LogicBench Access Control & Business Logic Vulnerability Benchmark
Benchmarking agent semantic reasoning on non-syntactic vulnerabilities: broken object-level authorization (BOLA), workflow state machine bypasses, and multi-tenant isolation leaks.
E-Commerce, Multi-Tenant SaaS, Workflows
Realistic Business Logic Topologies
Multi-Role Differential Authorization Oracle
Authorization Breach Identification
Core Research Problem
Business logic and authorization flaws (such as IDOR and BOLA) account for critical real-world vulnerabilities. Because these flaws involve syntactically valid requests and normal application APIs, traditional pattern-based SAST and DAST tools fail completely. LogicBench evaluates whether autonomous agents can reconstruct workflow state machines, recognize role matrices, and systematically detect authorization boundary bypasses.
Permission State Machine Inference
Extracts and models the implied role-permission matrix and step sequencing from API documentation and seed traffic.
Cross-Tenant Object Mutation
Systematically tests parameter substitution across tenant and role boundaries to uncover object-level leaks.
Step-Skipping & Workflow Bypasses
Detects flaws where multi-step transactional logic (e.g. checkout, payment confirmation, approvals) can be bypassed.
Differential Traffic Verification
Employs dual-token authentication sessions (Role A vs Role B) to verify unauthorized data mutations mathematically.
Deterministic Execution Pipeline
Every evaluation task follows a structured, auditable lifecycle from ingestion to oracle confirmation.
Seed Traffic & Credential Provision
Application is initialized with multiple authenticated role sessions (Admin, Operator, User A, User B).
Workflow Semantic Exploration
Agent analyzes legitimate workflow sequences and synthesizes cross-role mutation hypotheses.
Differential Authorization Oracle
Oracle monitors server database state and API responses to mathematically confirm unauthorized state change.
Falsifiable Scoring Standards
SecDome enforces strict ground-truth verification standards. No speculative scoring or synthetic shortcuts.
Dual-Role Validation Proof
Must prove that an action executed with Role A credentials successfully mutates or retrieves Role B private state.
State Sequence Violation Evidence
Identifies illegal jumps across finite state machines without fulfilling prerequisite authorization steps.
Semantic Context Precision
Distinguishes between intentional public endpoints and genuine broken object-level authorization vulnerabilities.
Benchmark specification and multi-role simulation templates defined. Ground-truth casebook construction in progress across open-source enterprise applications.
Reproducible & Auditable.
All SecDome benchmark specifications, task schemas, and evaluation protocols are maintained openly under Apache 2.0 / MIT. We invite external research groups to audit our task definitions and contribute reproducible evaluation environments.