Skip to content

test(solana): add preset-specific fuzz targets with fixed program IDs #378

Description

Problem

The existing fuzz targets (fuzz_transaction_string, fuzz_versioned_transaction) use fully random bytes with no fixed program ID. The probability of the fuzzer generating a valid transaction with a specific preset program ID (e.g. DF1ow4tspfHX9JwWJsAb9epbkA8hmpSEAtxXy1V27QBH) in 30 seconds is effectively zero. As a result, preset-specific code — discriminator matching, build_named_accounts, push_arg_fields, IDL argument decoding — is never exercised by fuzz testing.

Proposed fix

Add a fuzz target per IDL-based preset that hardcodes the program ID and fuzzes only the instruction data bytes:

fuzz_target!(|data: &[u8]| {
    let tx = build_versioned_transaction(DFLOW_AGGREGATOR_PROGRAM_ID, data);
    let _ = versioned_transaction_to_visual_sign(tx, VisualSignOptions::default());
});

This gives the fuzzer a direct path into the preset's parse logic. Targets should be added to fuzz/fuzz_targets/ but not to the CI fuzz workflow — they are intended for local runs (cargo +nightly fuzz run fuzz_dflow_aggregator) and corpus building, not 30-second CI gates.

Scope

Initial targets for the three recently regenerated presets:

  • fuzz_dflow_aggregator
  • fuzz_neutral_trade
  • fuzz_onre_app

Pattern can be extended to all IDL-based presets.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions