Counterflow Leaderboard

28/28 verified

Live verification results — regenerated by CI on every push to main. Every row is a real solver run: safe references must prove, known exploits must produce a counterexample. How it works

Benchmark suite — exploit classes vs safe references (16/16)

CaseClassExpectedResult
✅ TokenPool (safe)referenceprovedproved
✅ TokenPoolBuggy (missing balance check)underflow-drainviolatedviolated
✅ SafeVault (safe)referenceprovedproved
✅ ApprovalDrain (missing allowance check)approval-drainviolatedviolated
✅ UnbackedMintVault (infinite mint)unbacked-mintviolatedviolated
✅ BurnDesyncVault (totalShares desync)accounting-desyncviolatedviolated
✅ AMMSwap (safe)amm-referenceprovedproved
✅ AMMPriceManipulation (drain)amm-manipulationviolatedviolated
✅ LendingPool (safe)lending-referenceprovedproved
✅ LendingUnbackedBorrow (no health check)lending-unbackedviolatedviolated
✅ StakingPool (safe)staking-referenceprovedproved
✅ StakingInfiniteReward (no balance check)staking-exploitviolatedviolated
✅ OracleSafe (safe)oracle-referenceprovedproved
✅ OracleManipulation (manipulate)oracle-exploitviolatedviolated
✅ GovernanceTimelock (safe)governance-referenceprovedproved
✅ GovernanceNoTimelock (no timelock)governance-exploitviolatedviolated

DeFiHackLabs reproductions — real exploits, $261M+ (5/5)

CaseClassExpectedResult
✅ fei-protocol-reentrancy ($80.0M)reentrancyviolatedviolated
✅ cream-finance-reentrancy ($130.0M)reentrancyviolatedviolated
✅ pancake-bunny-flashloan ($45.0M)flash-loanviolatedviolated
✅ open-leverage-access-control ($0.23M)access-controlviolatedviolated
✅ belt-finance-arithmetic ($6.3M)arithmeticviolatedviolated

Real contract models (4/4)

CaseClassExpectedResult
✅ UniswapV2Swapreal-contractprovedproved
✅ UniswapV2SwapCorereal-contractprovedproved
✅ AaveLendingreal-contractprovedproved
✅ CompoundCTokenreal-contractprovedproved

ValuePacket (3/3)

CaseClassExpectedResult
✅ PaymentChannelvaluepacketprovedproved
✅ CrossChainSettlementvaluepacketprovedproved
✅ SubscriptionManagervaluepacketprovedproved

28/28 expectations matched · generated 2026-07-24 05:06 UTC by bench/leaderboard-pages.js