Skip to content

prototype: add test-based corpus prefilling via AST analysis#805

Draft
samalws-tob wants to merge 2 commits into
masterfrom
feat/prefill-corpus
Draft

prototype: add test-based corpus prefilling via AST analysis#805
samalws-tob wants to merge 2 commits into
masterfrom
feat/prefill-corpus

Conversation

@samalws-tob

Copy link
Copy Markdown
Contributor

VIBE CODED PROTOTYPE. Still need to check whether this is correct, but it at least looks plausible
resolves #792

feat/prefill-corpus-verify branch contains instructions and example for verifying that this works


Adds automatic corpus seeding by extracting call sequences from Foundry test functions. This helps bootstrap coverage-guided fuzzing with known-good transaction patterns from existing tests.

How it works:

  • Parses contract AST to identify test contracts and test functions
  • Extracts external function calls from test function bodies
  • Converts calls to CallSequence format and adds to corpus
  • Enabled via 'prefillCorpus: true' config option

Example:
contract TokenTest { Token token; function testTransfer() public {
token.mint(address(this), 1000); // Extracted
token.transfer(address(0x123), 100); // Extracted
}
}

This test function generates a 2-call sequence that seeds the corpus.

Implementation:

  • Extended AST type system to parse function bodies (Block, FunctionCall, etc.)
  • Added ast_analysis.go with test detection and call extraction logic
  • Integrated into fuzzer initialization after corpus creation
  • Uses existing solc AST data (no external dependencies)
  • Case-insensitive contract name matching (variable 'counter' matches 'Counter')

Benefits:

  • Bootstrap fuzzing with test-derived sequences
  • Improve initial coverage by starting from known execution paths
  • Pure Go implementation using existing compilation artifacts

Adds automatic corpus seeding by extracting call sequences from Foundry test
functions. This helps bootstrap coverage-guided fuzzing with known-good
transaction patterns from existing tests.

How it works:
- Parses contract AST to identify test contracts and test functions
- Extracts external function calls from test function bodies
- Converts calls to CallSequence format and adds to corpus
- Enabled via 'prefillCorpus: true' config option

Example:
  contract TokenTest {
      Token token;
      function testTransfer() public {
          token.mint(address(this), 1000);    // Extracted
          token.transfer(address(0x123), 100); // Extracted
      }
  }

This test function generates a 2-call sequence that seeds the corpus.

Implementation:
- Extended AST type system to parse function bodies (Block, FunctionCall, etc.)
- Added ast_analysis.go with test detection and call extraction logic
- Integrated into fuzzer initialization after corpus creation
- Uses existing solc AST data (no external dependencies)
- Case-insensitive contract name matching (variable 'counter' matches 'Counter')

Benefits:
- Bootstrap fuzzing with test-derived sequences
- Improve initial coverage by starting from known execution paths
- Pure Go implementation using existing compilation artifacts

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature]: Add --prefill-corpus option

2 participants