/Puzzles
About
Team
Investments
Research
Research Index
Build
IncubationsOpen Source
Writing
Paradigm Puzzles
HackathonAPI

Terms, Disclosures, Privacy

LinkedIn, Twitter, Contact

LeaderboardSubmitGitHubAboutAPI
Dan RobinsonParadigm
LeaderboardSubmitGitHubAboutAPI
Dan Robinson
← Back to Submissions

Ternary-selected storage array pop reverts

Credited

Genuine, unique divergence — fixed in the engine and merged. +1 on the leaderboard.

Details

Earliest qualifying filed report for this independent pop defect. Exact source manually screened and statically gated; credential-free restricted replay changes from empty revert to success. Raw EVM return is uint256 1, independently confirmed in CheckedInput with slot 0=0, slot 1=1 and no events. Both branch witnesses, full 2327-job Lean build and complete contest samples pass. Merged main tree is byte-identical to validated candidate.

manual-static-and-source-review

Author
@rappie_eth
Points
1
Verdict
SOUNDNESS_GAP
Resolution
Valid gap — fixed in the engine
Submitted
Oct 5, 2026, 05:04 PM
Reviewed
Oct 11, 2026, 08:58 PM

This divergence was root-caused and fixed in the engine. Fixed in PR #118 →

Root cause

Conditional storage-array pop receivers were not lowered as storage operations; the generic member-call fallback treated the selected storage reference as an external-call target and reverted. Env-aware conditional pop lowering now executes exactly one selected storage mutation.

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{"deploy":{"contract":"C","args":[],"value":0},"entry":{"function":"run","args":[true],"value":0},"lane":"S","feature":"ternary-selected-storage-array-pop","fuel":4096}
===END-ARENA-MANIFEST=== */

contract C {
    uint256[] left;
    uint256[] right;

    function run(bool chooseLeft) external returns (uint256) {
        left.push();
        right.push();
        (chooseLeft ? left : right).pop();
        return left.length * 10 + right.length;
    }
}