fuzzland / ityfuzz

Blazing Fast Bytecode-Level Hybrid Fuzzer for Smart Contracts
https://docs.ityfuzz.rs
MIT License
734 stars 116 forks source link

offchain evm fuzzing fails #514

Closed tomerdoi closed 3 weeks ago

tomerdoi commented 3 weeks ago

I'm trying to fuzz a test.sol file in the path: tests/evm/balance/ I compiled it using: solc ./test.sol -o ./ --bin --abi --overwrite --base-path . --combined-json bin-runtime,srcmap-runtime After that I tried to run (at this point I have test.sol, test.bin, test.abi in the tests/evm/balance dir): timeout 30s ../../../cli_offchain evm -t ./* -f

And I get: thread 'main' panicked at src/evm/mod.rs:672:13: Please specify --deployment-script (The contract that deploys the project) or --offchain-config-file (JSON for deploying the project) note: run with RUST_BACKTRACE=1 environment variable to display a backtrace

With RUST_BACKTRACE=1: thread 'main' panicked at src/evm/mod.rs:672:13: Please specify --deployment-script (The contract that deploys the project) or --offchain-config-file (JSON for deploying the project) stack backtrace: 0: rust_begin_unwind at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:645:5 1: core::panicking::panic_fmt at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/core/src/panicking.rs:72:14 2: ityfuzz::evm::evm_main 3: ityfuzz::main note: Some details are omitted, run with RUST_BACKTRACE=full for a verbose backtrace.

With RUST_BACKTRACE=full: thread 'main' panicked at src/evm/mod.rs:672:13: Please specify --deployment-script (The contract that deploys the project) or --offchain-config-file (JSON for deploying the project) stack backtrace: 0: 0x559c45d55916 - std::backtrace_rs::backtrace::libunwind::trace::h44f4ca7c442c0986 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5 1: 0x559c45d55916 - std::backtrace_rs::backtrace::trace_unsynchronized::h8e72beef8f98799e at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5 2: 0x559c45d55916 - std::sys_common::backtrace::_print_fmt::had1f7322c7191a83 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/sys_common/backtrace.rs:68:5 3: 0x559c45d55916 - ::fmt::hc02075f68ac68e83 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/sys_common/backtrace.rs:44:22 4: 0x559c45d85160 - core::fmt::rt::Argument::fmt::h4fb797bf569c9381 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/core/src/fmt/rt.rs:142:9 5: 0x559c45d85160 - core::fmt::write::h6f1ea15fe9368d17 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/core/src/fmt/mod.rs:1120:17 6: 0x559c45d5246f - std::io::Write::write_fmt::haaa4143b58137630 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/io/mod.rs:1810:15 7: 0x559c45d556f4 - std::sys_common::backtrace::_print::h16f1f390d8dff6aa at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/sys_common/backtrace.rs:47:5 8: 0x559c45d556f4 - std::sys_common::backtrace::print::h7a4cfc718891723c at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/sys_common/backtrace.rs:34:9 9: 0x559c45d57127 - std::panicking::default_hook::{{closure}}::h66f09592313f4ce8 10: 0x559c45d56e89 - std::panicking::default_hook::he45e0a376ce42f7d at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:292:9 11: 0x559c45d57746 - <alloc::boxed::Box<F,A> as core::ops::function::Fn>::call::h0ebdda5c503ff158 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/alloc/src/boxed.rs:2029:9 12: 0x559c45d57746 - std::panicking::rust_panic_with_hook::h4f38919015b1c60f at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:783:13 13: 0x559c45d57459 - std::panicking::begin_panic_handler::{{closure}}::h6e933e94ded3024f at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:649:13 14: 0x559c45d55e16 - std::sys_common::backtrace::rust_end_short_backtrace::h4efef00f0bd07d56 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/sys_common/backtrace.rs:171:18 15: 0x559c45d571f0 - rust_begin_unwind at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:645:5 16: 0x559c4414d5f5 - core::panicking::panic_fmt::h3f2350d70561f7cb at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/core/src/panicking.rs:72:14 17: 0x559c445f2b6c - ityfuzz::evm::evm_main::h069b752155d46c39 18: 0x559c4455da3f - ityfuzz::main::hff9786dcbc2ea802 19: 0x559c441af563 - std::sys_common::backtrace::__rust_begin_short_backtrace::hdd8c676012b09180 20: 0x559c44674bd9 - std::rt::lang_start::{{closure}}::hfb0f038f8b4739e3 21: 0x559c45d4b151 - core::ops::function::impls::<impl core::ops::function::FnOnce for &F>::call_once::h3737ca496f48ba0e at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/core/src/ops/function.rs:284:13 22: 0x559c45d4b151 - std::panicking::try::do_call::h0791b1268c7577e7 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:552:40 23: 0x559c45d4b151 - std::panicking::try::h01cc49c61c00b2c9 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:516:19 24: 0x559c45d4b151 - std::panic::catch_unwind::hada5d8a26ee4d1dc at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panic.rs:142:14 25: 0x559c45d4b151 - std::rt::lang_start_internal::{{closure}}::ha2b321c2944045e7 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/rt.rs:148:48 26: 0x559c45d4b151 - std::panicking::try::do_call::h9b22a884fda2d38f at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:552:40 27: 0x559c45d4b151 - std::panicking::try::h5e537adef10f5106 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panicking.rs:516:19 28: 0x559c45d4b151 - std::panic::catch_unwind::h6250cfd4a61ec9d4 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/panic.rs:142:14 29: 0x559c45d4b151 - std::rt::lang_start_internal::h892a9bd9313ca5d1 at /rustc/e51e98dde6a60637b6a71b8105245b629ac3fe77/library/std/src/rt.rs:148:20 30: 0x559c4455e785 - main 31: 0x7f369ae1209b - libc_start_main 32: 0x559c4415220a - _start 33: 0x0 -

What can be the problem?

publicqi commented 3 weeks ago

You need to pass in "./*" as a string. Quote it or your shell will expand them.

So it should be timeout 30s ../../../cli_offchain evm -t "./*" -f not timeout 30s ../../../cli_offchain evm -t ./* -f