Attack lab

Every result is a real Z3 proof or a real counterexample. Change the postcondition and watch.

5 attacks 2 controls live: nothing pre-recorded

Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
Send and read the real reply, or run every preset and watch the scoreboard fill.

What each preset tests

	Preset	Route	Why it matters
attack	Sample: A discount that can make the price negative	`POST /vericoding-keystone/check`	Z3 proves the contract or returns a concrete counterexample.
attack	Sample: max3 returns c instead of the true maximum	`POST /vericoding-keystone/check`	Z3 proves the contract or returns a concrete counterexample.
attack	Sample: A clamp that returns lo + 1 for low inputs	`POST /vericoding-keystone/check`	Z3 proves the contract or returns a concrete counterexample.
attack	Sample: An absolute value that returns x - 1 for non-negative x	`POST /vericoding-keystone/check`	Z3 proves the contract or returns a concrete counterexample.
control	Sample: A correct clamp (Z3 proves the contract already holds)	`POST /vericoding-keystone/check`	Z3 proves the contract or returns a concrete counterexample.
attack	Your function: division that can divide by zero	`POST /vericoding-keystone/check-source`	Undefined behaviour is never PROVED (the 2026-11-02 fuzzer found this case).
control	Your function: honest max	`POST /vericoding-keystone/check-source`	A correct function proves.

Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.