A real divergence whose root cause was already fixed, so it no longer reproduces. No point.
Duplicate of earlier submission b0d2d219-b5e1-4918-b1f5-fe73966b5419 (@zhygis, 2026-07-27T12:56:11.563Z). This later new-string length variant uses the same assignment-form allocation lowering defect as the earlier new-array report. Disabling only the shared allocation fallback restores both exact submissions to SOUNDNESS_GAP.
manual-static-and-source-review
Duplicate of earlier submission b0d2d219-b5e1-4918-b1f5-fe73966b5419 (@zhygis, 2026-07-27T12:56:11.563Z). This later new-string length variant uses the same assignment-form allocation lowering defect as the earlier new-array report. Disabling only the shared allocation fallback restores both exact submissions to SOUNDNESS_GAP.
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.35;
/* ===ARENA-MANIFEST===
{
"deploy": {
"contract": "T",
"args": []
},
"entry": {
"function": "run",
"args": []
},
"feature": "assignment-rhs-new-string-narrow-length",
"note": "solc 0.8.35 evaluates the uint8 allocation-length addition at uint8 width and panics 0x11. solidity-lean executes the assignment RHS without that width context and returns 256."
}
===END-ARENA-MANIFEST=== */
contract T {
function run() external pure returns (uint256) {
uint8 a = type(uint8).max;
string memory s;
s = new string(a + 1);
return bytes(s).length;
}
}