davide
b292590cdc
docs/docs-as-code.md defines the workflow; docs/adr holds 31 ADRs (retroactive, reconstructed from code and changelog) with a template and index. docs/check-docs.sh validates ADR structure, index, cited code paths, relative links and CLAUDE.md/AGENTS.md sync.
1.2 KiB
1.2 KiB
0026. Fuzz every untrusted-input parser
- Status: Accepted
- Area: Testing
- Recorded: 2026-11-03 (retroactive: reconstructed from code, comments and changelog)
Context
Headers, Merkle branches, extended keys, mnemonics, addresses, amounts, wallet documents, encrypted files and peer lists all arrive from outside the trust boundary. A crash or unexpected exception there is a bug or a denial of service.
Decision
tests/PalladiumWallet.Fuzz (SharpFuzz) has one target per parser (header merkle slip132 bip39 address coinamount walletdoc encfile peers), each encoding that parser's error contract: any other escaping exception is a finding. The seed corpus, including regression inputs for past findings, replays inside dotnet test through FuzzCorpusTests. Property-based tests (CsCheck) complement it for roundtrip invariants.
Consequences
- Past findings (corrupted pin file, JSON wallet detection) became permanent regression inputs.
- A new parser requires a new fuzz target and seed entries.
- Coverage-guided campaigns need afl++, so they are manual rather than part of the default test run.
References
tests/PalladiumWallet.Fuzz/Program.cstests/PalladiumWallet.Fuzz/fuzz.sh