Bytecode similarity to audited upstream with behavior deviation
A tooling / compiler / ai factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor flags whether the protocol's deployed bytecode has high similarity to an audited upstream codebase but deviates in state-mutation ordering or control flow in a way consistent with AI-generated code modification. The detection method is a bytecode diff against known-audited upstream deployments, combined with curator inspection of state-mutation patterns. A positive flag does not prove AI generation but warrants additional scrutiny of the deviated sections.
**Why it matters** AI-assisted code generation can produce code that appears syntactically correct and semantically similar to audited upstream code but introduces subtle ordering violations (e.g., checks after effects, state mutations before external calls) that create exploitable vulnerabilities. The risk is amplified when the AI-modified code closely resembles audited code, because security reviewers may rely on pattern-recognition from the upstream audit rather than re-reviewing the modified sections from scratch. Two post-mortems in the in-sample dataset explicitly attributed exploited vulnerabilities to AI-generated code that deviated from the audited upstream pattern.
**Green / Yellow / Red** Green: bytecode diff against known-audited upstream shows only expected, documented modifications with no state-mutation ordering changes in security-critical paths. Yellow: bytecode diff reveals unexplained deviations in non-critical paths, or deviations in critical paths that can be explained by documented intentional changes. Red: bytecode diff reveals state-mutation ordering changes in security-critical functions (e.g., external calls before state updates, reentrancy-guard bypasses) that are not present in the audited upstream.
**Common gray cases** Protocols that fork from upstream code with documented security improvements (e.g., adding reentrancy guards that the upstream lacked) will show bytecode differences in security-critical paths; curator must evaluate whether the deviation is an improvement or a regression.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether the bytecode has high structural similarity to an audited upstream but deviates in state-mutation ordering (AI-generated copy risk pattern).