Skip to content

feat: add eip8037 fuzzing scenarios - #235

Draft
spencer-tb wants to merge 5 commits into
holiman:masterfrom
spencer-tb:bal-devnet-7
Draft

feat: add eip8037 fuzzing scenarios#235
spencer-tb wants to merge 5 commits into
holiman:masterfrom
spencer-tb:bal-devnet-7

Conversation

@spencer-tb

Copy link
Copy Markdown

Description

Adds some EIP-8037 fuzzing scenarios. Note this is a draft PR and not in a mergeable state.

Adding for visability just now for others who want to fuzz EIP-8037. Command to run:

generic-fuzzer --eels ethereum-spec-evm --revme revme --nethermind nethtest --nimbus evmstate --engine eip8037 --engine eip8037_sstore_restoration --engine eip8037_deep_calls --engine eip8037_create_sd_same_tx --fork Amsterdam --outdir out/fuzz-8037 --parallel 4 --cleanupFiles=true

@holiman

holiman commented May 19, 2026

Copy link
Copy Markdown
Owner

Oh you found my ams branch did you ? :)
Guess I'll just merge that one then. Anything preventing this PR from going in too?

Comment thread common/utils.go
BailFlag = &cli.BoolFlag{
Name: "bail",
Value: false,
Usage: "If true, exit the process immediately after the first consensus flaw " +

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you feel the need for this? IMO the drain-period is usually pretty fast, unless one of the clients hang. But if they do, I don't think this will help.

Or is it because you don't want a second bug to obscure the first one?

// Beneficiary is varied across four scenarios that interact with the
// SELFDESTRUCT state-gas table:
// - ZERO address
// - factory (self)

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The initcode executes in a new address, doesn't it ? SO the self is something else?

Comment on lines +38 to +48
var beneficiary common.Address
switch rand.Intn(4) {
case 0:
beneficiary = common.Address{}
case 1:
beneficiary = factory
case 2:
beneficiary = common.HexToAddress("0xBE")
default:
beneficiary = common.HexToAddress("0xDEAD")
}

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO maybe let's add a bit more options here. One should be ADDRESS, SELFDESTRUCT (true SD-to-self). And the various addresses of things that exist, and does not exist, and precompiles, and zero, and magic system addresses...

// depths well beyond what RandCall2200's compile-time-recursion cap of
// 10 reaches. See test_state_gas_call.py::test_nested_calls_*.
func fillDeepCalls(gst *GstMaker, fork string) {
depth := 5 + rand.Intn(46) // 5..50

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is depth the only random thing here? Because if so, feels like this random-test-generator is exhausted after 50 or so runs...?

But maybe I'm missing something

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants