The wallet has poor fuzz coverage. Hopefully, some work is being done to improve it. The goal of this issue is to actively track current work and work that needs to be done to improve fuzz coverage for the wallet.

Open PRs / Ready to review

• fuzz: enhance wallet_fees by mocking mempool stuff #33210
• fuzz: wallet: add target for tx scanning #32993
• fuzz: wallet: add target for MigrateToDescriptor #32624
• fuzz: split coinselection harness #31870
• fuzz: coinselection: cover SetBumpFeeDiscount #31806
• fuzz: wallet: add target for spkm migration #29694
• fuzz: wallet: add target for CreateTransaction #29936
• fuzz: add more coverage for ScriptPubKeyMan #30134
• fuzz: wallet, add target for Crypter #28074

Current wallet targets

We currently have 7 specific targets for wallet, which cover:

• Fees (wallet/fees.cpp)
• Coin selection
• ScriptPubKeyManager (descriptor)
• Coin control (CCoinControl)
• Notifications
• ISO8601 parser
• Wallet BDB parser

Nice to have

• More coverage for CWallet
• Wallet transaction target
• Wallet receive target
• Wallet RPC (Fuzz coverage for wallet RPCs is zero #30458 - good first issue)

Won't/Can't cover

Legacy wallet removal

The goal is to remove legacy wallets and migrate them to descriptor ones. There is an open issue with a proposed timeline for Legacy Wallet and BDB removal (#20160). For this reason, we do not aim to increase fuzz coverage for legacy stuff. See that the scriptpubkeyman target only uses descriptor ones.

edit: legacy wallet has been removed.

External signer

I do believe we can't have fuzz coverage for external signer code.

Performance and determinism

Unfortunately, some aspects of the wallet may affect the fuzzing performance. E.g.:

• SetupDescriptorScriptPubKeyMans (it might also be non-deterministic due to key generation)
• Wallet encryption

Any ideas about it or PRs to add let me know.