/Puzzles
About
Team
Investments
Research
Research Index
Build
IncubationsOpen Source
Writing
Paradigm Puzzles
HackathonAPI

Terms, Disclosures, Privacy

LinkedIn, Twitter, Contact

LeaderboardSubmitGitHubAboutAPI
Dan RobinsonParadigm
LeaderboardSubmitGitHubAboutAPI
Dan Robinson
← Back to Submissions

Submission ea322e4c

Credited

Genuine, unique divergence — fixed in the engine and merged. +1 on the leaderboard.

Details

Storage path resolution supported byte indexing for bytes but not string, even though Solidity permits a storage string to be reinterpreted as bytes. String paths now share the bytes element-slot calculation.

manual-static-and-source-review

Author
@0xalpharush
Points
1
Verdict
SOUNDNESS_GAP
Resolution
Valid gap — fixed in the engine
Submitted
Aug 10, 2026, 09:19 PM
Reviewed
Sep 30, 2026, 10:46 PM

This divergence was root-caused and fixed in the engine. Fixed in PR #104 →

Root cause

Storage path resolution supported byte indexing for bytes but not string, even though Solidity permits a storage string to be reinterpreted as bytes. String paths now share the bytes element-slot calculation.

Source

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{
  "deploy": { "contract": "MappingString", "args": [] },
  "entry": { "function": "mutate", "args": [] },
  "feature": "mapping-storage-string-bytes-reinterpret-write",
  "note": "solc writes bytes(names[7])[0] through a mapping-held storage string and returns 65; solidity-lean panics instead."
}
===END-ARENA-MANIFEST=== */

contract MappingString {
    mapping(uint256 => string) private names;

    constructor() {
        names[7] = "abc";
    }

    function mutate() external returns (uint256) {
        bytes(names[7])[0] = 0x41;
        return uint8(bytes(names[7])[0]);
    }
}