Run 1783602094
- Date (UTC):
2026-07-09 13:01:34Z - Benchmark:
2aba92387fb440c7d8e18748429a0285 - Timeout:
2h - Target:
scfuzzbench/aave-v4-scfuzzbench@459b020058 - Benchmark type:
property - Instances:
4×c6a.4xlargeper fuzzer - Harness:
scfuzzbench/scfuzzbench@366bcf55ee
Trial run
Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.
Charts
Report
Fuzzer Benchmark Report (from bug-count CSV)
- Time budget: 2.00h
Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.
Executive summary
This report is derived solely from cumulative bugs-found over time across repeated runs per fuzzer. It emphasizes robust, distribution-based metrics (median/IQR, success rates, time-to-k) and shape-based behavior (plateau time, late discovery share) instead of single-run time-to-first-bug.
Bugs found at fixed time budgets (median [IQR])
| Fuzzer | Runs | 1h |
|---|---|---|
| recon-fuzzer | 4 | 10 [9,10] |
| echidna | 4 | 6 [6,7] |
| medusa | 4 | 6 [6,7] |
| foundry | 4 | 5 [4,5] |
Overall metrics
| Fuzzer | AUC (norm) | Plateau time | Late discovery share | Final median | Final IQR |
|---|---|---|---|---|---|
| recon-fuzzer | 0.868 | 1.20h | 0.050 | 10 | 0.50 |
| echidna | 0.622 | 1.60h | 0.188 | 8 | 1.00 |
| medusa | 0.577 | 1.90h | 0.071 | 7 | 2.50 |
| foundry | 0.395 | 0.80h | 0.000 | 5 | 0.25 |
Milestones: time-to-k and success rates
| Fuzzer | time-to-1 (p50) | time-to-3 (p50) | time-to-5 (p50) | reach-1 rate | reach-3 rate | reach-5 rate |
|---|---|---|---|---|---|---|
| recon-fuzzer | 0.00h | 0.10h | 0.10h | 100.0% | 100.0% | 100.0% |
| echidna | 0.10h | 0.10h | 0.20h | 100.0% | 100.0% | 100.0% |
| medusa | 0.10h | 0.10h | 0.20h | 100.0% | 100.0% | 75.0% |
| foundry | 0.00h | 0.50h | 0.80h | 100.0% | 100.0% | 100.0% |
Throughput metrics (if supported by log format)
Values are run-level rates aggregated per fuzzer; n/a indicates the parser could not recover that metric from logs.
| Fuzzer | Runs | Tx/s runs | Tx/s p50 [p25,p75] | Gas/s runs | Gas/s p50 [p25,p75] |
|---|---|---|---|---|---|
| recon-fuzzer | 4 | 4 | 5288.03 [4929.45,5602.05] | 4 | 24586558.50 [21618611.00,27933897.00] |
| echidna | 4 | 4 | 1886.60 [1840.01,1915.75] | 4 | 20770240482.00 [17734562144.50,24349296028.50] |
| medusa | 4 | 4 | 1241.50 [1196.50,1260.25] | 4 | 146828460.00 [144559563.25,148918299.25] |
Progress metrics from logs (fuzzer-specific proxies)
Coverage/corpus values are parsed from each fuzzer's native progress output and are useful for trend context, not strict cross-fuzzer equivalence.
| Fuzzer | Runs | Seq/s runs | Seq/s p50 [p25,p75] | Coverage runs | Coverage p50 [p25,p75] | Corpus runs | Corpus p50 [p25,p75] |
|---|---|---|---|---|---|---|---|
| recon-fuzzer | 4 | 0 | n/a | 4 | 72298.00 [72239.00,72355.50] | 4 | 80.00 [77.75,82.25] |
| echidna | 4 | 0 | n/a | 4 | 84235.00 [82262.75,85994.50] | 4 | 146.00 [142.00,147.75] |
| medusa | 4 | 4 | 12.00 [11.75,12.25] | 4 | 5054.00 [4939.75,5110.25] | 4 | 199.00 [198.00,200.25] |
Statistical comparison (Mann-Whitney U test)
Pairwise Mann-Whitney U tests on end-of-budget bug counts (two-sided). Bonferroni correction applied for 6 comparison(s). Significance level: alpha = 0.05.
Warnings:
- One or more fuzzers have fewer than 5 runs. Statistical power may be limited.
| Fuzzer A | Fuzzer B | Median A | Median B | U statistic | p-value | p (corrected) | Significant |
|---|---|---|---|---|---|---|---|
| recon-fuzzer | echidna | 10 | 8 | 12.5 | 0.2059 | 1.0000 | no |
| recon-fuzzer | medusa | 10 | 7 | 15.0 | 0.0485 | 0.2912 | no |
| recon-fuzzer | foundry | 10 | 5 | 16.0 | 0.0228 | 0.1370 | no |
| echidna | medusa | 8 | 7 | 11.5 | 0.3529 | 1.0000 | no |
| echidna | foundry | 8 | 5 | 15.5 | 0.0360 | 0.2160 | no |
| medusa | foundry | 7 | 5 | 11.5 | 0.3688 | 1.0000 | no |
No pairwise comparison reached significance after Bonferroni correction.
Note: The Mann-Whitney U test assesses whether one fuzzer tends to find more bugs than another across runs. It does not measure effect size or practical importance. Small sample sizes (fewer than 5 runs) reduce statistical power.
Shape-based interpretation (rules of thumb)
- Fast-start / early-plateau: high early checkpoint median + early plateau time + low late discovery share.
- Steady: moderate AUC, later plateau, consistent improvements across checkpoints, moderate variance.
- Slow-burn / late-surge: low early checkpoints but high late discovery share and later plateau time; often higher final median.
Limitations
- Core metrics in this section are count-based; use
broken_invariants.md/broken_invariants.csvfor invariant identities. - Severity, exploitability, and root-cause uniqueness cannot be measured directly without richer per-bug metadata.
- Harness design still affects results; mitigate by keeping harness identical across fuzzers and reporting many runs.
Broken invariants
- Budget filter: 2.00h
- Events considered: 117 / 117
- Unique invariants: 11
Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.
Per-fuzzer totals
| Fuzzer | Invariants |
|---|---|
| echidna | 10 |
| foundry | 6 |
| medusa | 8 |
| recon-fuzzer | 11 |
High-level overlap
- Shared by all active fuzzers: 6
- Exclusive to
echidna: 0 - Exclusive to
foundry: 0 - Exclusive to
medusa: 0 - Exclusive to
recon-fuzzer: 1
Grouped invariants
Exclusive to echidna (0)
None.
Exclusive to foundry (0)
None.
Exclusive to medusa (0)
None.
Exclusive to recon-fuzzer (1)
invariant_totalBorrowedLessThanSupplied_v2
Shared by all active fuzzers (6)
assert_canaryiHub_mintFeeSharesinvariant_canaryinvariant_shouldNotBecomeLiquidatableinvariant_totalBorrowedLessThanSupplied_v0invariant_totalBorrowedLessThanSupplied_v1
Top shared subsets (top 2 by size):
echidna, medusa, recon-fuzzer (2)
iSpoke_repayiSpoke_withdraw
echidna, recon-fuzzer (2)
iSpoke_liquidationCallinvariant_supplySharePriceAndDrawnIndexMonotonic
Runner resource usage
- Budget filter: 2.00h
- Instances with metrics: 16
- Total samples: 22864
Per-fuzzer medians (across instances)
| Fuzzer | Instances | CPU active avg (%) | CPU active peak (%) | Memory used avg (GiB) | Memory used peak (GiB) | Memory used avg (%) | Memory used peak (%) |
|---|---|---|---|---|---|---|---|
| echidna | 4 | 94.54 | 98.38 | 18.66 | 19.33 | 60.88 | 63.07 |
| foundry | 4 | 6.28 | 21.12 | 1.15 | 3.84 | 3.76 | 12.53 |
| medusa | 4 | 96.80 | 99.74 | 1.83 | 4.03 | 5.97 | 13.14 |
| recon-fuzzer | 4 | 93.33 | 100.00 | 2.22 | 4.30 | 7.25 | 14.02 |
Instance stats
| Instance | Fuzzer | Samples | Duration (h) | CPU active avg (%) | CPU active peak (%) | Memory avg (GiB) | Memory peak (GiB) | Memory avg (%) | Memory peak (%) |
|---|---|---|---|---|---|---|---|---|---|
| i-02cd98be70d42ded1-echidna-v2.3.1 | echidna | 1425 | 2.00 | 94.63 | 98.38 | 18.67 | 19.35 | 60.92 | 63.13 |
| i-03907389453b8b059-echidna-v2.3.1 | echidna | 1425 | 2.00 | 94.53 | 98.39 | 18.65 | 19.33 | 60.85 | 63.06 |
| i-0a1df537551fc51f6-echidna-v2.3.1 | echidna | 1425 | 2.00 | 94.37 | 98.28 | 18.67 | 19.33 | 60.92 | 63.08 |
| i-0f6f336b16a14ee92-echidna-v2.3.1 | echidna | 1425 | 2.00 | 94.54 | 98.38 | 18.64 | 19.28 | 60.83 | 62.90 |
| i-0b0e67f911d2fab80-foundry-git-907ba08 | foundry | 1436 | 2.00 | 6.29 | 22.23 | 1.15 | 4.07 | 3.76 | 13.27 |
| i-0b172f7bff995c61e-foundry-git-907ba08 | foundry | 1436 | 2.00 | 6.28 | 18.18 | 1.15 | 3.68 | 3.75 | 11.99 |
| i-0bda07262cec6ee35-foundry-git-907ba08 | foundry | 1436 | 2.00 | 6.28 | 20.00 | 1.16 | 3.85 | 3.77 | 12.57 |
| i-0c1f494c4100d0127-foundry-git-907ba08 | foundry | 1436 | 2.00 | 6.29 | 25.00 | 1.15 | 3.83 | 3.76 | 12.48 |
| i-0098b2bfd3b9e5fec-medusa-v1.4.1 | medusa | 1428 | 2.00 | 96.78 | 99.72 | 1.80 | 4.14 | 5.88 | 13.49 |
| i-01f15977e7db507b4-medusa-v1.4.1 | medusa | 1428 | 2.00 | 96.80 | 99.76 | 1.87 | 4.12 | 6.11 | 13.44 |
| i-0464c00d69368444e-medusa-v1.4.1 | medusa | 1428 | 2.00 | 96.84 | 99.74 | 1.80 | 3.67 | 5.89 | 11.96 |
| i-0a9aefebfb9473b8a-medusa-v1.4.1 | medusa | 1428 | 2.00 | 96.79 | 99.74 | 1.86 | 3.93 | 6.05 | 12.83 |
| i-00cbd0449cb0d7678-recon-v0.4.6 | recon-fuzzer | 1427 | 2.00 | 93.77 | 100.00 | 2.26 | 4.23 | 7.39 | 13.81 |
| i-03dba4f7c0b519b5c-recon-v0.4.6 | recon-fuzzer | 1427 | 2.00 | 90.56 | 100.00 | 2.20 | 4.21 | 7.19 | 13.73 |
| i-0928165ef9f9132e0-recon-v0.4.6 | recon-fuzzer | 1427 | 2.00 | 92.90 | 100.00 | 2.23 | 4.36 | 7.27 | 14.22 |
| i-0eefed895482f4704-recon-v0.4.6 | recon-fuzzer | 1427 | 2.00 | 94.60 | 100.00 | 2.22 | 4.50 | 7.24 | 14.69 |
Manifest
- scfuzzbench_commit:
366bcf55eed0cf50d1638b3c4a79c5018cdcd7f6 - target_repo_url: https://github.com/scfuzzbench/aave-v4-scfuzzbench
- target_commit:
459b020058f4a65d18eb1481083b75c766340124 - benchmark_type:
property - instance_type:
c6a.4xlarge - instances_per_fuzzer:
4 - timeout_hours:
2 - aws_region:
us-east-1 - ubuntu_ami_id:
ami-0a02a779008fa3b99 - foundry_version:
v1.7.1 - foundry_git_repo:
https://github.com/foundry-rs/foundry - foundry_git_ref:
907ba0817e8feb2404da9d506a12b69834cfb393 - echidna_version:
2.3.1 - medusa_version:
1.4.1 - recon_version:
0.4.6 - fuzzer_keys:
echidna, foundry, medusa, recon-fuzzer
Artifacts
Manifest (index): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/runs/1783602094/2aba92387fb440c7d8e18748429a0285/manifest.json
Report prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/
Broken invariants (Markdown): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/broken_invariants.md
Broken invariants (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/broken_invariants.csv
Throughput summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/throughput_summary.csv
Progress metrics summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/progress_metrics_summary.csv
Runner resource usage (Markdown): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/runner_resource_usage.md
Runner resource summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/runner_resource_summary.csv
Runner resource timeseries (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/runner_resource_timeseries.csv
Analysis bundle: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/bundles/analysis.zip
Corpus bundle: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/2aba92387fb440c7d8e18748429a0285/1783602094/bundles/corpus.zip
Raw logs prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/logs/1783602094/2aba92387fb440c7d8e18748429a0285/
Raw corpus prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/corpus/1783602094/2aba92387fb440c7d8e18748429a0285/