Skip to content

Run gh-29726518626-1

Trial run

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

Charts

Bugs Over TimeTime To KFinal DistributionPlateau And Late ShareInvariant Overlap (UpSet)Corpus Size Over TimeTx/s Over TimeGas/s Over TimeCPU Usage Over TimeMemory Usage Over Time

Report

Fuzzer Benchmark Report (from bug-count CSV)

  • Time budget: 0.25h

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

Executive summary

This report is derived solely from cumulative bugs-found over time across repeated runs per fuzzer. It emphasizes robust, distribution-based metrics (median/IQR, success rates, time-to-k) and shape-based behavior (plateau time, late discovery share) instead of single-run time-to-first-bug.

Bugs found at fixed time budgets (median [IQR])

FuzzerRuns0.25h
echidna113 [13,13]

Overall metrics

FuzzerAUC (norm)Plateau timeLate discovery shareFinal medianFinal IQR
echidna0.4000.10h0.000130.00

Milestones: time-to-k and success rates

Fuzzertime-to-1 (p50)time-to-3 (p50)time-to-5 (p50)reach-1 ratereach-3 ratereach-5 rate
echidna0.10h0.10h0.10h100.0%100.0%100.0%

Throughput metrics (if supported by log format)

Values are run-level rates aggregated per fuzzer; n/a indicates the parser could not recover that metric from logs.

FuzzerRunsTx/s runsTx/s p50 [p25,p75]Gas/s runsGas/s p50 [p25,p75]
echidna113776.58 [3776.58,3776.58]134771245176.00 [34771245176.00,34771245176.00]

Progress metrics from logs (fuzzer-specific proxies)

Sequence-rate and corpus values are parsed from native progress output and are useful for within-tool trend context.

FuzzerRunsSeq/s runsSeq/s p50 [p25,p75]Corpus runsCorpus p50 [p25,p75]
echidna10n/a121.00 [21.00,21.00]

Function selector sanity checks

Counts are occurrences in unique saved corpus sequences, not runtime execution frequencies The complete per-instance distribution is in selector_distribution.csv; selector_summary.json preserves statuses and provenance.

  • Expected-set status: unavailable (0 selector(s))
  • Expected-set provenance: peer-consensus heuristic: observed in every available corpus for at least two independent evidence families (Echidna and Recon count as one related typed-corpus family); not benchmark ground truth
FuzzerStatusInstances with telemetrySaved-corpus callsUnique selectors
echidnaavailable1/1210047
Most common saved-corpus selectors
FuzzerSelectorFunctionCallsShare
echidna0xa04961e8testTransferToZeroAddress(uint8,uint256)703.33%
echidna0x6a91b27atestRebasingCreditsPerTokenAboveZero()693.29%
echidna0x26610da8testBurnAllBalanceToZero(uint8)683.24%
echidna0x1e7cfc16testTransferSelf(uint8,uint256)653.10%
echidna0xe4840d4ftestTransferBalanceReceivedMore(uint8,uint8,uint256)643.05%
echidna0x1f3efb39testTotalNonRebasingSupplyLessThanTotalBalance()612.90%
echidna0xbfb72b06testMintBalanceRounding(uint8,uint256)612.90%
echidna0x324b65f5testApprove(uint8,uint8,uint256)602.86%
echidna0x6396b18dtestAutoConvertBalance(uint8)582.76%
echidna0xdf4d5977getTotalNonRebasingBalance()572.71%
Selector telemetry limitations
  • No expected selector set was available: the peer heuristic requires corroboration from every available instance in at least two fuzzer families

Statistical comparison (Mann-Whitney U and Vargha-Delaney A12)

Pairwise Mann-Whitney U tests and Vargha-Delaney A12 effect sizes on end-of-budget bug counts. The tests are two-sided, with Bonferroni correction applied for 0 comparison(s). Significance level: alpha = 0.05.

Warnings:

  • Only one fuzzer present; skipping pairwise statistical tests.

Note: A12 is the probability that a randomly selected Fuzzer A run has a higher final bug count than a randomly selected Fuzzer B run, counting ties as half. Values above 0.5 favor A, values below 0.5 favor B, and 0.5 means equal tendency. Magnitude thresholds by distance from 0.5 are negligible (<0.06), small (<0.14), medium (<0.21), and large (>=0.21). Small sample sizes (fewer than 5 runs) reduce statistical power. A12 and its magnitude label are descriptive; the thresholds are rules of thumb. Neither the effect size nor statistical significance establishes practical importance, causation, or performance beyond the observed runs.

Shape-based interpretation (rules of thumb)

  • Fast-start / early-plateau: high early checkpoint median + early plateau time + low late discovery share.
  • Steady: moderate AUC, later plateau, consistent improvements across checkpoints, moderate variance.
  • Slow-burn / late-surge: low early checkpoints but high late discovery share and later plateau time; often higher final median.

Limitations

  • Core count-based charts use normalized event identities stored under the legacy bugs_found column. They do not count crash inputs, but they are not confirmed root-cause bug counts.
  • Use known_bug_report.md, known_bug_summary.csv, and known_bug_findings.csv for evidence-backed known-bug hit rates; use broken_invariants.md / broken_invariants.csv for raw invariant identities.
  • Severity, exploitability, and root-cause uniqueness cannot be measured directly without richer per-bug metadata.
  • Harness design still affects results; mitigate by keeping harness identical across fuzzers and reporting many runs.

Broken invariants

  • Budget filter: 0.25h
  • Events considered: 14 / 14
  • Unique invariants: 14

Warning — trial run. This benchmark was executed with fewer than 10 instances per fuzzer and/or a time budget shorter than 24h. Results from trial runs are meant for debugging purposes and are not valid for extracting conclusions across different fuzzers.

Per-fuzzer totals

FuzzerInvariants
echidna14

High-level overlap

  • Shared by all active fuzzers: 14
  • Exclusive to echidna: 14

Grouped invariants

Exclusive to echidna (14)
  • AssertionFailed
  • assert_canary
  • invariant_canary
  • testBurnBalance
  • testChangeSupply
  • testMintBalanceRounding
  • testOptInBalance
  • testOptInBalanceRounding
  • testRebasingCreditsPerTokenNotIncreased
  • testTotalSupplyLessThanTotalBalance
  • testTransferBalanceReceivedLessRounding
  • testTransferBalanceReceivedMore
  • testTransferBalanceSentLess
  • testTransferSelf

Ground-truth known-bug mapping

  • Target: origin-dollar
  • Evidence-pinned commit: 299ec6b6bf5401b43efc3e9f7ee5cab3e76167c4
  • Resolution: matched run repository and commit
  • Catalog: benchmarks/known_bugs.json

Known bugs are limited to handlers explicitly annotated with hasKnownIssue in the pinned target. Each handler remains a separate catalog entry because the target does not provide evidence that any pair is the same root cause.

Canaries are reported separately as harness-health checks and are never included in the known-bug hit-rate denominator.

Per-fuzzer results

FuzzerReplicatesKnown-bug replicate hitsCatalog coverageCanary replicate hitsUnmapped event findings
echidna15/12 (41.7%)5/12 (41.7%)2/2 (100.0%)7

Known-bug catalog

Ground-truth IDKindTitleEvidence
origin-dollar/change-supply-mismatchdocumented-known-issuechangeSupply does not exactly reach the requested total supplysource
origin-dollar/total-supply-below-balancesdocumented-known-issueTotal supply can fall below the sum of account balancessource
origin-dollar/non-rebasing-supply-above-totaldocumented-known-issueNon-rebasing supply can exceed total supplysource
origin-dollar/rebasing-credits-per-token-increasedocumented-known-issueRebasing credits per token can increasesource
origin-dollar/non-rebasing-supply-below-balancesdocumented-known-issueNon-rebasing supply can fall below non-rebasing balancessource
origin-dollar/mint-balance-shortfalldocumented-known-issueMinting can increase an account balance by less than the minted amountsource
origin-dollar/burn-balance-shortfalldocumented-known-issueBurning can decrease an account balance by less than the burned amountsource
origin-dollar/burn-all-leaves-balancedocumented-known-issueBurning an account's full balance can leave a nonzero balancesource
origin-dollar/burn-all-revertsdocumented-known-issueBurning an account's full balance can revertsource
origin-dollar/transfer-recipient-shortfalldocumented-known-issueA transfer recipient can receive less than the transferred amountsource
origin-dollar/transfer-sender-shortfalldocumented-known-issueA transfer sender's balance can decrease by less than the transferred amountsource
origin-dollar/transfer-within-balance-revertsdocumented-known-issueA transfer within the sender's balance can revertsource

Unmapped event identities

FuzzerEvent identityReplicates observed
echidnaAssertionFailed1
echidnatestMintBalanceRounding1
echidnatestOptInBalance1
echidnatestOptInBalanceRounding1
echidnatestTransferBalanceReceivedLessRounding1
echidnatestTransferBalanceReceivedMore1
echidnatestTransferSelf1

Counting semantics

  • A canonical known-bug ID counts at most once per replicate, even when several event aliases or counterexamples reach it.
  • A replicate is identified by (run_id, instance_id, fuzzer).
  • Known-bug hit rate is canonical bug/replicate hits ÷ (cataloged bugs × replicates).
  • Unmapped rows are distinct normalized event identities per replicate. They are triage candidates, not claimed bugs.
  • Crash inputs and corpus files are not used as bug identities.

Runner resource usage

  • Budget filter: 0.25h
  • Instances with metrics: 1
  • Total samples: 175

Per-fuzzer medians (across instances)

FuzzerInstancesCPU active avg (%)CPU active peak (%)Memory used avg (GiB)Memory used peak (GiB)Memory used avg (%)Memory used peak (%)
echidna197.2099.425.976.3079.0683.38

Instance stats

InstanceFuzzerSamplesDuration (h)CPU active avg (%)CPU active peak (%)Memory avg (GiB)Memory peak (GiB)Memory avg (%)Memory peak (%)
i-0a45e7f0e5442db19-echidna-v2.3.1echidna1750.2597.2099.425.976.3079.0683.38

Manifest

  • scfuzzbench_commit: 7c2f6672915338c559f7f68f4a910e2263d729a8
  • target_repo_url: https://github.com/scfuzzbench/origin-dollar-scfuzzbench
  • target_commit: 299ec6b6bf5401b43efc3e9f7ee5cab3e76167c4
  • benchmark_type: property
  • instance_type: c6a.xlarge
  • instances_per_fuzzer: 1
  • timeout_hours: 0.25
  • aws_region: us-east-1
  • ubuntu_ami_id: ami-052355af2a014bd2c
  • foundry_version: 1.7.2-dev
  • foundry_git_repo: https://github.com/foundry-rs/foundry
  • foundry_git_ref: 02c05d970d2801da0aef8b82486ce84b01ede36d
  • foundry_source_patch: scfuzzbench-throughput-progress-v1@sha256:2ee9e69b77c8007c78c816eb9ca791684aa5ecede0651b63f86cdd2e055eb17e
  • echidna_version: 2.3.1
  • medusa_version: 1.4.1
  • recon_version: 0.4.6
  • fuzzer_keys: echidna

Artifacts

Fully static. Generated in CI from S3 run artifacts.