This fuzzer takes a list of pre-selected hints and runs a generated basic program with randomized inputs that uses a random hint from the list.
Use the commands:
make fuzzer-deps
to ensure that you have the atheris module and created a python module fromfuzzer/src/py_export.rs
using maturin.make fuzzer-run-hint-diff
to run the fuzzer.
The fuzzer is located in the random_hint_fuzzer.py file inside the diff_fuzzer folder.
- first it selects a random hint with the function
get_random_hint
, it has a list of indexes that represent a hint previously saved in a file within /hint_accountant/whitelists/; Selects a random number between the listed ones and returns the list of lines that correspond to that hint code. - Creates a basic program that uses the hint calling the function
generate_cairo_hint_program
, it returns a program with aREPLACEABLE_TOKEN
constant placed wherever a random value has to be placed. - Replace all the constants with random values with the function
generate_limb
, this function returns a value with 70% of provability to be a number within range_check_max >> 1 and range_check_max, with range_check_max being "340282366920938463463374607431768211456" 15% probability of being a number within 0 and 10 and 15% probability of being between 1 and range_check_max. - Creates a random name for the modified Cairo file and the compiled json one.
- Write the modified cairo program to a file with the generated .cairo name.
- Compile the .cairo file to get the .json file.
- Run the .json program with the Python original vm implementation and the new Rust one.
- if both implementations run correctly, use the
check_mem
function to compare that the memories are the same. If one implementation returns an error and the other one runs correctly the fuzzer reports an error, as both implementations should return the same output.
The program generator is located in the cairo_program_gen.py file inside the diff_fuzzer folder.
-
Grab a hint given by the fuzzer.
-
Look for all the
ids.(...)
expressions, make sure to keep track of any "=" to the left or right. Also check for cairo constants -
Reduce the
ids.(...)
expressions so that all the variables are grouped with their fields. -
After looking at the
ids.(...)
, importEcPoint
,BigInt3
or any cairo constants needed for the hint to run. -
Create dictionaries and classify the variables from step 3 - declare_in_main: if "=" was to the right - declare_in_hint_fn: if "=" was to the left
-
Create
main
using declare_in_main variablesfunc main() { let a = MyStruct(field=1, field=2); hint_func(); return(); }
-
Create
hint_func
with variables from declare_in_hint_fn as localshint_func(a: MyStruct) -> (MyStruct) { alloc_locals; local b: MyStruct; %{ ... %} return(b); }
-
return the entire generated program