#Sigma client 2.0 leak update
#Sigma client 2.0 leak code

The plan is to progressively onboard all Eth2 implementations: This approach should provide greater coverage by generating and mutating valid beacon states. Encodes (in our case, SSZ-serialises) the mutated data.Performs mutations of the parsed data (by leveraging libFuzzer mutations).Parses the input data following a defined scheme (or grammar).Custom mutators can be considered as libFuzzer plugins and are user-defined functions which perform the following: Sigma Prime is also exploring the possibility of creating custom libFuzzer mutators to enable structure-aware mutation-based fuzzing. We’re also ensuring consistent behaviour in the various implementations when returning empty byte arrays as opposed to uninitialized pointers. Specifically, we are working on adding support for the following epoch state transition related functions in new fuzzing targets: We’re adding more valid inputs to the corpora (refer to the repository) and are exploring adding valid post-states (Beacon states generated after a valid state transition) to the BeaconState corpus. Upcoming MilestonesĬoverage tracking and optimisation is a main priority. The four fuzzing targets currently support implementations from ZRNT, Pyspec, and Lighthouse. Implementations are now loading a BeaconState from file through a pre-processing function that uses a state_id reference and passes the relevant state to the different fuzz targets. Sigma Prime’s work on the differential fuzzer, named beacon-fuzz, is accessible at the following repositories:īeacon-fuzz currently runs the following fuzzing targets: Establishing a set of valid inputs (corpora) to be used by the differential fuzzer.Upgrading the fuzzing targets to match the latest version of the Ethereum 2.0 specification (version 0.8.3 at the time of writing).Analysing the long-term maintainability of the differential fuzzing platform and exploring other potential options to achieve the same goals.Since September 2019, Sigma Prime (primarily Nathaniel Jensen) has been building upon Guido Vranken’s prior work by: Vranken’s work leverages libFuzzer by creating modules (1 module per implementation to be fuzzed), orchestrated in C++, to be provided the same fuzzing input. This work leveraged libFuzzer, and focussed on fuzzing ZRNT and Pyspec, the Go and Python executable Ethereum 2.0 specification. In May 2019, the Ethereum Foundation engaged Guido Vranken to build a platform that allows differential fuzzing to be performed across the various Ethereum 2.0 clients.

#Sigma client 2.0 leak update

This process has been successful in identifying multiple bugs, some of which were caused by upstream dependencies used by various projects in the Blockchain space (refer to our fuzzing update and the security section of our Lighthouse updates for more details).ĭifferential fuzzing is the process of fuzz testing multiple implementations of the same specification and detecting any deviation/differences between the outputs produced by each of these implementations. Sigma Prime has been utilising libFuzzer on Lighthouse to identify vulnerabilities which affect our crates and our dependencies.

#Sigma client 2.0 leak code

Coverage-guided fuzzing: for every input/test case, the fuzzing framework tracks code paths (sections of the code which have been reached), and produces variants of each test case to generate additional input data with the goal of increasing code coverage.White-box fuzzing: the fuzzing toolset leverages compiler instrumentation and requires access to the source code.It must tolerate any kind of input (empty, huge, malformed, etc)

In-process fuzzing: the fuzzing engine executes the target many times with multiple data inputs in the same process.

Popular modern fuzzing frameworks, including AFL and libFuzzer, allow for several types of fuzzing: Contextįuzz testing (or fuzzing) is a process that allows the identification of bugs (not just security-related bugs) by providing randomised and unexpected data inputs to software, with the goal of causing crashes (or in Rust, panics) and other unexpected behaviours (e.g. This document explains our approach for the proposed differential fuzzer, and defines the upcoming milestones for this project. Sigma Prime was approached by the Ethereum Foundation to lead the development and maintenance of a differential fuzzer for Ethereum 2.0 clients.