prototype: add test-based corpus prefilling via AST analysis#805
Draft
samalws-tob wants to merge 2 commits into
Draft
prototype: add test-based corpus prefilling via AST analysis#805samalws-tob wants to merge 2 commits into
samalws-tob wants to merge 2 commits into
Conversation
48a4976 to
d59c451
Compare
Adds automatic corpus seeding by extracting call sequences from Foundry test
functions. This helps bootstrap coverage-guided fuzzing with known-good
transaction patterns from existing tests.
How it works:
- Parses contract AST to identify test contracts and test functions
- Extracts external function calls from test function bodies
- Converts calls to CallSequence format and adds to corpus
- Enabled via 'prefillCorpus: true' config option
Example:
contract TokenTest {
Token token;
function testTransfer() public {
token.mint(address(this), 1000); // Extracted
token.transfer(address(0x123), 100); // Extracted
}
}
This test function generates a 2-call sequence that seeds the corpus.
Implementation:
- Extended AST type system to parse function bodies (Block, FunctionCall, etc.)
- Added ast_analysis.go with test detection and call extraction logic
- Integrated into fuzzer initialization after corpus creation
- Uses existing solc AST data (no external dependencies)
- Case-insensitive contract name matching (variable 'counter' matches 'Counter')
Benefits:
- Bootstrap fuzzing with test-derived sequences
- Improve initial coverage by starting from known execution paths
- Pure Go implementation using existing compilation artifacts
Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
d59c451 to
d17d714
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
VIBE CODED PROTOTYPE. Still need to check whether this is correct, but it at least looks plausible
resolves #792
feat/prefill-corpus-verify branch contains instructions and example for verifying that this works
Adds automatic corpus seeding by extracting call sequences from Foundry test functions. This helps bootstrap coverage-guided fuzzing with known-good transaction patterns from existing tests.
How it works:
Example:
contract TokenTest { Token token; function testTransfer() public {
token.mint(address(this), 1000); // Extracted
token.transfer(address(0x123), 100); // Extracted
}
}
This test function generates a 2-call sequence that seeds the corpus.
Implementation:
Benefits: