Issues

• Safe public APIs can reach UB in release builds through invalid internal states

  bluealloy/revm#4000 · Filter by author Sieger9303 opened on Oct 30, 2026

• Stack::exchange computes n + m without overflow check, bypassing the bounds check and reading uninitialized memory (UB)

  bluealloy/revm#3999 · Filter by author zhaohy666-art opened on Oct 30, 2026
  1

• Stack::data_mut() hands out &mut Vec<U256>, letting safe code break the capacity invariant and trigger out-of-bounds writes in dup / push_slice (UB)

  bluealloy/revm#3998 · Filter by author zhaohy666-art opened on Oct 30, 2026

• codesize / codecopy use assume!(!is_eof()) which expands to unreachable_unchecked in release — public bytecode/contract fields let safe code reach the unreachable branch (UB)

  bluealloy/revm#3997 · Filter by author zhaohy666-art opened on Oct 30, 2026

• Interpreter::step dereferences instruction_pointer without checking it is valid — public instruction_pointer field lets safe code trigger a dangling-pointer dereference (UB)

  bluealloy/revm#3996 · Filter by author zhaohy666-art opened on Oct 30, 2026

• push and load_eof_code rely on analysis-time padding / "pc is correct" invariants without runtime bounds check — public Interpreter fields let safe code trigger out-of-bounds from_raw_parts / ptr::add (UB)

  bluealloy/revm#3995 · Filter by author zhaohy666-art opened on Oct 30, 2026

• rjump / rjumpi / rjumpv use std::ptr::offset without runtime bounds check — public Interpreter fields let safe code trigger out-of-bounds pointer arithmetic (UB)

  bluealloy/revm#3994 · Filter by author zhaohy666-art opened on Oct 30, 2026

• Stack::push assumes capacity == STACK_LIMIT, but serde deserialization can produce a larger capacity (UB in release)

  bluealloy/revm#3992 · Filter by author zhaohy666-art opened on Oct 28, 2026
  1

• SharedMemory::slice_mut: out-of-bounds is UB (not panic) in release builds

  bluealloy/revm#3991 · Filter by author zhaohy666-art opened on Oct 28, 2026
  1

• SharedMemory::slice_range/slice_mut: out-of-bounds is UB (not panic) in release builds

  bluealloy/revm#3990 · Filter by author zhaohy666-art opened on Oct 28, 2026
  1

• Expose the EIP-7702 authorization refund to inspectors during execution

  bluealloy/revm#3978 · Filter by author MysticRyuujin opened on Oct 17, 2026

• EIP-7702: delegated precompile address runs the precompile instead of the delegate code

  bluealloy/revm#3972 · Filter by author DaniPopes opened on Oct 13, 2026

• revm-inspector enables serde_json's preserve_order without using it

  bluealloy/revm#3944 · Filter by author hedgar2017 opened on Sep 25, 2026

• EIP-8037: missing TX_MAX_TOTAL_GAS_LIMIT enforcement

  bluealloy/revm#3929 · Filter by author anaPerezGhiglia opened on Sep 21, 2026

• Silent U256 truncation in blockchain test Transaction::to_tx_env()

  bluealloy/revm#3911 · Filter by author wangjingshuiku opened on Sep 12, 2026

• Precompiles::get_mut() can leave optimized short-address lookups stale

  bluealloy/revm#3859 · Filter by author aroralanuk opened on Aug 15, 2026

• CacheDB::flatten() drops inner storage entries for accounts present in both caches

  bluealloy/revm#3838 · Filter by author grandpig opened on Aug 3, 2026

• perf(precompile): kzg point-evaluation verify does an avoidable G2 scalar multiplication

  bluealloy/revm#3835 · Filter by author 4waan opened on Aug 2, 2026

• Inspector::selfdestruct is skipped for post-Cancun selfdestruct-to-self

  bluealloy/revm#3834 · Filter by author mo4islona opened on Jul 31, 2026

• TxEnvBuilder::build_fill leaves a repaired blob transaction typed as Legacy or EIP-1559

  bluealloy/revm#3826 · Filter by author 1sgtpepper opened on Jul 26, 2026

• UB found by miri

  bluealloy/revm#3776 · Filter by author yilin0518 opened on Jun 24, 2026
  1

• Potential soundness issue in revm-interpreter 35.0.1

  bluealloy/revm#3687 · Filter by author varies-rust opened on May 19, 2026
  1

• Upgrade to edition 2024

  bluealloy/revm#3575 · Filter by author DaniPopes opened on Apr 15, 2026

• Make memory expansion cost configurable through Cfg/Host

  bluealloy/revm#3489 · Filter by author haythemsellami opened on Mar 9, 2026

• Unsoundness in ExtBytecode::relative_jump: Safe API allows out-of-bounds pointer offset (UB)

  bluealloy/revm#3487 · Filter by author DiuDiu777 opened on Mar 9, 2026
  5