Fuzzing (Property-Based Testing)

Fuzzing tests a smart contract by executing it with large volumes of automatically generated inputs, trying to find values that break a stated property or cause a crash. In smart contracts, fuzzing is usually property-based: you declare what should always be true, and the fuzzer searches for inputs that violate it.

How It Works

You write properties (assertions or invariants) such as "total supply always equals the sum of balances." The fuzzer then generates and mutates inputs — sometimes guided by coverage feedback — to try to falsify them.

// A property a fuzzer tries to break
function invariant_totalSupply() public view {
    assert(token.totalSupply() == sumOfAllBalances());
}

Strengths and Limits

• Strength: excellent at edge cases and unexpected input combinations humans miss.
• Limit: only as good as the properties you define; it won't test behavior you never asserted.

Echidna and Foundry's fuzzer are common EVM fuzzing tools. Fuzzing pairs well with static analysis and symbolic execution.

Frequently Asked Questions

Q: What is property-based fuzzing?

A: You define properties that should always hold, and the fuzzer generates many inputs trying to violate them, reporting any input that does as a counterexample.

---

Q: Does fuzzing prove a contract is safe?

A: No. It increases confidence by testing many cases but cannot prove the absence of bugs. Combine it with other techniques and manual review.