Differential fuzzing

The comparison target can be a previous protocol version, a simpler reference model, another client, or two code paths expected to implement the same rule. Instead of writing every expected output by hand, the test treats disagreement as the signal to investigate.

Not every difference is a bug. Rounding, ordering, gas behavior, error types, and deliberately changed semantics need normalization or explicit exceptions. The strongest campaigns define which observations must match and preserve the sequence and state that produced a mismatch. See the migrated Balancer incident analysis for a concrete security use.