Sui Fuzzer (WIP)

Fuzzer for Sui Move Smart Contracts.

Milestones

Milestone 1: Discovery & project architecture

• Testing and analysis of Sui Move and VM internals
• Development of the project base (architecture and command line interface)
• Tutorial for project installation and testing
• Identification of arguments and contracts execution requirements
• Creation MVP

Milestone 2: Fuzzer improvements

• Improvement of the project (threading, runtimes perf monitoring)
• Implementation of coverage-guided fuzzing
• Implementation of vulnerability detectors
• Add support for property testing methods
• Docker and packaging of the fuzzer as a library
• Tutorial for running fuzzers and using advanced CLI options

Milestone 3: Fuzzer finalization

• Generation of sequences of calls (stateful fuzzing)
• Improvement of contract argument generation (based on )
• Improvement of command line options
• Improvement of the fuzzing (input file sharing, mutation algorithm, speed)
• Create more documentation & tutorials against basic/example contracts

Usage

You need to clone the repository with the submodules using the following command:

$ git clone --recursive git@github.com:FuzzingLabs/sui-fuzzer.git

In stateless

To run the fuzzer just use (with rust and cargo installed):

$ make CONFIG_PATH="./config.json" TARGET_MODULE="fuzzinglabs_module" TARGET_FUNCTION="fuzzinglabs"

You need to have a compiled SuiMove module path in the contract item in the config.

In stateful

To run the fuzzer just use (with rust and cargo installed):

$ make CONFIG_PATH="./config.json" TARGET_MODULE="calculator_module" TARGET_FUNCTIONS="add,sub"

You need to have a package path in the contract item in the config.

Configuration

Here is an example of config:

{
  "use_ui": true, // Do you want the nice UI or not ?
  "nb_threads": 8, // The number of threads used by the fuzzer
  "seed": 4242, // The inital seed
  "contract": "./examples/fuzzinglabs_package/build/fuzzinglabs_package/bytecode_modules/fuzzinglabs_module.mv", // The path to the compiled module / package
  "execs_before_cov_update": 10000, // When the coverage is shared between the threads (don't modify if you don't know why)
  "corpus_dir": "./corpus", // Path to where the corpus are written
  "crashes_dir": "./crashes", // Path to where the crashfiles are written
  "fuzz_functions_prefix": "fuzz_", // Fuzzing functions prefix (can be listed by the fuzzer)
  "max_call_sequence_size": 5 // Maximum size of a generated call sequence (only for stateful fuzzing)
}

You can find more information on how to use the fuzzer in ./doc/how_to_use_stateless.md and in ./doc/how_to_use_stateful.md .

Using Docker

You can also use the provided docker_run.sh script to launch it in a container, use the same arguments for the script as for the Makefile (Documentation in ./doc/how_to_use_stateless.md and ./doc/how_to_use_stateful.md).

$ ./docker_run.sh CONFIG_PATH="./config.json" TARGET_MODULE="fuzzinglabs_module" TARGET_FUNCTION="fuzzinglabs"