Eval integrity: @statxc submissions embed hardcoded answers / static report bank (#116 pending, #101 prior) — passed automated screening

[nickmopen]

Summary

A contributor (@statxc) has submitted agents that embed hardcoded benchmark answers / a static report bank — the exact practice the 2026-07-10 rules prohibit — across two rounds. The current entry (#116) passed automated static screening and is queued for Round 3 (scoring 4:00 PM EDT today). Raising for manual review before scoring.

Related prior report (now closed, on a since-dethroned king): #86.

Evidence

PR #116 (statxc-20260709-01, currently kata:pending)

Emits pre-written findings gated on verbatim source lines, not analysis:

• _contains_all(low, ("amountclaimed","totalamount","releaserate","stepsclaimed")) → hardcoded function="transferVesting" finding, line=_line_for(text, "grantorVesting.releaseRate = grantorVesting.totalAmount / numOfSteps;") (secondswap)
• _line_for(text, "_createVesting(_beneficiary, _amount, grantorVesting.stepsClaimed, true);")
• _line_for(text, "uint256 accrued = IERC20(tokens[i]).balanceOf(vault) - lastBalance;") (a second project)

The finding title/description/severity are hardcoded string literals — a "static report bank" returned without model analysis.

PR #101 (statxc, last round — scored 3 TP, since closed)

Same technique, more extensive: 9 _make_finding() calls gated on verbatim source-line matches fingerprinting multiple projects, e.g. _line_for(text, "SecondSwap_Vesting(vesting).transferVesting(address(this), buyer, amount);"). This indicates statxc's 3 true positives last round came from memorized answers, not detection.

Why automated screening missed it

The screener blocks specific literal leakage tokens (ground_truth, curated-highs-only, scabench, …). This technique embeds the answers without those strings — signatures + pre-written findings — so it passes. It needs a check for hardcoded findings keyed to verbatim source-line matches (e.g. _line_for(text, "<source literal>") banks).

Requests

1. Manual review of sn60__bitsec / miner: statxc-20260709-01 #116 before Round 3 scoring.
2. A ruling on Add sn60 bitsec miner submission for statxc #101's prior result.
3. Strengthen screening beyond literal-token matching to catch static finding banks.

Disclosure: I'm a competitor in this lane (#108), raising this in good faith on eval integrity. Happy to be corrected if this is deemed within the rules.