substrate-runtime-fuzzer is a substrate runtime fuzzing harness continuously developed at SRLabs since 2020.

It has been used as a part of our continuous audit process for Parity as well as many parachains in the Polkadot and Kusama ecosystem.

As a part of the Substrate Builders Program, this fuzzer has been used on over 30 different projects, finding dozens of critical vulnerabilities in the process.

Here are the steps to launch substrate-runtime-fuzzer against the node template runtime:

cargo install ziggy cargo-afl honggfuzz grcov
rustup target add wasm32-unknown-unknown
git clone https://github.com/srlabs/substrate-runtime-fuzzer
cd substrate-runtime-fuzzer/node-template/
cargo ziggy fuzz -t 20

The -t 20 option defines a 20 seconds timeout before the fuzzer classifies an input as a "hang".

You can also pass ziggy the -j n flag to run $n$ jobs in parallel.

ziggy is a fuzzer management tool written by the team at SRLabs.

It will spawn multiple different coverage-guided fuzzers with the right configuration and regularly minimize the corpus and share it between instances.

The first step is creating a project and adding the same dependencies as this project. Then, you can modify the node-template-runtime dependency to your own runtime (either as a local path or as a git URL).

Finally you should add a genesis configuration to make sure the fuzzer can reach as much of the code as possible. You can take inspiration from the genesis configuration of the kitchensink fuzzer.

Substrate Runtime Fuzzer is primarily distributed under the terms of both the MIT license and the Apache License (Version 2.0).

See LICENSE-APACHE and LICENSE-MIT for details.