
 a, b = Bool("a"), Bool("b")
 x, y = BV("x"), BV("y")
diff --git a/tests/test_bytevec.py b/tests/test_bytevec.py
index 865d6159d..c7708a0e6 100644
--- a/tests/test_bytevec.py
+++ b/tests/test_bytevec.py
@@ -1,8 +1,8 @@
 import pytest
 from z3 import BitVec, BitVecVal, Concat, Extract, eq
 
-from halmos.bytevec import ByteVec, Chunk, defrag
-from halmos.utils import concat, extract_bytes
+from dolmos.bytevec import ByteVec, Chunk, defrag
+from dolmos.utils import concat, extract_bytes
 
 
 @pytest.fixture
diff --git a/tests/test_cli.py b/tests/test_cli.py
index edde7ecdd..f9f61cd14 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -8,10 +8,10 @@
     eq,
 )
 
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.calldata import str_abi
-from halmos.sevm import Contract, Instruction
-from halmos.utils import EVM, hexify
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.calldata import str_abi
+from dolmos.sevm import Contract, Instruction
+from dolmos.utils import EVM, hexify
 
 
 @pytest.fixture
diff --git a/tests/test_config.py b/tests/test_config.py
index 1ada79fc6..4b91b16fb 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -4,7 +4,7 @@
 
 import pytest
 
-from halmos.config import (
+from dolmos.config import (
     Config,
     ConfigSource,
     ParseArrayLengths,
@@ -13,8 +13,9 @@
     arg_parser,
     default_config,
     resolve_config_files,
+    split_command,
 )
-from halmos.config import (
+from dolmos.config import (
     toml_parser as get_toml_parser,
 )
 
@@ -131,7 +132,23 @@ def test_config_file_in_project_root():
     config_files = resolve_config_files(args, include_missing=True)
 
     # then the config file should be in the project root
-    assert config_files == [os.path.join(base_path, "halmos.toml")]
+    # (dolmos.toml is the preferred name when neither file exists)
+    assert config_files == [os.path.join(base_path, "dolmos.toml")]
+
+
+def test_config_file_halmos_toml_fallback(tmp_path):
+    # halmos.toml is still picked up when there is no dolmos.toml
+    (tmp_path / "halmos.toml").write_text("[global]\n")
+    config_files = resolve_config_files(["--root", str(tmp_path)])
+    assert config_files == [str(tmp_path / "halmos.toml")]
+
+
+def test_config_file_dolmos_toml_first(tmp_path):
+    # dolmos.toml takes precedence when both exist
+    (tmp_path / "halmos.toml").write_text("[global]\n")
+    (tmp_path / "dolmos.toml").write_text("[global]\n")
+    config_files = resolve_config_files(["--root", str(tmp_path)])
+    assert config_files == [str(tmp_path / "dolmos.toml")]
 
 
 def test_config_file_explicit():
@@ -429,3 +446,30 @@ def test_command_line_precedence_over_annotations(config):
         "cvc5",
         ConfigSource.command_line,
     )
+
+
+@pytest.mark.parametrize(
+    "command, windows, expected",
+    [
+        (
+            "path/to/bitwuzla --produce-models",
+            False,
+            ["path/to/bitwuzla", "--produce-models"],
+        ),
+        ("'/opt/my solver/z3' -in", False, ["/opt/my solver/z3", "-in"]),
+        (r"a\ b -x", False, ["a b", "-x"]),
+        (
+            r"D:\a\dolmos\.venv\Scripts\yices-smt2.exe --smt2-model-format",
+            True,
+            [r"D:\a\dolmos\.venv\Scripts\yices-smt2.exe", "--smt2-model-format"],
+        ),
+        (
+            r'"C:\Program Files\z3\z3.exe" -in',
+            True,
+            [r"C:\Program Files\z3\z3.exe", "-in"],
+        ),
+        (r"'D:\x\y.exe' --z", True, [r"D:\x\y.exe", "--z"]),
+    ],
+)
+def test_split_command(command, windows, expected):
+    assert split_command(command, windows=windows) == expected
diff --git a/tests/test_halmos.py b/tests/test_dolmos.py
similarity index 72%
rename from tests/test_halmos.py
rename to tests/test_dolmos.py
index d5995e3f1..a7e70f475 100644
--- a/tests/test_halmos.py
+++ b/tests/test_dolmos.py
@@ -1,12 +1,13 @@
 import dataclasses
 import json
+import shutil
 
 import pytest
 
-from halmos.__main__ import _main
-from halmos.bytevec import ByteVec
-from halmos.sevm import con
-from halmos.traces import rendered_calldata
+from dolmos.__main__ import _main
+from dolmos.bytevec import ByteVec
+from dolmos.sevm import con
+from dolmos.traces import rendered_calldata
 
 
 @pytest.mark.parametrize(
@@ -17,7 +18,7 @@
             "tests/expected/all.json",
         ),
         (
-            ["--root", "tests/ffi"],
+            ["--root", "tests/ffi", "--ffi"],
             "tests/expected/ffi.json",
         ),
         (
@@ -51,14 +52,28 @@
         "long:examples/tokens/ERC721",
     ),
 )
-def test_main(cmd, expected_path, halmos_options):
-    actual = dataclasses.asdict(_main(cmd + halmos_options.split()))
+def test_main(cmd, expected_path, dolmos_options):
+    actual = dataclasses.asdict(_main(cmd + dolmos_options.split()))
     with open(expected_path, encoding="utf8") as f:
         expected = json.load(f)
     assert expected["exitcode"] == actual["exitcode"]
     assert_eq(expected["test_results"], actual["test_results"])
 
 
+@pytest.mark.skipif(
+    shutil.which("vyper") is None, reason="vyper compiler not found in PATH"
+)
+def test_main_vyper(dolmos_options):
+    # vyper tests and vyper targets (requires the vyper compiler, used by forge)
+    actual = dataclasses.asdict(
+        _main(["--root", "tests/vyper"] + dolmos_options.split())
+    )
+    with open("tests/expected/vyper.json", encoding="utf8") as f:
+        expected = json.load(f)
+    assert expected["exitcode"] == actual["exitcode"]
+    assert_eq(expected["test_results"], actual["test_results"])
+
+
 @pytest.mark.parametrize(
     "cmd",
     [
@@ -66,8 +81,8 @@ def test_main(cmd, expected_path, halmos_options):
     ],
     ids=("SetupFailTest",),
 )
-def test_main_fail(cmd, halmos_options):
-    actual = dataclasses.asdict(_main(cmd + halmos_options.split()))
+def test_main_fail(cmd, dolmos_options):
+    actual = dataclasses.asdict(_main(cmd + dolmos_options.split()))
     assert actual["exitcode"] != 0
 
 
diff --git a/tests/test_evm_version.py b/tests/test_evm_version.py
new file mode 100644
index 000000000..388c57cd2
--- /dev/null
+++ b/tests/test_evm_version.py
@@ -0,0 +1,125 @@
+import pytest
+from test_sevm import caller, mk_ex, this
+
+from dolmos.__main__ import with_evm_version
+from dolmos.config import ConfigSource, default_config
+from dolmos.evm_version import (
+    EVM_VERSIONS,
+    LATEST_EVM_VERSION,
+    evm_version_from_metadata,
+    is_at_least,
+    normalize_evm_version,
+    unavailable_opcodes,
+)
+from dolmos.exceptions import DolmosException, InvalidOpcode
+from dolmos.sevm import SEVM
+from dolmos.utils import EVM
+
+
+def mk_sevm(fun_info, evm_version: str) -> SEVM:
+    args = default_config().with_overrides(
+        ConfigSource.command_line, evm_version=evm_version
+    )
+    return SEVM(args, fun_info)
+
+
+def test_versions_are_ordered():
+    assert EVM_VERSIONS.index("shanghai") < EVM_VERSIONS.index("cancun")
+    assert LATEST_EVM_VERSION == "osaka"
+    assert is_at_least("prague", "cancun")
+    assert not is_at_least("shanghai", "cancun")
+
+
+@pytest.mark.parametrize(
+    "name, expected",
+    [
+        ("cancun", "cancun"),
+        ("Cancun", "cancun"),
+        ("tangerinewhistle", "tangerineWhistle"),
+        ("merge", "paris"),
+        ("unknown", None),
+    ],
+)
+def test_normalize(name, expected):
+    assert normalize_evm_version(name) == expected
+
+
+def test_unavailable_opcodes():
+    assert unavailable_opcodes("osaka") == frozenset()
+    assert unavailable_opcodes("prague") == {EVM.CLZ}
+    assert unavailable_opcodes("shanghai") == {
+        EVM.TLOAD,
+        EVM.TSTORE,
+        EVM.MCOPY,
+        EVM.BLOBHASH,
+        EVM.BLOBBASEFEE,
+        EVM.CLZ,
+    }
+    assert EVM.PUSH0 in unavailable_opcodes("paris")
+    assert EVM.PUSH0 not in unavailable_opcodes("shanghai")
+    assert EVM.BASEFEE in unavailable_opcodes("berlin")
+    assert EVM.CHAINID in unavailable_opcodes("petersburg")
+    assert EVM.CREATE2 in unavailable_opcodes("byzantium")
+    assert EVM.REVERT in unavailable_opcodes("spuriousDragon")
+
+
+def test_metadata():
+    assert (
+        evm_version_from_metadata({"metadata": {"settings": {"evmVersion": "paris"}}})
+        == "paris"
+    )
+    assert evm_version_from_metadata({}) is None
+    assert evm_version_from_metadata({"metadata": "not a dict"}) is None
+
+
+def test_with_evm_version_from_metadata():
+    args = with_evm_version(
+        default_config(), {"metadata": {"settings": {"evmVersion": "shanghai"}}}
+    )
+    assert args.evm_version == "shanghai"
+
+
+def test_with_evm_version_option_wins():
+    cli = default_config().with_overrides(
+        ConfigSource.command_line, evm_version="cancun"
+    )
+    args = with_evm_version(cli, {"metadata": {"settings": {"evmVersion": "paris"}}})
+    assert args.evm_version == "cancun"
+
+
+def test_with_evm_version_unknown_in_metadata():
+    args = with_evm_version(
+        default_config(), {"metadata": {"settings": {"evmVersion": "future"}}}
+    )
+    assert args.evm_version == ""  # falls back to the latest fork
+
+
+def test_unsupported_version_rejected(fun_info):
+    with pytest.raises(DolmosException):
+        mk_sevm(fun_info, "future")
+
+
+@pytest.mark.parametrize(
+    "hexcode, evm_version, valid",
+    [
+        ("5f00", "shanghai", True),  # PUSH0; STOP
+        ("5f00", "paris", False),
+        ("60015f5d00", "cancun", True),  # PUSH1 1; PUSH0; TSTORE; STOP
+        ("60015f5d00", "shanghai", False),
+        ("60011e00", "osaka", True),  # PUSH1 1; CLZ; STOP
+        ("60011e00", "prague", False),
+        ("4800", "london", True),  # BASEFEE; STOP
+        ("4800", "berlin", False),
+    ],
+)
+def test_opcode_availability(hexcode, evm_version, valid, fun_info, solver):
+    sevm = mk_sevm(fun_info, evm_version)
+    ex = mk_ex(
+        bytes.fromhex(hexcode), sevm, solver, sevm.mk_storagedata(), caller, this
+    )
+    [out] = list(sevm.run(ex))
+    error = out.context.output.error
+    if valid:
+        assert error is None
+    else:
+        assert isinstance(error, InvalidOpcode)
diff --git a/tests/test_fixtures.py b/tests/test_fixtures.py
index 502eb627b..31d779b17 100644
--- a/tests/test_fixtures.py
+++ b/tests/test_fixtures.py
@@ -1,9 +1,9 @@
 import pytest
 
-from halmos.__main__ import mk_solver
-from halmos.calldata import FunctionInfo
-from halmos.config import default_config
-from halmos.sevm import SEVM
+from dolmos.__main__ import mk_solver
+from dolmos.calldata import FunctionInfo
+from dolmos.config import default_config
+from dolmos.sevm import SEVM
 
 
 @pytest.fixture
@@ -27,5 +27,5 @@ def solver(args):
 
 
 @pytest.fixture
-def halmos_options(request):
-    return request.config.getoption("--halmos-options")
+def dolmos_options(request):
+    return request.config.getoption("--dolmos-options")
diff --git a/tests/test_fs.py b/tests/test_fs.py
new file mode 100644
index 000000000..452265e97
--- /dev/null
+++ b/tests/test_fs.py
@@ -0,0 +1,180 @@
+import os
+import subprocess
+
+import pytest
+
+from dolmos import fs
+from dolmos.exceptions import DolmosException
+from dolmos.fs import (
+    FsPermission,
+    ensure_readable,
+    find_permission,
+    parse_fs_permissions,
+    parse_hex_bytes,
+    resolve_path,
+)
+
+ROOT = "/project"
+
+
+def P(path: str) -> str:
+    """
+    The absolute, normalized form of a POSIX-style test path on the current OS
+    (on Windows, '/project/a' is D:\\project\\a, as returned by resolve_path).
+    """
+    return os.path.normpath(os.path.abspath(path))
+
+
+def perms(*entries) -> tuple[FsPermission, ...]:
+    return parse_fs_permissions(ROOT, [{"access": a, "path": p} for a, p in entries])
+
+
+def test_parse_fs_permissions_access_aliases():
+    # `forge config --json` serializes "read-write" as true and "none" as false
+    parsed = perms(("read", "./a"), (True, "b"), (False, "c"), ("write", "/abs/d"))
+    assert [(p.access, p.path) for p in parsed] == [
+        ("read", P("/project/a")),
+        ("read-write", P("/project/b")),
+        ("none", P("/project/c")),
+        ("write", P("/abs/d")),
+    ]
+    assert [p.can_read for p in parsed] == [True, True, False, False]
+
+
+def test_resolve_path_is_lexical():
+    assert resolve_path(ROOT, "data/../secret/s.txt") == P("/project/secret/s.txt")
+    assert resolve_path(ROOT, "./data/x") == P("/project/data/x")
+    assert resolve_path(ROOT, "/elsewhere/x") == P("/elsewhere/x")
+    assert resolve_path(ROOT, "../x") == P("/x")
+
+
+def test_find_permission_most_specific_wins():
+    p = perms(("read", "./data"), ("none", "./data/private"))
+    assert find_permission(p, P("/project/data/x.txt")).access == "read"
+    assert find_permission(p, P("/project/data/private/x.txt")).access == "none"
+    assert find_permission(p, P("/project/data/private")).access == "none"
+    # order of declaration does not matter
+    p = perms(("none", "./data/private"), ("read", "./data"))
+    assert find_permission(p, P("/project/data/private/x.txt")).access == "none"
+
+
+def test_find_permission_matches_path_components_only():
+    p = perms(("read", "./data"))
+    assert find_permission(p, P("/project/database.txt")) is None
+    assert find_permission(p, P("/project/data-other/x")) is None
+    assert find_permission(p, P("/project/data")) is not None
+
+
+def test_find_permission_root():
+    p = perms(("read", "./"))
+    assert find_permission(p, P("/project/anything/at/all")).access == "read"
+    assert find_permission(p, P("/outside")) is None
+
+
+@pytest.mark.skipif(
+    os.name != "nt", reason="paths are case-insensitive on Windows only"
+)
+def test_find_permission_case_insensitive_on_windows():
+    p = perms(("read", "./Data"))
+    assert find_permission(p, P("/PROJECT/data/x.txt")).access == "read"
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "foundry.toml",
+        "data/../foundry.toml",
+        "data/private/secret.txt",
+        "../outside.txt",
+        "/etc/passwd",
+        "out-of-tree/data/x",
+    ],
+)
+def test_ensure_readable_denied(path):
+    p = perms(("read", "./data"), ("none", "./data/private"))
+    with pytest.raises(DolmosException, match="not allowed to be accessed"):
+        ensure_readable(ROOT, path, "vm.readFile", p)
+
+
+def test_ensure_readable_allowed():
+    p = perms(("read", "./data"), ("read-write", "/shared"), ("write", "./logs"))
+    assert ensure_readable(ROOT, "data/x", "vm.readFile", p) == P("/project/data/x")
+    assert ensure_readable(ROOT, "/shared/y", "vm.readFile", p) == P("/shared/y")
+    with pytest.raises(DolmosException):
+        ensure_readable(ROOT, "logs/z", "vm.readFile", p)
+
+
+def test_ensure_readable_no_permissions():
+    with pytest.raises(DolmosException):
+        ensure_readable(ROOT, "anything", "vm.readFile", ())
+
+
+def test_load_fs_permissions_falls_back_to_foundry_default(monkeypatch, tmp_path):
+    def failing_run(*args, **kwargs):
+        raise FileNotFoundError("forge")
+
+    monkeypatch.setattr(subprocess, "run", failing_run)
+    fs.load_fs_permissions.cache_clear()
+    try:
+        root = str(tmp_path)
+        assert fs.load_fs_permissions(root) == (
+            FsPermission("read", os.path.join(root, "out")),
+        )
+    finally:
+        fs.load_fs_permissions.cache_clear()
+
+
+def test_read_file(monkeypatch, tmp_path):
+    (tmp_path / "data").mkdir()
+    (tmp_path / "data" / "crlf.txt").write_bytes(b"a\r\nb\n")
+    (tmp_path / "secret.txt").write_bytes(b"secret")
+
+    root = str(tmp_path)
+    monkeypatch.setattr(
+        fs,
+        "load_fs_permissions",
+        lambda r: parse_fs_permissions(r, [{"access": "read", "path": "data"}]),
+    )
+
+    # returned as is, no newline translation
+    assert fs.read_file(root, "data/crlf.txt", "vm.readFile") == b"a\r\nb\n"
+
+    with pytest.raises(DolmosException, match="failed to read"):
+        fs.read_file(root, "data/missing.txt", "vm.readFile")
+
+    with pytest.raises(DolmosException, match="failed to read"):
+        fs.read_file(root, "data", "vm.readFile")  # a directory
+
+    with pytest.raises(DolmosException, match="not allowed"):
+        fs.read_file(root, "secret.txt", "vm.readFile")
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    [
+        ("0x", b""),
+        ("0x00ff", b"\x00\xff"),
+        ("00ff", b"\x00\xff"),
+        ("0xABcd", b"\xab\xcd"),
+        ("0x600a600c600039600a6000f3", bytes.fromhex("600a600c600039600a6000f3")),
+    ],
+)
+def test_parse_hex_bytes(value, expected):
+    assert parse_hex_bytes(value) == expected
+
+
+@pytest.mark.parametrize(
+    "value, reason",
+    [
+        ("", "missing hex prefix"),
+        ("0x123", "odd number of digits"),
+        ("0x6001\n", "invalid hex character"),
+        (" 0xab", "invalid hex character"),
+        ("0x ab", "invalid hex character"),
+        ("0XAB", "invalid hex character"),
+        ("0xzz", "invalid hex character"),
+    ],
+)
+def test_parse_hex_bytes_invalid(value, reason):
+    with pytest.raises(DolmosException, match=reason):
+        parse_hex_bytes(value)
diff --git a/tests/test_lasso.py b/tests/test_lasso.py
new file mode 100644
index 000000000..fedc41365
--- /dev/null
+++ b/tests/test_lasso.py
@@ -0,0 +1,139 @@
+import json
+import os
+import shutil
+import subprocess
+
+import pytest
+from z3 import UGE, ULT, BitVec, BitVecVal, simplify
+
+from dolmos.lasso import (
+    MAX_SMALL_CONSTANT,
+    BodyPath,
+    LassoError,
+    Registry,
+    Translator,
+    WrapProver,
+    build_lasso,
+    check_small_constants,
+)
+
+M = 2**256
+
+
+def v(name: str):
+    return BitVec(f"lasso_v1_{name}", 256)
+
+
+def small_translator(conditions, names=None):
+    prover = WrapProver(conditions, 1000)
+    return Translator(Registry(), names or {}, stem=False, prover=prover)
+
+
+def test_add_without_wrap_is_exact():
+    x = v("x")
+    tr = small_translator([ULT(x, 100)], {"lasso_v1_x": "x_i"})
+    assert tr.bv(x + 1) == "(+ x_i 1)"
+    assert not tr.reg.approximate
+
+
+def test_add_with_possible_wrap_is_approximated():
+    x = v("x")
+    tr = small_translator([], {"lasso_v1_x": "x_i"})
+    r = tr.bv(x + 1)
+    assert r.startswith("aux")
+    assert f"(<= {r} (+ x_i 1))" in tr.constraints
+    assert tr.reg.approximate
+
+
+def test_minus_one_is_a_subtraction():
+    # solc compiles x - 1 as x + (2^256 - 1)
+    x = v("x")
+    expr = simplify(x - 1)
+    tr = small_translator([UGE(x, 1)], {"lasso_v1_x": "x_i"})
+    assert tr.bv(expr) == "(- x_i 1)"
+
+
+def test_borrow_without_large_constant():
+    x = v("x")
+    tr = small_translator([], {"lasso_v1_x": "x_i"})
+    r = tr.bv(simplify(x - 2))
+    assert any("(< (- x_i 2) 0)" in c for c in tr.constraints)
+    for c in tr.constraints:
+        check_small_constants(c)
+    assert r.startswith("aux")
+
+
+def test_large_literals_become_constants():
+    x = v("x")
+    tr = small_translator([], {"lasso_v1_x": "x_i"})
+    term = tr.bv(x & BitVecVal(0xFF << 200, 256))  # not a low mask: opaque
+    tr2 = small_translator([], {"lasso_v1_x": "x_i"})
+    lit = tr2.bool(ULT(x, BitVecVal(2**200, 256)))
+    assert lit == "(< x_i c0)"
+    assert term
+    assert tr2.reg.approximate
+
+
+def test_exact_encoding_keeps_wrap_cases():
+    x = v("x")
+    tr = Translator(Registry(), {"lasso_v1_x": "x_i"}, stem=False)
+    tr.bv(x + 1)
+    assert any(str(M) in c for c in tr.constraints)
+
+
+def test_check_small_constants():
+    check_small_constants(f"(< x {MAX_SMALL_CONSTANT})")
+    with pytest.raises(LassoError):
+        check_small_constants(f"(< x {M})")
+
+
+def count_down_lasso():
+    # while (x != 0) { x -= 1; }   (checked arithmetic: x >= 1 on the path)
+    x = v("0")
+    out = simplify(x - 1)
+    again = out != 0
+    body = BodyPath(
+        conditions=[UGE(x, 1), again],
+        outputs=[out],
+        context=[UGE(x, 1), again],
+    )
+    n = BitVec("p_n_uint256", 256)
+    approximate, lasso = build_lasso(
+        ["lasso_v1_0"],
+        [256],
+        [n],
+        [n != 0],
+        None,
+        [body],
+        stem_context=[n != 0],
+        complete=True,
+    )
+    return approximate, lasso
+
+
+def test_count_down_lasso():
+    approximate, lasso = count_down_lasso()
+    assert not approximate
+    loop = lasso["loop"][0]
+    assert "(= v0_o (- v0_i 1))" in loop["formula"]
+    check_small_constants(loop["formula"])
+    check_small_constants(lasso["stem"][0]["formula"])
+    assert lasso["program_vars"] == ["v0"]
+
+
+@pytest.mark.skipif(
+    not (os.environ.get("PASTTEL") or shutil.which("pasttel")),
+    reason="PaSTTeL binary not available (set PASTTEL)",
+)
+def test_count_down_terminates_with_pasttel(tmp_path):
+    binary = os.environ.get("PASTTEL") or shutil.which("pasttel")
+    _, lasso = count_down_lasso()
+    path = tmp_path / "count_down.json"
+    path.write_text(json.dumps(lasso))
+    out = subprocess.run(
+        [binary, "-a", "both", "-t", "30", str(path)],
+        capture_output=True,
+        text=True,
+        timeout=60,
+    ).stdout
+    assert "OVERALL RESULT: TERMINATING" in out
diff --git a/tests/test_mapper.py b/tests/test_mapper.py
index 487a4e723..2e389adfb 100644
--- a/tests/test_mapper.py
+++ b/tests/test_mapper.py
@@ -3,7 +3,7 @@
 
 import pytest
 
-from halmos.mapper import AstNode, ContractMappingInfo, Mapper, SingletonMeta
+from dolmos.mapper import AstNode, ContractMappingInfo, Mapper, SingletonMeta
 
 
 @pytest.fixture
diff --git a/tests/test_natspec.py b/tests/test_natspec.py
new file mode 100644
index 000000000..099f7f438
--- /dev/null
+++ b/tests/test_natspec.py
@@ -0,0 +1,36 @@
+from dolmos.build import parse_devdoc, parse_natspec
+
+
+def devdoc(**tags):
+    return {"metadata": {"output": {"devdoc": {"methods": {"f()": tags}}}}}
+
+
+def test_parse_natspec_dolmos_tag():
+    assert parse_natspec({"text": "@custom:dolmos --loop 4"}) == "--loop 4"
+
+
+def test_parse_natspec_legacy_halmos_tag():
+    # test suites written for halmos keep working
+    assert parse_natspec({"text": "@custom:halmos --loop 4"}) == "--loop 4"
+
+
+def test_parse_natspec_both_tags():
+    text = "@title T\n@custom:halmos --loop 4\n@notice n\n@custom:dolmos --width 2"
+    assert parse_natspec({"text": text}).split() == ["--loop", "4", "--width", "2"]
+
+
+def test_parse_natspec_other_tags_ignored():
+    assert parse_natspec({"text": "@custom:other --loop 4"}) == ""
+
+
+def test_parse_devdoc():
+    assert parse_devdoc("f()", devdoc(**{"custom:dolmos": "--loop 4"})) == "--loop 4"
+    assert parse_devdoc("f()", devdoc(**{"custom:halmos": "--loop 4"})) == "--loop 4"
+    assert (
+        parse_devdoc(
+            "f()", devdoc(**{"custom:halmos": "--loop 4", "custom:dolmos": "--width 2"})
+        )
+        == "--width 2 --loop 4"
+    )
+    assert parse_devdoc("f()", devdoc()) is None
+    assert parse_devdoc("g()", devdoc()) is None
diff --git a/tests/test_pcex.py b/tests/test_pcex.py
new file mode 100644
index 000000000..ee66d43b3
--- /dev/null
+++ b/tests/test_pcex.py
@@ -0,0 +1,959 @@
+"""Tests of --pretty-counterexamples (dolmos.pcex) and of the EXP refinement (dolmos.solve)"""
+
+import json
+import os
+import shlex
+import shutil
+import sys
+from dataclasses import replace
+from pathlib import Path
+
+import pytest
+from z3 import BitVec, BitVecSort, BitVecVal, Function, Solver, sat
+
+from dolmos.config import ConfigSource, default_config
+from dolmos.pcex import (
+    EMPTY_SELECTOR,
+    AbiType,
+    CallLayout,
+    CexLayout,
+    CodeGen,
+    ModelReader,
+    PcexState,
+    Ref,
+    RenderContext,
+    Segment,
+    SelectorIndex,
+    TraceCall,
+    abi_decode,
+    abi_encode,
+    base_literal,
+    bytes_literal,
+    checksum_address,
+    compact_hex,
+    index_symbols,
+    params_type,
+    parse_abi_type,
+    render_counterexample,
+    repro_function,
+    segments_of,
+    selector_of,
+    svm_value,
+    uint_hint,
+)
+from dolmos.solve import (
+    ExpApp,
+    ExpApps,
+    ModelVariable,
+    PathContext,
+    SMTQuery,
+    SolvingContext,
+    exp_arg_decls,
+    exp_invalid_reason,
+    exp_square_and_multiply,
+    exp_table,
+    mk_exp_apps,
+    parse_exp_arg_values,
+    solve_end_to_end,
+)
+
+#
+# helpers
+#
+
+
+def var(name: str, value: int, size: int = 256) -> ModelVariable:
+    return ModelVariable(
+        full_name=name,
+        variable_name="",
+        solidity_type="",
+        smt_type=f"BitVec {size}",
+        size_bits=size,
+        value=value,
+    )
+
+
+def model_of(*variables: ModelVariable) -> dict:
+    return {v.full_name: v for v in variables}
+
+
+def word(value: int) -> bytes:
+    return value.to_bytes(32, "big")
+
+
+TOKEN_ABI = [
+    {
+        "type": "function",
+        "name": "transfer",
+        "inputs": [
+            {"name": "to", "type": "address", "internalType": "address"},
+            {"name": "amount", "type": "uint256", "internalType": "uint256"},
+        ],
+        "outputs": [{"name": "", "type": "bool", "internalType": "bool"}],
+        "stateMutability": "nonpayable",
+    },
+    {
+        "type": "function",
+        "name": "withdraw",
+        "inputs": [{"name": "amount", "type": "uint256", "internalType": "uint256"}],
+        "outputs": [],
+        "stateMutability": "nonpayable",
+    },
+    {"type": "receive", "stateMutability": "payable"},
+]
+
+TOKEN_JSON = {"abi": TOKEN_ABI, "deployedBytecode": {"object": "0x6080"}}
+
+
+def token_index() -> SelectorIndex:
+    return SelectorIndex([("Token", TOKEN_JSON)])
+
+
+#
+# symbol names
+#
+
+
+def test_index_symbols():
+    names = [
+        "p_x_uint256_0a1b2c3_00",
+        "p_my_var_bytes32_abcdef0_01",
+        "p_calls[0]_bytes_1234567_00",
+        "p_calls[0]_length_7654321_00",
+        "p_calls_length_aaaaaaa_00",
+        "p_s.items[1].a_int8_bbbbbbb_12",
+        "p__uint256_ccccccc_00",
+        "p__uint256_ddddddd_00",
+        "dolmos_x_uint256_eeeeeee_01",
+    ]
+    index = index_symbols(names)
+    assert index[("x", "uint256")] == ["p_x_uint256_0a1b2c3_00"]
+    assert index[("my_var", "bytes32")] == ["p_my_var_bytes32_abcdef0_01"]
+    assert index[("calls[0]", "bytes")] == ["p_calls[0]_bytes_1234567_00"]
+    assert index[("calls[0]", "length")] == ["p_calls[0]_length_7654321_00"]
+    assert index[("calls", "length")] == ["p_calls_length_aaaaaaa_00"]
+    assert index[("s.items[1].a", "int8")] == ["p_s.items[1].a_int8_bbbbbbb_12"]
+    # unnamed parameters share the same path, in order
+    assert index[("", "uint256")] == ["p__uint256_ccccccc_00", "p__uint256_ddddddd_00"]
+    assert len(index) == 7
+
+
+#
+# ABI types, encoding and decoding
+#
+
+
+def test_parse_abi_type():
+    t = parse_abi_type(
+        {
+            "name": "ps",
+            "type": "tuple[2][]",
+            "internalType": "struct Foo.Pair[2][]",
+            "components": [
+                {"name": "a", "type": "uint", "internalType": "uint256"},
+                {"name": "b", "type": "bytes4[]", "internalType": "bytes4[]"},
+            ],
+        }
+    )
+    assert t.kind == "array"
+    assert t.abi == "(uint256,bytes4[])[2][]"
+    assert t.internal == "struct Foo.Pair[2][]"
+    assert t.elem.kind == "fixed" and t.elem.length == 2
+    assert t.elem.internal == "struct Foo.Pair[2]"
+    pair = t.elem.elem
+    assert pair.kind == "tuple" and pair.names == ("a", "b")
+    assert pair.internal == "struct Foo.Pair"
+    assert pair.components[0].abi == "uint256"
+    assert pair.is_dynamic and t.is_dynamic
+
+    static = parse_abi_type(
+        {
+            "type": "tuple",
+            "components": [
+                {"name": "x", "type": "uint8"},
+                {"name": "y", "type": "address[3]"},
+            ],
+        }
+    )
+    assert not static.is_dynamic
+    assert static.static_size == 4 * 32
+
+
+# examples from the solidity documentation (ABI specification)
+DOC_F = (
+    "8be65246"
+    "0000000000000000000000000000000000000000000000000000000000000123"
+    "0000000000000000000000000000000000000000000000000000000000000080"
+    "3132333435363738393000000000000000000000000000000000000000000000"
+    "00000000000000000000000000000000000000000000000000000000000000e0"
+    "0000000000000000000000000000000000000000000000000000000000000002"
+    "0000000000000000000000000000000000000000000000000000000000000456"
+    "0000000000000000000000000000000000000000000000000000000000000789"
+    "000000000000000000000000000000000000000000000000000000000000000d"
+    "48656c6c6f2c20776f726c642100000000000000000000000000000000000000"
+)
+
+DOC_G = (
+    "2289b18c"
+    "0000000000000000000000000000000000000000000000000000000000000040"
+    "0000000000000000000000000000000000000000000000000000000000000140"
+    "0000000000000000000000000000000000000000000000000000000000000002"
+    "0000000000000000000000000000000000000000000000000000000000000040"
+    "00000000000000000000000000000000000000000000000000000000000000a0"
+    "0000000000000000000000000000000000000000000000000000000000000002"
+    "0000000000000000000000000000000000000000000000000000000000000001"
+    "0000000000000000000000000000000000000000000000000000000000000002"
+    "0000000000000000000000000000000000000000000000000000000000000001"
+    "0000000000000000000000000000000000000000000000000000000000000003"
+    "0000000000000000000000000000000000000000000000000000000000000003"
+    "0000000000000000000000000000000000000000000000000000000000000060"
+    "00000000000000000000000000000000000000000000000000000000000000a0"
+    "00000000000000000000000000000000000000000000000000000000000000e0"
+    "0000000000000000000000000000000000000000000000000000000000000003"
+    "6f6e650000000000000000000000000000000000000000000000000000000000"
+    "0000000000000000000000000000000000000000000000000000000000000003"
+    "74776f0000000000000000000000000000000000000000000000000000000000"
+    "0000000000000000000000000000000000000000000000000000000000000005"
+    "7468726565000000000000000000000000000000000000000000000000000000"
+)
+
+
+def test_abi_decode_encode_doc_example_f():
+    data = bytes.fromhex(DOC_F)
+    assert selector_of("f(uint256,uint32[],bytes10,bytes)") == data[:4]
+
+    params = params_type(
+        [
+            {"name": "a", "type": "uint256"},
+            {"name": "b", "type": "uint32[]"},
+            {"name": "c", "type": "bytes10"},
+            {"name": "d", "type": "bytes"},
+        ]
+    )
+    v = abi_decode(params, data, 4)
+    a, b, c, d = v.items
+    assert a.word == 0x123
+    assert [item.word for item in b.items] == [0x456, 0x789]
+    assert c.word.to_bytes(32, "big")[:10] == b"1234567890"
+    assert d.data == b"Hello, world!"
+    assert abi_encode(v) == data[4:]
+
+
+def test_abi_decode_encode_doc_example_g():
+    data = bytes.fromhex(DOC_G)
+    assert selector_of("g(uint256[][],string[])") == data[:4]
+
+    params = params_type(
+        [{"name": "x", "type": "uint256[][]"}, {"name": "y", "type": "string[]"}]
+    )
+    v = abi_decode(params, data, 4)
+    x, y = v.items
+    assert [[i.word for i in row.items] for row in x.items] == [[1, 2], [3]]
+    assert [s.data for s in y.items] == [b"one", b"two", b"three"]
+    assert abi_encode(v) == data[4:]
+
+
+@pytest.mark.parametrize(
+    "data",
+    [
+        word(0x20),  # offset without length
+        word(0x20) + word(2**200),  # absurd length
+        word(2**100),  # offset out of bounds
+    ],
+)
+def test_abi_decode_malformed(data):
+    from dolmos.pcex import AbiDecodeError
+
+    with pytest.raises(AbiDecodeError):
+        abi_decode(params_type([{"name": "b", "type": "bytes"}]), data)
+
+
+#
+# values from the model
+#
+
+
+def test_model_reader_dynamic_lengths():
+    # check_calls(bytes[] calls) with calls.length == 2, calls[1].length == 65
+    params = params_type([{"name": "calls", "type": "bytes[]"}])
+    calldata = bytes.fromhex("a9059cbb") + word(0xBEEF) + word(5) + b"\x07"
+    model = model_of(
+        var("p_calls_length_aaaaaaa_00", 2),
+        var("p_calls[0]_length_bbbbbbb_00", 0),
+        var("p_calls[0]_bytes_ccccccc_00", 0, 8 * 1024),
+        var("p_calls[1]_length_ddddddd_00", 69),
+        var(
+            "p_calls[1]_bytes_eeeeeee_00",
+            int.from_bytes(calldata + bytes(1024 - 69), "big"),
+            8 * 1024,
+        ),
+    )
+    reader = ModelReader(model, index_symbols(model))
+    v = reader.read(params, "")
+    calls = v.items[0]
+    assert [item.data for item in calls.items] == [b"", calldata]
+    assert reader.used == set(model)
+
+    ctx = RenderContext(index=token_index())
+    leaves = dict(ctx.leaves("calls", calls))
+    assert leaves["calls.length"] == "2"
+    assert leaves["calls[0]"] == "0x (empty)"
+    decoded, raw = leaves["calls[1]"].split("\n")
+    assert decoded == (
+        "Token.transfer(to: 0x000000000000000000000000000000000000bEEF, amount: 5)"
+        " + 1 trailing bytes"
+    )
+    assert raw.endswith("(69 bytes)")
+
+
+def test_model_reader_missing_symbols_are_free():
+    params = params_type(
+        [{"name": "x", "type": "uint256"}, {"name": "s", "type": "string"}]
+    )
+    reader = ModelReader(
+        {}, index_symbols(["p_x_uint256_aaaaaaa_00", "p_s_length_bbbbbbb_00"])
+    )
+    v = reader.read(params, "")
+    assert v.items[0].free and v.items[0].word == 0
+    assert v.items[1].free and v.items[1].data == b""
+    assert RenderContext().leaves("x", v.items[0]) == [("x", "0 (any value)")]
+
+
+def test_svm_value():
+    t, w, _ = svm_value(var("dolmos_d_int16_aaaaaaa_01", 0xFFFE, 16), "int16")
+    assert RenderContext().render_base(t, w) == "-2"
+
+    t, w, _ = svm_value(var("dolmos_s_bytes4_aaaaaaa_01", 0x2E1A7D4D, 32), "bytes4")
+    assert RenderContext(index=token_index()).render_base(t, w) == (
+        "0x2e1a7d4d (Token.withdraw(uint256))"
+    )
+
+    t, _, data = svm_value(var("dolmos_b_bytes_aaaaaaa_01", 0xABCD, 16), "bytes")
+    assert t.kind == "bytes" and data == b"\xab\xcd"
+
+
+#
+# rendering
+#
+
+
+def test_empty_selector_is_explained():
+    # halmos#419: 0x00000000 is rendered as the selector of plain ether transfers
+    ctx = RenderContext(index=token_index())
+    t = AbiType("base", "bytes4")
+    rendered = ctx.render_base(t, 0)
+    assert rendered.startswith("0x00000000 (no selector: empty calldata")
+    assert "receive()" in rendered
+
+    # unless some contract has a function with that selector
+    index = SelectorIndex(
+        [
+            (
+                "Vanity",
+                {
+                    "abi": [
+                        {
+                            "type": "function",
+                            "name": "wycpnbqcyf",
+                            "inputs": [],
+                            "outputs": [],
+                            "stateMutability": "nonpayable",
+                        }
+                    ]
+                },
+            )
+        ]
+    )
+    assert selector_of("wycpnbqcyf()") == EMPTY_SELECTOR
+    assert (
+        RenderContext(index=index).render_base(t, 0)
+        == "0x00000000 (Vanity.wycpnbqcyf())"
+    )
+
+
+@pytest.mark.parametrize(
+    "address",
+    [
+        # EIP-55 test vectors
+        "0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed",
+        "0xfB6916095ca1df60bB79Ce92cE3Ea74c37c5d359",
+        "0xdbF03B407c01E7cD3CBea99509d93f8DDDC8C6FB",
+        "0xD1220A0cf47c7B9Be7A2E6BA89F429762e7b9aDb",
+    ],
+)
+def test_checksum_address(address):
+    assert checksum_address(int(address, 16)) == address
+
+
+@pytest.mark.parametrize(
+    "value, bits, hint",
+    [
+        (2**256 - 1, 256, "type(uint256).max"),
+        (2**256 - 3, 256, "type(uint256).max - 2"),
+        (2**255, 256, "2**255"),
+        (10**18, 256, "1e18"),
+        (15 * 10**17, 256, "1.5e18"),
+        (6 * 2**64, 256, hex(6 * 2**64)),
+        (42, 256, None),
+        (255, 8, "type(uint8).max"),
+    ],
+)
+def test_uint_hint(value, bits, hint):
+    assert uint_hint(value, bits) == hint
+
+
+def test_compact_hex():
+    assert compact_hex(b"") == "0x"
+    assert compact_hex(bytes(1024)) == "0x00…00 (1024 zero bytes)"
+    assert compact_hex(b"\xab" + bytes(40)) == "0xab + 40 zero bytes"
+    assert compact_hex(b"\xab" + bytes(3)) == "0xab000000"
+
+
+def test_render_dirty_values():
+    ctx = RenderContext()
+    assert ctx.render_base(AbiType("base", "address"), 2**160).endswith(
+        "(not a valid address)"
+    )
+    assert ctx.render_base(AbiType("base", "int8"), 2**256 - 128) == (
+        "-128 (type(int8).min)"
+    )
+    assert ctx.render_base(AbiType("base", "int8"), 2**256 - 129).endswith(
+        "(not a valid int8)"
+    )
+
+
+#
+# duplicates (halmos#398)
+#
+
+
+def test_pcex_state_hides_duplicates():
+    state = PcexState()
+    assert state.admit("x = 0", is_valid=True)
+    assert not state.admit("x = 0", is_valid=True)
+    assert not state.admit("x = 0", is_valid=True)
+    assert state.admit("x = 1", is_valid=False)
+    assert not state.admit("x = 1", is_valid=False)
+    # a valid counterexample is shown even if an invalid one had the same values
+    assert state.admit("x = 1", is_valid=True)
+    assert not state.admit("x = 1", is_valid=False)
+    assert (state.shown, state.hidden) == (3, 4)
+
+
+#
+# reproduction
+#
+
+
+def test_base_literals():
+    assert base_literal(AbiType("base", "uint8"), 42) == "42"
+    assert base_literal(AbiType("base", "uint8"), 256) is None
+    assert base_literal(AbiType("base", "uint256"), 2**200) == hex(2**200)
+    assert base_literal(AbiType("base", "int8"), 2**256 - 128) == "type(int8).min"
+    assert base_literal(AbiType("base", "int16"), 2**256 - 3) == "-3"
+    assert base_literal(AbiType("base", "bool"), 1) == "true"
+    assert base_literal(AbiType("base", "bool"), 2) is None
+    assert (
+        base_literal(AbiType("base", "bytes4"), 0x12345678 << 224)
+        == "bytes4(0x12345678)"
+    )
+    assert base_literal(AbiType("base", "bytes4"), 1) is None
+    assert base_literal(AbiType("base", "address"), 0) == "address(0)"
+    assert (
+        base_literal(AbiType("base", "address", internal="contract IERC20"), 0xBEEF)
+        == "IERC20(payable(0x000000000000000000000000000000000000bEEF))"
+    )
+    assert (
+        base_literal(AbiType("base", "uint8", internal="enum Foo.Kind"), 2)
+        == "Foo.Kind(2)"
+    )
+    assert (
+        base_literal(AbiType("base", "uint256", internal="Price"), 7) == "Price.wrap(7)"
+    )
+
+
+def test_bytes_literals():
+    assert bytes_literal(b"") == '""'
+    assert bytes_literal(b"\xab\xcd") == 'hex"abcd"'
+    assert bytes_literal(bytes(100)) == "new bytes(100)"
+    assert (
+        bytes_literal(b"\xab" + bytes(100))
+        == 'abi.encodePacked(hex"ab", new bytes(100))'
+    )
+
+
+def test_codegen_structs_and_arrays():
+    params = params_type(
+        [
+            {
+                "name": "ps",
+                "type": "tuple[]",
+                "internalType": "struct T.Pair[]",
+                "components": [
+                    {"name": "a", "type": "uint256", "internalType": "uint256"},
+                    {"name": "b", "type": "int8", "internalType": "int8"},
+                ],
+            },
+            {"name": "fixedArr", "type": "uint16[3]", "internalType": "uint16[3]"},
+            {"name": "data", "type": "bytes", "internalType": "bytes"},
+        ]
+    )
+    data = abi_encode_args(params, [[(0, 0), (7, -3)], [0, 0, 9], b"\x01"])
+    v = abi_decode(params, data)
+
+    gen = CodeGen()
+    args = gen.args(params, v)
+    assert gen.ok
+    assert args == ["ps", "fixedArr", 'hex"01"']
+    assert gen.lines == [
+        "T.Pair[] memory ps = new T.Pair[](2);",
+        "ps[1].a = 7;",
+        "ps[1].b = -3;",
+        "uint16[3] memory fixedArr;",
+        "fixedArr[2] = 9;",
+    ]
+
+
+def test_codegen_rejects_dirty_values():
+    params = params_type([{"name": "x", "type": "uint8", "internalType": "uint8"}])
+    gen = CodeGen()
+    gen.args(params, abi_decode(params, word(300)))
+    assert not gen.ok
+
+
+def abi_encode_args(params: AbiType, values: list) -> bytes:
+    """encodes python values with the dolmos.pcex encoder (test helper)"""
+    from dolmos.pcex import Val
+
+    def to_val(t, value):
+        match t.kind:
+            case "base":
+                return Val(t, word=value % 2**256)
+            case "bytes" | "string":
+                return Val(t, data=value)
+            case "array" | "fixed":
+                return Val(t, items=[to_val(t.elem, x) for x in value])
+            case _:
+                return Val(
+                    t,
+                    items=[
+                        to_val(c, x) for c, x in zip(t.components, value, strict=True)
+                    ],
+                )
+
+    return abi_encode(to_val(params, values))
+
+
+def mk_call(fun_name, sig, inputs, symbols, target=None, contract=None, **refs):
+    return CallLayout(
+        contract=contract,
+        fun_name=fun_name,
+        fun_sig=sig,
+        inputs_json=json.dumps(inputs),
+        payable=False,
+        target=target,
+        sender=refs.get("sender", Ref()),
+        origin=refs.get("origin", Ref()),
+        value=refs.get("value", Ref(const=0)),
+        symbols=index_symbols(symbols),
+    )
+
+
+def test_render_counterexample_check_test():
+    inputs = [{"name": "x", "type": "uint256", "internalType": "uint256"}]
+    layout = CexLayout(
+        test_contract="FooTest",
+        test_source="test/Foo.t.sol",
+        fun_name="check_x",
+        fun_sig="check_x(uint256)",
+        is_invariant=False,
+        is_probe=False,
+        test_call=mk_call(
+            "check_x", "check_x(uint256)", inputs, ["p_x_uint256_aaaaaaa_00"]
+        ),
+        sequence=(),
+        render_ctx=RenderContext(index=token_index()),
+    )
+    model = model_of(
+        var("p_x_uint256_aaaaaaa_00", 10**18),
+        var("dolmos_sel_bytes4_bbbbbbb_01", 0, 32),
+        var("dolmos_n_uint8_ccccccc_02", 3, 8),
+    )
+    rendered = render_counterexample(layout, model)
+    assert rendered.body == [
+        "    x = 1000000000000000000 (1e18)",
+        "    Other symbols:",
+        "        n (uint8) = 3",
+        "        sel (bytes4) = 0x00000000 (no selector: empty calldata, i.e. receive() or "
+        "fallback(), e.g. a plain ether transfer)",
+    ]
+    function = repro_function(layout, rendered, 1)
+    assert function[0].startswith("Reproduce: add to FooTest (test/Foo.t.sol)")
+    assert function[1:] == [
+        "    function test_pcex_check_x_1() public {",
+        "        // values chosen for the symbols created by the test (replace the svm cheatcodes):",
+        '        //   svm.createUint(8, "n") = 3',
+        '        //   svm.createBytes4("sel") = 0x00000000 (no selector: empty calldata, i.e. '
+        "receive() or fallback(), e.g. a plain ether transfer)",
+        "        this.check_x(1000000000000000000);",
+        "    }",
+    ]
+
+
+def test_render_counterexample_invariant_sequence():
+    vault = 0xCCCC0000
+    sender = 0xABCD
+    inputs = [{"name": "amount", "type": "uint256", "internalType": "uint256"}]
+    deposit = replace(
+        mk_call(
+            "deposit",
+            "deposit(uint256)",
+            inputs,
+            ["p_amount_uint256_aaaaaaa_03"],
+            target=vault,
+            contract="Vault",
+            sender=Ref(symbol="dolmos_msg_sender_0xcccc0000_bbbbbbb_01"),
+            origin=Ref(symbol="dolmos_tx_origin_0xcccc0000_ccccccc_00"),
+            value=Ref(symbol="dolmos_msg_value_0xcccc0000_ddddddd_02"),
+        ),
+        payable=True,
+    )
+    layout = CexLayout(
+        test_contract="InvTest",
+        test_source=None,
+        fun_name="invariant_x",
+        fun_sig="invariant_x()",
+        is_invariant=True,
+        is_probe=False,
+        test_call=mk_call("invariant_x", "invariant_x()", [], []),
+        sequence=(deposit, deposit),
+        render_ctx=RenderContext(
+            addr_names={vault: "Vault"},
+            test_vars={vault: ("vault", "contract Vault")},
+            index=SelectorIndex(),
+        ),
+    )
+    model = model_of(
+        var("p_amount_uint256_aaaaaaa_03", 5),
+        var("dolmos_msg_sender_0xcccc0000_bbbbbbb_01", sender, 160),
+        var("dolmos_tx_origin_0xcccc0000_ccccccc_00", sender, 160),
+        var("dolmos_msg_value_0xcccc0000_ddddddd_02", 5),
+        var("dolmos_block_timestamp_depth1_eeeeeee", 100, 64),
+        var("dolmos_block_timestamp_depth2_fffffff", 200, 64),
+    )
+    rendered = render_counterexample(layout, model)
+    sender_str = checksum_address(sender)
+    assert rendered.body == [
+        "    Sequence:",
+        "        [1] Vault(vault).deposit(amount: 5)",
+        f"            msg.sender: {sender_str}, msg.value: 5",
+        "        [2] Vault(vault).deposit(amount: 5)",
+        f"            msg.sender: {sender_str}, msg.value: 5, block.timestamp: 100",
+        "        then invariant_x() at block.timestamp: 200",
+    ]
+    assert rendered.repro == [
+        f"vm.deal({sender_str}, 5);",
+        f"vm.prank({sender_str});",
+        "vault.deposit{value: 5}(5);",
+        "vm.warp(100);",
+        f"vm.deal({sender_str}, 5);",
+        f"vm.prank({sender_str});",
+        "vault.deposit{value: 5}(5);",
+        "vm.warp(200);",
+        "this.invariant_x();",
+    ]
+
+
+def test_render_trace_calls():
+    # calldata built by svm.createCalldata("Token"): selector + 2 symbolic words
+    to, amount = "p_to_address_aaaaaaa_05", "p_amount_uint256_bbbbbbb_06"
+    trace_call = TraceCall(
+        target=0xCCCC0000,
+        value=Ref(const=0),
+        segments=(
+            Segment(const=0xA9059CBB, size=32),
+            Segment(symbol=to, size=256),
+            Segment(symbol=amount, size=256),
+        ),
+    )
+    layout = CexLayout(
+        test_contract="T",
+        test_source=None,
+        fun_name="check_c",
+        fun_sig="check_c()",
+        is_invariant=False,
+        is_probe=False,
+        test_call=mk_call("check_c", "check_c()", [], []),
+        sequence=(),
+        render_ctx=RenderContext(
+            addr_names={0xCCCC0000: "Token"},
+            test_vars={0xCCCC0000: ("token", "contract Token")},
+            index=token_index(),
+        ),
+        trace_calls=(trace_call,),
+    )
+    rendered = render_counterexample(layout, model_of(var(to, 0xBEEF), var(amount, 7)))
+    assert rendered.body == [
+        "    Calls made with symbolic calldata:",
+        "        Token(token) ← Token.transfer("
+        "to: 0x000000000000000000000000000000000000bEEF, amount: 7)",
+    ]
+    assert rendered.repro[1] == (
+        "//   calldata sent to Token(token) = Token.transfer("
+        "to: 0x000000000000000000000000000000000000bEEF, amount: 7), i.e. "
+        'hex"a9059cbb000000000000000000000000000000000000000000000000000000000000beef'
+        '0000000000000000000000000000000000000000000000000000000000000007"'
+    )
+
+
+def test_segments_of():
+    x = BitVec("p_x_uint256_aaaaaaa_00", 256)
+    b = BitVec("dolmos_b_bool_bbbbbbb_01", 1)
+    from z3 import Concat, Extract, ZeroExt
+
+    expr = Concat(BitVecVal(0x12345678, 32), Extract(255, 248, x), ZeroExt(255, b))
+    segments = segments_of(expr)
+    call = TraceCall(target=None, value=Ref(), segments=tuple(segments))
+    model = model_of(
+        var("p_x_uint256_aaaaaaa_00", 0xAB << 248),
+        var("dolmos_b_bool_bbbbbbb_01", 1, 1),
+    )
+    assert call.calldata(model) == bytes.fromhex("12345678ab") + word(1)
+
+    # anything else than constants, symbols, extracts and zero extensions is not evaluated
+    assert segments_of(x + 1) is None
+
+
+#
+# EXP refinement (halmos#280)
+#
+
+
+def test_mk_exp_apps():
+    f = Function("f_evm_exp_256", BitVecSort(256), BitVecSort(256), BitVecSort(256))
+    x = BitVec("p_x_uint256_aaaaaaa_00", 256)
+    y = BitVec("p_y_uint256_bbbbbbb_00", 256)
+    three, ten = BitVecVal(3, 256), BitVecVal(10, 256)
+    apps = mk_exp_apps([f(x, three) == 27, f(ten, y) > 5, f(x, three) != f(x, y)])
+    assert apps.complete
+    found = {(a.base_value, a.exponent_value) for a in apps.apps}
+    assert found == {(None, 3), (10, None), (None, None)}
+    assert len(apps) == 3
+
+
+@pytest.mark.parametrize("base", [0, 1, 2, 3, 4, 10, 7, 2**255, 2**256 - 1])
+@pytest.mark.parametrize("exponent", [0, 1, 2, 5, 64, 127, 128, 255, 256, 300])
+def test_exp_table(base, exponent):
+    from z3 import parse_smt2_string
+
+    query = (
+        "(declare-fun e () (_ BitVec 256))\n"
+        "(declare-fun r () (_ BitVec 256))\n"
+        f"(assert (= e (_ bv{exponent} 256)))\n"
+        f"(assert (= r {exp_table(base, 'e', 'r')}))\n"
+    )
+    solver = Solver()
+    solver.add(parse_smt2_string(query))
+    assert solver.check() == sat
+    r = solver.model().eval(BitVec("r", 256), model_completion=True).as_long()
+
+    exact = base % 2 == 0 or base == 1 or exponent < 256
+    if exact:
+        assert r == pow(base, exponent, 2**256)
+
+
+@pytest.mark.parametrize("exponent", [0, 1, 2, 3, 10, 255, 2**20 + 3])
+def test_exp_square_and_multiply(exponent):
+    from z3 import parse_smt2_string
+
+    base = 0x123456789ABCDEF
+    query = (
+        "(declare-fun pcex_expb_0 () (_ BitVec 256))\n"
+        "(declare-fun pcex_expr_0 () (_ BitVec 256))\n"
+        f"(assert (= pcex_expb_0 (_ bv{base} 256)))\n"
+        + exp_square_and_multiply(0, exponent)
+    )
+    solver = Solver()
+    solver.add(parse_smt2_string(query))
+    assert solver.check() == sat
+    r = solver.model().eval(BitVec("pcex_expr_0", 256)).as_long()
+    assert r == pow(base, exponent, 2**256)
+
+
+def test_parse_exp_arg_values():
+    stdout = """sat
+    (define-fun pcex_expb_0 () (_ BitVec 256) (_ bv8 256))
+    (define-fun pcex_expe_0 () (_ BitVec 256) #x0000000000000000000000000000000000000000000000000000000000000003)
+    (define-fun |pcex_expr_0| () (_ BitVec 256) (_ bv27 256))
+    (define-fun pcex_expb_1 () (_ BitVec 256) (_ bv2 256))
+    """
+    assert parse_exp_arg_values(stdout) == {0: {"b": 8, "e": 3, "r": 27}, 1: {"b": 2}}
+
+
+def test_exp_invalid_reason():
+    apps = ExpApps((ExpApp("p_x", "p_y"), ExpApp("#x0a", "p_y", base_value=10)))
+    reason = exp_invalid_reason(apps, {0: {"b": 7, "e": 300, "r": 5}}, [0], [1])
+    assert reason.startswith("EXP is approximated: ")
+    assert "x ** y (symbolic base and exponent): the model takes 7 ** 300 = 5" in reason
+    assert "10 ** y: the solver did not report its operands" in reason
+    assert "vm.assume" in reason
+
+
+def yices_command() -> list[str] | None:
+    path = shutil.which("yices-smt2") or str(Path(sys.prefix) / "bin" / "yices-smt2")
+    if not os.path.exists(path):
+        return None
+    return [path, "--smt2-model-format", "--bvconst-in-decimal"]
+
+
+EXP_PRELUDE = (
+    "(declare-fun p_x_uint256_aaaaaaa_00 () (_ BitVec 256))\n"
+    "(declare-fun p_y_uint256_bbbbbbb_00 () (_ BitVec 256))\n"
+    "(declare-fun f_evm_exp_256 ((_ BitVec 256) (_ BitVec 256)) (_ BitVec 256))\n"
+)
+
+
+def solve_exp_query(tmp_path, assertions: str, apps: ExpApps):
+    command = yices_command()
+    if command is None:
+        pytest.skip("yices-smt2 not found")
+
+    args = default_config().with_overrides(
+        source=ConfigSource.command_line,
+        solver_command=shlex.join(command),
+        pretty_counterexamples=True,
+    )
+    ctx = PathContext(
+        args=args,
+        path_id=1,
+        solving_ctx=SolvingContext(dump_dir=tmp_path),
+        query=SMTQuery(EXP_PRELUDE + assertions, []),
+        exp_apps=apps,
+    )
+    return solve_end_to_end(ctx)
+
+
+X, Y = "p_x_uint256_aaaaaaa_00", "p_y_uint256_bbbbbbb_00"
+BV3 = "(_ bv3 256)"
+
+
+def test_exp_refinement_constant_exponent(tmp_path):
+    # x ** 3 == 27: the abstraction allows any x, the real EXP only x == 3
+    out = solve_exp_query(
+        tmp_path,
+        f"(assert (= (f_evm_exp_256 {X} {BV3}) (_ bv27 256)))\n",
+        ExpApps((ExpApp(X, BV3, exponent_value=3),)),
+    )
+    assert out.result == sat
+    assert out.model.is_valid
+    assert out.model.model[X].value == 3
+
+
+def test_exp_refinement_proves_absence(tmp_path):
+    # 10 ** y == 5 has no solution, but the abstraction has one
+    ten = "(_ bv10 256)"
+    out = solve_exp_query(
+        tmp_path,
+        f"(assert (= (f_evm_exp_256 {ten} {Y}) (_ bv5 256)))\n",
+        ExpApps((ExpApp(ten, Y, base_value=10),)),
+    )
+    assert str(out.result) == "unsat"
+
+
+def test_exp_refinement_gives_up_with_a_reason(tmp_path):
+    # x ** y == 3 with an even x has no solution, and infinitely many candidate points
+    out = solve_exp_query(
+        tmp_path,
+        f"(assert (= (f_evm_exp_256 {X} {Y}) {BV3}))\n"
+        f"(assert (= ((_ extract 0 0) {X}) #b0))\n"
+        f"(assert (bvugt {Y} (_ bv0 256)))\n",
+        ExpApps((ExpApp(X, Y),)),
+    )
+    assert out.result == sat
+    assert not out.model.is_valid
+    assert "symbolic base and exponent" in out.invalid_reason
+
+
+def test_exp_arg_decls():
+    decls = exp_arg_decls(ExpApps((ExpApp(X, BV3, exponent_value=3),)))
+    assert f"(assert (= pcex_expb_0 {X}))" in decls
+    assert "(assert (= pcex_expr_0 (f_evm_exp_256 pcex_expb_0 pcex_expe_0)))" in decls
+
+
+#
+# end to end, on tests/regression/test/PrettyCex.t.sol
+#
+
+ANSI_ESCAPE = __import__("re").compile(r"\x1b\[[0-9;]*m")
+
+
+def run_pretty_cex_test(capsys, *args):
+    from dolmos.__main__ import _main
+
+    result = _main(["--root", "tests/regression", "--contract", "PrettyCexTest", *args])
+    out = ANSI_ESCAPE.sub("", capsys.readouterr().out)
+    return result.test_results["test/PrettyCex.t.sol:PrettyCexTest"], out
+
+
+def test_pretty_counterexamples_end_to_end(capsys):
+    # the state variables of the test (`token` below) are read through the solidity storage
+    # layout: pin it, as the CI matrix also runs with --storage-layout generic
+    results, out = run_pretty_cex_test(capsys, "-pcex", "--storage-layout", "solidity")
+
+    # the verdicts and counts are the same as without the option
+    assert {r.name: (r.exitcode, r.num_models) for r in results} == {
+        "check_pcex_calldata(bytes)": (1, 1),
+        "check_pcex_duplicates(uint256)": (1, 3),
+        "check_pcex_exp(uint256)": (1, 1),
+        "check_pcex_selector(bytes)": (1, 1),
+        "invariant_pcex_balance()": (1, 1),
+    }
+
+    # halmos#398: duplicates are counted, not printed
+    assert out.count("Counterexample: check_pcex_duplicates(uint256)\n    x = 0\n") == 1
+    assert "2 duplicate counterexamples not shown" in out
+
+    # halmos#280: the approximation of x ** 3 is refined, giving the real counterexample
+    assert "Counterexample: check_pcex_exp(uint256)\n    x = 3\n" in out
+    assert "potentially invalid" not in out
+
+    # halmos#369: calldata decoded with the ABI of the target
+    assert "    data = PcexToken.transfer(to: 0x" in out
+    assert "trailing zero bytes\n" in out
+
+    # halmos#419: the empty selector is explained
+    assert "selector (bytes4) = 0x00000000 (no selector: empty calldata" in out
+    assert 'this.check_pcex_selector("");' in out
+
+    # invariant call sequence and its reproduction through the state variable of the test
+    assert "        [1] PcexToken(token).transfer(to: 0x" in out
+    assert "        token.transfer(0x" in out
+    assert "        this.invariant_pcex_balance();" in out
+
+
+def test_pretty_counterexamples_generic_storage_layout(capsys):
+    # without the solidity storage layout, the state variable holding the target is unknown:
+    # the call sequence falls back to the raw address, with a note in the reproduction
+    results, out = run_pretty_cex_test(
+        capsys,
+        "-pcex",
+        "--storage-layout",
+        "generic",
+        "--match-test",
+        "^invariant_pcex_balance",
+    )
+    assert [(r.exitcode, r.num_models) for r in results] == [(1, 1)]
+    assert "        [1] PcexToken@0x" in out
+    assert "is the address of PcexToken in dolmos" in out
+
+
+def test_early_exit_does_not_report_cancelled_queries(capsys, caplog):
+    # halmos#398 requires --early-exit to work: the queries cancelled once a counterexample is
+    # found are neither solver errors nor failed queries
+    results, out = run_pretty_cex_test(
+        capsys, "--match-test", "^check_pcex_duplicates", "--early-exit"
+    )
+    assert [(r.exitcode, r.num_models >= 1) for r in results] == [(1, True)]
+    assert "executor has been shutdown" not in caplog.text
+    assert "[ERROR]" not in out
+    assert "Error queries saved" not in out
diff --git a/tests/test_prank.py b/tests/test_prank.py
index ec5ee7acb..a7c2d45fa 100644
--- a/tests/test_prank.py
+++ b/tests/test_prank.py
@@ -1,14 +1,14 @@
 import pytest
 from z3 import BitVec
 
-from halmos.cheatcodes import (
+from dolmos.cheatcodes import (
     NO_PRANK,
     Prank,
     PrankResult,
-    halmos_cheat_code,
     hevm_cheat_code,
+    svm_cheat_code,
 )
-from halmos.sevm import CallContext, Message
+from dolmos.sevm import CallContext, Message
 
 
 @pytest.fixture
@@ -99,7 +99,7 @@ def test_lookup_no_active_prank(prank, other):
     # when we call lookup() without an active prank, it returns NO_PRANK
     assert prank.lookup(other) == NO_PRANK
     assert prank.lookup(hevm_cheat_code.address) == NO_PRANK
-    assert prank.lookup(halmos_cheat_code.address) == NO_PRANK
+    assert prank.lookup(svm_cheat_code.address) == NO_PRANK
 
 
 def test_prank_lookup(prank, sender, other):
@@ -107,7 +107,7 @@ def test_prank_lookup(prank, sender, other):
     prank.prank(sender)
 
     # when calling lookup(to=<cheat-address>)
-    for cheat_code in [hevm_cheat_code, halmos_cheat_code]:
+    for cheat_code in [hevm_cheat_code, svm_cheat_code]:
         result = prank.lookup(cheat_code.address)
 
         # then the active prank is ignored
@@ -130,7 +130,7 @@ def test_startPrank_lookup(prank, sender, origin, other):
     prank.startPrank(sender, origin)
 
     # when calling lookup(to=<cheat-address>)
-    for cheat_code in [hevm_cheat_code, halmos_cheat_code]:
+    for cheat_code in [hevm_cheat_code, svm_cheat_code]:
         result = prank.lookup(cheat_code.address)
 
         # then the active prank is ignored
diff --git a/tests/test_sevm.py b/tests/test_sevm.py
index ef05c2af0..6a91b2dda 100644
--- a/tests/test_sevm.py
+++ b/tests/test_sevm.py
@@ -13,16 +13,16 @@
     ZeroExt,
 )
 
-from halmos.__main__ import mk_block
-from halmos.bitvec import HalmosBitVec as BV
-from halmos.bytevec import ByteVec
-from halmos.exceptions import (
+from dolmos.__main__ import mk_block
+from dolmos.bitvec import DolmosBitVec as BV
+from dolmos.bytevec import ByteVec
+from dolmos.exceptions import (
     InvalidJumpDestError,
     InvalidOpcode,
     OutOfGasError,
     StackUnderflowError,
 )
-from halmos.sevm import (
+from dolmos.sevm import (
     SEVM,
     CallContext,
     Contract,
@@ -40,7 +40,7 @@
     uint160,
     uint256,
 )
-from halmos.utils import EVM
+from dolmos.utils import EVM
 
 caller = BitVec("msg_sender", 160)
 origin = BitVec("tx_origin", 160)
diff --git a/tests/test_solve.py b/tests/test_solve.py
index 7f9d76cb4..d08d5b830 100644
--- a/tests/test_solve.py
+++ b/tests/test_solve.py
@@ -1,12 +1,20 @@
 import pytest
+from eth_hash.auto import keccak
+from z3 import sat, unknown, unsat
 
-from halmos.solve import ModelVariable, parse_model_str
+from dolmos.solve import (
+    ModelVariable,
+    keccak_fact,
+    parse_model_str,
+    parse_sha3_arg_values,
+    sha3_arg_decls,
+)
 
 
 @pytest.mark.parametrize(
     "full_name",
     [
-        "halmos_y_uint256_043cfd7_01",
+        "dolmos_y_uint256_043cfd7_01",
         "p_y_uint256_043cfd7_01",
     ],
 )
@@ -32,7 +40,7 @@ def test_smtlib_z3_bv_output(full_name):
 @pytest.mark.parametrize(
     "full_name",
     [
-        "halmos_z_uint256_cabf047_02",
+        "dolmos_z_uint256_cabf047_02",
         "p_z_uint256_cabf047_02",
     ],
 )
@@ -58,7 +66,7 @@ def test_smtlib_yices_binary_output(full_name):
 @pytest.mark.parametrize(
     "full_name",
     [
-        "halmos_z_uint256_11ce021_08",
+        "dolmos_z_uint256_11ce021_08",
         "p_z_uint256_11ce021_08",
     ],
 )
@@ -81,7 +89,7 @@ def test_smtlib_yices_decimal_output(full_name):
 @pytest.mark.parametrize(
     "full_name",
     [
-        "halmos_x_uint8_043cfd7_01",
+        "dolmos_x_uint8_043cfd7_01",
         "p_x_uint8_043cfd7_01",
     ],
 )
@@ -110,3 +118,87 @@ def test_smtlib_stp_output(full_name):
         size_bits=8,
         value=4,
     )
+
+
+@pytest.mark.parametrize(
+    "smtlib_str",
+    [
+        # z3
+        "(define-fun sha3arg_0 () (_ BitVec 256)\n  #x000000000000000000000000000000000000000000000000000000000000002a)"
+        "(define-fun sha3arg_1 () (_ BitVec 16) #x0001)",
+        # yices --smt2-model-format --bvconst-in-decimal
+        "(define-fun sha3arg_0 () (_ BitVec 256) (_ bv42 256))"
+        "(define-fun sha3arg_1 () (_ BitVec 16) (_ bv1 16))",
+        # yices --smt2-model-format
+        "(define-fun sha3arg_0 () (_ BitVec 256) #b" + "0" * 250 + "101010)"
+        "(define-fun sha3arg_1 () (_ BitVec 16) #b0000000000000001)",
+    ],
+)
+def test_parse_sha3_arg_values(smtlib_str):
+    values = parse_sha3_arg_values(
+        "sat\n(define-fun p_x_uint256_00 () (_ BitVec 256) (_ bv7 256))\n" + smtlib_str
+    )
+    assert values == {0: (256, 42), 1: (16, 1)}
+
+
+def test_keccak_fact():
+    fact, hash_value = keccak_fact(256, 42)
+    expected = int.from_bytes(keccak((42).to_bytes(32, "big")), "big")
+    assert hash_value == expected
+    assert fact == f"(assert (= (f_sha3_256 (_ bv42 256)) (_ bv{expected} 256)))\n"
+
+
+def test_sha3_arg_decls():
+    decls = sha3_arg_decls(((256, "p_x_uint256_00"), (512, "(concat a b)")))
+    assert decls == (
+        "(declare-fun sha3arg_0 () (_ BitVec 256))\n"
+        "(assert (= sha3arg_0 p_x_uint256_00))\n"
+        "(declare-fun sha3arg_1 () (_ BitVec 512))\n"
+        "(assert (= sha3arg_1 (concat a b)))\n"
+    )
+
+
+def _refine_keccak_setup(tmp_path, monkeypatch, refined_results):
+    """runs refine_keccak on a sat model whose keccak preimage is 0, with mocked solver results"""
+    import dolmos.solve as solve_mod
+    from dolmos.config import default_config
+    from dolmos.sevm import SMTQuery
+    from dolmos.solve import PathContext, PotentialModel, SolverOutput, SolvingContext
+
+    ctx = PathContext(
+        args=default_config(),
+        path_id=0,
+        solving_ctx=SolvingContext(dump_dir=tmp_path),
+        query=SMTQuery("", []),
+        sha3_args=((256, "p_x_uint256_00"),),
+    )
+
+    def mk_output(result, index):
+        query_file = str(tmp_path / f"{index}.smt2")
+        with open(f"{query_file}.out", "w") as f:
+            f.write(f"(define-fun sha3arg_0 () (_ BitVec 256) (_ bv{index} 256))\n")
+        model = PotentialModel(model={}, is_valid=True) if result == sat else None
+        return SolverOutput(result, 0, 0, query_file, model=model)
+
+    outputs = iter(mk_output(r, i + 1) for i, r in enumerate(refined_results))
+    monkeypatch.setattr(solve_mod, "solve_low_level", lambda _ctx: next(outputs))
+    return solve_mod.refine_keccak(ctx, mk_output(sat, 0))
+
+
+def test_refine_keccak_unsat(tmp_path, monkeypatch):
+    # the refined query is unsat: no counterexample under the real keccak values
+    assert _refine_keccak_setup(tmp_path, monkeypatch, [unsat]).result == unsat
+
+
+def test_refine_keccak_undecided_keeps_counterexample(tmp_path, monkeypatch):
+    # the refined query times out: the counterexample is kept, as potentially invalid
+    out = _refine_keccak_setup(tmp_path, monkeypatch, [unknown])
+    assert out.result == sat
+    assert not out.model.is_valid
+
+
+def test_refine_keccak_rounds_exhausted(tmp_path, monkeypatch):
+    # every round picks a new preimage: potentially invalid after the last round
+    out = _refine_keccak_setup(tmp_path, monkeypatch, [sat, sat, sat])
+    assert out.result == sat
+    assert not out.model.is_valid
diff --git a/tests/test_source_map.py b/tests/test_source_map.py
index fd0772676..ce0e0a967 100644
--- a/tests/test_source_map.py
+++ b/tests/test_source_map.py
@@ -3,7 +3,7 @@
 
 import pytest
 
-from halmos.mapper import SourceFileMap
+from dolmos.mapper import SourceFileMap
 
 
 @pytest.fixture
diff --git a/tests/test_traces.py b/tests/test_traces.py
index d6dc22d53..3a88f972a 100644
--- a/tests/test_traces.py
+++ b/tests/test_traces.py
@@ -13,11 +13,11 @@
     is_bv,
 )
 
-import halmos.sevm
-from halmos.__main__ import mk_block, render_trace
-from halmos.bytevec import ByteVec
-from halmos.exceptions import MessageDepthLimitError, Revert, WriteInStaticContext
-from halmos.sevm import (
+import dolmos.sevm
+from dolmos.__main__ import mk_block, render_trace
+from dolmos.bytevec import ByteVec
+from dolmos.exceptions import MessageDepthLimitError, Revert, WriteInStaticContext
+from dolmos.sevm import (
     SEVM,
     ZERO,
     CallContext,
@@ -31,7 +31,7 @@
     con,
     int_of,
 )
-from halmos.utils import EVM
+from dolmos.utils import EVM
 
 # keccak256("FooEvent()")
 FOO_EVENT_SIG = 0x34E21A9428B1B47E73C4E509EABEEA7F2B74BECA07D82AAC87D4DD28B74C2A4A
@@ -730,7 +730,7 @@ def test_static_context_propagates(sevm: SEVM, solver):
     assert next(inner_call.logs(), None) is None
 
 
-def test_halmos_exception_halts_path(sevm: SEVM, solver):
+def test_dolmos_exception_halts_path(sevm: SEVM, solver):
     _, runtime_hexcode = get_bytecode(
         """
         contract Foo {
@@ -853,7 +853,7 @@ def test_call_limit_with_create(monkeypatch, sevm: SEVM, solver):
 
     # override the call depth limit to 3 (the test runs faster)
     MAX_CALL_DEPTH_OVERRIDE = 3
-    monkeypatch.setattr(halmos.sevm, "MAX_CALL_DEPTH", MAX_CALL_DEPTH_OVERRIDE)
+    monkeypatch.setattr(dolmos.sevm, "MAX_CALL_DEPTH", MAX_CALL_DEPTH_OVERRIDE)
 
     (is_single_exec, output_exec) = single(sevm.run(input_exec))
     assert is_single_exec
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 36e144d59..471c16124 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -12,8 +12,8 @@
     simplify,
 )
 
-from halmos.solve import dirname
-from halmos.utils import (
+from dolmos.solve import dirname
+from dolmos.utils import (
     f_sha3_256,
     match_dynamic_array_overflow_condition,
 )
diff --git a/tests/test_vyper.py b/tests/test_vyper.py
new file mode 100644
index 000000000..769fa8d25
--- /dev/null
+++ b/tests/test_vyper.py
@@ -0,0 +1,330 @@
+import json
+
+import pytest
+
+from dolmos.__main__ import is_invalid_opcode_found, load_config, with_vyper_defaults
+from dolmos.build import (
+    VYPER_VERSION_PREFIX,
+    build_out_view,
+    build_output_iterator,
+    get_source_path,
+    has_vyper_contracts,
+    load_forge_cache,
+    normalize_vyper_artifact,
+    parse_build_out,
+    parse_devdoc,
+    parse_natspec,
+    parse_vyper_docstrings,
+)
+from dolmos.bytevec import ByteVec
+from dolmos.config import ConfigSource
+from dolmos.exceptions import InvalidOpcode, Revert
+
+VYPER_SOURCE = '''# pragma version ~=0.4.3
+"""
+@title Test
+@custom:dolmos --loop 4
+"""
+
+counter: uint256
+
+
+@external
+def check_one(x: uint256):
+    """
+    @notice first
+    @custom:halmos --default-bytes-lengths 0,10
+    """
+    assert x != 1, UNREACHABLE
+
+
+@external
+def check_multiline(
+    x: uint256,
+    y: DynArray[uint256, 3],
+) -> uint256:  # trailing comment
+    \'\'\'
+    @custom:dolmos --loop 5
+    \'\'\'
+    return x
+
+
+@external
+def no_doc(x: uint256):
+    pass
+'''
+
+ABI = [
+    {
+        "type": "function",
+        "name": "check_one",
+        "inputs": [{"name": "x", "type": "uint256"}],
+        "outputs": [],
+        "stateMutability": "nonpayable",
+    },
+    {
+        "type": "function",
+        "name": "check_multiline",
+        "inputs": [
+            {"name": "x", "type": "uint256"},
+            {"name": "y", "type": "uint256[]"},
+        ],
+        "outputs": [{"name": "", "type": "uint256"}],
+        "stateMutability": "nonpayable",
+    },
+    {
+        "type": "function",
+        "name": "no_doc",
+        "inputs": [{"name": "x", "type": "uint256"}],
+        "outputs": [],
+        "stateMutability": "nonpayable",
+    },
+]
+
+
+def forge_vyper_artifact():
+    # the shape of the artifacts emitted by forge for vyper
+    return {
+        "abi": ABI,
+        "bytecode": {"object": "0x6000"},
+        "deployedBytecode": {"object": "0x5f5ffd"},
+        "methodIdentifiers": {},
+        "id": 1,
+    }
+
+
+def test_parse_vyper_docstrings():
+    module_doc, function_docs = parse_vyper_docstrings(VYPER_SOURCE)
+
+    assert parse_natspec({"text": module_doc}) == "--loop 4"
+    assert set(function_docs) == {"check_one", "check_multiline"}
+    assert (
+        parse_natspec({"text": function_docs["check_one"]})
+        == "--default-bytes-lengths 0,10"
+    )
+    assert parse_natspec({"text": function_docs["check_multiline"]}) == "--loop 5"
+
+
+def test_parse_vyper_docstrings_none():
+    assert parse_vyper_docstrings("x: uint256\n") == (None, {})
+
+
+@pytest.fixture
+def vyper_project(tmp_path):
+    (tmp_path / "test").mkdir()
+    (tmp_path / "test" / "Foo.vy").write_text(VYPER_SOURCE)
+
+    out = tmp_path / "out"
+    (out / "Foo.vy").mkdir(parents=True)
+    (out / "Foo.vy" / "Foo.json").write_text(json.dumps(forge_vyper_artifact()))
+
+    (tmp_path / "cache").mkdir()
+    cache = {
+        "files": {
+            "test/Foo.vy": {
+                "sourceName": "test/Foo.vy",
+                "artifacts": {
+                    "Foo": {
+                        "0.4.3": {
+                            "default": {
+                                "path": "Foo.vy/Foo.json",
+                                "build_id": "x",
+                            }
+                        }
+                    }
+                },
+            }
+        }
+    }
+    (tmp_path / "cache" / "solidity-files-cache.json").write_text(json.dumps(cache))
+    return tmp_path
+
+
+def test_load_forge_cache(vyper_project):
+    cache = load_forge_cache(str(vyper_project), str(vyper_project / "out"))
+    assert cache == {"Foo.vy/Foo.json": ("test/Foo.vy", "0.4.3")}
+
+
+def test_load_forge_cache_missing(tmp_path):
+    assert load_forge_cache(str(tmp_path), str(tmp_path / "out")) == {}
+
+
+def test_normalize_vyper_artifact(vyper_project):
+    json_out = forge_vyper_artifact()
+    contract_type, version, natspec = normalize_vyper_artifact(
+        json_out, "Foo.vy", str(vyper_project), ("test/Foo.vy", "0.4.3")
+    )
+
+    assert contract_type == "contract"
+    assert version == VYPER_VERSION_PREFIX + "0.4.3"
+    assert parse_natspec(natspec) == "--loop 4"
+
+    assert set(json_out["methodIdentifiers"]) == {
+        "check_one(uint256)",
+        "check_multiline(uint256,uint256[])",
+        "no_doc(uint256)",
+    }
+    assert json_out["methodIdentifiers"]["check_one(uint256)"] == "48ad1bf6"
+    assert get_source_path(json_out) == "test/Foo.vy"
+    assert json_out["bytecode"]["linkReferences"] == {}
+    assert json_out["metadata"]["compiler"]["version"] == "0.4.3"
+
+    assert (
+        parse_devdoc("check_one(uint256)", json_out) == "--default-bytes-lengths 0,10"
+    )
+    assert parse_devdoc("check_multiline(uint256,uint256[])", json_out) == "--loop 5"
+    assert parse_devdoc("no_doc(uint256)", json_out) is None
+
+
+def test_normalize_vyper_selector():
+    # keccak256("transfer(address,uint256)")[:4]
+    json_out = {
+        "abi": [
+            {
+                "type": "function",
+                "name": "transfer",
+                "inputs": [
+                    {"name": "to", "type": "address"},
+                    {"name": "amount", "type": "uint256"},
+                ],
+                "outputs": [{"name": "", "type": "bool"}],
+                "stateMutability": "nonpayable",
+            },
+            {"type": "event", "name": "Transfer", "inputs": [], "anonymous": False},
+        ],
+        "bytecode": {"object": "0x"},
+        "deployedBytecode": {"object": "0x"},
+    }
+    normalize_vyper_artifact(json_out, "Token.vy", "/nonexistent", None)
+    assert json_out["methodIdentifiers"] == {"transfer(address,uint256)": "a9059cbb"}
+
+
+def test_normalize_vyper_interface_and_no_cache():
+    json_out = {"abi": [], "bytecode": {"object": "0x"}, "deployedBytecode": {}}
+    contract_type, version, natspec = normalize_vyper_artifact(
+        json_out, "IFoo.vyi", "/nonexistent", None
+    )
+    assert contract_type == "interface"
+    assert version == VYPER_VERSION_PREFIX + "unknown"
+    assert natspec is None
+    assert get_source_path(json_out) == "IFoo.vyi"
+    assert json_out["deployedBytecode"]["object"] == "0x"
+
+
+def test_parse_build_out_vyper(vyper_project):
+    args = load_config(["--root", str(vyper_project)])
+    build_out = parse_build_out(args)
+
+    assert list(build_out) == [VYPER_VERSION_PREFIX + "0.4.3"]
+    assert has_vyper_contracts(build_out)
+
+    [(view, filename, contract_name)] = list(build_output_iterator(build_out))
+    assert (filename, contract_name) == ("Foo.vy", "Foo")
+
+    json_out, contract_type, natspec = view[filename][contract_name]
+    assert contract_type == "contract"
+    assert "check_one(uint256)" in json_out["methodIdentifiers"]
+    assert parse_natspec(natspec) == "--loop 4"
+
+
+def test_build_out_view():
+    sol = {"A.sol": {"A": None}}
+    vy1 = {"B.vy": {"B": None}}
+    vy2 = {"C.vy": {"C": None}}
+    build_out = {
+        "0.8.30": sol,
+        VYPER_VERSION_PREFIX + "0.4.3": vy1,
+        VYPER_VERSION_PREFIX + "0.3.10": vy2,
+    }
+
+    assert set(build_out_view(build_out, "0.8.30")) == {"A.sol", "B.vy", "C.vy"}
+    assert set(build_out_view(build_out, VYPER_VERSION_PREFIX + "0.4.3")) == {
+        "A.sol",
+        "B.vy",
+        "C.vy",
+    }
+
+    # solidity is not shared with vyper groups if the solc version is ambiguous
+    build_out["0.7.6"] = {"D.sol": {"D": None}}
+    assert set(build_out_view(build_out, VYPER_VERSION_PREFIX + "0.4.3")) == {
+        "B.vy",
+        "C.vy",
+    }
+
+    # no vyper: unchanged, same object
+    assert build_out_view({"0.8.30": sol}, "0.8.30") is sol
+
+    # every contract is iterated exactly once
+    iterated = [(f, c) for _, f, c in build_output_iterator(build_out)]
+    assert sorted(iterated) == [
+        ("A.sol", "A"),
+        ("B.vy", "B"),
+        ("C.vy", "C"),
+        ("D.sol", "D"),
+    ]
+
+
+def test_with_vyper_defaults():
+    args = with_vyper_defaults(load_config([]))
+    assert args.storage_layout == "generic"
+    assert args.invalid_as_failure
+
+    # explicit settings win
+    args = with_vyper_defaults(load_config(["--storage-layout", "solidity"]))
+    assert args.storage_layout == "solidity"
+    assert args.invalid_as_failure
+
+    # annotations applied later still win over the vyper defaults
+    args = with_vyper_defaults(load_config([]))
+    args = args.with_overrides(
+        ConfigSource.contract_annotation, storage_layout="solidity"
+    )
+    assert args.storage_layout == "solidity"
+
+
+def test_invalid_as_failure_default():
+    assert not load_config([]).invalid_as_failure
+    assert load_config(["--invalid-as-failure"]).invalid_as_failure
+
+
+class FakeOutput:
+    def __init__(self, error=None, data=b""):
+        self.error = error
+        self.data = ByteVec(data)
+
+
+class FakeContext:
+    def __init__(self, error=None, data=b"", subcalls=()):
+        self.output = FakeOutput(error, data)
+        self._subcalls = list(subcalls)
+
+    def last_subcall(self):
+        return self._subcalls[-1] if self._subcalls else None
+
+
+def test_is_invalid_opcode_found():
+    invalid = FakeContext(InvalidOpcode(0xFE))
+    empty_revert = FakeContext(Revert())
+    ok = FakeContext()
+
+    # directly
+    assert is_invalid_opcode_found(invalid)
+
+    # bubbled up through empty reverts
+    assert is_invalid_opcode_found(FakeContext(Revert(), subcalls=[invalid]))
+    assert is_invalid_opcode_found(
+        FakeContext(Revert(), subcalls=[FakeContext(Revert(), subcalls=[invalid])])
+    )
+
+    # not an INVALID failure
+    assert not is_invalid_opcode_found(ok)
+    assert not is_invalid_opcode_found(empty_revert)
+    assert not is_invalid_opcode_found(FakeContext(Revert(), subcalls=[ok]))
+
+    # the revert carries its own data, so it's not the bubbled-up INVALID failure
+    assert not is_invalid_opcode_found(
+        FakeContext(Revert(), data=b"\x08\xc3\x79\xa0", subcalls=[invalid])
+    )
+
+    # the INVALID failure was caught: the call succeeded
+    assert not is_invalid_opcode_found(FakeContext(subcalls=[invalid]))
diff --git a/tests/vyper/foundry.toml b/tests/vyper/foundry.toml
new file mode 100644
index 000000000..6839b0d23
--- /dev/null
+++ b/tests/vyper/foundry.toml
@@ -0,0 +1,11 @@
+[profile.default]
+src = 'src'
+out = 'out'
+libs = ['../lib', 'lib']
+
+evm_version = 'cancun'
+
+force = false
+
+# compile options used by dolmos (to prevent unnecessary recompilation when running forge test and dolmos together)
+extra_output = ["storageLayout", "metadata"]
diff --git a/tests/vyper/remappings.txt b/tests/vyper/remappings.txt
new file mode 100644
index 000000000..30f1086e1
--- /dev/null
+++ b/tests/vyper/remappings.txt
@@ -0,0 +1,3 @@
+openzeppelin/=../lib/openzeppelin-contracts/contracts/
+ds-test/=../lib/forge-std/lib/ds-test/src/
+forge-std/=../lib/forge-std/src/
diff --git a/tests/vyper/src/Counter.vy b/tests/vyper/src/Counter.vy
new file mode 100644
index 000000000..da8f233a4
--- /dev/null
+++ b/tests/vyper/src/Counter.vy
@@ -0,0 +1,15 @@
+# pragma version ~=0.4.3
+"""
+@title Counter with a bug
+"""
+
+count: public(uint256)
+
+
+@external
+def add(x: uint256):
+    # bug: resets the counter instead of adding 13
+    if x == 13:
+        self.count = 0
+        return
+    self.count += x
diff --git a/tests/vyper/src/Immutable.vy b/tests/vyper/src/Immutable.vy
new file mode 100644
index 000000000..2a9830222
--- /dev/null
+++ b/tests/vyper/src/Immutable.vy
@@ -0,0 +1,14 @@
+# pragma version ~=0.4.3
+
+LIMIT: public(immutable(uint256))
+
+
+@deploy
+def __init__(limit: uint256):
+    LIMIT = limit
+
+
+@view
+@external
+def under(x: uint256) -> bool:
+    return x <= LIMIT
diff --git a/tests/vyper/src/Vault.vy b/tests/vyper/src/Vault.vy
new file mode 100644
index 000000000..112df63a3
--- /dev/null
+++ b/tests/vyper/src/Vault.vy
@@ -0,0 +1,21 @@
+# pragma version ~=0.4.3
+
+balanceOf: public(HashMap[address, uint256])
+total: public(uint256)
+
+
+@external
+def deposit(amount: uint256):
+    self.balanceOf[msg.sender] += amount
+    self.total += amount
+
+
+@external
+def withdraw(amount: uint256):
+    self.balanceOf[msg.sender] -= amount
+    self.total -= amount
+
+
+@external
+def boom(x: uint256):
+    assert x != 42, UNREACHABLE
diff --git a/tests/vyper/test/CounterTest.vy b/tests/vyper/test/CounterTest.vy
new file mode 100644
index 000000000..426ff2eb8
--- /dev/null
+++ b/tests/vyper/test/CounterTest.vy
@@ -0,0 +1,71 @@
+# pragma version ~=0.4.3
+"""
+@title Symbolic tests written in Vyper
+@custom:dolmos --loop 3
+"""
+
+interface ICounter:
+    def count() -> uint256: view
+    def add(x: uint256): nonpayable
+
+
+interface Vm:
+    def assume(c: bool): nonpayable
+    def assertEq(a: uint256, b: uint256): nonpayable
+    def getCode(path: String[64]) -> Bytes[4096]: view
+
+
+VM: constant(address) = 0x7109709ECfa91a80626fF3989D68f67F5b1DD12D
+
+counter: ICounter
+
+
+@external
+def setUp():
+    code: Bytes[4096] = staticcall Vm(VM).getCode("Counter.vy:Counter")
+    self.counter = ICounter(raw_create(code))
+
+
+@external
+def check_add_unreachable(x: uint256):
+    # expected to fail (x == 13): UNREACHABLE compiles to the INVALID opcode
+    before: uint256 = staticcall self.counter.count()
+    extcall self.counter.add(x)
+    assert staticcall self.counter.count() == before + x, UNREACHABLE
+
+
+@external
+def check_add_cheatcode(x: uint256):
+    # expected to fail (x == 13): hevm assertion cheatcodes work from vyper too
+    before: uint256 = staticcall self.counter.count()
+    extcall self.counter.add(x)
+    extcall Vm(VM).assertEq(staticcall self.counter.count(), before + x)
+
+
+@external
+def check_add_ok(x: uint256):
+    extcall Vm(VM).assume(x != 13)
+    before: uint256 = staticcall self.counter.count()
+    extcall self.counter.add(x)
+    assert staticcall self.counter.count() == before + x, UNREACHABLE
+
+
+@external
+def check_plain_assert(x: uint256):
+    # a plain `assert` is an empty revert, indistinguishable from a `require`:
+    # the path is discarded, not reported
+    assert x != 13
+
+
+@external
+def check_bytes_default(data: Bytes[100]):
+    # expected to fail: 65 is one of the default bytes lengths
+    assert len(data) != 65, UNREACHABLE
+
+
+@external
+def check_bytes_annotated(data: Bytes[100]):
+    """
+    @custom:dolmos --default-bytes-lengths 0,10
+    """
+    assert len(data) != 65, UNREACHABLE
diff --git a/tests/vyper/test/VyperTarget.t.sol b/tests/vyper/test/VyperTarget.t.sol
new file mode 100644
index 000000000..29c9bd052
--- /dev/null
+++ b/tests/vyper/test/VyperTarget.t.sol
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: AGPL-3.0
+pragma solidity >=0.8.0 <0.9.0;
+
+import {Test} from "forge-std/Test.sol";
+
+interface ICounter {
+    function count() external view returns (uint256);
+    function add(uint256) external;
+}
+
+interface IVault {
+    function deposit(uint256) external;
+    function withdraw(uint256) external;
+    function balanceOf(address) external view returns (uint256);
+    function total() external view returns (uint256);
+    function boom(uint256) external;
+}
+
+interface IImmutable {
+    function LIMIT() external view returns (uint256);
+    function under(uint256) external view returns (bool);
+}
+
+/// @notice solidity tests for vyper contracts
+contract VyperTargetTest is Test {
+    ICounter counter;
+    IVault vault;
+    IImmutable imm;
+
+    function setUp() public {
+        // all supported getCode path formats
+        counter = ICounter(deployCode("Counter.vy:Counter"));
+        vault = IVault(deployCode("src/Vault.vy"));
+        imm = IImmutable(deployCode("Immutable.vy", abi.encode(uint256(100))));
+    }
+
+    function check_counter(uint256 x) public {
+        // expected to fail (x == 13)
+        uint256 before = counter.count();
+        counter.add(x);
+        assertEq(counter.count(), before + x);
+    }
+
+    function check_hashmap(address a, address b, uint256 x, uint256 y) public {
+        // exercises vyper's HashMap layout, keccak256(slot . key)
+        vm.assume(a != b);
+        vm.prank(a);
+        vault.deposit(x);
+        vm.prank(b);
+        vault.deposit(y);
+        assertEq(vault.balanceOf(a), x);
+        assertEq(vault.balanceOf(b), y);
+        assertEq(vault.total(), x + y);
+    }
+
+    function check_unreachable_in_target(uint256 x) public {
+        // expected to fail (x == 42): INVALID in the target bubbles up as an empty revert
+        vault.boom(x);
+    }
+
+    function check_unreachable_caught(uint256 x) public {
+        // the failure is caught, so it must not be reported
+        try vault.boom(x) {} catch {}
+    }
+
+    function check_immutable(uint256 x) public view {
+        assertEq(imm.LIMIT(), 100);
+        assertEq(imm.under(x), x <= 100);
+    }
+}