Connect ›
Cover: How we audit ourselves: the verification apparatus on one page

How we audit ourselves: the verification apparatus on one page

Every instrument the BlazePhoenix V2 suite runs, the question each one answers, its result on the measured tree and the limit it states — mutation guard, invariant-aimed mutants, covering arrays, hostile venues, canonical oracles, metamorphic relations, N-version, projection distance.

Known formally as The Verification Apparatus in the BlazePhoenix whitepaper.

BlazePhoenix Engineering · updated 2026-09-06 · data through 2026-10-11 · 7 min · written from the deployed bytecode

By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.

Abstract in 15 languages · resumo · resumen · 摘要 · 要旨 · ملخص

English — Every instrument the BlazePhoenix V2 suite runs, the question each one answers, its result on the measured tree and the limit it states — mutation guard, invariant-aimed mutants, covering arrays, hostile venues, canonical oracles, metamorphic relations, N-version, projection distance, fee detection rates and quote ageing — with the denominator beside every number.

Português — Todos os instrumentos que a suite BlazePhoenix V2 corre, a pergunta a que cada um responde, o seu resultado na árvore medida e o limite que enuncia — guarda de mutação, mutantes dirigidos a invariantes, arrays de cobertura (covering arrays), locais hostis, oráculos canónicos, relações metamórficas, N-version, distância de projecção, taxas de detecção da fee e envelhecimento da cotação — com o denominador ao lado de cada número.

Español — Todos los instrumentos que ejecuta la suite BlazePhoenix V2, la pregunta que responde cada uno, su resultado sobre el árbol medido y el límite que declara — guarda de mutación, mutantes dirigidos a invariantes, arreglos de cobertura (covering arrays), sedes hostiles, oráculos canónicos, relaciones metamórficas, N-version, distancia de proyección, tasas de detección de la comisión y envejecimiento de la cotización — con el denominador junto a cada número.

Français — Chaque instrument que la suite BlazePhoenix V2 exécute, la question à laquelle il répond, son résultat sur l’arbre mesuré et la limite qu’il énonce — garde de mutation, mutants visant les invariants, tableaux de couverture (covering arrays), places hostiles, oracles canoniques, relations métamorphiques, N-version, distance de projection, taux de détection des frais et vieillissement du devis — avec le dénominateur à côté de chaque nombre.

Deutsch — Jedes Instrument, das die BlazePhoenix-V2-Suite ausführt, die Frage, die es beantwortet, sein Ergebnis am gemessenen Baum und die Grenze, die es nennt — Mutationswächter, invariantengerichtete Mutanten, überdeckende Felder (covering arrays), feindliche Handelsplätze, kanonische Orakel, metamorphe Relationen, N-version, Projektionsdistanz, Erkennungsraten der Gebühr und Alterung des Angebots — mit dem Nenner neben jeder Zahl.

Русский — Каждый инструмент, который запускает набор BlazePhoenix V2, вопрос, на который он отвечает, его результат на измеренном дереве и предел, который он заявляет — страж мутаций, мутанты, нацеленные на инварианты, покрывающие массивы (covering arrays), враждебные площадки, канонические оракулы, метаморфические отношения, N-version, дистанция проекции, доли обнаружения комиссии и старение котировки — со знаменателем рядом с каждым числом.

Türkçe — BlazePhoenix V2 paketinin çalıştırdığı her araç, her birinin yanıtladığı soru, ölçülen ağaç üzerindeki sonucu ve belirttiği sınır — mutasyon nöbeti, değişmezleri hedefleyen mutantlar, kapsayan diziler (covering arrays), düşmanca borsalar, kanonik kâhinler (oracles), metamorfik ilişkiler, N-version, izdüşüm mesafesi, ücret saptama oranları ve teklifin yaşlanması — her sayının yanında paydasıyla.

العربية — كل أداة تشغّلها حزمة BlazePhoenix V2، والسؤال الذي تجيب عنه كل واحدة، ونتيجتها على الشجرة المقيسة، والحد الذي تعلنه — حارس الطفرات، والطفرات الموجّهة إلى الثوابت، والمصفوفات المغطّية (covering arrays)، والمنصات العدائية، والعرافات المرجعية (canonical oracles)، والعلاقات التحوّلية، وN-version، ومسافة الإسقاط، ومعدلات كشف الرسوم، وتقادم التسعيرة — مع المقام بجوار كل رقم.

हिन्दी — BlazePhoenix V2 सुइट जो भी उपकरण चलाता है, हर एक किस प्रश्न का उत्तर देता है, मापे गए ट्री पर उसका परिणाम और वह जो सीमा बताता है — म्यूटेशन गार्ड, इनवेरिएंट-लक्षित म्यूटेंट, कवरिंग ऐरे (covering arrays), शत्रुतापूर्ण वेन्यू, कैनोनिकल ऑरैकल, मेटामॉर्फिक संबंध, N-version, प्रक्षेपण दूरी, फ़ीस पहचान दरें और कोट का पुराना पड़ना — हर संख्या के बगल में उसका हर (denominator)।

日本語 — BlazePhoenix V2 スイートが走らせるすべての計測器、それぞれが答える問い、測定対象のツリー上での結果、そして各自が示す限界 — ミューテーション・ガード、不変条件を狙った変異体、被覆配列 (covering arrays)、敵対的な取引所、正典オラクル、変成関係、N-version、投影距離、手数料の検出率、そして見積もりの経年 — すべての数値の隣に分母を添えて。

中文 — BlazePhoenix V2 测试套件运行的每一件仪器、每件仪器回答的问题、它在被测代码树上的结果以及它所声明的限度 — 变异守卫、面向不变量的变异体、覆盖数组 (covering arrays)、恶意场所、规范预言机、蜕变关系、N-version、投影距离、手续费检出率与报价老化 — 每个数字旁边都附上分母。

한국어 — BlazePhoenix V2 스위트가 실행하는 모든 계측기, 각각이 답하는 질문, 측정 대상 트리에서의 결과, 그리고 그것이 명시하는 한계 — 변이 감시(mutation guard), 불변식을 겨냥한 변이체, 커버링 배열 (covering arrays), 적대적 거래소, 정준 오라클, 변성 관계, N-version, 투영 거리, 수수료 검출률, 견적 노화 — 모든 숫자 옆에 분모를 붙여서.

Bahasa Indonesia — Setiap instrumen yang dijalankan suite BlazePhoenix V2, pertanyaan yang dijawab masing-masing, hasilnya pada pohon kode yang diukur dan batas yang dinyatakannya — penjaga mutasi, mutan yang membidik invarian, larik penutup (covering arrays), bursa yang bermusuhan, orakel kanonik, relasi metamorfik, N-version, jarak proyeksi, laju deteksi biaya protokol, dan penuaan kuotasi — dengan penyebut di samping setiap angka.

বাংলা — BlazePhoenix V2 স্যুট যে যে যন্ত্র চালায়, প্রতিটি যে প্রশ্নের উত্তর দেয়, মাপা ট্রি-তে তার ফল এবং সে যে সীমা ঘোষণা করে — মিউটেশন গার্ড, ইনভেরিয়েন্ট-লক্ষ্য করা মিউট্যান্ট, কভারিং অ্যারে (covering arrays), বৈরী ভেন্যু, ক্যানোনিকাল ওরাকল, রূপান্তরী সম্পর্ক, N-version, প্রক্ষেপণ দূরত্ব, ফি শনাক্তকরণের হার এবং কোটের বার্ধক্য — প্রতিটি সংখ্যার পাশে তার হর (denominator) সহ।

Filipino — Bawat instrumentong pinapatakbo ng BlazePhoenix V2 suite, ang tanong na sinasagot ng bawat isa, ang resulta nito sa sinukat na code tree at ang hangganang isinasaad nito — mutation guard, mga mutant na nakatutok sa invariant, covering arrays, mapanganib na venue, canonical oracles, metamorphic relations, N-version, projection distance, mga rate ng pagtukoy sa bayad, at pagtanda ng quote — kasama ang denominator sa tabi ng bawat numero.

What you gain from this page is a map: which instrument answers which question about the V2 contracts, what it measured on the tree of 2026-09-05, and where it stops. Metrological Design applied to the test suite means the suite is itself an instrument, and an instrument is published with its calibration — the number, the denominator it was measured against, and the command that recomputes it from a clean checkout. Where a number is a floor it is called a floor; where an instrument cannot see something, that is written beside the result rather than left for the reader to discover.

One frame before the numbers. The tree measured is V2, compiled on the release settings (optimizer_runs 300, via_ir). V2 is not deployed; the deployed generation is V1, pinned by codehash on every network so the two are never conflated. Everything below is a statement about the repository, not about a contract you can trade against today.

Stacked bars of the regime covering arrays at strength 2 and 3: settled, refused with a selector of ours, not constructible; no third way
Regime covering arrays: the outcome of every generated row at strength 2 (63 rows) and strength 3 (168 rows) over 5,184 combinations — settled, refused with a selector of ours, not constructible; never a third way. Source: regimes-covering.json, regimes-covering-t3.json, Verification Report §1.

The suite in numbers

Two counts of “tests” appear here and they are not the same number, so both are printed with how they are counted: one is a grep over declarations, the other is what forge ran and reported.

whatcounthow it is counted
declared tests1,609 test / invariant / check functions across 236 .t.sol filesgrep over the test tree
green on the release profile, fork suites excluded1,319 passed · 0 failed · 1 skipped (1,320)forge test, fork lane excluded
green on live liquidity119 of 119 on the 39 suites of the fork lane, five chainsforge test on the fork lane with an archive RPC
stateful invariants40 invariant functions in 14 campaignsgrep over invariant_ declarations
curated mutants, all killed268 of 268mutants.py
regime covering arraysstrength 2: 63 rows, all 258 pairs · strength 3: 168 rows, all 1,636 triples · of 5,184 combinationscovering_array.py --check
shipped runtime sizes (EIP-170 limit 24,576; project gate 24,000)Hub 23,648 · Router 23,781 · Solver 19,686 · Quoter 11,429 · Core 6,442 bytesforge build --sizes, release profile

Source: VERIFICATION-REPORT-2026-09.md §1, branch vectors/invariant-mutants-metamorphic-t3-nversion on main df46649, 2026-09-05

What each instrument answers, and where it stops

Read the table one row at a time: the question, the reading, the limit. A row without a limit would be marketing.

instrumentthe question it answersresult on this treethe limit, stated
curated mutation guarddo the tests notice when a guard disappears?268 of 268 killed; each mutant names the one test that must die; optimiser-removed mutations reported as inertadequacy against this register — a saturated score is a floor, not a ceiling
mutants aimed at the invariantscan the stateful campaigns go red at all?15 source mutations × 39 invariants on one seed: 11 noticed on the first measurement, 18 distinct invariant names went red; 14 of 15 killed after three campaigns gained the action they lackedone survivor, the userMinOut sentinel, unreachable by design in the campaign universes
regime covering arrayswhich combinations of regime factors has a fixture run?t = 2: 53 settle, 4 refuse with a selector of ours, 6 not constructible, 0 third way · t = 3: 158 settle, 10 refuse, 0 not constructible, 0 third wayten factors; V4, Algebra and the native door are outside the array
hostile-venue matrixdoes a pathological pool ever produce a third outcome?ten pathologies × two doors: settle with the balance delta and nothing left on the Router, or refuse with a selector of ours — 20 of 20the ten pathologies are the ones named; classes nobody has named are outside the denominator
sandwich curvewhat can an attacker extract against the floor?on a 1 %-of-depth trade the floor caps a sandwich at about 2.7 % of the trade and refuses beyond it, the attacker’s round trip negativeconstant-product mocks; the fork version needs an archive key
canonical oraclesis the quote maths right against the venues’ own specifications?V2 exact to the wei; stable curve within 4 wei; V3 within one ulp of the square-root price (L / 2⁹⁶ wei)oracles written from the specifications, not from the venues’ bytecode
metamorphic relationshow must the output move when the input moves?14 relations over the quote maths and 5 over the Solver’s plan, all green; three bounds measured before they were writtenbounds are the mechanism, stated in the assertion
N-version of the quote mathsdoes the source mean the same thing under other code generation?compiled at optimizer_runs 1 / 300 / 20000, three binaries compared on 3,000 fuzzed inputs per function: they agreethe compiler was not the finding — the lane found the reference reverting (below)
projection distancehow far does each refusal observe from what decides?86 of 99 refusal sites at distance zerothe 13 at distance above zero are listed with their reading
evidence independencehow many independent confirmations stand behind each load-bearing guard?the minimum across source, oracle, tool, environment and methodologyindependence is the minimum, never the mean
calldata-field matrixwhich caller-writable fields steer, which are confirmed, which are only declared?23 rows in fields.json: 5 steering, 14 confirmed, 4 declaredthe declared rows carry their reason and are weighed in the register
fee rule, both regimes, asserted at run timeis the protocol fee charged where the rule says, and counted?pinned by an oracle-independent fuzz over ten route shapes, both regimes; a transient ledger refuses a settlement that paid nothing (RouterE 15) or twice on an anchored route (RouterE 16)the ledger’s own two checks are belts, measured as unobservable in isolation
how a quote ageswhat does a quote promise 0–10 s later, with the world moving?240 samples on mocks; five live Base rowsmocks for the distribution; live Base for the reach

Source: VERIFICATION-REPORT-2026-09.md §2; ASSURANCE.md §4h–§4p

The two numbers about how tests observe

Two instruments in that table are not about the contracts but about the evidence. Projection distance classifies the predicate in front of every revert by how far the object it reads sits from the object that decides: a constant or a balance delta is distance zero, a field of the caller’s route is distance one, a property of a contract that can delegate its behaviour is unbounded. Measured over 99 refusal sites, 86 are at distance zero. Every defect confirmed in this repository, internal or reported, had the shape of a check observing one object while a different one decided — which is why the distance is the property worth measuring.

Evidence independence records, for each load-bearing guard, how many confirmations exist that share no hypothesis — by source, oracle, tool, environment and methodology — and reports the minimum. A chain of evidence fails at its weakest link, so the minimum is the number; a mean would flatter a guard confirmed five times by five copies of one idea.

Fee detection rates and quote ageing, in one paragraph each

Every fee mutant was run under twenty fuzz seeds per fuzzed test, and the detection rate is published with a Wilson 95 % interval. The six defects a test can see are seen 20 of 20 by the FeeSeals fuzz and by the widened Router campaign, interval [0.84, 1.00]; the two ledger belts are seen 0 of 20 by everything, as their name says. Twenty seeds at 20 of 20 bound one campaign’s miss probability at 15 % by the rule of three, which is why the guard runs the named test and the campaign both.

A quote taken through previewAndEncode, with zero to three adverse trades through the same pools and zero to ten seconds of delay before the calldata runs unchanged: 240 samples. With no drift, 64 of 64 settle and deliver exactly the prediction at every delay. With up to 100 bps of drift, 43 of 43 settle. With 100–300 bps, 102 of 133 settle and 31 are refused by the floor — RouterE 5 — rather than filled below the attested output. Time is not what moves a quote; drift is. The full tables are in the swap report at /research/swap-tests-report.

What the round produced

Instruments are worth what they find. The N-version lane, fuzzing three binaries of the stable curve over its whole input domain, made the reference revert on a pool holding under one unit of each token; the repair asks the question the division stood in for, went in red-first with three named tests, a 5,000-run fuzz, a 60,000-sample Python sweep and three mutants, and is 35 bytes smaller than the code it replaced. The fee rule gained its second name, and the Router now asserts the count at run time. Three metamorphic bounds were measured before they were written. And the measurement of the campaigns found two guards with no watcher of any kind — the number that section existed to print — and the campaigns were given the actions they lacked, each verified red without its guard.

What none of this establishes

The claim this apparatus does make is narrow and falsifiable: we know of no other public DeFi codebase that publishes a curated, named mutation guard with per-mutant killing tests and inert-mutation reporting; mutants aimed at its stateful invariants with the survivors published; a strength-3 covering array over its regime factors under one assertion; N-version testing of its quote maths; a measured curve of how its quotes age; or the detection rate of its own fee mutants with a confidence interval. If you find a prior instance, the claim is wrong and we would like to know: contact@blazephoenix.xyz.

Reproduce

Every number above is recomputed from a clean checkout by the scripts in .github/scripts/assurance/ or by a named forge command. The verification report at /research/verification-report is the long form; the swap report at /research/swap-tests-report is the swap side only.

forge test --no-match-path 'test/fork/**'                       # the suite, release settings
python3 .github/scripts/mutants.py                               # the mutation guard
python3 .github/scripts/check_targets.py                         # every mutant still points at one line
python3 .github/scripts/assurance/covering_array.py --check      # both covering arrays current
NVERSION_LANE=1 forge test --match-path 'test/nversion/*'        # the three binaries agree
forge test --match-path test/FeeSeals.t.sol                      # the fee rule, both regimes
forge test --match-path test/QuoteDelayStatistics.t.sol -vv      # how a quote ages
python3 .github/scripts/assurance/metrics.py                     # every assurance number, with its denominator

Do not trust this page — reproduce it

Every claim above is checkable against the chain. Start here:

git clone https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex && cd Blaze-Phoenix-Dex && python3 .github/scripts/assurance/metrics.py  # every assurance number above, recomputed with its denominator
Cite this article

Licensed CC BY 4.0 — quote, translate and reuse freely, including commercially, with attribution and a link. Copy a ready-made citation:

BlazePhoenix (2026). How we audit ourselves: the verification apparatus on one page. BlazePhoenix Engineering. https://blazephoenix.xyz/learn/how-we-audit-ourselves
@misc{blazephoenix_how_we_audit_ourselves,
  title  = {How we audit ourselves: the verification apparatus on one page},
  author = {BlazePhoenix},
  year   = {2026},
  url    = {https://blazephoenix.xyz/learn/how-we-audit-ourselves},
  note   = {Accessed: reproduce the claim with the command above}
}

Writing an answer, a wiki entry or a paper? The claim above is reproducible against the chain before you quote it — which is the only sound basis for citing a technical source at all.

Contracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF).

Related engineering

Next in Limits of verification · 1 / 4
The mutation guard: 268 named breaks, each paired with the one test that must die ›What a mutant is, why the BlazePhoenix guard is curated rather than generated, why every entry names the single test that must fail, how a mutation the optimiser removes is reported as inert rather than killed, and why 268 of 268 is a floor on what the suite watches and not a guarantee.6 min

Questions, a partnership or a bug to report? Contact us or email contact@blazephoenix.xyz