srlabs/substrate-runtime-fuzzer

A fuzzing harness for Substrate-based blockchains.

Substrate Runtime Fuzzer

substrate-runtime-fuzzer is a substrate runtime fuzzing harness continuously developed at SRLabs since 2020.

It has been used as a part of our continuous audit process for Parity as well as many parachains in the Polkadot and Kusama ecosystem.

As a part of the Substrate Builders Program, this fuzzer has been used on over 30 different projects, finding dozens of critical vulnerabilities in the process.

How do I use it?

Here are the steps to launch substrate-runtime-fuzzer against the solochain template runtime:

cargo install ziggy cargo-afl honggfuzz grcov
rustup target add wasm32-unknown-unknown
git clone https://github.com/srlabs/substrate-runtime-fuzzer
cd substrate-runtime-fuzzer/solochain/
cargo ziggy fuzz -t 20

The -t 20 option defines a 20 seconds timeout before the fuzzer classifies an input as a "hang".

You can also pass ziggy the -j n flag to run $n$ jobs in parallel.

What is "ziggy"?

ziggy is a fuzzer management tool written by the team at SRLabs.

It will spawn multiple different coverage-guided fuzzers with the right configuration and regularly minimize the corpus and share it between instances.

How do I use this on my substrate-based runtime?

The first step is creating a project and adding the same dependencies as this project. Then, you can modify the solochain-template-runtime dependency to your own runtime (either as a local path or as a git URL).

Finally you should add a genesis configuration to make sure the fuzzer can reach as much of the code as possible. You can take inspiration from the genesis configuration of the kitchensink fuzzer.

License

Substrate Runtime Fuzzer is primarily distributed under the terms of both the MIT license and the Apache License (Version 2.0).

See LICENSE-APACHE and LICENSE-MIT for details.

substrate-runtime-fuzzer's Issues

error: some crates failed to install - after following instructions from README

I'm in the process of trying out this fuzzer and I follow this section from the README:

https://github.com/srlabs/substrate-runtime-fuzzer#how-do-i-use-it, first line in particular:
cargo install ziggy afl honggfuzz grcov

which gives me

   Installed package `grcov v0.8.19` (executable `grcov`)
     Summary Successfully installed ziggy, honggfuzz, grcov! Failed to install afl (see error(s) above).
error: some crates failed to install

the error above is:

  Downloaded afl v0.14.1
  Downloaded 1 crate (1.4 MB) in 2.01s
error: there is nothing to install in `afl v0.14.1`, because it has no binaries
`cargo install` is only for installing programs, and can't be used with libraries.
To use a library crate, add it as a dependency to a Cargo project with `cargo add`.

So maybe need to update README ?

Trying out the instructions further:

node-template-fuzzer]$ cargo ziggy fuzz -t 20
    Building afl
error: no such command: `afl`

	Did you mean `add`?

	View all installed commands with `cargo --list`
Error: Failure running fuzzers

Caused by:
    0: Failed to build the fuzzers
    1: Error building afl fuzzer: Exited with Some(101)