High-performance Concrete Fuzzing Taking Advantage of Expr
- Dominant language
- Haskell
- Stars
- 358
- Forks
- 79
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 6
Description
# Original Idea (already implemented)
There are some hard cases where running concrete execution for a little bit will get us a win. For example:
```
function prove_distributivity(uint120 x, uint120 y, uint120 z) public pure {
assert(x + (y * z) == (x + y) * (x + z));
}
```
In the benchmark suite https://github.com/eth-sc-comp/benchmarks/ will take forever for an SMT solver to deal with, but a fuzzer should find a counterexample in <1s.
This sounds like a hack, and in some sense it is, but I can very easily see this being helpful to the users. The perceived utility of HEVM would be higher, and that's all that matters.
We could even run a thread that just does fuzzing, while the other threads do the symbolic interpretation, etc.
# Follow-ups
The original idea as per above has been implemented already, see `Fuzz.hs`. However, as detailed below by d-xo, there are a number of significant improvements that can be done that could improve the performance in very significant ways.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading Fuzz.hs and the follow-up discussion, then use the benchmark suite linked in the issue to measure the current implementation. The original idea is already implemented; the remaining work is to identify and validate significant fuzzing performance improvements, with benchmark results defining done.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- blockchain, performance, testing-qa
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100