Skip to content

Add libfuzzer targets for markets and fees contracts - #328

Merged
dultimateade merged 1 commit into
dultimateade:mainfrom
MrWestWiz:add/fuzz-targets-markets-fees
Oct 22, 2026
Merged

dultimateade merged 1 commit into
dultimateade:mainfrom
MrWestWiz:add/fuzz-targets-markets-fees

Conversation

@MrWestWiz

Copy link
Copy Markdown

closes #230
closes #231
closes #232
closes #233
Add comprehensive fuzz targets for high-risk contract surfaces:

Markets Contract:

  • place_bet.rs: Exercises bet placement with arbitrary stakes, market states, outcome validation, and pool accumulation. Detects overflow and state transition violations.
  • claim_winnings.rs: Tests payout claims with CEI pattern protection, double-claim prevention, and payout calculation correctness.

Fees Contract:

  • collect_fees.rs: Fuzzes fee collection with admin enforcement, cooldown periods, collection thresholds, and pause/unpause state transitions.

Implementation Details:

  • All targets follow established fuzz patterns from existing targets (disputes, oracles, resolution, predictify-hybrid)
  • Fixed-byte-consumption model for deterministic action sequencing
  • Error codes frozen against auth_boundary tests to prevent regression
  • CEI pattern validation ensures reentrant call safety
  • Pre-allocated resource pools (4 markets, 5 users) for efficient coverage

Risk Coverage:

  • Markets handles highest funds volume (now covered)
  • Fees collects platform revenue (now covered)
  • Reduces uncovered high-risk surface from 3 to 1 contract

Running:
cargo +nightly fuzz run --fuzz-dir contracts/markets/fuzz place_bet cargo +nightly fuzz run --fuzz-dir contracts/markets/fuzz claim_winnings cargo +nightly fuzz run --fuzz-dir contracts/fees/fuzz collect_fees

Add comprehensive fuzz targets for high-risk contract surfaces:

Markets Contract:
- place_bet.rs: Exercises bet placement with arbitrary stakes, market states,
  outcome validation, and pool accumulation. Detects overflow and state
  transition violations.
- claim_winnings.rs: Tests payout claims with CEI pattern protection,
  double-claim prevention, and payout calculation correctness.

Fees Contract:
- collect_fees.rs: Fuzzes fee collection with admin enforcement, cooldown
  periods, collection thresholds, and pause/unpause state transitions.

Implementation Details:
- All targets follow established fuzz patterns from existing targets
  (disputes, oracles, resolution, predictify-hybrid)
- Fixed-byte-consumption model for deterministic action sequencing
- Error codes frozen against auth_boundary tests to prevent regression
- CEI pattern validation ensures reentrant call safety
- Pre-allocated resource pools (4 markets, 5 users) for efficient coverage

Risk Coverage:
- Markets handles highest funds volume (now covered)
- Fees collects platform revenue (now covered)
- Reduces uncovered high-risk surface from 3 to 1 contract

Running:
  cargo +nightly fuzz run --fuzz-dir contracts/markets/fuzz place_bet
  cargo +nightly fuzz run --fuzz-dir contracts/markets/fuzz claim_winnings
  cargo +nightly fuzz run --fuzz-dir contracts/fees/fuzz collect_fees
@drips-wave

drips-wave Bot commented Oct 21, 2026

Copy link
Copy Markdown

@MrWestWiz Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@dultimateade
dultimateade merged commit 9096c60 into dultimateade:main Oct 22, 2026
0 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants