# Ground-truth known-bug mapping

- Target: `aave-v4`
- Evidence-pinned commit: `459b020058f4a65d18eb1481083b75c766340124`
- Resolution: matched run repository and commit
- Catalog: `benchmarks/known_bugs.json`

Only the two instrumented health-check canaries are mapped. Other property failures remain unmapped until a reviewed root-cause record ties them to a confirmed bug.

Canaries are reported separately as harness-health checks and are never included in the known-bug hit-rate denominator.

## Per-fuzzer results

| Fuzzer | Replicates | Known-bug replicate hits | Catalog coverage | Canary replicate hits | Unmapped event findings |
| --- | ---: | ---: | ---: | ---: | ---: |
| echidna | 2 | n/a | n/a | 4/4 (100.0%) | 10 |
| foundry | 2 | n/a | n/a | 4/4 (100.0%) | 9 |
| medusa | 2 | n/a | n/a | 4/4 (100.0%) | 9 |
| recon-fuzzer | 2 | n/a | n/a | 4/4 (100.0%) | 14 |

## Known-bug catalog

| Ground-truth ID | Kind | Title | Evidence |
| --- | --- | --- | --- |
| _None cataloged_ |  |  |  |

## Unmapped event identities

| Fuzzer | Event identity | Replicates observed |
| --- | --- | ---: |
| echidna | `iHub_mintFeeShares` | 2 |
| echidna | `iSpoke_withdraw` | 1 |
| echidna | `invariant_shouldNotBecomeLiquidatable` | 1 |
| echidna | `invariant_supplySharePriceAndDrawnIndexMonotonic` | 2 |
| echidna | `invariant_totalBorrowedLessThanSupplied_v0` | 2 |
| echidna | `invariant_totalBorrowedLessThanSupplied_v1` | 2 |
| foundry | `iHub_mintFeeShares` | 2 |
| foundry | `invariant_shouldNotBecomeLiquidatable` | 2 |
| foundry | `invariant_totalBorrowedLessThanSupplied_v0` | 2 |
| foundry | `invariant_totalBorrowedLessThanSupplied_v1` | 2 |
| foundry | `invariant_totalBorrowedLessThanSupplied_v2` | 1 |
| medusa | `iHub_mintFeeShares` | 2 |
| medusa | `iSpoke_withdraw` | 1 |
| medusa | `invariant_shouldNotBecomeLiquidatable` | 2 |
| medusa | `invariant_totalBorrowedLessThanSupplied_v0` | 2 |
| medusa | `invariant_totalBorrowedLessThanSupplied_v1` | 2 |
| recon-fuzzer | `iHub_mintFeeShares` | 2 |
| recon-fuzzer | `iSpoke_liquidationCall` | 2 |
| recon-fuzzer | `iSpoke_repay` | 2 |
| recon-fuzzer | `iSpoke_withdraw` | 1 |
| recon-fuzzer | `invariant_shouldNotBecomeLiquidatable` | 1 |
| recon-fuzzer | `invariant_supplySharePriceAndDrawnIndexMonotonic` | 2 |
| recon-fuzzer | `invariant_totalBorrowedLessThanSupplied_v0` | 2 |
| recon-fuzzer | `invariant_totalBorrowedLessThanSupplied_v1` | 2 |

## Counting semantics

- A canonical known-bug ID counts at most once per replicate, even when several event aliases or counterexamples reach it.
- A replicate is identified by `(run_id, instance_id, fuzzer)`.
- Known-bug hit rate is `canonical bug/replicate hits ÷ (cataloged bugs × replicates)`.
- Unmapped rows are distinct normalized event identities per replicate. They are triage candidates, not claimed bugs.
- Crash inputs and corpus files are not used as bug identities.