igneum/tools/exec-attacks/run_scenario6.sh
igneum-josh 1d58fd8726 exec-attacks: execution-layer attack suite (tools + bench log)
Adversarial robustness and conformance tests of the execution layer against a
throwaway 3-node simnet on ports 27600+. Six scenarios, each a runnable command
with a design-derived pass criterion and a measured result: malformed/boundary
txs, nonce games across parallel blocks, RPC fuzz, pgas exhaustion, reorgs under
execution, and developer-registry abuse. 98 checks, 0 failures, 0 node panics.

Two findings filed in the bench-log entry: the mempool admits txs with gas_limit
above B_e (low), and an over-pgas-budget tx is executed natively in full before
being skipped for no fee (medium, griefing).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-03 22:57:19 +00:00

20 lines
1.1 KiB
Bash
Executable file

#!/usr/bin/env bash
# Runs scenario 6 (reorg under execution) for several partition durations, restarting the split network each time so
# each cycle forces a reorg of a different depth. Results accumulate in results/scenario6.json.
set -u
HERE="$(cd "$(dirname "$0")" && pwd)"
cd "$HERE"
rm -f results/scenario6.json
DURS="${DURS:-1 3 5 8}"
for secs in $DURS; do
./net.sh stop >/dev/null 2>&1
./net.sh start-split >/dev/null 2>&1
# Wait for both partitions to produce a block.
t=0
until [ "$(curl -s -m2 -X POST http://127.0.0.1:27691 -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' | grep -o '0x[0-9a-f]*' | head -1)" != "0x0" ] 2>/dev/null || [ $t -ge 40 ]; do sleep 2; t=$((t+2)); done
echo "=== cycle: partition ${secs}s ==="
PARTITION_SECS=$secs node scenario6_reorg.mjs
done
./net.sh stop >/dev/null 2>&1
echo "=== scenario 6 depths ==="
node -e "const r=require('./results/scenario6.json'); console.log('cycles:', r.cycles.map(c=>({secs:c.partitionSecs, depth:c.maxReorgDepth, pass:c.summary.pass, fail:c.summary.fail}))); console.log('totals', r.checks, 'maxDepth', r.maxReorgDepthSeen)"