{
  "schemaVersion": 1,
  "article": {
    "wpId": 6048,
    "permalink": "/archives/6048",
    "sourceIssue": 190
  },
  "localFixture": {
    "checkedAt": "2026-09-01",
    "externalRpc": false,
    "mainnetFork": false,
    "browserWallet": false,
    "userPrivateKey": false,
    "publicTransaction": false,
    "realAsset": false,
    "environment": {
      "foundry": "1.8.0",
      "foundryCommit": "61ae26af36320d4fa1020f7db53785885e29eeb5",
      "solidity": "0.8.36",
      "evmVersion": "cancun",
      "optimizer": true,
      "optimizerRuns": 200,
      "fuzzRuns": 256,
      "invariantRuns": 64,
      "invariantDepth": 32,
      "invariantWorkers": 1,
      "seed": "0x6048604860486048604860486048604860486048604860486048604860486048"
    },
    "tests": {
      "status": "pass-with-expected-counterexample",
      "unitTestCount": 13,
      "unitTests": [
        "testClassicSingleFunctionDrainBreaksSolvency",
        "testClassicChecksEffectsInteractionsFixPreservesSolvency",
        "testCrossFunctionGuardOnWithdrawDoesNotCoverMoveCredit",
        "testSharedGuardCoversCrossFunctionEntryPoints",
        "testReadOnlyCrossContractCallbackObservesTransientPrice",
        "testReadOnlySnapshotFixKeepsCallbackPriceStable",
        "testErc777StyleRecipientHookReentersWithdraw",
        "testErc777StyleChecksEffectsInteractionsFixRejectsHook",
        "testStorageAndTransientGuardsRejectNestedEntryAndClear",
        "testTransientGuardUsesLessExecutionGasThanStorageGuard",
        "testDelegatecallModuleSpecificLocksAllowCrossModuleEntry",
        "testDelegatecallSharedStorageLockBlocksCrossModuleEntry",
        "testDelegatecallSharedTransientLockBlocksAndClears"
      ],
      "fixedInvariant": {
        "name": "invariant_FixedVaultAlwaysBacksHonestCredit",
        "status": "pass",
        "runs": 64,
        "calls": 2048,
        "reverts": 0
      },
      "vulnerableInvariant": {
        "name": "invariant_VaultAlwaysBacksHonestCredit",
        "status": "expected-failure-observed",
        "reason": "honest liability undercollateralized",
        "originalCalls": 1,
        "shrunkCalls": 1,
        "minimizedSequence": [
          "vm.prank(0x000000000000000000000000000000000000bEEF)",
          "ClassicAttackHandler.attack(bound(rawDepth, 1, 3))"
        ]
      }
    },
    "observations": {
      "classic": {
        "vulnerable": {
          "honestDepositWei": "4000000000000000000",
          "attackerDepositWei": "1000000000000000000",
          "configuredReentryDepth": 3,
          "attackerReceivedWei": "4000000000000000000",
          "vaultBalanceWei": "1000000000000000000",
          "honestCreditWei": "4000000000000000000",
          "totalCreditsWei": "1000000000000000000",
          "invariant": "vault balance is below honest credit"
        },
        "fixed": {
          "attackerReceivedWei": "1000000000000000000",
          "rejectedReentries": 1,
          "vaultBalanceWei": "4000000000000000000",
          "totalCreditsWei": "4000000000000000000"
        }
      },
      "crossFunctionAndCrossContract": {
        "vulnerableReceiverCreditWei": "1000000000000000000",
        "vulnerableClaimsExceedBalance": true,
        "fixedReceiverCreditWei": "0",
        "sharedGuardRejectedNestedEntry": true
      },
      "readOnly": {
        "stablePriceWad": "1000000000000000000",
        "vulnerableCallbackPriceWad": "1100000000000000000",
        "vulnerableClaimSucceeded": true,
        "postStatePriceWad": "1000000000000000000",
        "fixedCallbackPriceWad": "1000000000000000000",
        "fixedClaimSucceeded": false
      },
      "tokenReceiverCallback": {
        "standardStyle": "ERC-777 tokensReceived-like local fixture",
        "vulnerableAttackerBalance": "400",
        "vulnerableVaultBalance": "100",
        "fixedAttackerBalance": "100",
        "fixedVaultBalance": "400",
        "fixedRejectedReentries": 1
      },
      "guardImplementations": {
        "storage": {
          "nestedEntryRejected": true,
          "lockClearedForNextCall": true
        },
        "transient": {
          "nestedEntryRejected": true,
          "lockClearedForNextCall": true
        },
        "localObservation": "transient guard execution gas was lower than the storage guard in this fixed fixture"
      },
      "delegatecallModules": {
        "moduleLocalLocks": {
          "counter": 2,
          "nestedEntrySucceeded": true
        },
        "sharedStorageLock": {
          "counter": 1,
          "nestedEntrySucceeded": false
        },
        "sharedTransientLock": {
          "counterAfterNestedAttempt": 1,
          "nestedEntrySucceeded": false,
          "counterAfterNextTransaction": 2
        }
      }
    }
  },
  "limits": [
    "bounded deterministic local fixture, not an exhaustive proof or production audit",
    "the token hook is an ERC-777-style receiver callback fixture, not a full standards implementation",
    "the gas comparison is directional for this compiler, EVM, and fixture and is not a universal benchmark",
    "no public RPC, mainnet fork, browser wallet, user key, public transaction, or real asset was used",
    "the vulnerable contracts are minimal educational counterexamples and are not deployment templates or instructions for targeting a real system"
  ]
}