CppCon 2025

The recent acceptance of contracts into the draft standard for C++ 26 promises to help create safer programs by supporting preconditions, postconditions and assertions that can be validated at runtime to ensure fast failure in case of error. However, nobody likes programs that unexpectedly terminate, and fixing faults earlier in the development lifecycle is significantly cheaper than later, so a question arises—can we check these contracts  before  the program is run?

In this talk we will show how contracts as specified in C++  can  in many cases be validated at compile-time using static analysis tools. We will talk about which contracts are amenable to such analysis, and what theoretical and practical limitations exist. To validate these ideas, we’ll demonstrate an implementation in CodeQL – GitHub’s extensible static analysis engine – combined with a constraint solver to validate certain types of contracts. Finally, we’ll present results from a case study evaluating the effectiveness of these techniques on real-world contracts and code bases.