Run gh-30002647594-1

• Date (UTC): 2026-07-23 11:19:07Z
• Benchmark: 70ec03ebaecd32dda4dbc2e5bb4efcd0
• Timeout: 4h
• Target: scfuzzbench/superform-v2-periphery-scfuzzbench @ 102eeaf5e2
• Benchmark type: property
• Instances: 2 × c6a.4xlarge per fuzzer
• Harness: scfuzzbench/scfuzzbench@82f696d530

Trial run

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

Charts

Report

Fuzzer Benchmark Report (from bug-count CSV)

• Time budget: 4.00h

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

⚠️ Run health

The following fuzzer legs show signs of not having run for the full time budget. Their results below are not comparable to healthy legs.

• ⚠️ echidna: last parsed activity at 0.05h of a 4.00h budget across 2 instance(s) — the leg likely terminated early. Inspect the instance logs.

Executive summary

This report is derived solely from cumulative bugs-found over time across repeated runs per fuzzer. It emphasizes robust, distribution-based metrics (median/IQR, success rates, time-to-k) and shape-based behavior (plateau time, late discovery share) instead of single-run time-to-first-bug.

Bugs found at fixed time budgets (median [IQR])

Fuzzer	Runs	1h	4h
recon-fuzzer	2	12 [10,13]	12 [10,14]
medusa	2	6 [5,6]	8 [8,9]
foundry	2	2 [2,2]	4 [4,4]
echidna	2	3 [3,3]	3 [3,3]

Overall metrics

Fuzzer	AUC (norm)	Plateau time	Late discovery share	Final median	Final IQR
recon-fuzzer	0.696	1.10h	0.000	12	4.00
medusa	0.452	1.90h	0.000	8	0.50
foundry	0.123	4.00h	0.500	4	0.00
echidna	0.183	0.10h	0.000	3	0.00

Milestones: time-to-k and success rates

Fuzzer	time-to-1 (p50)	time-to-3 (p50)	time-to-5 (p50)	reach-1 rate	reach-3 rate	reach-5 rate
recon-fuzzer	0.00h	0.10h	0.10h	100.0%	100.0%	100.0%
medusa	0.00h	0.10h	0.15h	100.0%	100.0%	100.0%
foundry	0.00h	4.00h	inf	100.0%	100.0%	0.0%
echidna	0.10h	0.10h	inf	100.0%	100.0%	0.0%

Throughput metrics (if supported by log format)

Values are run-level rates aggregated per fuzzer; n/a indicates the parser could not recover that metric from logs.

Fuzzer	Runs	Tx/s runs	Tx/s p50 [p25,p75]	Gas/s runs	Gas/s p50 [p25,p75]
recon-fuzzer	2	2	21901.67 [21755.80,22047.53]	2	2858456735.50 [2800993881.75,2915919589.25]
medusa	2	2	975.50 [898.75,1052.25]	2	354461951.00 [347402733.00,361521169.00]
foundry	2	2	48172.60 [42005.17,54340.03]	2	222987981721169.00 [163609461458523.62,282366501983814.38]
echidna	2	2	360.46 [357.87,363.06]	2	3786766843.50 [3675554406.25,3897979280.75]

Progress metrics from logs (fuzzer-specific proxies)

Sequence-rate and corpus values are parsed from native progress output and are useful for within-tool trend context.

Fuzzer	Runs	Seq/s runs	Seq/s p50 [p25,p75]	Corpus runs	Corpus p50 [p25,p75]
recon-fuzzer	2	0	n/a	2	643.50 [635.75,651.25]
medusa	2	2	9.50 [8.25,10.75]	2	736.00 [733.50,738.50]
foundry	2	0	n/a	2	0.00 [0.00,0.00]
echidna	2	0	n/a	2	274.00 [272.50,275.50]

Function selector sanity checks

Counts are occurrences in unique saved corpus sequences, not runtime execution frequencies The complete per-instance distribution is in selector_distribution.csv; selector_summary.json preserves statuses and provenance.

• Expected-set status: available (149 selector(s))
• Expected-set provenance: peer-consensus heuristic: observed in every available corpus for at least two independent evidence families (Echidna and Recon count as one related typed-corpus family); not benchmark ground truth

Fuzzer	Status	Instances with telemetry	Saved-corpus calls	Unique selectors
echidna	available	2/2	53452	180
foundry	unavailable	0/2	0	0
medusa	available	2/2	71063	171
recon-fuzzer	available	2/2	126507	180

Most common saved-corpus selectors

Fuzzer	Selector	Function	Calls	Share
echidna	0x4a9f284f	doomsday_maxWithdrawResetsAfterFullWithdrawal_ASSERTION_MAX_WITHDRAW_RESETS_AFTER_FULL_WITHDRAWAL(uint256)	399	0.75%
echidna	0x923b5116	ECDSAPPSOracle_updatePPS_clamped(uint256)	391	0.73%
echidna	0x5e79ec62	superVaultAggregator_createVault_clamped(uint256,uint256,uint256,uint256)	389	0.73%
echidna	0xab2c6ce7	yieldSource_setRevertBehavior4626(uint8,uint8)	386	0.72%
echidna	0xdeaf00fe	superGovernor_executeRemoveIncentiveTokens()	386	0.72%
echidna	0x5b5006a4	invariant_erc7540_3()	380	0.71%
echidna	0xf1f2a8fb	superVaultStrategy_executeHooks_clamped(uint256[],uint256[],bool[])	379	0.71%
echidna	0xecac6242	superVaultStrategy_handleOperations7540_clamped(uint256,uint256)	374	0.70%
echidna	0x8efa3b2d	invariant_totalSharesDontDecreaseOnRedemptionRequest()	371	0.69%
echidna	0xfa912362	superVaultStrategy_manageYieldSource_clamped(uint256)	371	0.69%
medusa	0xe121d831	yieldSource_setRevertBehavior5115(uint8)	712	1.00%
medusa	0x69a21b7a	yieldSource_requestRedeem(uint256,address,address)	644	0.91%
medusa	0xed652da1	superVaultAggregator_slashStake(address,uint256)	631	0.89%
medusa	0x16932562	doomsday_maxRedeemResetsAfterFullRedemption_ASSERTION_MAX_REDEEM_RESETS_AFTER_FULL_REDEMPTION(uint256)	620	0.87%
medusa	0xf7f335e9	yieldSource_approve(address,uint256)	614	0.86%
medusa	0xbed76c2c	superVault_mint_ASSERTION_PREVIEW_MINT_MATCHES_EXECUTION(uint256)	608	0.86%
medusa	0x64dfafca	superVaultAggregator_addAuthorizedCaller(address,address)	607	0.85%
medusa	0xf9e20e1b	superVaultStrategy_handleOperations4626Deposit(address,uint256)	603	0.85%
medusa	0x53b95ac1	doomsday_primaryManagerAlwaysChangeable_ASSERTION_PRIMARY_MANAGER_ALWAYS_CHANGEABLE()	596	0.84%
medusa	0xfb48798d	yieldSource_mint(uint256,address)	595	0.84%
recon-fuzzer	0xfa912362	superVaultStrategy_manageYieldSource_clamped(uint256)	982	0.78%
recon-fuzzer	0x1e78dbc2	superVaultAggregator_updatePPSVerificationThresholds(address,uint256,uint256,uint256)	890	0.70%
recon-fuzzer	0xf1f2a8fb	superVaultStrategy_executeHooks_clamped(uint256[],uint256[],bool[])	867	0.69%
recon-fuzzer	0xfb48798d	yieldSource_mint(uint256,address)	858	0.68%
recon-fuzzer	0x98bea562	yieldSource_setLossOnWithdraw(uint256)	850	0.67%
recon-fuzzer	0x0012bfca	superVaultStrategy_handleOperations4626Mint(address,uint256,uint256,uint256)	842	0.67%
recon-fuzzer	0x1a001033	superVault_deposit_ASSERTION_PREVIEW_DEPOSIT_MATCHES_EXECUTION(uint256)	841	0.66%
recon-fuzzer	0xa6b7e9a7	global_comparePreviewDepositAndConvertToShares_ASSERTION_GLOBAL_CONVERT_TO_SHARES_GTE_PREVIEW_DEPOSIT(uint256)	835	0.66%
recon-fuzzer	0xfe4574ac	yieldSource_deposit(uint256,address)	823	0.65%
recon-fuzzer	0x5d83e580	yieldSource_simulateGain(uint256)	821	0.65%

Selector telemetry limitations

• i-004bdfd0d17dc687a-foundry-git-02c05d9: Foundry selector distribution is unavailable because no persisted corpus was present; failure-event selectors are intentionally not used as a distribution
• i-07fee1e9a2fddd68f-foundry-git-02c05d9: Foundry selector distribution is unavailable because no persisted corpus was present; failure-event selectors are intentionally not used as a distribution

Statistical comparison (Mann-Whitney U and Vargha-Delaney A12)

Pairwise Mann-Whitney U tests and Vargha-Delaney A12 effect sizes on end-of-budget bug counts. The tests are two-sided, with Bonferroni correction applied for 6 comparison(s). Significance level: alpha = 0.05.

Warnings:

• One or more fuzzers have fewer than 5 runs. Statistical power may be limited.

Fuzzer A	Fuzzer B	Median A	Median B	U statistic	A12 (A over B)	Effect magnitude	p-value	p (corrected)	Significant
recon-fuzzer	medusa	12	8.5	2.5	0.625	small	1.0000	1.0000	no
recon-fuzzer	foundry	12	4	4.0	1.000	large	0.2207	1.0000	no
recon-fuzzer	echidna	12	3	4.0	1.000	large	0.2207	1.0000	no
medusa	foundry	8.5	4	4.0	1.000	large	0.2207	1.0000	no
medusa	echidna	8.5	3	4.0	1.000	large	0.2207	1.0000	no
foundry	echidna	4	3	4.0	1.000	large	0.1939	1.0000	no

No pairwise comparison reached significance after Bonferroni correction.

Note: A12 is the probability that a randomly selected Fuzzer A run has a higher final bug count than a randomly selected Fuzzer B run, counting ties as half. Values above 0.5 favor A, values below 0.5 favor B, and 0.5 means equal tendency. Magnitude thresholds by distance from 0.5 are negligible (<0.06), small (<0.14), medium (<0.21), and large (>=0.21). Small sample sizes (fewer than 5 runs) reduce statistical power. A12 and its magnitude label are descriptive; the thresholds are rules of thumb. Neither the effect size nor statistical significance establishes practical importance, causation, or performance beyond the observed runs.

Shape-based interpretation (rules of thumb)

• Fast-start / early-plateau: high early checkpoint median + early plateau time + low late discovery share.
• Steady: moderate AUC, later plateau, consistent improvements across checkpoints, moderate variance.
• Slow-burn / late-surge: low early checkpoints but high late discovery share and later plateau time; often higher final median.

Limitations

• Core count-based charts use normalized event identities stored under the legacy bugs_found column. They do not count crash inputs, but they are not confirmed root-cause bug counts.
• Use known_bug_report.md, known_bug_summary.csv, and known_bug_findings.csv for evidence-backed known-bug hit rates; use broken_invariants.md / broken_invariants.csv for raw invariant identities.
• Severity, exploitability, and root-cause uniqueness cannot be measured directly without richer per-bug metadata.
• Harness design still affects results; mitigate by keeping harness identical across fuzzers and reporting many runs.

Broken invariants

• Budget filter: 4.00h
• Events considered: 55 / 55
• Unique invariants: 19

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

Per-fuzzer totals

Fuzzer	Invariants
echidna	3
foundry	4
medusa	12
recon-fuzzer	16

High-level overlap

• Shared by all active fuzzers: 2
• Exclusive to echidna: 0
• Exclusive to foundry: 0
• Exclusive to medusa: 2
• Exclusive to recon-fuzzer: 7

Grouped invariants

Exclusive to echidna (0)

None.

Exclusive to foundry (0)

None.

Exclusive to medusa (2)

• invariant_accumulatorCostBasisIncrease
• invariant_fulfillOnlyBurnsRequestedAmount

Exclusive to recon-fuzzer (7)

• doomsday_fulfillDoesntOverRedeemMultipleActors
• doomsday_maxWithdrawResetsAfterFullWithdrawal
• global_erc7540_4_redeem
• global_erc7540_7_redeem
• global_erc7540_7_withdraw
• invariant_sumOfClaimable
• superVaultStrategy_fulfillRedeemRequests_clamped

Shared by all active fuzzers (2)

• assert_canary
• invariant_canary

Top shared subsets (top 4 by size):

medusa, recon-fuzzer (5)

• doomsday_depositWithdrawSymmetrical
• doomsday_maxRedeemResetsAfterFullRedemption
• global_comparePreviewMintAndConvertToAssets
• global_previewEquivalenceFromAssets
• invariant_accumulatorSharesDecreaseOnFulfill_exact

echidna, medusa, recon-fuzzer (1)

• global_previewEquivalenceFromShares

foundry, medusa (1)

• invariant_maxRedeemMaxWithdrawSymmetry

foundry, medusa, recon-fuzzer (1)

• doomsday_mintRedeemSymmetrical

Ground-truth known-bug mapping

• Target: superform-v2-periphery
• Evidence-pinned commit: 102eeaf5e2f49963bdd007c7358739b0a0e59e84
• Resolution: matched run repository and commit
• Catalog: benchmarks/known_bugs.json

Only the two instrumented health-check canaries are mapped. The target documents historical findings, but their current event aliases are left unmapped until each alias-to-root-cause relationship is independently reviewed.

Canaries are reported separately as harness-health checks and are never included in the known-bug hit-rate denominator.

Per-fuzzer results

Fuzzer	Replicates	Known-bug replicate hits	Catalog coverage	Canary replicate hits	Unmapped event findings
echidna	2	n/a	n/a	4/4 (100.0%)	2
foundry	2	n/a	n/a	4/4 (100.0%)	4
medusa	2	n/a	n/a	4/4 (100.0%)	13
recon-fuzzer	2	n/a	n/a	4/4 (100.0%)	20

Known-bug catalog

Ground-truth ID	Kind	Title	Evidence
None cataloged

Unmapped event identities

Fuzzer	Event identity	Replicates observed
echidna	global_previewEquivalenceFromShares	2
foundry	doomsday_mintRedeemSymmetrical	2
foundry	invariant_maxRedeemMaxWithdrawSymmetry	2
medusa	doomsday_depositWithdrawSymmetrical	1
medusa	doomsday_maxRedeemResetsAfterFullRedemption	1
medusa	doomsday_mintRedeemSymmetrical	2
medusa	global_comparePreviewMintAndConvertToAssets	1
medusa	global_previewEquivalenceFromAssets	1
medusa	global_previewEquivalenceFromShares	2
medusa	invariant_accumulatorCostBasisIncrease	1
medusa	invariant_accumulatorSharesDecreaseOnFulfill_exact	1
medusa	invariant_fulfillOnlyBurnsRequestedAmount	1
medusa	invariant_maxRedeemMaxWithdrawSymmetry	2
recon-fuzzer	doomsday_depositWithdrawSymmetrical	2
recon-fuzzer	doomsday_fulfillDoesntOverRedeemMultipleActors	1
recon-fuzzer	doomsday_maxRedeemResetsAfterFullRedemption	1
recon-fuzzer	doomsday_maxWithdrawResetsAfterFullWithdrawal	1
recon-fuzzer	doomsday_mintRedeemSymmetrical	2
recon-fuzzer	global_comparePreviewMintAndConvertToAssets	2
recon-fuzzer	global_erc7540_4_redeem	1
recon-fuzzer	global_erc7540_7_redeem	1
recon-fuzzer	global_erc7540_7_withdraw	1
recon-fuzzer	global_previewEquivalenceFromAssets	2
recon-fuzzer	global_previewEquivalenceFromShares	2
recon-fuzzer	invariant_accumulatorSharesDecreaseOnFulfill_exact	2
recon-fuzzer	invariant_sumOfClaimable	1
recon-fuzzer	superVaultStrategy_fulfillRedeemRequests_clamped	1

Counting semantics

• A canonical known-bug ID counts at most once per replicate, even when several event aliases or counterexamples reach it.
• A replicate is identified by (run_id, instance_id, fuzzer).
• Known-bug hit rate is canonical bug/replicate hits ÷ (cataloged bugs × replicates).
• Unmapped rows are distinct normalized event identities per replicate. They are triage candidates, not claimed bugs.
• Crash inputs and corpus files are not used as bug identities.

Runner resource usage

• Budget filter: 4.00h
• Instances with metrics: 8
• Total samples: 16952

Per-fuzzer medians (across instances)

Fuzzer	Instances	CPU active avg (%)	CPU active peak (%)	Memory used avg (GiB)	Memory used peak (GiB)	Memory used avg (%)	Memory used peak (%)
echidna	2	15.56	84.21	5.49	11.09	17.92	36.19
foundry	2	99.05	100.00	1.48	2.83	4.81	9.25
medusa	2	98.26	99.86	2.30	2.88	7.49	9.41
recon-fuzzer	2	97.14	99.96	6.62	9.38	21.59	30.60

Instance stats

Instance	Fuzzer	Samples	Duration (h)	CPU active avg (%)	CPU active peak (%)	Memory avg (GiB)	Memory peak (GiB)	Memory avg (%)	Memory peak (%)
i-026e15969fbd760d9-echidna-v2.3.2	echidna	54	0.07	15.17	89.54	5.00	10.93	16.30	35.66
i-0aad8404a01667ef5-echidna-v2.3.2	echidna	63	0.09	15.95	78.88	5.98	11.26	19.53	36.73
i-004bdfd0d17dc687a-foundry-git-02c05d9	foundry	2812	4.00	99.05	100.00	1.46	2.80	4.78	9.14
i-07fee1e9a2fddd68f-foundry-git-02c05d9	foundry	2810	4.00	99.05	100.00	1.49	2.87	4.85	9.36
i-05a8a88d7d521aabd-medusa-v1.5.1	medusa	2810	4.00	98.27	99.85	2.29	2.88	7.48	9.40
i-08ebb34134490c698-medusa-v1.5.1	medusa	2808	4.00	98.24	99.87	2.30	2.89	7.50	9.42
i-024892c856245b58f-recon-v0.4.18	recon-fuzzer	2796	4.00	97.54	99.97	6.45	9.72	21.03	31.71
i-0b938d62f045d4abf-recon-v0.4.18	recon-fuzzer	2799	4.00	96.73	99.95	6.78	9.04	22.14	29.49

Manifest

• scfuzzbench_commit: 82f696d5309a468dc66498f818e55d804a0113ea
• target_repo_url: https://github.com/scfuzzbench/superform-v2-periphery-scfuzzbench
• target_commit: 102eeaf5e2f49963bdd007c7358739b0a0e59e84
• benchmark_type: property
• instance_type: c6a.4xlarge
• instances_per_fuzzer: 2
• timeout_hours: 4
• aws_region: us-east-1
• ubuntu_ami_id: ami-052355af2a014bd2c
• foundry_version: 1.7.2-dev
• foundry_git_repo: https://github.com/foundry-rs/foundry
• foundry_git_ref: 02c05d970d2801da0aef8b82486ce84b01ede36d
• foundry_source_patch: scfuzzbench-throughput-progress-v1@sha256:2ee9e69b77c8007c78c816eb9ca791684aa5ecede0651b63f86cdd2e055eb17e
• echidna_version: 2.3.2
• medusa_version: 1.5.1
• recon_version: 0.4.18
• fuzzer_keys: echidna, foundry, medusa, recon-fuzzer

Artifacts

• Manifest (index): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/runs/gh-30002647594-1/70ec03ebaecd32dda4dbc2e5bb4efcd0/manifest.json

• Report prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/

• Broken invariants (Markdown): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/broken_invariants.md

• Broken invariants (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/broken_invariants.csv

• Ground-truth known bugs (Markdown): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/known_bug_report.md

• Ground-truth summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/known_bug_summary.csv

• Ground-truth findings (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/known_bug_findings.csv

• Throughput summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/throughput_summary.csv

• Progress metrics summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/progress_metrics_summary.csv

• Function selector distribution (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/selector_distribution.csv

• Function selector summary and health (JSON): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/selector_summary.json

• Runner resource usage (Markdown): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/runner_resource_usage.md

• Runner resource summary (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/runner_resource_summary.csv

• Runner resource timeseries (CSV): https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/runner_resource_timeseries.csv

• Analysis bundle: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/bundles/analysis.zip

• Logs bundle: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/bundles/logs.zip

• Corpus bundle: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/analysis/70ec03ebaecd32dda4dbc2e5bb4efcd0/gh-30002647594-1/bundles/corpus.zip

• Raw logs prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/logs/gh-30002647594-1/70ec03ebaecd32dda4dbc2e5bb4efcd0/

• Raw corpus prefix: https://scfuzzbench-logs-185f44d6.s3.us-east-1.amazonaws.com/corpus/gh-30002647594-1/70ec03ebaecd32dda4dbc2e5bb4efcd0/