SRLabs: Introduce fuzzing harness for pallet-domains #3693

R9295 · 2025-09-01T12:30:13Z

This PR introduces a fuzzing harness for pallet-domains, encoding invariants and valid user-processes when fuzzing for maximum impact.

Please note that the changes seem large due to the use of the macro to make functions public conditionally.

Code contributor checklist:

I have read, understood and followed contributing guide

immunefi-magnus · 2025-09-01T12:30:25Z

🛡️ Immunefi PR Reviews

We noticed that your project isn't set up for automatic code reviews. If you'd like this PR reviewed by the Immunefi team, you can request it manually using the link below:

🔗 Send this PR in for review

Once submitted, we'll take care of assigning a reviewer and follow up here.

jfrank-summit · 2025-09-05T00:04:41Z

@R9295 thank you for this PR! It will likely not get fully reviewed until early next week. In the meantime could you please cleanup the commit history. See our contribution guide for what we are expecting. Thanks!

teor2345

Thank you for this PR, it's an important part of our security testing.

I've made a large number of comments, but most of them are code style nitpicks (starting with Nit:). Feel free to ignore those, one of the developers can do them later.

The most important revisions are:

adding comments to new functions and structs, so reviewers know what they're meant to do
reducing the size of the PR by doing re-exports in the standard Rust way

teor2345 · 2025-09-08T08:53:59Z

crates/pallet-domains/Cargo.toml

    "pallet-subspace/runtime-benchmarks",
    "schnorrkel",
+    "hex-literal",


Nit: please keep dependencies in alphabetical order, and add any new dependencies in order
(This was likely an accidental revert in a merge commit.)

teor2345 · 2025-09-08T08:56:46Z

crates/pallet-domains/Cargo.toml

+domain-pallet-executive = {workspace = true, optional = true}
+pallet-timestamp = {workspace = true, optional = true}
+pallet-block-fees = {workspace = true, optional = true}
+prop-test = {workspace = true, optional = true}


This dependency is not part of the fuzz feature. This seems like a copy-paste mistake?

teor2345 · 2025-09-08T08:57:15Z

crates/pallet-domains/Cargo.toml

@@ -35,6 +35,12 @@ sp-subspace-mmr.workspace = true
 sp-version = { workspace = true, features = ["serde"] }
 subspace-core-primitives.workspace = true
 subspace-runtime-primitives.workspace = true
+domain-pallet-executive = {workspace = true, optional = true}


A new section would make this clearer:

Suggested change

domain-pallet-executive = {workspace = true, optional = true}

# fuzz feature optional dependencies

domain-pallet-executive = {workspace = true, optional = true}

teor2345 · 2025-09-08T09:00:34Z

crates/pallet-domains/src/fuzz_utils.rs

@@ -0,0 +1,216 @@
+// Copyright 2025 Security Research Labs GmbH


The rest of the crate is 0BSD, do you mind updating this copyright to match?
https://opensource.org/license/0bsd

subspace/crates/pallet-domains/Cargo.toml

Line 6 in 3d0d436

license = "0BSD"

I also have the same licence ask for the fuzzing crate.

teor2345 · 2025-09-08T09:02:00Z

crates/pallet-domains/src/fuzz_utils.rs

+use sp_core::H256;
+use sp_domains::{DomainId, OperatorId};
+use sp_runtime::traits::One;
+


Nit: Most of the crate uses a single import block. This might require a rustfmt run after this change.

Suggested change

teor2345 · 2025-09-08T09:43:26Z

fuzz/staking/src/main.rs

+                        println!("skipping NominateOperator");
+                        continue;
+                    }
+                    let old_amount = amount.min(&21);


What does this do, and why is it needed?

Good catch, it should be amount.max

teor2345 · 2025-09-08T09:44:35Z

fuzz/staking/src/main.rs

+                        println!("skipping WithdrawStake");
+                        continue;
+                    }
+                    // TODO:


Nit: remove this or complete it?

teor2345 · 2025-09-08T09:56:31Z

fuzz/staking/src/main.rs

+                        .1;
+                    let slash_reason = match slash_reason % 2 {
+                        0 => SlashedReason::InvalidBundle(0),
+                        _ => SlashedReason::BadExecutionReceipt(H256::from([0u8; 32])),


Nit: I try to avoid wildcard matches, so the compiler will tell us that we need to update them if the surrounding code changes. What we really want is a compiler error when there is a new SlashedReason.

The standard way of doing it would be:

add an enum without fields that matches each existing SlashedReason, and converts to a dummy SlashedReason

add a function that converts a u8 to that enum

convert from the u8 to the fieldless enum to the dummy SlashedReason here

teor2345 · 2025-09-08T09:57:32Z

fuzz/staking/src/main.rs

+    let config = OperatorConfig {
+        signing_key: pair.public(),
+        minimum_nominator_stake,
+        nomination_tax: sp_runtime::Percent::from_percent(60),


Is this deliberately different from the DomainsConfig above?

Good catch, we wanted the fuzzer to mutate these values too. I will update it

teor2345 · 2025-09-08T10:07:45Z

fuzz/staking/src/main.rs

+    .unwrap()
+}
+
+fn main() {


This fuzzing harness isn't tested in CI, so any other PR could accidentally break it. We've had similar issues with the runtime benchmarks in the past.

Things to do (edited):

before this PR merges, add a single fuzzer run in CI, to make sure it works

add it to the rust-all job

Here's how that works for benchmarks:

subspace/.github/workflows/rust.yml

Lines 329 to 331 in 3d0d436

# Checks benchmark code generation, and runs each benchmark once.

# Fails if code generation fails, benchmarks panic, or generated weights are not valid Rust.

check-runtime-benchmarks:

Co-authored-by: teor <[email protected]>

R9295 added 2 commits September 1, 2025 14:18

SRLabs: introduce staking harness

2952b65

added README

f4acf4a

R9295 requested review from nazar-pc and vedhavyas as code owners September 1, 2025 12:30

R9295 added 9 commits September 1, 2025 14:46

fmt & clippy

149bdbe

fix deps

27a4f89

clippy

6629d70

clippy

937fbe1

clippy

296c612

fix tests

ab83fca

use genesis in the harness

99a4622

fmt

f13454b

unused-deps

3a639e4

jfrank-summit requested a review from teor2345 September 4, 2025 13:51

vanhauser-thc assigned teor2345 Sep 6, 2025

teor2345 reviewed Sep 8, 2025

View reviewed changes

teor2345 changed the title ~~SRLabs: Intrdouce fuzzing harness for pallet-domains~~ SRLabs: Introduce fuzzing harness for pallet-domains Sep 8, 2025

R9295 and others added 2 commits September 10, 2025 17:35

Update crates/pallet-domains/src/fuzz_utils.rs

1c1ecac

Co-authored-by: teor <[email protected]>

fixes

13c4eeb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SRLabs: Introduce fuzzing harness for pallet-domains #3693

SRLabs: Introduce fuzzing harness for pallet-domains #3693

Uh oh!

R9295 commented Sep 1, 2025 •

edited

Loading

Uh oh!

immunefi-magnus bot commented Sep 1, 2025

Uh oh!

jfrank-summit commented Sep 5, 2025

Uh oh!

teor2345 left a comment

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025 •

edited

Loading

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

R9295 Sep 10, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

teor2345 Sep 8, 2025

Uh oh!

R9295 Sep 10, 2025

Uh oh!

teor2345 Sep 8, 2025 •

edited

Loading

Uh oh!

Uh oh!

		@@ -0,0 +1,216 @@
		// Copyright 2025 Security Research Labs GmbH

	# Checks benchmark code generation, and runs each benchmark once.
	# Fails if code generation fails, benchmarks panic, or generated weights are not valid Rust.
	check-runtime-benchmarks:

SRLabs: Introduce fuzzing harness for pallet-domains #3693

Are you sure you want to change the base?

SRLabs: Introduce fuzzing harness for pallet-domains #3693

Uh oh!

Conversation

R9295 commented Sep 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code contributor checklist:

Uh oh!

immunefi-magnus bot commented Sep 1, 2025

🛡️ Immunefi PR Reviews

Uh oh!

jfrank-summit commented Sep 5, 2025

Uh oh!

teor2345 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teor2345 Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teor2345 Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

R9295 commented Sep 1, 2025 •

edited

Loading

teor2345 Sep 8, 2025 •

edited

Loading

teor2345 Sep 8, 2025 •

edited

Loading