Skip to content

Commit 58594c7

Browse files
committed
fuzz: txorphan tests fixups
Adds the following fixups in txorphan fuzz tests: - Don't bond the output count of the created orphans based on the number of available coins - Allow duplicate inputs, when applicable, but don't store duplicate outpoints Rationale --------- The way the test is currently written, duplicate inputs are allowed based on a random flag (`duplicate_input`). If the flag is unset, upon selecting an outpoint as input for a new transaction, the input is popped to prevent re-selection, and later re-added to the collection (once all inputs have been picked). However, the re-addition to the collection is performed independently of whether the flag was set or not. This means that, if the flag is set, the selected inputs are duplicated which in turn makes these inputs more likely to be re-picked in the following iteration of the loop. Additionally, both the input and output count of the transaction and bonded to the number of available outpoints. This makes sense for the former, but the latter shouldn't be.
1 parent 842f7fd commit 58594c7

File tree

1 file changed

+10
-18
lines changed

1 file changed

+10
-18
lines changed

src/test/fuzz/txorphan.cpp

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,12 @@ FUZZ_TARGET(txorphan, .init = initialize_orphanage)
3737
SetMockTime(ConsumeTime(fuzzed_data_provider));
3838

3939
TxOrphanage orphanage;
40-
std::vector<COutPoint> outpoints;
40+
std::set<COutPoint> outpoints;
41+
4142
// initial outpoints used to construct transactions later
4243
for (uint8_t i = 0; i < 4; i++) {
43-
outpoints.emplace_back(Txid::FromUint256(uint256{i}), 0);
44+
outpoints.emplace(Txid::FromUint256(uint256{i}), 0);
4445
}
45-
// if true, allow duplicate input when constructing tx
46-
const bool duplicate_input = fuzzed_data_provider.ConsumeBool();
4746

4847
CTransactionRef ptx_potential_parent = nullptr;
4948

@@ -53,29 +52,22 @@ FUZZ_TARGET(txorphan, .init = initialize_orphanage)
5352
const CTransactionRef tx = [&] {
5453
CMutableTransaction tx_mut;
5554
const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
56-
const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
57-
// pick unique outpoints from outpoints as input
55+
const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, 256);
56+
// pick outpoints from outpoints as input. We allow input duplicates on purpose, given we are not
57+
// running any transaction validation logic before adding transactions to the orphanage
5858
for (uint32_t i = 0; i < num_in; i++) {
5959
auto& prevout = PickValue(fuzzed_data_provider, outpoints);
60-
tx_mut.vin.emplace_back(prevout);
61-
// pop the picked outpoint if duplicate input is not allowed
62-
if (!duplicate_input) {
63-
std::swap(prevout, outpoints.back());
64-
outpoints.pop_back();
65-
}
60+
// try making transactions unique by setting a random nSequence, but allow duplicate transactions if they happen
61+
tx_mut.vin.emplace_back(prevout, CScript{}, fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, CTxIn::SEQUENCE_FINAL));
6662
}
6763
// output amount will not affect txorphanage
6864
for (uint32_t i = 0; i < num_out; i++) {
6965
tx_mut.vout.emplace_back(CAmount{0}, CScript{});
7066
}
71-
// restore previously popped outpoints
72-
for (auto& in : tx_mut.vin) {
73-
outpoints.push_back(in.prevout);
74-
}
7567
auto new_tx = MakeTransactionRef(tx_mut);
76-
// add newly constructed transaction to outpoints
68+
// add newly constructed outpoints to the coin pool
7769
for (uint32_t i = 0; i < num_out; i++) {
78-
outpoints.emplace_back(new_tx->GetHash(), i);
70+
outpoints.emplace(new_tx->GetHash(), i);
7971
}
8072
return new_tx;
8173
}();

0 commit comments

Comments
 (0)