Repository navigation
Add FFI receiver checklists fuzz target - #2022
Open
caarloshenriq wants to merge 1 commit into
Open
caarloshenriq wants to merge 1 commit into
caarloshenriq wants to merge 1 commit into
Conversation
Each of the receiver's first four checks (broadcast suitability, inputs owned, inputs seen, outputs owned) is exposed through the FFI twice: as a host callback, and as a checklist the host marks and hands back. The checklist path is new FFI surface, and a host can return it reordered, incomplete or marked for another session. Fuzz both paths from fuzzer-shaped original PSBTs and assert that for the same answers they persist the same events, that a checklist not matching this receiver's own values is rejected without persisting anything, that a failing callback or failing storage never advances the session, and that the log plus what was persisted replays to the state the transition reported. Saves alternate between the sync and async persister adapters, so every comparison also checks that the two agree.
Collaborator
Coverage Report for CI Build 40973224615Coverage remained the same at 87.547%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
ffi-receiver-checklists, a fuzz target for the receiver's first four checks through payjoin-ffi: broadcast suitability, inputs owned, inputs seen and outputs owned.Each check is exposed to the host twice. One way is a callback (
check_inputs_not_owned(Arc<dyn IsInputOwned>)). The other is a checklist the host fetches, marks and hands back (inputs_owned_checklist,mark,apply_inputs_owned_checklist). The checklist path is FFI surface the core targets don't reach, and nothing stops a host from returning it reordered, incomplete, or marked for a different session.What the fuzzer controls
The input is decision bytes read through
Unstructured, with no custom mutator. The target rebuilds the original PSBT from theRetrievedOriginalPayloadseed inseeds/receiver.jsonl:u64for the FFI range validation.Choices that end the session early are decoded as rare ones (one in eight). An empty input passes all four checks.
Fuzzing results
From an empty corpus on aarch64 macOS, 600 seconds, one job:
A follow up run with 6 forks for 790 seconds reached 5501 counters with 0 / 0 / 0, so coverage of the four checks is saturated. Throughput is about 950 exec/s on one job, since every save is followed by a replay.
Addresses part of #1267.
Assigning @benalleng to review.
Disclosure: co-authored by Claude
Pull Request Checklist
Please confirm the following before requesting review: