fuzzland / ityfuzz

Blazing Fast Bytecode-Level Hybrid Fuzzer for Smart Contracts
https://docs.ityfuzz.rs
MIT License
834 stars 134 forks source link

No coverage data produced #433

Open nicedinner02 opened 7 months ago

nicedinner02 commented 7 months ago

The coverage.json, coverage.txt, and the JSON files in the coverage folder are either empty or only contain "{"coverage":{}}" when we run the command "timeout 20s ityfuzz evm -t './build/*'" with the following contract:

ragma solidity ^0.4.24;

/ User can add pay in and withdraw Ether. The constructor is wrongly named, so anyone can become 'creator' and withdraw all funds. /

contract Wallet { address creator;

mapping(address => uint256) balances;

function initWallet() public {
    creator = msg.sender;
}

function deposit() public payable {
    assert(balances[msg.sender] + msg.value > balances[msg.sender]);
    balances[msg.sender] += msg.value;
}

function withdraw(uint256 amount) public {
    require(amount <= balances[msg.sender]);
    msg.sender.transfer(amount);
    balances[msg.sender] -= amount;
}

}

How can i obtain the coverage data? Really lookforward to you help! thanks a lot!

shouc commented 6 months ago

There is a bug in the coverage calculation process.

An ad-hoc way to bypass this is by making it a foundry project and adding a setup script (check https://book.getfoundry.sh/forge/invariant-testing)

Example:

contract InvariantExample1 is Test {

    ExampleContract1 foo;

    function setUp() external {
        foo = new ExampleContract1();
    }

    function invariant_A() external {
        assertEq(foo.val1() + foo.val2(), foo.val3());
    }

    function invariant_B() external {
        assertGe(foo.val1() + foo.val2(), foo.val3());
    }

}

Then run:

ityfuzz evm -m test/Invariant.sol:InvariantExample1 -- forge test
qianqianpang commented 5 months ago

@shouc Excuse me, has anyone been working on fixing this calculation bug?