sub0 Asia 2024 - Martin Hloska (HydraDX)
summary
Uses Ziggy + AFL++/hongfuzz to fuzz Substrate runtimes and shares concrete hacks: a snapshot tool seeds a realistic Omni-pool state, special input bytes choose origin/skip blocks, and helpers constrain asset IDs so fuzzing reaches relevant paths. Adds invariant checks in runtime (and a try-runtime hook) to catch logic errors; a deliberately introduced rounding bug in the Omni-pool yields 11 crashes in ~10 minutes and a coverage report that pinpoints unreached pallet branches.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:41What is fuzzing
- 3:11Substrate runtime fuzzing with Ziggy
- 7:12How fuzzing works
- 10:48Initial state setup
- 12:11Ziggy fuzzer details
- 17:33Optimizing with structured inputs
- 19:47Live demo setup
- 21:33OmniPool rounding issue
- 25:13Defining fuzzing invariants
- 27:01Adding runtime assertions
- 28:07try-runtime hooks for invariants
- 29:33Running fuzzer and crash detection
- 31:01Investigating Ziggy crashes
- 33:05Coverage reports
related talks
52mStructure aware fuzzing
13mFuzzing Comes to Solana
45mFuzzing with AFL
01h 15mMake your programs more reliable with Fuzzing
25mHow fuzzing helps to find bugs
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
20mAFL++ : Combining Incremental Steps of Fuzzing Research
53mFuzzing 101