BA-14 · LESSON 04

Fuzzing and property tests

KEY DEFINITIONS

Terms used in this lesson

Proof-of-work target: The maximum header-hash value accepted for a block; lowering it makes valid hashes harder to find.
Descriptor: A machine-readable description of the scripts, keys, and derivation paths a Bitcoin wallet watches or can spend.
PSBT: Partially Signed Bitcoin Transaction: a format for passing an unsigned or partly signed transaction between constructors and signers.

Generated inputs uncover parser and state-machine edge cases while invariants catch broad classes of failure.

65 min Difficulty 3/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · state machineOne valid action transforms a known stateSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
BEFOREKnown state
Identify the facts and objects that exist before the action.
02
ACTIONFuzzing and property tests
The Fuzzing and property tests lesson isolates the event that proposes a change.
03
RULEDeterministic check
The enforcing rule accepts or rejects the proposed transition.
04
AFTERSuccessor state
Accepted work creates a new state without silently changing the prior facts.
05
FAILUREState unchanged
A failed condition must not produce a partially accepted successor.

Rule shown: A valid transition names the prior state, action, enforcing rule, and successor state.

STAGE 1 OF 5BEFORE: Known state

Identify the facts and objects that exist before the action.

Governing relationship: A valid transition names the prior state, action, enforcing rule, and successor state. Complete path: 1. BEFORE, Known state. Identify the facts and objects that exist before the action. 2. ACTION, Fuzzing and property tests. The Fuzzing and property tests lesson isolates the event that proposes a change. 3. RULE, Deterministic check. The enforcing rule accepts or rejects the proposed transition. 4. AFTER, Successor state. Accepted work creates a new state without silently changing the prior facts. 5. FAILURE, State unchanged. A failed condition must not produce a partially accepted successor.

1. State transitionWhat exists, what changes, and what results

BEFORE

Parser reads prefix fd, which promises a following two-byte integer, but input ends after one byte.

MECHANISM

Parsers, script interpreters, network messages, descriptors, PSBTs, and state transitions process attacker-controlled or complex data.

AFTER

The value of a fuzz crash comes from reproducible minimization and a fixed invariant, not the number of random cases alone.

Text equivalent: Starting from Parser reads prefix fd, which promises a following two-byte integer, but input ends after one byte. The mechanism begins when Parsers, script interpreters, network messages, descriptors, PSBTs, and state transitions process attacker-controlled or complex data. The resulting lesson is The value of a fuzz crash comes from reproducible minimization and a fixed invariant, not the number of random cases alone.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Choose a hostile boundary

Parsers, script interpreters, network messages, descriptors, PSBTs, and state transitions process attacker-controlled or complex data.

Complete path: 1. Choose a hostile boundary: Parsers, script interpreters, network messages, descriptors, PSBTs, and state transitions process attacker-controlled or complex data. 2. Define properties: Examples include parse-serialize round trip, no crash, bounded allocation, deterministic rejection, conservation, and equivalent implementations agreeing. 3. Generate structured and raw inputs: Grammar-aware generators reach deep states, while raw mutation explores malformed lengths, truncation, overflow, and unexpected encodings. 4. Capture and shrink failures: Persist corpus input, seed, version, and environment. Minimize the example without removing the failure. 5. Fix and regress: Explain the root cause, add the minimized input as a deterministic regression test, then continue fuzzing for related paths.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

A deterministic generator executes the authored property for its recorded seed and iterations, preserves the failure class during each shrink step, and replays the saved regression artifact.

CHANGED CONDITION

A case-mismatched seed, zero iterations, missing property, changed failure class, unsaved corpus record, or failed replay blocks completion.

Important distinction: A long fuzz run with no crashes proves the parser is correct. It establishes only that tested inputs and reached paths did not trigger monitored failures. Properties, corpus quality, coverage, and unmodeled semantic bugs remain.

Text equivalent: The accepted path is enforced by A deterministic generator executes the authored property for its recorded seed and iterations, preserves the failure class during each shrink step, and replays the saved regression artifact. If the required condition changes, A case-mismatched seed, zero iterations, missing property, changed failure class, unsaved corpus record, or failed replay blocks completion.

Loading lesson visuals...

Learn the idea

Fuzzing generates or mutates many inputs to find crashes, hangs, excessive resource use, or violated assertions. A property test generates structured cases and checks an invariant across them. A seed reproduces one generated failure, and shrinking reduces it to a smaller counterexample. Coverage guides which code paths the generator reaches.

GUIDED EXPLANATION1/5 ideas inspected

Choose a hostile boundary

Parsers, script interpreters, network messages, descriptors, PSBTs, and state transitions process attacker-controlled or complex data.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A long fuzz run with no crashes proves the parser is correct.”

It establishes only that tested inputs and reached paths did not trigger monitored failures. Properties, corpus quality, coverage, and unmodeled semantic bugs remain.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.