Held Arc fork
Every campaign runs on pinned simulation state. Nothing is signed, deployed, or broadcast.
03 · Aomi Fuzz for Arc Studio
Break the contract before users do.
Connect an Arc Studio app. Aomi attacks its compiled Solidity on a held Arc fork, minimizes any property violation, and reports it only after two clean replays.
- Status
- Live
- Target
- Arc Studio apps
- Engine
- Aomi + evm-sim
- Effect
- Simulation only
Campaign flow
From Studio artifact to verified finding.
01
Connect Arc Studio
Input: Studio appAuthorize the web app, then select the app and compiled contract to test.
02
Seal the artifact
Bounded HTTPS linkMint a 30-minute link containing exactly one contract's source, ABI, and runtime bytecode.
03
Map the attack surface
Threat planThe model proposes actors, properties, and ordered action templates.
04
Attack a held Arc fork
No broadcastevm-sim installs code and executes multi-actor transaction sequences against pinned state.
05
Minimize and replay
2× confirmationThe app shrinks a violation to its shortest reproduction and replays it twice from baseline.
06
Return the finding
Output: evidenceOnly a reproducible violation becomes a finding that can be sent back to Arc Studio for a fix.
Ownership
Separate imagination from execution facts.
The model ownsThe threat model, actors, properties, and action templates.
The Aomi app ownsThe breadth-first frontier, deduplication, minimization, and two-replay promotion rule.
evm-sim ownsThe fork lifetime, installed code, ordered calls, balances, return data, and engine errors.
The builder ownsThe target contract, remediation decision, and anything later signed or deployed.
Finding standard
Evidence before severity.
Shortest reproduction
Failing traces are reduced so builders see the smallest sequence that still violates the property.
Two clean replays
A violation that cannot reproduce twice remains unconfirmed and is not promoted to a finding.
Current boundary: the fuzzer installs runtime bytecode, so constructor-initialized state is not reproduced yet. Prefer deployed-instance fuzzing when constructor state is material.