/Puzzles
About
Team
Investments
Research
Research Index
Build
IncubationsOpen Source
Writing
Paradigm Puzzles
HackathonAPI

Terms, Disclosures, Privacy

LinkedIn, Twitter, Contact

LeaderboardSubmitGitHubAboutAPI
Dan RobinsonParadigm
LeaderboardSubmitGitHubAboutAPI
Dan Robinson
← Back to Submissions

Nested dynamic-array storage reference return panics

Credited

Genuine, unique divergence — fixed in the engine and merged. +1 on the leaderboard.

Details

Independent in-scope soundness gap, first-file review in submission timestamp order. The exact screened source produced SOUNDNESS_GAP on the previous main and NO_DIVERGENCE on merged c1827fb64e6a; raw return bytes, events, and full ordinary storage match the EVM. The 2,326-job full build, 85-case contest suite, focused Lean witnesses, and four neighboring credited controls passed. No harness, comparator, contest rule, or exclusion changed.

manual-static-and-source-review

Author
@rappie_eth
Points
1
Verdict
SOUNDNESS_GAP
Resolution
Valid gap — fixed in the engine
Submitted
Oct 2, 2026, 07:02 PM
Reviewed
Oct 3, 2026, 10:09 PM

This divergence was root-caused and fixed in the engine. Fixed in PR #105 →

Root cause

The storage path builder required a narrow-integer cast when cleaning up an index expression. The valid full-width uint256 index lost its returned storage-reference path and fell back to a value assignment, causing Panic(0). Preserving the typed index in the path fixes the alias binding.

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{"deploy":{"contract":"C","args":[],"value":0},"entry":{"function":"run","args":[],"value":0},"lane":"S","feature":"v12-storage-reference","note":"V12 coverage-first syntax-shaped generator"}
===END-ARENA-MANIFEST=== */

/* ===SOLIDITY-LEAN-FUZZ-CONFIG===
{"format":12,"generator":"v12-syntax-shaped","scenario":"storage-reference","engine":"contextual_recursive_ast","lane":"storage","acceptance_intent":"solc-accepted","call_schema":{"entry_types":[],"constructor_types":[],"structs":{}},"structural_signature":"storage|op3|p0|a0|t1|v0","control_signature":"storage|op3|p0|a0|t1|v0|control","instance_signature":"storage|op3|p0|a0|t1|v0|instance"}
===END-SOLIDITY-LEAN-FUZZ-CONFIG=== */

struct Leaf { uint256[] values; bytes data; mapping(uint256 => uint256) map; }
struct Branch { Leaf leaf; Leaf[] leaves; }
struct Box { uint256[] words; Branch branch; }
contract C {
	Box[2] boxes;
	bytes32 public observation;
	uint256 typeWitness; uint256 stateScalar; bytes stateBytes; uint32[3] stateFixed; uint32[] stateArray; mapping(uint256 => uint256) stateMap;
	function selectWords(uint256 which, uint256 depth) internal view returns (uint256[] storage r) { if (depth == 0) return boxes[which % 2].words; return boxes[which % 2].branch.leaf.values; }
	function run() external returns (bytes32) {
		stateScalar = 18; typeWitness = stateScalar; boxes[0].branch.leaf.map[4] = 19; uint256[] storage r = selectWords(0, 0); r.push(18);
		observation = keccak256(abi.encode(typeWitness, boxes[0].words.length, boxes[1].words.length, boxes[0].branch.leaf.values.length, boxes[1].branch.leaf.map[4]));
		return observation;
	}
}