Skip to main content
4 votes
Accepted

What is structured fuzzing and is the fuzzing that Bitcoin Core does currently considered structured?

I'll use the definitions used in this presentation from Jonathan Metzman at Black Hat 2019 but obviously this is a relatively new field and so there may well be disagreement amongst researchers and ...
Michael Folkson's user avatar
3 votes
Accepted

What is fuzz testing?

In the paper The Art, Science and Engineering of Fuzzing the authors define fuzzing as “a process of repeatedly running a program with generated inputs that may be syntactically or semantically ...
Michael Folkson's user avatar
1 vote
Accepted

How can you transfer a seed that crashed a fuzz test via text?

When a fuzz-test crashes it will print the error stack. The top will give you an idea what caused the issue, and the bottom will provide you with a text-formatted version of the crashing fuzz seed. ...
Murch's user avatar
  • 76k
1 vote
Accepted

What vulnerabilities have been found in Bitcoin Core using fuzzing?

For a list of historical Bitcoin related CVEs (common vulnerabilities and exposures) see the Bitcoin wiki. However, for a focus on Bitcoin Core vulnerabilities found by fuzzing there is a resource on ...
Michael Folkson's user avatar
1 vote
Accepted

Why doesn't Bitcoin Core use Google's OSS-Fuzz?

The primary reason that Bitcoin Core doesn't use OSS-Fuzz is that as Greg Maxwell states in this secp256k1 issue, there is an: extremely short timeframe mandatory disclosure (edit: 90 days) which ...
Michael Folkson's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible