Skip to content
HASHXLABS
Invariant Lab

Break a vault. Then fix it.

An interactive simulation of how we test contracts. Pick a variant, run the fuzzer and read the counterexample. The output is scripted for illustration, not taken from a client project.

invariant labsimulated output · not client data

External call happens before the balance update.

1function withdraw(uint256 shares) external {
2    uint256 assets = previewRedeem(shares);
3    token.safeTransfer(msg.sender, assets);
4    balanceOf[msg.sender] -= shares;
5    totalShares -= shares;
6}
press run to fuzz this contract
3 invariants · foundry

What this shows

  1. 01

    Invariants, not examples

    A test that says "this input works" proves little. A property that must hold for every call sequence is what catches the bug.

  2. 02

    Counterexamples you can run

    When a property fails, the fuzzer shrinks the attack to its shortest call sequence. That sequence becomes a regression test.

  3. 03

    The fix is checked, too

    Apply the fix and the same properties run again. If they hold across the whole campaign, that class of bug is covered.

Want this level of testing on your contracts?

Tell us what you are building and what must not go wrong. An engineer who would work on it will reply.

Start a project info@hashxlabs.com