glamsterdam-compat-lab 0.3.0 → 0.3.2

package/datasets/public-seed/reports/bytecode-usdc-proxy-mainnet-runtime--research.json

@@ -0,0 +1,150 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "bytecode",
+    "name": "fixtures/bytecode/usdc-proxy-mainnet-runtime.hex"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 5,
+    "highCount": 0,
+    "mediumCount": 2,
+    "lowCount": 2,
+    "unknownCount": 1
+  },
+  "findings": [
+    {
+      "id": "bytecode.state-account-opcode-exposure",
+      "title": "State and account access opcodes are prominent in bytecode",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-7904",
+        "EIP-8038",
+        "EIP-7976"
+      ],
+      "description": "This bytecode contains multiple storage, account, or hashing opcodes. Glamsterdam gas repricing candidates may change the cost profile of state-heavy execution, but static bytecode does not prove those paths are hot.",
+      "evidence": [
+        {
+          "sensitiveOpcodeCount": 9,
+          "opcodeCounts": {
+            "SLOAD": 2,
+            "SSTORE": 3,
+            "EXTCODESIZE": 1,
+            "SELFBALANCE": 1,
+            "SHA3": 2
+          }
+        }
+      ],
+      "recommendation": "Replay representative transactions and benchmark hot paths once a Glamsterdam client/devnet or local fork configuration is available."
+    },
+    {
+      "id": "bytecode.calldata-copy-exposure",
+      "title": "Calldata copy opcode is present",
+      "severity": "low",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-7976",
+        "EIP-7904",
+        "EIP-8038"
+      ],
+      "description": "CALLDATACOPY appears in the bytecode. Calldata-related repricing candidates should be tested if this contract processes large calldata in production.",
+      "evidence": [
+        {
+          "CALLDATACOPY": 2
+        }
+      ],
+      "recommendation": "Add large-calldata cases to benchmarks and trace replay when final Glamsterdam parameters are known."
+    },
+    {
+      "id": "bytecode.storage-heavy-pattern",
+      "title": "Storage-related opcodes appear frequently",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-8038"
+      ],
+      "description": "This bytecode contains many storage-related opcodes. Glamsterdam gas repricing candidates may change the cost profile of storage-heavy execution.",
+      "evidence": [
+        {
+          "SLOAD": 2,
+          "SSTORE": 3,
+          "storageOps": 5
+        }
+      ],
+      "recommendation": "Replay representative storage-heavy transactions against a Glamsterdam devnet or fork configuration when available."
+    },
+    {
+      "id": "bytecode.log-opcodes-present",
+      "title": "Log opcodes are present",
+      "severity": "low",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The bytecode can emit logs. Indexers and monitoring systems should include representative log-emitting transactions when testing Glamsterdam-era assumptions.",
+      "evidence": [
+        {
+          "LOG0": 0,
+          "LOG1": 3,
+          "LOG2": 0,
+          "LOG3": 0,
+          "LOG4": 1
+        }
+      ],
+      "recommendation": "Include log-emitting paths in trace replay and indexer regression tests, especially where native ETH transfer visibility matters."
+    },
+    {
+      "id": "bytecode.manual-review-required",
+      "title": "Manual review is still required for runtime behavior",
+      "severity": "unknown",
+      "confidence": "low",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING"
+      ],
+      "description": "The scanner found static opcode evidence, but exact fork impact depends on executed paths, calldata, storage warmness, account state, compiler output, and final Glamsterdam parameters.",
+      "evidence": [
+        {
+          "byteLength": 2186,
+          "opcodeKinds": 80
+        }
+      ],
+      "recommendation": "Use this report to choose transactions for trace replay and benchmark them under current and Glamsterdam configurations."
+    }
+  ],
+  "assumptions": [
+    "Input was interpreted as EVM bytecode after removing whitespace and an optional 0x prefix.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change.",
+    "Detector thresholds are dated 2026-05-09 and are MVP heuristics, not protocol gas parameters."
+  ],
+  "limitations": [
+    "Static bytecode scanning cannot determine which branches are executed in production.",
+    "Opcode counts are not gas estimates and do not include dynamic call targets, storage keys, calldata sizes, or transaction context.",
+    "Findings are compatibility prompts, not predictions that a contract will fail."
+  ]
+}

package/datasets/public-seed/reports/bytecode-weth9-mainnet-runtime--default.json

@@ -0,0 +1,127 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "bytecode",
+    "name": "fixtures/bytecode/weth9-mainnet-runtime.hex"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 4,
+    "highCount": 0,
+    "mediumCount": 2,
+    "lowCount": 1,
+    "unknownCount": 1
+  },
+  "findings": [
+    {
+      "id": "bytecode.state-account-opcode-exposure",
+      "title": "State and account access opcodes are prominent in bytecode",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-7904",
+        "EIP-8038",
+        "EIP-7976"
+      ],
+      "description": "This bytecode contains multiple storage, account, or hashing opcodes. Glamsterdam gas repricing candidates may change the cost profile of state-heavy execution, but static bytecode does not prove those paths are hot.",
+      "evidence": [
+        {
+          "sensitiveOpcodeCount": 48,
+          "opcodeCounts": {
+            "SLOAD": 20,
+            "SSTORE": 6,
+            "BALANCE": 1,
+            "EXTCODECOPY": 1,
+            "SHA3": 20
+          }
+        }
+      ],
+      "recommendation": "Replay representative transactions and benchmark hot paths once a Glamsterdam client/devnet or local fork configuration is available."
+    },
+    {
+      "id": "bytecode.storage-heavy-pattern",
+      "title": "Storage-related opcodes appear frequently",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-8038"
+      ],
+      "description": "This bytecode contains many storage-related opcodes. Glamsterdam gas repricing candidates may change the cost profile of storage-heavy execution.",
+      "evidence": [
+        {
+          "SLOAD": 20,
+          "SSTORE": 6,
+          "storageOps": 26
+        }
+      ],
+      "recommendation": "Replay representative storage-heavy transactions against a Glamsterdam devnet or fork configuration when available."
+    },
+    {
+      "id": "bytecode.log-opcodes-present",
+      "title": "Log opcodes are present",
+      "severity": "low",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The bytecode can emit logs. Indexers and monitoring systems should include representative log-emitting transactions when testing Glamsterdam-era assumptions.",
+      "evidence": [
+        {
+          "LOG0": 0,
+          "LOG1": 1,
+          "LOG2": 2,
+          "LOG3": 3,
+          "LOG4": 0
+        }
+      ],
+      "recommendation": "Include log-emitting paths in trace replay and indexer regression tests, especially where native ETH transfer visibility matters."
+    },
+    {
+      "id": "bytecode.manual-review-required",
+      "title": "Manual review is still required for runtime behavior",
+      "severity": "unknown",
+      "confidence": "low",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING"
+      ],
+      "description": "The scanner found static opcode evidence, but exact fork impact depends on executed paths, calldata, storage warmness, account state, compiler output, and final Glamsterdam parameters.",
+      "evidence": [
+        {
+          "byteLength": 3124,
+          "opcodeKinds": 68
+        }
+      ],
+      "recommendation": "Use this report to choose transactions for trace replay and benchmark them under current and Glamsterdam configurations."
+    }
+  ],
+  "assumptions": [
+    "Input was interpreted as EVM bytecode after removing whitespace and an optional 0x prefix.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change.",
+    "Detector thresholds are dated 2026-05-09 and are MVP heuristics, not protocol gas parameters."
+  ],
+  "limitations": [
+    "Static bytecode scanning cannot determine which branches are executed in production.",
+    "Opcode counts are not gas estimates and do not include dynamic call targets, storage keys, calldata sizes, or transaction context.",
+    "Findings are compatibility prompts, not predictions that a contract will fail."
+  ]
+}

package/datasets/public-seed/reports/bytecode-weth9-mainnet-runtime--research.json

@@ -0,0 +1,127 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "bytecode",
+    "name": "fixtures/bytecode/weth9-mainnet-runtime.hex"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 4,
+    "highCount": 0,
+    "mediumCount": 2,
+    "lowCount": 1,
+    "unknownCount": 1
+  },
+  "findings": [
+    {
+      "id": "bytecode.state-account-opcode-exposure",
+      "title": "State and account access opcodes are prominent in bytecode",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-7904",
+        "EIP-8038",
+        "EIP-7976"
+      ],
+      "description": "This bytecode contains multiple storage, account, or hashing opcodes. Glamsterdam gas repricing candidates may change the cost profile of state-heavy execution, but static bytecode does not prove those paths are hot.",
+      "evidence": [
+        {
+          "sensitiveOpcodeCount": 48,
+          "opcodeCounts": {
+            "SLOAD": 20,
+            "SSTORE": 6,
+            "BALANCE": 1,
+            "EXTCODECOPY": 1,
+            "SHA3": 20
+          }
+        }
+      ],
+      "recommendation": "Replay representative transactions and benchmark hot paths once a Glamsterdam client/devnet or local fork configuration is available."
+    },
+    {
+      "id": "bytecode.storage-heavy-pattern",
+      "title": "Storage-related opcodes appear frequently",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING",
+        "EIP-8038"
+      ],
+      "description": "This bytecode contains many storage-related opcodes. Glamsterdam gas repricing candidates may change the cost profile of storage-heavy execution.",
+      "evidence": [
+        {
+          "SLOAD": 20,
+          "SSTORE": 6,
+          "storageOps": 26
+        }
+      ],
+      "recommendation": "Replay representative storage-heavy transactions against a Glamsterdam devnet or fork configuration when available."
+    },
+    {
+      "id": "bytecode.log-opcodes-present",
+      "title": "Log opcodes are present",
+      "severity": "low",
+      "confidence": "medium",
+      "domain": [
+        "contracts",
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The bytecode can emit logs. Indexers and monitoring systems should include representative log-emitting transactions when testing Glamsterdam-era assumptions.",
+      "evidence": [
+        {
+          "LOG0": 0,
+          "LOG1": 1,
+          "LOG2": 2,
+          "LOG3": 3,
+          "LOG4": 0
+        }
+      ],
+      "recommendation": "Include log-emitting paths in trace replay and indexer regression tests, especially where native ETH transfer visibility matters."
+    },
+    {
+      "id": "bytecode.manual-review-required",
+      "title": "Manual review is still required for runtime behavior",
+      "severity": "unknown",
+      "confidence": "low",
+      "domain": [
+        "contracts",
+        "execution"
+      ],
+      "relatedEips": [
+        "GAS-REPRICING"
+      ],
+      "description": "The scanner found static opcode evidence, but exact fork impact depends on executed paths, calldata, storage warmness, account state, compiler output, and final Glamsterdam parameters.",
+      "evidence": [
+        {
+          "byteLength": 3124,
+          "opcodeKinds": 68
+        }
+      ],
+      "recommendation": "Use this report to choose transactions for trace replay and benchmark them under current and Glamsterdam configurations."
+    }
+  ],
+  "assumptions": [
+    "Input was interpreted as EVM bytecode after removing whitespace and an optional 0x prefix.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change.",
+    "Detector thresholds are dated 2026-05-09 and are MVP heuristics, not protocol gas parameters."
+  ],
+  "limitations": [
+    "Static bytecode scanning cannot determine which branches are executed in production.",
+    "Opcode counts are not gas estimates and do not include dynamic call targets, storage keys, calldata sizes, or transaction context.",
+    "Findings are compatibility prompts, not predictions that a contract will fail."
+  ]
+}

package/datasets/public-seed/reports/indexers-balance-diff-indexer--default.json

@@ -0,0 +1,63 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "indexer",
+    "name": "fixtures/indexers/balance-diff-indexer.json"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 2,
+    "highCount": 0,
+    "mediumCount": 2,
+    "lowCount": 0,
+    "unknownCount": 0
+  },
+  "findings": [
+    {
+      "id": "indexer.balance-diff-native-transfer-assumption",
+      "title": "Indexer mentions balance-diff based native transfer handling",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The configuration mentions balance-diff based transfer handling. That can be a valid design, but it should be reviewed if native ETH transfer log proposals remain active or considered.",
+      "evidence": [
+        "Balance-diff marker found in configuration text."
+      ],
+      "recommendation": "Document whether native ETH transfers come from logs, balance diffs, traces, receipts, or a combined pipeline, and add replay tests for representative transfer cases."
+    },
+    {
+      "id": "indexer.missing-bal-readiness-metadata",
+      "title": "No explicit Block-Level Access List readiness metadata found",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7928"
+      ],
+      "description": "The configuration does not mention BALs or EIP-7928. Static config cannot prove whether the indexer is incompatible, but explorer and indexer teams should explicitly track BAL ingestion and monitoring assumptions.",
+      "evidence": [
+        "No BAL/EIP-7928 marker found in configuration text."
+      ],
+      "recommendation": "Add fork-readiness metadata documenting whether BAL-related block data is ignored, stored, displayed, monitored, or replay-tested."
+    }
+  ],
+  "assumptions": [
+    "JSON and YAML configs were parsed statically; subgraph-style handler fields were summarized when present.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change."
+  ],
+  "limitations": [
+    "Static indexer configuration cannot prove runtime indexing behavior.",
+    "Heuristics may miss compatibility logic implemented in code, environment variables, infrastructure manifests, or downstream pipelines.",
+    "Findings marked heuristic should be treated as review prompts."
+  ]
+}

package/datasets/public-seed/reports/indexers-explorer-replay-indexer--default.json

@@ -0,0 +1,45 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "indexer",
+    "name": "fixtures/indexers/explorer-replay-indexer.json"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 1,
+    "highCount": 0,
+    "mediumCount": 1,
+    "lowCount": 0,
+    "unknownCount": 0
+  },
+  "findings": [
+    {
+      "id": "indexer.balance-diff-native-transfer-assumption",
+      "title": "Indexer mentions balance-diff based native transfer handling",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The configuration mentions balance-diff based transfer handling. That can be a valid design, but it should be reviewed if native ETH transfer log proposals remain active or considered.",
+      "evidence": [
+        "Balance-diff marker found in configuration text."
+      ],
+      "recommendation": "Document whether native ETH transfers come from logs, balance diffs, traces, receipts, or a combined pipeline, and add replay tests for representative transfer cases."
+    }
+  ],
+  "assumptions": [
+    "JSON and YAML configs were parsed statically; subgraph-style handler fields were summarized when present.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change."
+  ],
+  "limitations": [
+    "Static indexer configuration cannot prove runtime indexing behavior.",
+    "Heuristics may miss compatibility logic implemented in code, environment variables, infrastructure manifests, or downstream pipelines.",
+    "Findings marked heuristic should be treated as review prompts."
+  ]
+}

package/datasets/public-seed/reports/indexers-subgraph--default.json

@@ -0,0 +1,123 @@
+{
+  "toolVersion": "0.3.2",
+  "fork": "glamsterdam",
+  "target": {
+    "kind": "indexer",
+    "name": "fixtures/indexers/subgraph.yaml"
+  },
+  "summary": {
+    "risk": "medium",
+    "findingCount": 5,
+    "highCount": 0,
+    "mediumCount": 4,
+    "lowCount": 0,
+    "unknownCount": 1
+  },
+  "findings": [
+    {
+      "id": "indexer.event-only-assumption",
+      "title": "Indexer appears to rely on event-only handlers",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "This looks like an event-only indexer configuration. Event-only pipelines should be reviewed for native ETH transfer visibility, balance-diff assumptions, and fork-specific log semantics if related EIPs remain active or considered.",
+      "evidence": [
+        {
+          "eventHandlers": 1,
+          "callHandlers": 0,
+          "blockHandlers": 0
+        }
+      ],
+      "recommendation": "Document how native ETH transfers are represented today, how they would be represented if transfer-log proposals are included, and how historical replay would be validated."
+    },
+    {
+      "id": "indexer.native-eth-transfer-review-missing",
+      "title": "No native ETH transfer handling metadata found",
+      "severity": "unknown",
+      "confidence": "low",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7708"
+      ],
+      "description": "The configuration does not mention native ETH transfers, balance diffs, or EIP-7708. Static config cannot determine whether the runtime indexer already handles this elsewhere.",
+      "evidence": [
+        "No native-transfer marker found in configuration text."
+      ],
+      "recommendation": "Add an explicit compatibility note or test plan for native ETH transfers, especially if dashboards or alerts currently infer transfers from balance diffs."
+    },
+    {
+      "id": "indexer.missing-bal-readiness-metadata",
+      "title": "No explicit Block-Level Access List readiness metadata found",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7928"
+      ],
+      "description": "The configuration does not mention BALs or EIP-7928. Static config cannot prove whether the indexer is incompatible, but explorer and indexer teams should explicitly track BAL ingestion and monitoring assumptions.",
+      "evidence": [
+        "No BAL/EIP-7928 marker found in configuration text."
+      ],
+      "recommendation": "Add fork-readiness metadata documenting whether BAL-related block data is ignored, stored, displayed, monitored, or replay-tested."
+    },
+    {
+      "id": "indexer.missing-fork-compatibility-metadata",
+      "title": "No explicit fork or EIP compatibility metadata found",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "tooling"
+      ],
+      "relatedEips": [
+        "EIP-7928",
+        "EIP-7708"
+      ],
+      "description": "The config does not include explicit Glamsterdam, fork, or EIP compatibility metadata. That may be fine for older configs, but it makes readiness tracking harder.",
+      "evidence": [
+        "No Glamsterdam/fork/EIP/compatibility marker found in configuration text."
+      ],
+      "recommendation": "Add a small compatibility section that records reviewed EIPs, replay status, testnet/devnet coverage, and owner notes."
+    },
+    {
+      "id": "indexer.missing-replay-plan",
+      "title": "No replay, testnet, or devnet plan found",
+      "severity": "medium",
+      "confidence": "medium",
+      "domain": [
+        "indexer",
+        "monitoring"
+      ],
+      "relatedEips": [
+        "EIP-7928",
+        "EIP-7708",
+        "GAS-REPRICING"
+      ],
+      "description": "The config does not mention a replay or testnet/devnet plan. Indexer compatibility is usually validated by replaying representative data rather than by static config alone.",
+      "evidence": [
+        "No replay/testnet/devnet marker found in configuration text."
+      ],
+      "recommendation": "Add a replay plan that covers historical sync, recent blocks, expected reorg behavior, native ETH transfer handling, and BAL-related block data."
+    }
+  ],
+  "assumptions": [
+    "JSON and YAML configs were parsed statically; subgraph-style handler fields were summarized when present.",
+    "The loaded registry is dated 2026-05-08. Glamsterdam scope and gas parameters may change."
+  ],
+  "limitations": [
+    "Static indexer configuration cannot prove runtime indexing behavior.",
+    "Heuristics may miss compatibility logic implemented in code, environment variables, infrastructure manifests, or downstream pipelines.",
+    "Findings marked heuristic should be treated as review prompts."
+  ]
+}