argotorg / argotorg/solidity

solProtoFuzzer of OSSFUZZ can not generate different solidity program

Open
#15,066 1 comment 0 reactions 0 assignees View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

## Description
I added code in [solProtoFuzzer.cpp](https://github.com/ethereum/solidity/tree/develop/test/tools/ossfuzz) to output the Solidity program each time, but I found that each outputted program is the same.

## Environment

- Compiler version: 0.8.25
- Target EVM version (as per compiler settings): None
- Framework/IDE (e.g. Truffle or Remix): None
- EVM execution environment / backend / blockchain client: None
- Operating system: Linux

## Steps to Reproduce

```cpp
DEFINE_PROTO_FUZZER(Program const& _input)
{
ProtoConverter converter;
string sol_source = converter.protoToSolidity(_input);

// ·········································································
auto now = std::chrono::system_clock::now();
std::time_t now_c = std::chrono::system_clock::to_time_t(now);
std::tm localTime = *std::localtime(&now_c);
std::ostringstream oss;
oss << std::put_time(&localTime, "%Y%m%d-%H%M%S");

std::hash hasher;
size_t hashValue = hasher(sol_source);
std::string hashString = std::to_string(hashValue);

std::string dump_path_string="/mnt/sdd1/solProtoFuzzer/"+hashString+"_"+oss.str()+".sol";
ofstream of(dump_path_string.c_str());
of.write(sol_source.data(), static_cast(sol_source.size()));
// ············································································
```
However, I found that all the generated programs are the same, as follows.

```solidity

pragma solidity >=0.0;

contract C {
function test() public returns (uint)
{
return 0;
}
}
```

Contributor guide

Open the contributing guide

Research direction

Start in test/tools/ossfuzz/solProtoFuzzer.cpp, especially DEFINE_PROTO_FUZZER and the ProtoConverter::protoToSolidity call shown in the report. Reproduce the issue using the reported OSSFUZZ setup and inspect why different fuzz inputs produce the same Solidity source. Done means the fuzzer generates varied Solidity programs and the behavior is covered by an appropriate test.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
blockchain, compilers, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.