README
¶
Differential fuzzer
The fuzzer generates a fresh Go type corpus, generates SSZ methods for it, and then compares reflection, code generation, buffer, streaming, known-length, and unknown-length paths over valid, mutated, and random inputs.
Valid values also run an oracle battery by default:
- a small independent SSZ encoder and hash-tree-root implementation checks the classic, single-dimensional subset without calling dynamic-ssz internals;
- native SHA-256 and accelerated hashing must agree;
SizeSSZmust equal the marshaled length;HashTreeRootWithand repeated root calculations must agree.
The status line prints reference coverage as ref: checked/eligible. Skipped
schemas are visible rather than being counted as successful oracle checks. The
independent oracle deliberately skips progressive types, unions, wrappers,
multi-dimensional collections, dynamic spec expressions, and extended types;
the official ethereum/ssz-specs suite in tests/sszspecs supplies the external
oracle for progressive containers/lists/bitlists and compatible unions.
The generated corpus now includes both classic Union and CompatibleUnion
(including explicit sparse selectors), plus progressive lists of composite
elements.
Pull-request CI runs twelve 30-second rounds and regenerates the corpus between rounds. The six minutes of actual fuzzing therefore cover twelve independent schema universes with varied type counts, nesting depths, collection bounds, and extended-type settings.
make fuzz DURATION=60s NUM_TYPES=100 MAX_DEPTH=4
# Differential paths only, or keep invariants but disable the reference model:
go run ./cmd/fuzz -oracles=false
go run ./cmd/fuzz -reference=false
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
fuzz
command
Command fuzz runs the SSZ fuzzer against generated corpus types.
|
Command fuzz runs the SSZ fuzzer against generated corpus types. |
|
generate
command
Command generate creates random SSZ-compatible Go types, runs codegen on them, and produces a compilable corpus for the fuzzer.
|
Command generate creates random SSZ-compatible Go types, runs codegen on them, and produces a compilable corpus for the fuzzer. |
|
Package corpus contains generated SSZ types for fuzz testing.
|
Package corpus contains generated SSZ types for fuzz testing. |
|
Package engine implements the core fuzzing logic for comparing SSZ reflection-based and codegen-based implementations.
|
Package engine implements the core fuzzing logic for comparing SSZ reflection-based and codegen-based implementations. |
|
Package typegen generates random SSZ-compatible Go struct definitions for fuzz testing.
|
Package typegen generates random SSZ-compatible Go struct definitions for fuzz testing. |
|
Package walker drives both sszutils.HashWalker implementations over the same generated call sequence and compares what they build.
|
Package walker drives both sszutils.HashWalker implementations over the same generated call sequence and compares what they build. |