Fuzzing

anchor fuzz init <program_name>

fuzz/<program_name>/
├── Cargo.toml
├── rust-toolchain.toml
├── idls/<program_name>.json
└── src/main.rs

anchor fuzz run <program_name> <test_name> --release

# Multi-core fuzzing (4 workers)
anchor fuzz run <program_name> <test_name> --release --cores 4
 
# Stateful fuzzing (state coverage + better performance but higher memory usage)
anchor fuzz run <program_name> <test_name> --release --stateful --cores 4
 
# Stop after 60 seconds
anchor fuzz run <program_name> <test_name> --release --timeout 60
 
# Replay a crash
anchor fuzz run <program_name> <test_name> --release --replay ./crashes/<test_name>/<crash_id>

# List crashes
anchor fuzz show <program_name>
 
# View crash metadata
anchor fuzz show <program_name> <crash_file>
 
# Minimize a crash to smallest reproducing sequence
anchor fuzz tmin <program_name> <test_name> <crash_file> --release

use crucible_fuzzer::prelude::*;
 
#[derive(Clone)]
struct MyFixture {
    ctx: TestContext,
    admin: Rc<Keypair>,
}
 
#[fuzz_fixture]
impl MyFixture {
    pub fn setup() -> Self {
        // Initialize accounts, deploy program
    }
 
    pub fn action_deposit(&mut self, #[range(0..3)] user: usize, amount: u64) {
        // Actions prefixed with action_ are auto-discovered
    }
 
    pub fn action_withdraw(&mut self, #[range(0..3)] user: usize, amount: u64) {
        // Each action is a state transition the fuzzer can choose
    }
}
 
#[invariant_test]
fn check_invariants(fixture: &mut MyFixture) {
    // Runs after each action — assert properties that must always hold
    assert!(fixture.total_deposited() >= fixture.total_withdrawn());
}