feat(invariant): decouple handler-side assertions from invariant predicates#14482
Draft
grandizzy wants to merge 2 commits intogdzzy/issue-9727from
Draft
feat(invariant): decouple handler-side assertions from invariant predicates#14482grandizzy wants to merge 2 commits intogdzzy/issue-9727from
grandizzy wants to merge 2 commits intogdzzy/issue-9727from
Conversation
…icates Handler-side assertion failures are now tracked in a dedicated broken_handlers map keyed by (reverter, selector) instead of being attributed to every live invariant. They surface in their own "Suite handlers:" report section, keeping invariant predicate breaks rendered separately. Under assert_all = true (the new default), the campaign continues for the full budget after a preflight invariant failure so handler-side bugs and still-live invariants can be discovered. The legacy abort-on-preflight behavior is preserved when assert_all = false. Live progress (progress bar + JSON pulse events) now surfaces unique handler bug counts alongside invariant failure counts so both classes are visible during the campaign. Tests: - New regression test assert_all_handler_assertion_routed_to_handler_section asserting the "handler bug != invariant break" semantics. - Existing handler-assert tests (invariant_fail_on_assert_panic, invariant_fail_on_vm_assert_*, etc.) updated to expect the new "Suite handlers:" rendering while keeping the failure-reason line. - should_exit_early_on_invariant_failure now sets assert_all = false explicitly so it continues to exercise the legacy abort-on-preflight path. Refs: #14437
Amp-Thread-ID: https://ampcode.com/threads/T-019dd3bb-9f77-7224-9d25-acdf2c0dd095 Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Decouple handler-side assertion failures from invariant predicate violations so the campaign can keep running after either class of bug is discovered. Closes #14448.
Motivation
Today, an
assert(false)(orvm.assertEqfailure) inside a fuzzed handler is attributed to every live invariant and aborts the campaign on the first hit. On real targets like Aave v4 SCFuzzBench, this means a single canary in the handler kills 95+% of the time budget — Foundry finds 3 bugs where Echidna/Medusa find 10+ in the same 24 h window.What changes
broken_handlers: HashMap<(Address, Selector), HandlerAssertionFailure>map, deduplicated by(reverter, selector)so each unique handler bug is reported once.Suite handlers: N assertion bug(s) foundwith full reason + counterexample, separate from the existing per-invariant[FAIL: ...]blocks.assert_all. With the newassert_all = truedefault, a preflight invariant failure (e.g., a global canary) is recorded and the campaign continues for the full budget. Legacy abort-on-preflight is preserved whenassert_all = false.broken_handlerscounts alongside invariant failure counts so users see both classes accumulate.Result on SCFuzzBench (Aave v4)
Single 1 h run, seed 42:
Stack
This PR stacks on top of #12587 (rename
continuous_run→assert_all, default true). Review/merge that first.TODOs