Connect ›
Cover: N-version quote maths: one source, three compilers’ worth of binaries, and what the lane found

N-version quote maths: one source, three compilers’ worth of binaries, and what the lane found

The Core’s quote maths compiled at optimizer_runs 1, 300 and 20000, three binaries compared on 3,000 fuzzed inputs per function. They agree — and the lane’s first full-domain run made the reference itself revert on a dust pool.

Known formally as N-Version Quote Maths in the BlazePhoenix whitepaper.

BlazePhoenix Engineering · updated 2026-09-06 · data through 2026-10-11 · 6 min · written from the deployed bytecode

By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.

Abstract in 15 languages · resumo · resumen · 摘要 · 要旨 · ملخص

English — The Core’s quote maths compiled at optimizer_runs 1, 300 and 20000, three binaries compared on 3,000 fuzzed inputs per function. They agree — and the lane’s first full-domain run made the reference itself revert on a dust pool. The repair, the three tests, the 5,000-run fuzz, the 60,000-sample sweep and the three mutants, told once as the result of an instrument.

Português — A matemática de cotação do Core compilada com optimizer_runs 1, 300 e 20000, três binários comparados em 3,000 entradas fuzzed por função. Concordam — e a primeira corrida de domínio completo desta via fez a própria referência reverter numa pool de pó. A reparação, os três testes, o fuzz de 5,000 corridas, a varredura de 60,000 amostras e os três mutantes, contados uma vez como o resultado de um instrumento.

Español — La matemática de cotización del Core compilada con optimizer_runs 1, 300 y 20000, tres binarios comparados sobre 3,000 entradas fuzzeadas por función. Coinciden — y la primera corrida de dominio completo de esta vía hizo que la propia referencia revirtiera en una pool de polvo. La reparación, las tres pruebas, el fuzz de 5,000 corridas, el barrido de 60,000 muestras y los tres mutantes, contados una sola vez como el resultado de un instrumento.

Français — Les maths de devis du Core compilées avec optimizer_runs 1, 300 et 20000, trois binaires comparés sur 3,000 entrées fuzzées par fonction. Ils s’accordent — et la première passe en domaine complet de cette voie a fait revert la référence elle-même sur un pool de poussière. La réparation, les trois tests, le fuzz de 5,000 tirages, le balayage de 60,000 échantillons et les trois mutants, racontés une fois comme le résultat d’un instrument.

Deutsch — Die Quote-Mathematik des Core, kompiliert mit optimizer_runs 1, 300 und 20000, drei Binaries verglichen auf 3,000 gefuzzten Eingaben pro Funktion. Sie stimmen überein — und der erste Lauf dieser Spur über den vollen Definitionsbereich brachte die Referenz selbst dazu, an einem Staub-Pool zu reverten. Die Reparatur, die drei Tests, der Fuzz über 5,000 Läufe, der Sweep über 60,000 Stichproben und die drei Mutanten, einmal erzählt als das Ergebnis eines Instruments.

Русский — Математика котировок Core, скомпилированная при optimizer_runs 1, 300 и 20000, три бинарника сравнены на 3,000 фаззинговых входах на функцию. Они сходятся — а первый прогон этой линии по всей области определения заставил саму эталонную реализацию сделать revert на пылевом пуле. Починка, три теста, фаззинг на 5,000 прогонов, развёртка на 60,000 выборок и три мутанта — рассказанные один раз как результат инструмента.

Türkçe — Core’un teklif matematiği optimizer_runs 1, 300 ve 20000 ile derlendi; üç ikili dosya, işlev başına 3,000 fuzz girdisinde karşılaştırıldı. Uyuşuyorlar — ve bu hattın tüm tanım kümesindeki ilk koşusu, referansın kendisini bir toz havuzunda revert ettirdi. Onarım, üç test, 5,000 koşuluk fuzz, 60,000 örneklik tarama ve üç mutant: bir aracın sonucu olarak bir kez anlatıldı.

العربية — رياضيات التسعير في Core مُصرَّفة عند optimizer_runs 1 و300 و20000، وثلاثة ملفات ثنائية قورنت على 3,000 مُدخل عشوائي (fuzz) لكل دالة. إنها تتفق — وأول تشغيل لهذا المسار على المجال الكامل جعل المرجع نفسه يرتد (revert) عند بركة غبار. الإصلاح، والاختبارات الثلاثة، والفحص العشوائي بـ5,000 تشغيل، والمسح بـ60,000 عينة، والطفرات الثلاث: تُروى مرة واحدة بوصفها نتيجة أداة.

हिन्दी — Core का कोट गणित optimizer_runs 1, 300 और 20000 पर कंपाइल किया गया, तीन बाइनरी प्रति फ़ंक्शन 3,000 फ़ज़्ड इनपुट पर तुलना की गईं। वे सहमत हैं — और इस लेन की पहली पूर्ण-डोमेन दौड़ ने स्वयं संदर्भ को ही एक धूल-पूल पर revert करा दिया। मरम्मत, तीन टेस्ट, 5,000 दौड़ का फ़ज़, 60,000 नमूनों का स्वीप और तीन म्यूटेंट — एक उपकरण के परिणाम के रूप में एक बार बताए गए।

日本語 — Core の見積もり計算を optimizer_runs 1、300、20000 でコンパイルし、三つのバイナリを関数あたり 3,000 件のファズ入力で比較した。三者は一致する — そしてこのレーンの全定義域を通した最初の実行が、参照実装そのものをダストプールで revert させた。修理、三つのテスト、5,000 回のファズ、60,000 サンプルの掃引、そして三つの変異体を、ひとつの計測器の結果として一度だけ語る。

中文 — Core 的报价数学分别以 optimizer_runs 1、300 和 20000 编译,三个二进制在每个函数 3,000 个模糊测试输入上比对。它们一致 — 而这条路线第一次跑遍完整定义域时,让参照实现自己在一个尘埃池上 revert 了。修复、三个测试、5,000 次的模糊测试、60,000 个样本的扫描以及三个变异体,作为一件仪器的结果讲述一次。

한국어 — Core의 견적 수식을 optimizer_runs 1, 300, 20000으로 컴파일하고, 세 개의 바이너리를 함수당 3,000개의 퍼즈 입력으로 비교했다. 셋은 일치한다 — 그리고 이 레인의 첫 전 정의역 실행에서 기준 구현 자체가 먼지 풀에서 revert했다. 수리, 세 개의 테스트, 5,000회 퍼즈, 60,000 표본 스윕, 그리고 세 개의 변이체를 한 계측기의 결과로서 한 번에 이야기한다.

Bahasa Indonesia — Matematika kuotasi Core dikompilasi pada optimizer_runs 1, 300 dan 20000; tiga biner dibandingkan pada 3,000 masukan fuzz per fungsi. Ketiganya sepakat — dan lintasan ini, pada jalannya yang pertama atas seluruh domain, membuat implementasi rujukan itu sendiri revert pada pool debu. Perbaikannya, ketiga ujinya, fuzz 5,000 putaran, sapuan 60,000 sampel dan ketiga mutannya, diceritakan sekali sebagai hasil sebuah instrumen.

বাংলা — Core-এর কোট গণিত optimizer_runs 1, 300 ও 20000-এ কম্পাইল করা হয়েছে, তিনটি বাইনারি প্রতি ফাংশনে 3,000টি ফাজ ইনপুটে তুলনা করা হয়েছে। তারা একমত — আর এই লেনের প্রথম পূর্ণ-ডোমেন দৌড় খোদ রেফারেন্স বাস্তবায়নকেই একটি ধুলো-পুলে revert করিয়ে দিল। মেরামত, তিনটি টেস্ট, 5,000 দৌড়ের ফাজ, 60,000 নমুনার সুইপ এবং তিনটি মিউট্যান্ট — একটি যন্ত্রের ফলাফল হিসেবে একবারই বলা।

Filipino — Ang matematika ng quote ng Core na kinompile sa optimizer_runs 1, 300 at 20000, tatlong binary na inihambing sa 3,000 fuzzed na input bawat function. Nagkakasundo sila — at ang unang buong-domain na takbo ng lane na ito ang nagpa-revert mismo sa reference sa isang dust pool. Ang pagkukumpuni, ang tatlong test, ang fuzz na 5,000 takbo, ang sweep na 60,000 sample at ang tatlong mutant, isinalaysay nang isang beses bilang resulta ng isang instrumento.

What you gain from this page is a component most test suites never test: the compiler. A suite executes one binary — the one the release settings emit — and profile_parity.py keeps the suite on those settings so that the binary tested is the binary shipped. That closes one gap and leaves another open. Every other optimiser setting is a different program compiled from the same source, and a miscompile, or source that only means what it seems to mean under one setting, is invisible to a suite that runs under that setting alone.

N-version programming, in Avizienis’s 1985 formulation, runs independently produced versions of a program and compares their outputs. Here the versions are not independently written — that would need three teams — but independently generated: the same source under three code generators, which is the cheap half of the idea and exactly the half that catches a compiler.

Output against input for a balanced pair: the Solidly stable curve against constant product and the zero-slippage diagonal
Output against input for a balanced stable pair, from the Core’s own formulas: the Solidly quartic (x³y + xy³ = k) against constant product and the zero-slippage diagonal — the curve the N-version lane fuzzed over its whole domain. Source: BlazePhoenixCore.sol outV2, outSolidlyStable.

The lane

test/nversion/ compiles the Core’s quote maths — through CoreProbe.sol, an external surface over the internal library — under two more profiles, nver1 at optimizer_runs = 1 and nver2 at 20000, everything else identical to release at 300. NVersionCore.t.sol deploys the three binaries side by side and asserts equality on fuzzed inputs for outV2, outV3, outSolidly, outSolidlyStable, mulDiv and mulDivUp: 3,000 runs each, over the whole input domain.

Two guards keep the lane from passing vacuously. It first asserts that the alternate bytecode differs from the shipped one, so it cannot pass by comparing a program with itself. And NVERSION_LANE=1 turns a missing artefact from a skip into a failure, so it cannot pass by never having built anything. A verdict without a search is vacuity; both guards exist because that shape of green has been produced before, in this repository’s own tooling.

profileoptimizer_runsrole
release300the shipped binary; the suite runs on it
nver11size-biased code generation
nver220000speed-biased code generation

Source: ASSURANCE.md §4n; VERIFICATION-REPORT-2026-09.md §2 and §8 — 3,000 fuzzed inputs per function, six functions

The result: the three binaries agree

On every fuzzed input, the three binaries return the same word. The compiler was not the finding. What the lane found instead came from its shape rather than its purpose: to compare three binaries over the whole input domain, the fuzz has to visit the whole input domain, and the existing tests of the stable curve had not.

The reference reverted on a dust pool

outSolidlyStable — the Solidly stable curve, x³y + xy³ = k solved by Newton’s method — on a pool holding under one unit of each token raised BPC:mulDiv instead of quoting zero. The curve’s domain guards were written for the seed of the iteration; the guard that checks whether k fits a word divided max · WAD / b, and that division itself overflows once b is below one WAD, a pool with less than one token per side. A second escape, a whale input reserve against a dust output reserve, passed the k check and overflowed the derivative on the first step.

Neither was a wrong number. Both were reverts inside a quote, and universalQuote is a library DELEGATECALL, so the revert unwinds the Solver’s whole plan and, with it, the planned door for the pair. The reach is stated with the mechanism: the curve is the fallback for a pool whose own getAmountOut answers at most 1 wei, so a registered pool holding 1 wei of the output token is enough. Its class is the one this repository names first — fail-open — found by an instrument that was not looking for it.

The repair asks the question the division stood in for

mulDiv reverts exactly when the high word of the 512-bit product reaches the divisor. So instead of dividing, _mulFitsWad computes that high word — two multiplications, no division — and compares it with one WAD. It is asked once for k and once for the derivative, at the seed, which is the largest point Newton visits, and it cannot overflow on any input. The repair is 35 bytes smaller than the code it replaced, and the Hub is byte-for-byte the same size as before.

  1. Three named tests in CoreStableCurveFailsClosed.t.sol, including the plan-level reach through a real Solver, failed against the tree before the repair and pass against the tree after it — red first.
  2. A 5,000-run fuzz over the full domain finds no revert.
  3. A 60,000-sample sweep of the same arithmetic in Python finds no revert.
  4. Three mutants in the guard watch the two checks; a fourth guard, a cap on Newton’s iterate, was written first, found unobservable by any test once the two checks hold — its mutant was decorative — and removed.

What the lane does not establish

Reproduce

Build the two alternate profiles, then run the lane with the environment flag that refuses to skip.

FOUNDRY_PROFILE=nver1 forge build --skip '*.t.sol' && FOUNDRY_PROFILE=nver2 forge build --skip '*.t.sol'
NVERSION_LANE=1 forge test --match-path 'test/nversion/*'        # the three binaries agree
forge test --match-path test/CoreStableCurveFailsClosed.t.sol      # the repair, red-first

Do not trust this page — reproduce it

Every claim above is checkable against the chain. Start here:

git clone https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex && cd Blaze-Phoenix-Dex && FOUNDRY_PROFILE=nver1 forge build --skip '*.t.sol' && FOUNDRY_PROFILE=nver2 forge build --skip '*.t.sol' && NVERSION_LANE=1 forge test --match-path 'test/nversion/*'
Cite this article

Licensed CC BY 4.0 — quote, translate and reuse freely, including commercially, with attribution and a link. Copy a ready-made citation:

BlazePhoenix (2026). N-version quote maths: one source, three compilers’ worth of binaries, and what the lane found. BlazePhoenix Engineering. https://blazephoenix.xyz/learn/n-version-quote-maths
@misc{blazephoenix_n_version_quote_maths,
  title  = {N-version quote maths: one source, three compilers’ worth of binaries, and what the lane found},
  author = {BlazePhoenix},
  year   = {2026},
  url    = {https://blazephoenix.xyz/learn/n-version-quote-maths},
  note   = {Accessed: reproduce the claim with the command above}
}

Writing an answer, a wiki entry or a paper? The claim above is reproducible against the chain before you quote it — which is the only sound basis for citing a technical source at all.

Contracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF). Standards cited: A. AVIZIENIS — THE N-VERSION APPROACH TO FAULT-TOLERANT SOFTWARE, IEEE TRANSACTIONS ON SOFTWARE ENGINEERING SE-11(12), 1985 — HTTPS://DOI.ORG/10.1109/TSE.1985.231893

Related engineering

Next in Limits of verification · 3 / 4
What a conservation guard cannot see: five findings that passed a correct, enforced, tested invariant ›A measurement: a conservation check applied at thirteen entry points with no exemption for administrators was silent for six of the seven vulnerabilities disclosed against the contract it protected — and five of those are 2-safety properties no single-trace invariant can express.12 min

Questions, a partnership or a bug to report? Contact us or email contact@blazephoenix.xyz