# Ground-truth known-bug mapping

- Target: `drips`
- Evidence-pinned commit: `c50d160ead6bf82b1d1071e853dc74da0b23f595`
- Resolution: matched run repository and commit
- Catalog: `benchmarks/known_bugs.json`

The one real known bug is the pinned historical squeeze regression. Two assertion handlers are aliases for the same root cause and therefore count as one bug per run.

Canaries are reported separately as harness-health checks and are never included in the known-bug hit-rate denominator.

## Per-fuzzer results

| Fuzzer | Replicates | Known-bug replicate hits | Catalog coverage | Canary replicate hits | Unmapped event findings |
| --- | ---: | ---: | ---: | ---: | ---: |
| echidna | 2 | 2/2 (100.0%) | 1/1 (100.0%) | 4/4 (100.0%) | 21 |
| foundry | 2 | 2/2 (100.0%) | 1/1 (100.0%) | 4/4 (100.0%) | 19 |
| medusa | 2 | 2/2 (100.0%) | 1/1 (100.0%) | 4/4 (100.0%) | 20 |
| recon-fuzzer | 2 | 2/2 (100.0%) | 1/1 (100.0%) | 4/4 (100.0%) | 4 |

## Known-bug catalog

| Ground-truth ID | Kind | Title | Evidence |
| --- | --- | --- | --- |
| `drips/pre-update-time-squeeze` | historical-regression | Previously streamed funds can be removed from the squeezable balance | [source](https://github.com/scfuzzbench/drips-fuzzing-scfuzzbench/blob/c50d160ead6bf82b1d1071e853dc74da0b23f595/src/Streams.sol#L501-L510) |

## Unmapped event identities

| Fuzzer | Event identity | Replicates observed |
| --- | --- | ---: |
| echidna | `AssertionFailed` | 2 |
| echidna | `invariantAccountingVsTokenBalance` | 2 |
| echidna | `invariantWithdrawAllTokensShouldNotRevert` | 2 |
| echidna | `testAddStreamShouldNotRevert` | 2 |
| echidna | `testReceiveStreamsShouldNotRevert` | 2 |
| echidna | `testSetStreamBalanceShouldNotRevert` | 1 |
| echidna | `testSetStreamBalanceWithdrawAllShouldNotRevert` | 2 |
| echidna | `testSetStreamsShouldNotRevert` | 2 |
| echidna | `testSqueezableVsReceived` | 2 |
| echidna | `testSqueezeWithDefaultHistoryShouldNotRevert` | 2 |
| echidna | `testSqueezeWithFuzzedHistoryShouldNotRevert` | 2 |
| foundry | `invariantAccountingVsTokenBalance` | 2 |
| foundry | `invariantWithdrawAllTokensShouldNotRevert` | 2 |
| foundry | `testBalanceAtInFuture` | 2 |
| foundry | `testReceiveStreamsShouldNotRevert` | 2 |
| foundry | `testSetStreamBalanceShouldNotRevert` | 1 |
| foundry | `testSetStreamBalanceWithdrawAllShouldNotRevert` | 2 |
| foundry | `testSetStreamsShouldNotRevert` | 2 |
| foundry | `testSqueezableVsReceived` | 2 |
| foundry | `testSqueezeWithDefaultHistoryShouldNotRevert` | 2 |
| foundry | `testSqueezeWithFuzzedHistoryShouldNotRevert` | 2 |
| medusa | `invariantAccountingVsTokenBalance` | 2 |
| medusa | `invariantWithdrawAllTokensShouldNotRevert` | 2 |
| medusa | `testAddStreamShouldNotRevert` | 2 |
| medusa | `testReceiveStreamsShouldNotRevert` | 2 |
| medusa | `testSetStreamBalanceShouldNotRevert` | 2 |
| medusa | `testSetStreamBalanceWithdrawAllShouldNotRevert` | 2 |
| medusa | `testSetStreamsShouldNotRevert` | 2 |
| medusa | `testSqueezableVsReceived` | 2 |
| medusa | `testSqueezeWithDefaultHistoryShouldNotRevert` | 2 |
| medusa | `testSqueezeWithFuzzedHistoryShouldNotRevert` | 2 |
| recon-fuzzer | `invariantWithdrawAllTokensShouldNotRevert` | 2 |
| recon-fuzzer | `testReceiveStreamsShouldNotRevert` | 2 |

## Counting semantics

- A canonical known-bug ID counts at most once per replicate, even when several event aliases or counterexamples reach it.
- A replicate is identified by `(run_id, instance_id, fuzzer)`.
- Known-bug hit rate is `canonical bug/replicate hits ÷ (cataloged bugs × replicates)`.
- Unmapped rows are distinct normalized event identities per replicate. They are triage candidates, not claimed bugs.
- Crash inputs and corpus files are not used as bug identities.