Skip to content

feat: add initial fuzz testing #271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

oleonardolima
Copy link
Contributor

@oleonardolima oleonardolima commented Jun 24, 2025

Description

It's an initial work towards the goal of #61, it adds a new fuzz crate to the project which is meant to be used to add new fuzz target in order to increase the fuzz coverage.

It's built on top of and with inspiration from previous Antoine's work through the most recent BDK Audit.

So far, this PR:

  • creates a new fuzz crate with cargo fuzz relying on LibFuzzer engine.
  • adds an initial fuzz target, which builds and applies an Update to Wallet.
  • adds both initial fuzzed_data_provider and fuzz_utils with common used fns to build BDK's-specific types from fuzzed bytes.

Still to be done by this PR:

  • write-up the README.md with instructions for other users.
  • add helpful bash scripts, to build the environment, and run the existing fuzz targets.
  • add a new CI step, to briefly run the existing fuzz targets at a certain schedule.
  • add remaining: (i) persist ; (ii) tx creation fuzz targets (by Antoine's existing target).
  • add other fuzz targets.

Notes to the reviewers

Are there any other BDK usage scenarios you'd like to see covered by a fuzz target ? Let's discuss it either on the issue or under this PR comments.

Changelog notice

TBD

Checklists

All Submissions:

@coveralls
Copy link

coveralls commented Jun 24, 2025

Pull Request Test Coverage Report for Build 16149185029

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 94 unchanged lines in 7 files lost coverage.
  • Overall coverage decreased (-0.8%) to 84.733%

Files with Coverage Reduction New Missed Lines %
wallet/src/descriptor/dsl.rs 1 95.34%
wallet/src/wallet/changeset.rs 2 85.0%
wallet/src/descriptor/policy.rs 3 79.07%
wallet/src/wallet/coin_selection.rs 3 98.48%
wallet/src/descriptor/template.rs 4 98.04%
wallet/src/wallet/tx_builder.rs 39 93.35%
wallet/src/wallet/mod.rs 42 81.03%
Totals Coverage Status
Change from base Build 15719064446: -0.8%
Covered Lines: 6577
Relevant Lines: 7762

💛 - Coveralls

@oleonardolima oleonardolima force-pushed the feat/add-initial-fuzz-testing branch from 1114dc9 to 31f422f Compare June 25, 2025 19:03
- creates a new `fuzz` crate, it's meant to run fuzz testing over
  bdk_wallet targets, with `cargo fuzz` (libFuzzer).
- creates an initial `wallet_update` fuzz target for `bdk_wallet`.
- creates an initial `fuzzed_data_provider` and `fuzz_utils` files with
  useful methods to consume the fuzzed data into `bdk_wallet` API-specific types.
@oleonardolima oleonardolima force-pushed the feat/add-initial-fuzz-testing branch from 31f422f to 2b885dc Compare June 25, 2025 19:15
@oleonardolima oleonardolima self-assigned this Jun 25, 2025
@oleonardolima oleonardolima added the tests New or improved tests label Jun 25, 2025
@oleonardolima oleonardolima moved this to In Progress in BDK Wallet Jun 25, 2025
@oleonardolima oleonardolima added this to the Wallet 3.0.0 milestone Jun 25, 2025
@evanlinjin
Copy link
Member

Could you include the rationale for having a separate crate for fuzzing? Is it because we need to use nightly cargo?

@TheBlueMatt
Copy link

Rather than requiring use of libFuzzer, it might make sense to build a generic fuzz wrapper, possibly based on the LDK fuzz infra at https://github.com/lightningdevkit/rust-lightning/tree/main/fuzz or the rust-bitcoin fuzz infra. libFuzzer is great and one of the more actively maintained fuzz harnesses, but honggfuzz is in many cases easier to run, so we've found it quite useful to offer both (plus AFL, for those who want that).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
tests New or improved tests
Projects
Status: In Progress
Development

Successfully merging this pull request may close these issues.

4 participants