substrate-runtime-fuzzer is a substrate runtime fuzzing harness continuously developed at SRLabs since 2020.
It has been used as a part of our continuous audit process for Parity as well as many parachains in the Polkadot and Kusama ecosystem.
As a part of the Substrate Builders Program, this fuzzer has been used on over 30 different projects, finding dozens of critical vulnerabilities in the process.
Here are the steps to launch substrate-runtime-fuzzer against the solochain template runtime:
cargo install ziggy cargo-afl honggfuzz grcov
rustup target add wasm32-unknown-unknown
git clone https://github.com/srlabs/substrate-runtime-fuzzer
cd substrate-runtime-fuzzer/templates/solochain/
SKIP_WASM_BUILD=1 cargo ziggy fuzz
You can use the the -j n flag to run --no-honggfuzz if running for a long time with many cores, as honggfuzz will have a tendency to slow things down and bloat the corpus in this situation.
SKIP_WASM_BUILD=1 will reduce compilation time and the binary's size. We are not fuzzing the wasm runtime.
ziggy is a fuzzer management tool written by the team at SRLabs.
It will spawn multiple different coverage-guided fuzzers with the right configuration and regularly minimize the corpus and share it between instances.
The first step is creating a project and adding the same dependencies as this project.
Then, you can modify the solochain-template-runtime dependency to your own runtime (either as a local path or as a git URL).
Finally you should add a genesis configuration to make sure the fuzzer can reach as much of the code as possible. You can take inspiration from the genesis configuration of the kitchensink fuzzer.
Substrate Runtime Fuzzer is primarily distributed under the terms of both the MIT license and the Apache License (Version 2.0).
See LICENSE-APACHE and LICENSE-MIT for details.