Skip to content

Conversation

dergoegge
Copy link
Member

Alternative to the mocking of CheckProofOfWork in #28043 for avoiding fuzzers to be blocked on proof-of-work checks.

More on FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION: https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode

Unless we are fuzzing `CheckProofOfWork` itself, it makes little sense
to have it be a blocker when fuzzing. We therefore use
`FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` (only defined for fuzz builds
by e.g. clang with -fsanitize=fuzzer, afl-clang-lto, etc.) to replace
the actual proof-of-work checks with checking if the first bit on
`nNonce` is set. This allows the fuzzer to create PoW (in)valid blocks
by controling that one bit instead of having to grind for actual PoW.

Checking for a bit in `nNonce` is preferable over checking for a bit in
the block hash as `nNonce` is chosen by the fuzzer and when whole chains
of blocks are created during fuzzing a change in an old block won't
invalidate the fake PoW on newer blocks.
@DrahtBot
Copy link
Contributor

DrahtBot commented Jan 24, 2024

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.
A summary of reviews will appear here.

@dergoegge
Copy link
Member Author

dergoegge commented Jan 24, 2024

Using clang with -fsanitize=fuzzer does actually not define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION by default.

@dergoegge dergoegge closed this Jan 24, 2024
@bitcoin bitcoin locked and limited conversation to collaborators Jan 23, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants