[FUZZ] Beaconfuzz_v2 crash-a41dca0095809f489d002ebca53a69074aa409e9 in struct_attester_slashing

[Daft-Wullie]

I've done and provided the following:

• [x] Checked to see if any other [FUZZ] issue already refers to that crasher

• [x] Attached the crashing input (either attached to the issue as a .zip or .gz, or as a link to a file sharing service)

• [x] Noted the beacon-fuzz version or commit used.

• [x] Provided crash output

• [x] Noted the command or fuzzer used to generate the crash

• [x] Name of the original crash file

• [x] (Optional but optimal) Checked if the crash can be consistently replicated by re-running the input.

  Info to Reproduce

• Command run: e.g. make fuzz_attester_slashing-struct

• Crasher file name: crash-a41dca0095809f489d002ebca53a69074aa409e9 crash-a41dca0095809f489d002ebca53a69074aa409e9.zip

• beaconstate to trigger: 5d184954275b8c4003b86fa78a175448.ssz

• Client exercised: N/A

• Fuzzing engine used (if applicable): libfuzzer

Crash output and stacktrace

DBG 2020-10-11 12:51:34.932+02:00 slash_validator: ejecting validator via slashing (validator_leaving) tid=128104 file=beaconstate.nim:175 index=0 num_validators=256 current_epoch=2 validator_slashed=false validator_withdrawable_epoch=263 validator_exit_epoch=7 validator_effective_balance=32000000000
#78123  NEW    cov: 1744 ft: 2190 corp: 94/22Kb lim: 3006 exec/s: 11 rss: 423Mb L: 320/2302 MS: 5 ChangeByte-InsertRepeatedBytes-CMP-ChangeBinInt-InsertRepeatedBytes- DE: "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"-
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `false`,
 right: `true`', /home/beacon-fuzz/beaconfuzz_v2/libs/eth2clientsfuzz/src/attester_slashing.rs:39:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Traceback (most recent call last, using override)
/home/nim-beacon-chain/vendor/nimbus-build-system/vendor/Nim/lib/system/excpt.nim(614) signalHandler
SIGABRT: Abnormal termination.
==128104== ERROR: libFuzzer: fuzz target exited
    #0 0x5562924ab901  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xb90901)
    #1 0x556294918a40  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x2ffda40)
    #2 0x55629492d7ab  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30127ab)
    #3 0x7fd7188c9a26  (/lib/x86_64-linux-gnu/libc.so.6+0x49a26)
    #4 0x7fd7188c9bdf  (/lib/x86_64-linux-gnu/libc.so.6+0x49bdf)
    #5 0x5562926e2ddc  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xdc7ddc)
    #6 0x7fd7188c620f  (/lib/x86_64-linux-gnu/libc.so.6+0x4620f)
    #7 0x7fd7188c618a  (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
    #8 0x7fd7188a5858  (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
    #9 0x5562949df626  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30c4626)
    #10 0x5562949c8915  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30ad915)
    #11 0x55629490bf86  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x2ff0f86)
    #12 0x5562949cfb57  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30b4b57)
    #13 0x5562949cf708  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30b4708)
    #14 0x5562949cabeb  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30afbeb)
    #15 0x5562949cf6c8  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30b46c8)
    #16 0x5562949cf67a  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30b467a)
    #17 0x5562925c5bb1  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xcaabb1)
    #18 0x5562925578ab  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xc3c8ab)
    #19 0x55629490bfb0  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x2ff0fb0)
    #20 0x55629490bc0f  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x2ff0c0f)
    #21 0x55629492dc0c  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x3012c0c)
    #22 0x556294935dc0  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x301adc0)
    #23 0x55629493677c  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x301b77c)
    #24 0x556294938b7f  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x301db7f)
    #25 0x55629490a159  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x2fef159)
    #26 0x5562924284b6  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xb0d4b6)
    #27 0x7fd7188a70b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #28 0x55629242865d  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xb0d65d)

SUMMARY: libFuzzer: fuzz target exited
MS: 4 CMP-PersAutoDict-ChangeByte-CopyPart- DE: "08h.com"-"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"-; base unit: ccfc7d9cd5bc4ab54d26c3383983a60c5f694ab1
artifact_prefix='/home/beacon-fuzz/beaconfuzz_v2/fuzz/artifacts/struct_attester_slashing/'; Test unit written to /home/beacon-fuzz/beaconfuzz_v2/fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9

────────────────────────────────────────────────────────────────────────────────

Failing input:

        fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9

Output of `std::fmt::Debug`:

        AttesterSlashing {
            attestation_1: IndexedAttestation {
                attesting_indices: VariableList {
                    vec: [
                        0,
                    ],
                    _phantom: PhantomData,
                },
                data: AttestationData {
                    slot: Slot(42949672960),
                    index: 0,
                    beacon_block_root: 0x0000f97a00000000000a3bff00000000f9ef0000000000260000000000080000,
                    source: Checkpoint {
                        epoch: Epoch(0),
                        root: 0x00000000000000cb000000000000000000000000000000000000000000000000,
                    },
                    target: Checkpoint {
                        epoch: Epoch(0),
                        root: 0x000000000000000000000000000000000000000000000000000000000000a4a4,
                    },
                },
                signature: 0xa40000ff0000000affff0000748100000000ffffffffffffffffffffffffffff3038682e636f6dffffffffffffffffff15f65ec3fa80e4935c071a97a256ec6d77ce5853705257455f48985753c758baebf4000bc40c00027608ffffff02fffd,
            },
            attestation_2: IndexedAttestation {
                attesting_indices: VariableList {
                    vec: [
                        0,
                        1099511627775,
                    ],
                    _phantom: PhantomData,
                },
                data: AttestationData {
                    slot: Slot(0),
                    index: 0,
                    beacon_block_root: 0x0000000000000000000000000000000000000000000000000000000000000000,
                    source: Checkpoint {
                        epoch: Epoch(0),
                        root: 0x0000000000000000000000000000000000000000000000000000000000000000,
                    },
                    target: Checkpoint {
                        epoch: Epoch(0),
                        root: 0x0000000000000000000000000000000000000000000000000000000000000000,
                    },
                },
                signature: 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,
            },
        }

Reproduce with:

        cargo fuzz run struct_attester_slashing fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9

Minimize test case with:

        cargo fuzz tmin struct_attester_slashing fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9

────────────────────────────────────────────────────────────────────────────────

re run crasher file with ETH2FUZZ_BEACONSTATE=../eth2fuzz/workspace/corpora/beaconstate cargo +nightly fuzz run struct_attester_slashing fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9 and got:

    Finished release [optimized] target(s) in 0.48s
     Running `fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing -artifact_prefix=/home/beacon-fuzz/beaconfuzz_v2/fuzz/artifacts/struct_attester_slashing/ fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9`
INFO: Seed: 35227024
INFO: Loaded 1 modules   (202276 inline 8-bit counters): 202276 [0x55d54b926461, 0x55d54b957a85),
INFO: Loaded 1 PC tables (202276 PCs): 202276 [0x55d54b957a88,0x55d54bc6dcc8),
fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing: Running 1 inputs 1 time(s) each.
Running: fuzz/artifacts/struct_attester_slashing/crash-a41dca0095809f489d002ebca53a69074aa409e9
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Could not get rough time result: no reply     prefix=roughtime
ERRO[0018] Failed to calculate roughtime offset          error="no valid responses" prefix=roughtime
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `false`,
 right: `true`', /home/beacon-fuzz/beaconfuzz_v2/libs/eth2clientsfuzz/src/attester_slashing.rs:39:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Traceback (most recent call last, using override)
/home/nim-beacon-chain/vendor/nimbus-build-system/vendor/Nim/lib/system/excpt.nim(614) signalHandler
SIGABRT: Abnormal termination.
==131128== ERROR: libFuzzer: fuzz target exited
    #0 0x55d5482a2901  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xc0e901)
    #1 0x55d54a761a70  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30cda70)
    #2 0x55d54a7767db  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30e27db)
    #3 0x7fc453eeea26  (/lib/x86_64-linux-gnu/libc.so.6+0x49a26)
    #4 0x7fc453eeebdf  (/lib/x86_64-linux-gnu/libc.so.6+0x49bdf)
    #5 0x55d5484e419c  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xe5019c)
    #6 0x7fc453eeb20f  (/lib/x86_64-linux-gnu/libc.so.6+0x4620f)
    #7 0x7fc453eeb18a  (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
    #8 0x7fc453eca858  (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
    #9 0x55d54a828906  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x3194906)
    #10 0x55d54a811bf5  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x317dbf5)
    #11 0x55d54a754fb6  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30c0fb6)
    #12 0x55d54a818e37  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x3184e37)
    #13 0x55d54a8189e8  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x31849e8)
    #14 0x55d54a813ecb  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x317fecb)
    #15 0x55d54a8189a8  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x31849a8)
    #16 0x55d54a81895a  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x318495a)
    #17 0x55d5483c2991  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xd2e991)
    #18 0x55d548352ba3  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xcbeba3)
    #19 0x55d54a754fe0  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30c0fe0)
    #20 0x55d54a754c3f  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30c0c3f)
    #21 0x55d54a776c3c  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30e2c3c)
    #22 0x55d54a747d49  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30b3d49)
    #23 0x55d54a751b42  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0x30bdb42)
    #24 0x55d54821f4b6  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xb8b4b6)
    #25 0x7fc453ecc0b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #26 0x55d54821f65d  (/home/beacon-fuzz/beaconfuzz_v2/fuzz/target/x86_64-unknown-linux-gnu/release/struct_attester_slashing+0xb8b65d)

SUMMARY: libFuzzer: fuzz target exited
────────────────────────────────────────────────────────────────────────────────

Your Environment

• Fuzzer ran: beaconfuzz_v2
• Version/Commit used: 624908e
• Operating System and version: Ubuntu 20.04

[pventuzelo]

I'm not able to repro with latest version of prysm and nimbus.

@Daft-Wullie Can you try as well on your side and re-open if needed?