This project is directly inspired by logic_bombs. It includes a set of small programs with logic bombs. The logic bomb can be triggered when certain conditions are met. We release the dataset for benchmarking purposes. Any dynamic testing tools (especially symbolic execution) can employ the dataset to benchmark their capabilities. The dataset was originally released with our paper:
You can use the binaries or their source codes as they are to test if your symbolic execution tool can detect the bomb.
For synthetic cases the binary is included in the repository and can be run directly.
For real-world (go-compiler/real-world/) cases each directory contains a README.md with the upstream repository, the exact vulnerable commit to check out, build instructions (go build -gcflags="all=-N -l"), and the command-line arguments or inputs that trigger the bug.
go-compiler/theoretical/: Go-compiled versions of simple, synthetic logic bombs (e.g.,crashme,invalid-shift).go-compiler/real-world/: Real CVEs and bugs from production Go projects (EASE-2026 evaluation corpus). Each subdirectory documents the vulnerable commit, build steps, and trigger inputs for the actual upstream binary.tinygo-compiler/theoretical/: TinyGo-compiled theoretical bombs that exercise a variety of runtime panics (null pointer dereference, array/slice out-of-bounds, invalid shift, nil map assignment, large channel creation, heap-allocation panic, etc.).tinygo-compiler/real-world/: Real-world style logic bomb (omni-vuln4) based on Merkle tree multi-proof generation.
Below we list these programs, how they are activated, and the conditions to trigger each bomb.
| Type | Binary / Case | Project | Activation | Trigger Condition |
|---|---|---|---|---|
| Null Pointer Dereference | crashme (Go) / crashme (TinyGo) |
Synthetic | Conditional | User inputs 'K' (ASCII 75) as argv[1][0]. |
broken-calculator-tinygo |
Synthetic | Conditional | argv[1]='5', argv[2]='+', argv[3]='5' → nil dereference in the engine. |
|
tinygo_additiongo |
Synthetic | Direct | Always dereferences a nil pointer; no specific input needed. | |
geth-tracers-2024 |
go-ethereum commit 733fcbbc |
Conditional | Call OnTxEnd(nil, nil) — nil receipt with no error dereferences receipt.GasUsed before the nil guard. |
|
geth-graphql-2025 |
go-ethereum commit bf141fbf |
Conditional | Query a non-existent block via GraphQL — HeaderByNumberOrHash returns (nil, nil) and b.header.Hash() dereferences nil. |
|
kubelet-empty-flag-2025 |
kubernetes/kubernetes commit 46e2c3fc |
Conditional | Run kubelet --help — the flag package calls String() on an uninitialised RegisterWithTaintsVar, dereferencing its nil Value pointer. |
|
kubectl-nil-delegate-2025 |
kubernetes/kubernetes commit 1c30a75a |
Conditional | Run kubectl exec <pod> -- <cmd> without a TTY — terminalSizeQueueAdapter.Next() is called with a nil delegate. |
|
| Array/Slice Out-of-Bounds | invalid-shift (Go) / invalid-shift (TinyGo) |
Synthetic | Conditional | argv[1][0] >= 64 triggers an out-of-bounds array access. |
panic-index |
Synthetic | Conditional | argv[1] outside [0, 2] causes index-out-of-range on a 3-element array. |
|
tinygo_index-out-of-range |
Synthetic | Direct | Always indexes slice[3] on a length-3 slice; no specific input needed. |
|
ksm-oob-2025 |
kube-state-metrics commit 61be81f |
Conditional | A metric path whose list index equals len(s) passes the > guard (off-by-one) and panics on s[i]. |
|
coredns-loop-oob-2025 |
coredns/coredns commit 0d05791 |
Conditional | Corefile with unix:// server block — NormalizeExact returns [], zones[0] panics at startup. |
|
goprotobuf-overflow-2013 |
golang/protobuf commit 4f8da86 |
Conditional | Varint-encoded length 0x7fffffffffffffff overflows int when added to p.index; bounds check passes but slice panics. |
|
| Memory Allocation | panic-alloc |
Synthetic | Conditional | argv[1]='1000' requests ~1 000 MB, exceeding the TinyGo heap limit. |
| Silent Integer Overflow | evm-gascost-2017 |
go-ethereum ≤ v1.5.x | Conditional | Memory size 0xffffffffe1 (≈ 4 GiB) causes words*words to overflow uint64 silently — wrong gas cost, no panic. |
fasthttp-parseuint-2020 |
valyala/fasthttp, parent of 3e27d8e |
Conditional | Content-Length: 9999999999999999999 — two-stage int overflow bypasses the overflow guard, wrong length accepted silently. |
|
tendermint-voting-2018 |
tendermint/tendermint v0.25–0.26 | Conditional | Validator set with totalVotingPower = MaxInt64/2 + 1 — TotalVotingPower()*2 overflows int64, empty commit accepted as valid. |
|
| Silent Arithmetic Error | p224-elliptic-2021 |
golang/go ≤ 1.15.8 (CVE-2021-3114) | Conditional | P-224 point with out[3] > 0xffff000 — inverted mask and missing carry-down produce a wrong field element silently. |
| Complex Logic (Real-world) | omni-vuln4 |
Synthetic Merkle tree | Conditional | Leaves 'a','b','c' with indices 1,3,5 — sibling index exceeds the tree array bounds. |
| Nil Map Assignment | tinygo_assign-to-nil-map |
Synthetic | Direct | Assigns to a key in a nil map; any run triggers a panic. |
| Invalid Shift (Negative) | tinygo_negative-shift |
Synthetic | Direct | Performs x << -1; any run triggers a negative-shift panic. |
| Channel Creation | tinygo_too-large-channel-creation |
Synthetic | Direct | Creates make(chan int, MaxInt); any run panics during channel creation. |