Searcharxiv⌕ Search

arXiv subjects

Josef Gattermayer

Publications and source records attributed to Josef Gattermayer.

2 recordsLinked to original sources

Wake 5: A Python Framework for Solidity Testing, Fuzzing, and Static Analysis

Smart-contract fuzzers differ by an order of magnitude in throughput and by design in how they construct inputs, yet published comparisons rarely separate the two. We present Wake 5, an open-source Python framework for Solidity testing, fuzzing and static analysis, and use it to locate the binding constraint of stateful smart-contract fuzzing. Wake 5 replaces the JSON-RPC connection to an external node with an in-process EVM (revm) and exposes its static analysis to language-model agents through a Model Context Protocol (MCP) server. On the Daedaluzz maze benchmark (153 reachable assertions, guard constants below 2^32), Wake 5 executes 29,931 transactions per second, on par with Foundry (30,186) and 11.5x faster than Echidna (2,600). In eight-hour campaigns, however, the three tools plateau at medians of 75, 71 and 70 assertions, and their union reaches 93. We show that Wake's integer generator places 51% of its probability mass below 2^32 and that, once shallow assertions are exhausted, the generator prior rather than throughput bounds every tool. A harness written by a language-model agent, which derives inputs with a constraint solver, reached all 153 assertions in each of five campaigns executed by Wake, in 33 to 79 minutes. A complementary ablation in an agentic audit of a production Go codebase found that static-analysis tools improved recall for none of three models, raised precision for all three, and increased language-model cost by up to 12.7%. We discuss correlated oracles and non-deterministic completion, and argue that the fuzzer's role is shifting from search to execution.

cs.SE↗

The ack3 H1 2026 DeFi Incident Dataset: Audit Scope Across 135 Security Incidents

Smart-contract audits cover defined artifacts at a specific time, but the label audited is often treated as project-wide assurance. We analyze audit history and incident-path scope across 135 DeFi security incidents using the H1 2026 DeFi Incident Dataset published by cybersecurity company ack3 (https://ack3.ai), covering 1 January to 29 June 2026. The corpus reports USD 939.86 million in attributed loss. Audit history was identified for 68 incidents. Of these, 46 attack paths were outside all identified public pre-incident audit scopes, 20 were inside at least one scope, and 2 were unresolved. Within this 68-incident subset, outside-scope paths represented 67.6% by count and 94.4% of reported loss. The loss-weighted result was concentrated in two large incidents; excluding both reduced the share to 72.1%, while preserving the direction of the result. We also describe audit age, temporal loss distribution, and affected project types. The results show that project-level audit history and incident-path scope are distinct variables.

cs.CR↗