# Fuzzer Benchmark Report (from bug-count CSV)

- Time budget: **6.00h**

## Executive summary
This report is derived solely from cumulative bugs-found over time across repeated runs per fuzzer. It emphasizes robust, distribution-based metrics (median/IQR, success rates, time-to-k) and shape-based behavior (plateau time, late discovery share) instead of single-run time-to-first-bug.

## Bugs found at fixed time budgets (median [IQR])
| Fuzzer | Runs | 1h | 4h |
|---|---|---|---|
| foundry | 4 | 6 [6,6] | 6 [6,6] |
| medusa | 4 | 6 [6,6] | 6 [6,7] |
| echidna | 4 | 4 [4,4] | 6 [5,6] |

## Overall metrics
| Fuzzer | AUC (norm) | Plateau time | Late discovery share | Final median | Final IQR |
|---|---|---|---|---|---|
| foundry | 0.665 | 0.10h | 0.000 | 6 | 0.00 |
| medusa | 0.646 | 0.50h | 0.000 | 6 | 0.75 |
| echidna | 0.548 | 4.40h | 0.308 | 6 | 1.75 |

## Milestones: time-to-k and success rates
| Fuzzer | time-to-1 (p50) | time-to-3 (p50) | time-to-5 (p50) | reach-1 rate | reach-3 rate | reach-5 rate |
|---|---|---|---|---|---|---|
| foundry | 0.00h | 0.00h | 0.00h | 100.0% | 100.0% | 100.0% |
| medusa | 0.10h | 0.10h | 0.35h | 100.0% | 100.0% | 100.0% |
| echidna | 0.10h | 0.10h | 2.20h | 100.0% | 100.0% | 75.0% |

## Shape-based interpretation (rules of thumb)
- **Fast-start / early-plateau**: high early checkpoint median + early plateau time + low late discovery share.
- **Steady**: moderate AUC, later plateau, consistent improvements across checkpoints, moderate variance.
- **Slow-burn / late-surge**: low early checkpoints but high late discovery share and later plateau time; often higher final median.

## Limitations
- Core metrics in this section are count-based; use `broken_invariants.md` / `broken_invariants.csv` for invariant identities.
- Severity, exploitability, and root-cause uniqueness cannot be measured directly without richer per-bug metadata.
- Harness design still affects results; mitigate by keeping harness identical across fuzzers and reporting many runs.
