|
1 | 1 | # Fuzzing |
2 | 2 |
|
3 | | -## Running |
| 3 | +This directory contains fuzz tests for the Cosmos SDK to identify potential bugs, crashes, and security vulnerabilities through automated input generation. |
4 | 4 |
|
5 | | -The fuzz tests are in standard [Go format](https://go.dev/doc/fuzz/). |
6 | | -To run a fuzz test, use the `-fuzz` flag to `go test`. For example: |
| 5 | +## What is Fuzzing? |
| 6 | + |
| 7 | +Fuzzing is a testing technique that automatically generates random inputs to find edge cases, crashes, and unexpected behavior in code. The Go fuzzing framework uses coverage-guided fuzzing to efficiently explore code paths. |
| 8 | + |
| 9 | +## Available Fuzz Tests |
| 10 | + |
| 11 | +The following fuzz tests are available: |
| 12 | + |
| 13 | +- **Crypto HD**: `FuzzCryptoHDNewParamsFromPath`, `FuzzCryptoHDDerivePrivateKeyForPath` |
| 14 | +- **Types**: `FuzzTypesParseTimeBytes`, `FuzzTypesParseDecCoin`, `FuzzTypesParseCoin`, `FuzzTypesVerifyAddressFormat`, `FuzzTypesDecSetString` |
| 15 | +- **Tendermint**: `FuzzTendermintAminoDecodeTime` |
| 16 | +- **Crypto Types**: `FuzzCryptoTypesCompactBitArrayMarshalUnmarshal` |
| 17 | +- **Unknown Proto**: `FuzzUnknownProto` |
| 18 | + |
| 19 | +## Running Fuzz Tests |
| 20 | + |
| 21 | +The fuzz tests use the standard [Go fuzzing format](https://go.dev/doc/fuzz/). To run a specific fuzz test, use the `-fuzz` flag with `go test`: |
7 | 22 |
|
8 | 23 | ```shell |
9 | | -go test -fuzz FuzzCryptoHDNewParamsFromPath ./tests |
| 24 | +# Run a specific fuzz test |
| 25 | +go test -fuzz FuzzCryptoHDNewParamsFromPath ./tests/fuzz/tests |
| 26 | + |
| 27 | +# Run all fuzz tests |
| 28 | +go test -fuzz . ./tests/fuzz/tests |
| 29 | + |
| 30 | +# Run with time limit (e.g., 30 seconds) |
| 31 | +go test -fuzz FuzzTypesParseTimeBytes -fuzztime 30s ./tests/fuzz/tests |
10 | 32 | ``` |
| 33 | + |
| 34 | +## Interpreting Results |
| 35 | + |
| 36 | +- **Crashes**: If a fuzz test crashes, it will save the input that caused the crash in the `testdata` directory |
| 37 | +- **Coverage**: Fuzzing automatically tracks code coverage and focuses on unexplored paths |
| 38 | +- **Timeouts**: Long-running fuzz tests can be stopped with `Ctrl+C` |
| 39 | + |
| 40 | +## Requirements |
| 41 | + |
| 42 | +- Go 1.18+ (required for built-in fuzzing support) |
| 43 | +- The `gofuzz` build tag is also supported for compatibility |
| 44 | + |
| 45 | +## Contributing |
| 46 | + |
| 47 | +When adding new fuzz tests: |
| 48 | +1. Follow the naming convention: `Fuzz<Package><Function>` |
| 49 | +2. Include proper error handling and input validation |
| 50 | +3. Add the test to this README |
| 51 | +4. Ensure the test can run for extended periods without crashes |
0 commit comments