Modern Testing and Fuzzing in Bitcoin Core
summary
Describes how Bitcoin Core adds fuzz harnesses with a single target macro and fuz_data_provider, builds with sanitizers or no-sanitize then measures coverage via LLVM to steer libFuzzer and OSS-Fuzz runs, finding crashes in serialization, script engine, P2P and crypto code. Out-of-process AFL++ and multiprocess honggfuzz target state corruption and differential cases. Uses mutation testing (flip > to >=, delete statements) to prove test effectiveness and notes chain-state logic usually requires functional tests not fuzzing.
AI-written summary · about
chapters (10)
- 0:00Bitcoin Core testing needs
- 2:28Types of tests today
- 5:25Writing a fuzz harness
- 7:10Key fuzzing targets
- 8:34Fuzzing engines compared
- 10:22Selecting fuzzing targets
- 12:08Mutation testing effectiveness
- 13:34Formal verification of code
- 15:40Getting involved in testing
- 17:29Q&A
related talks
53mFuzzing 101
39mMaking Fuzzing Part of Your Software Development Lifecycle
25mHow fuzzing helps to find bugs
31m“Fuzz or lose..."
33mDifferential Fuzzing on Lightning Network
24mWhy you should be using automated fuzzing to test for security issues in your code
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
53mFuzz Testing for Fun and Profit