Solidity Fuzzing Boilerplate Description
Solidity Fuzzing boilerplate is a repository of templates designed to make it easier to fuzze components in Solidity projects. This includes libraries. Write your tests once and use them for both Echidna's and Foundry’s fuzzing. Etheno can be used to deploy components that are incompatible Solidity versions into a Ganache instance. Use HEVM’s FFI cheat codes to generate complex fuzzing outputs or to compare the outputs with non EVM executables when doing differential fuzzing. You can publish your fuzzing experiment without worrying about licensing if you extend the shell script to include specific files. If you do not intend to use shell commands in your Solidity contracts, turn off FFI. FFI is a slow solution and should only ever be used as a temporary workaround. It can be used to test against things that are hard to implement in Solidity but already exist in other programming languages. Be sure to check the commands being executed before executing tests on a project with FFI enabled.
Solidity Fuzzing Boilerplate Alternatives
Google OSS-Fuzz
OSS-Fuzz provides continuous fuzzing to open source software. Fuzz testing is an established technique for detecting programming errors in software. Many of these detectable mistakes, such as buffer overflow, have serious security implications. Google has discovered thousands of security flaws and stability bugs through guided in-process fuzzing of Chrome components. We now want to share this service with the open-source community. OSS-Fuzz aims at making open source software more stable and secure by combining modern fuzzing with scalable, distributive execution. ClusterFuzzLite or ClusterFuzz is available for projects that do not qualify to use OSS-Fuzz. OSS-Fuzz currently supports C/C++ code, Rust code, Go code, Python code, and Java/JVM. Other languages supported by LLVM could also work. OSS-Fuzz can fuzz both x86_64 builds and i386 versions.
Learn more
Honggfuzz
Honggfuzz, a software fuzzer focusing on security, is available. Supports evolutionary feedback-driven fuzzing (SW and Hardware-based) based on code cover. Honggfuzz is multi-processed and multi-threaded. You don't need to run multiple instances of your fuzzer as it can unlock all of your CPU cores. The file corpus will be automatically shared and improved among all fuzzed process. When persistent fuzzing is used, it's lightning fast. A simple/empty LLVMFuzzerTestOneInput function can be tested with up to 1mo iteration per second on a relatively modern CPU. Honggfuzz has a track record of discovering security bugs. The only vulnerability (to date) in OpenSSL that received the critical score was discovered by Honggfuzz. It will report hijacked/ignored crashes signals (intercepted by a fuzzed application and potentially hidden).
Learn more
hevm
The hevm is a special implementation of the Ethereum Virtual Machine, which was created for the purpose of symbolic execution, unit-testing, and debugging smart contracts. It was developed by DappHub, and integrates particularly well with the DappHub toolsuite. The hevm program can run smart contracts symbolically, run unit testing, interactively debug Solidity contracts while showing their source code, or run any EVM code. Calculations can be performed by using a local test harness state or retrieved on demand from live networks via RPC calls. Run a symbolic implementation against the parameters to search for assertion violations. You can also add specific arguments to the function signature, while leaving others abstract. Hevm uses a eager approach for symbol execution, which means that it will try to explore all branches of a program first.
Learn more
Google ClusterFuzz
ClusterFuzz provides a scalable fuzzing system that can be used to find security and stability issues within software. Google uses ClusterFuzz as the fuzzing engine for OSS Fuzz and to fuzz all Google Products. ClusterFuzz offers many features that allow fuzzing to be seamlessly integrated into the software development process. Fully automatic bug filing and triage for different issue trackers. Supports multiple coverages-guided fuzzing engines to achieve optimal results (with ensemble fuzzing and fuzzing strategy). Statistics to analyze fuzzer performance and crash rates. Web interface for managing and viewing crashes. Support for multiple authentication providers using Firebase. Support for black-box fuzzing, test case minimization and regression finding using bisection.
Learn more
Pricing
Pricing Starts At:
Free
Free Version:
Yes
Integrations
Company Details
Company:
patrickd
Website:
github.com/patrickd-/solidity-fuzzing-boilerplate
Media
Recommended Products
Our Free Plans just got better! | Auth0 by Okta
You asked, we delivered! Auth0 is excited to expand our Free and Paid plans to include more options so you can focus on building, deploying, and scaling applications without having to worry about your secuirty. Auth0 now, thank yourself later.
Product Details
Platforms
Windows
Mac
Linux
Type of Training
Documentation
Customer Support
Online
Solidity Fuzzing Boilerplate Features and Options
Solidity Fuzzing Boilerplate User Reviews
Write a Review- Previous
- Next