Mixed-width ternary addition in a loop post-expression spuriously panics

Credited

Genuine, unique divergence — fixed in the engine and merged. +1 on the leaderboard.

Details

First-file independent mixed-width binary type-inference gap. The exact screened source produced a spurious Panic(0x11) at the prior merged commit while solc/EVM returned word 1, and gives NO_DIVERGENCE at merged commit 56239411a17669d1cb87394d73b861a91ddc2a47. Focused two-branch witness, full 2,326-job build, all 85 contest samples, source/binary/helper-attested credential-free network-denied native replay, and independent raw return/event/storage checks passed.

manual-static-and-source-review

Author: @rappie_eth
Points: 1
Verdict: SOUNDNESS_GAP
Resolution: Valid gap — fixed in the engine
Submitted: Oct 4, 2026, 05:28 PM
Reviewed: Oct 5, 2026, 12:14 AM

This divergence was root-caused and fixed in the engine. Fixed in PR #116 →

Root cause

An outer binary expression accepted an environment-free provisional type before recursively inferring an environment-dependent ternary operand. The outer bitwise expression therefore narrowed to uint8 from the ternary first branch instead of using the uint256 common type required by the other branch.

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{"deploy":{"contract":"C","args":[],"value":0},"entry":{"function":"run","args":[false],"value":0},"lane":"S","feature":"loop-post-wide-addition"}
===END-ARENA-MANIFEST=== */

contract C {
    function run(bool flag) external pure returns (uint256) {
        uint256 first = 128;
        uint256 second = 128;
        uint256 result;
        for (
            uint256 i;
            i < 1;
            i += ((flag ? uint8(1) : first + second) | 1)
        ) {
            result += i + 1;
        }
        return result;
    }
}