[move-fuzz] A DUG-guided fuzzer for Move-based smart contracts

Cargo.toml

@@ -261,6 +261,7 @@ members = [
     "third_party/move/tools/move-coverage",
     "third_party/move/tools/move-decompiler",
     "third_party/move/tools/move-docgen",
+    "third_party/move/tools/move-fuzz",
     "third_party/move/tools/move-linter",
     "third_party/move/tools/move-package",
     "third_party/move/tools/move-package-cache",
@@ -923,6 +924,7 @@ move-core-types = { path = "third_party/move/move-core/types" }
 move-coverage = { path = "third_party/move/tools/move-coverage" }
 move-decompiler = { path = "third_party/move/tools/move-decompiler" }
 move-docgen = { path = "third_party/move/tools/move-docgen" }
+move-fuzz = { path = "third_party/move/tools/move-fuzz" }
 move-ir-types = { path = "third_party/move/move-ir/types" }
 move-linter = { path = "third_party/move/tools/move-linter" }
 move-model = { path = "third_party/move/move-model" }

aptos-move/cli/Cargo.toml

@@ -59,6 +59,7 @@ move-compiler-v2 = { workspace = true }
 move-core-types = { workspace = true }
 move-coverage = { workspace = true }
 move-decompiler = { workspace = true }
+move-fuzz = { workspace = true }
 move-linter = { workspace = true }
 move-model = { workspace = true }
 move-package = { workspace = true }

aptos-move/cli/src/commands.rs

@@ -6,6 +6,7 @@ use crate::{
     coverage::{CoverageCommon, SummaryCoverage},
     dispatch_transaction,
     fmt::Fmt,
+    fuzz::Fuzz,
     lint::LintPackage,
     local_simulation,
     manifest::{Dependency, ManifestNamedAddress, MovePackageManifest, PackageInfo},
@@ -130,6 +131,7 @@ pub enum MoveTool {
     View(ViewFunction),
     Replay(Replay),
     Fmt(Fmt),
+    Fuzz(Fuzz),
     #[clap(subcommand)]
     Sim(Sim),
 }
@@ -173,6 +175,7 @@ impl MoveTool {
             MoveTool::List(tool) => tool.attach_env(env).execute_serialized().await,
             MoveTool::Test(tool) => tool.attach_env(env).execute_serialized().await,
             MoveTool::Fmt(tool) => tool.attach_env(env).execute_serialized().await,
+            MoveTool::Fuzz(tool) => tool.execute_serialized().await,
             MoveTool::Sim(tool) => tool.attach_env(env).execute().await,
         }
     }

aptos-move/cli/src/fuzz.rs

@@ -0,0 +1,83 @@
+// Copyright (c) Aptos Foundation
+// Licensed pursuant to the Innovation-Enabling Source Code License, available at https://github.com/aptos-labs/aptos-core/blob/main/LICENSE
+
+use aptos_cli_common::{CliCommand, CliTypedResult};
+use async_trait::async_trait;
+use clap::Parser;
+use move_fuzz::{
+    cli::{run_on, FuzzCommand},
+    language::LanguageSetting,
+};
+use std::path::PathBuf;
+
+/// Fuzz a collection of Move packages
+#[derive(Parser)]
+pub struct Fuzz {
+    /// Path to the project directory
+    path: PathBuf,
+
+    /// Subdirectories to be included in the analysis
+    #[clap(long)]
+    subdir: Vec<PathBuf>,
+
+    /// Choose a language version
+    #[clap(long, default_value = "2.3+")]
+    language: LanguageSetting,
+
+    /// Named alias declarations
+    #[clap(long)]
+    alias: Vec<String>,
+
+    /// Resource account declaration
+    #[clap(long)]
+    resource: Vec<String>,
+
+    /// Execute in-place instead of copying over the directory to a tempdir
+    #[clap(long)]
+    in_place: bool,
+
+    /// Skip automated update of dependencies
+    #[clap(long)]
+    skip_deps_update: bool,
+
+    /// Print additional diagnostics if available.
+    #[clap(short, long, action = clap::ArgAction::Count)]
+    verbose: u8,
+
+    /// Command
+    #[clap(subcommand)]
+    command: FuzzCommand,
+}
+
+#[async_trait]
+impl CliCommand<&'static str> for Fuzz {
+    fn command_name(&self) -> &'static str {
+        "Fuzz"
+    }
+
+    async fn execute(self) -> CliTypedResult<&'static str> {
+        let Self {
+            path,
+            subdir,
+            language,
+            alias,
+            resource,
+            in_place,
+            skip_deps_update,
+            verbose,
+            command,
+        } = self;
+        run_on(
+            path,
+            subdir,
+            language,
+            alias,
+            resource,
+            in_place,
+            skip_deps_update,
+            verbose,
+            command,
+        )?;
+        Ok("succeeded")
+    }
+}

aptos-move/cli/src/lib.rs

@@ -12,6 +12,7 @@ mod bytecode;
 mod commands;
 pub mod coverage;
 mod fmt;
+mod fuzz;
 mod lint;
 pub mod local_simulation;
 mod manifest;

aptos-move/e2e-tests/src/executor.rs

@@ -97,7 +97,7 @@ use move_vm_types::gas::UnmeteredGasMeter;
 use serde::Serialize;
 use std::{
     cell::Cell,
-    collections::{BTreeMap, BTreeSet},
+    collections::{BTreeMap, BTreeSet, HashMap},
     env,
     fs::{self, OpenOptions},
     io::Write,
@@ -284,6 +284,26 @@ impl<O: OutputLogger> FakeExecutorImpl<O> {
         executor
     }
 
+    pub fn duplicate_with_assumption(&self) -> Self {
+        let state_store = DeltaStateStore::new_with_base_and_delta(
+            EitherStateView::Left(EmptyStateView),
+            self.state_store.delta(),
+        );
+        assert!(self.executed_output.is_none());
+        Self {
+            state_store,
+            event_store: self.event_store.clone(),
+            concurrency_level: self.concurrency_level,
+            block_time: self.block_time,
+            executed_output: None,
+            trace_dir: None,
+            rng: KeyGen::from_seed(RNG_SEED),
+            executor_mode: self.executor_mode,
+            allow_block_executor_fallback: self.allow_block_executor_fallback,
+            block_state: BlockState::None,
+        }
+    }
+
     fn from_remote_state_impl(
         network_url: AptosBaseUrl,
         txn_id: u64,
@@ -491,6 +511,11 @@ impl<O: OutputLogger> FakeExecutorImpl<O> {
         &self.state_store
     }
 
+    /// Returns the full state store delta (all writes applied on top of the base view).
+    pub fn get_state_delta(&self) -> HashMap<StateKey, Option<StateValue>> {
+        self.state_store.delta()
+    }
+
     /// Creates an executor in which no genesis state has been applied yet.
     pub fn no_genesis() -> Self {
         Self {

third_party/move/tools/move-coverage/src/coverage_map.rs

@@ -86,7 +86,7 @@ impl CoverageMap {
             } else {
                 // Don't count scripts (for now)
                 assert_eq!(context_segs.pop().unwrap(), "main",);
-                assert_eq!(context_segs.pop().unwrap(), "Script",);
+                assert_eq!(context_segs.pop().unwrap(), "script",);
             }
         }
         Ok(self)
@@ -332,7 +332,7 @@ impl TraceMap {
             } else {
                 // Don't count scripts (for now)
                 assert_eq!(context_segs.pop().unwrap(), "main",);
-                assert_eq!(context_segs.pop().unwrap(), "Script",);
+                assert_eq!(context_segs.pop().unwrap(), "script",);
             }
         }
         Ok(self)