Skip to content

test: Foundry suite, invariants, mutation-tested; CI - #2

Merged
predge-ai merged 1 commit into
mainfrom
audit/self-audit-2026-10-20
Oct 23, 2026
Merged

predge-ai merged 1 commit into
mainfrom
audit/self-audit-2026-10-20

Conversation

@predge-ai

Copy link
Copy Markdown
Member

Prepares the contract set for an external formal-methods + mutation-testing scan. No contract source changes.

What is added

  • foundry.toml with the deploy compiler settings (solc 0.8.26, optimizer 200, cancun). test/forge-parity.test.mjs checks that forge's runtime bytecode equals the deployed runtime (metadata hash excluded), so the suite tests exactly what is live. npm test (plan + live bytecode match) still passes.
  • test/foundry/: 190 tests: unit tests for every external/public function and every revert path of all six contracts, fuzz tests, and handler-based invariant suites (escrow/bond conservation, no double payout/refund/slash, no reclaim inside the window, write-once verdicts and filings, forward-only job states, role checks).
  • Mocks: fee-on-transfer, no-return-value and blacklisting USDC-like ERC20s, a programmable job, and non-payable / re-entrant receivers.
  • CI (.github/workflows/foundry.yml): forge build / test / coverage, npm test, slither (informational).

Numbers

  • Coverage: 0% before. After: 100% lines (279/279), statements (339/339), branches (82/82) and functions (44/44).
  • Mutation testing (Certora Gambit 1.0.6, 335 mutants): 333 of 333 valid mutants killed after one added test. The other 2 mutants do not compile.

Known-issue tests

test_BUG_* tests (6) fail on purpose and are excluded from the main CI step. Each one pins an open finding until it is fixed in the contracts. test_finding_* tests pass and document current behaviour that carries a design or operational risk.

Do not merge until the contract review is complete.

…ue tests

- foundry.toml with the deploy compiler settings (solc 0.8.26, optimizer 200, cancun);
  contracts/ untouched, forge-parity test proves forge runtime == deployed runtime
- unit + fuzz tests for every external function and revert path of all six contracts,
  handler-based invariants for AgentJob, PredgeValidatorBond, PredgeRefundArbiter,
  PredgeAgentValidator and PredgeSettlement; 100% line/branch/function coverage
- test_BUG_* tests pin open findings and fail until the contracts are fixed
- GitHub Actions: forge build/test/coverage, npm test, slither (informational)
@predge-ai
predge-ai merged commit 96ffa82 into main Oct 23, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant