Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Security] Formal Invariant Property Testing & Fuzzing Harness for Economic Solvency

Abierto
  • ¿Algo no está bien?
#1,455 7 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 7 días

@aabolari ya está trabajando en esto.

Desde el 29/9/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

drips-wave fuzzing security smart-contracts Stellar Wave testing

Overview & Background

Smart contracts escrowing user assets must satisfy strict mathematical invariants regardless of sequence ordering, arbitrary timestamps, rate modifications, or extreme token amounts. While standard unit tests cover nominal paths, edge-case rounding errors or balance accounting bugs can lead to protocol insolvency (where the contract's actual token balance is less than the cumulative claimable debt owed to stream recipients).

Detailed Problem Statement

  1. Complex Interleaved State Machine:
    • Complex lifecycle permutations (e.g. create -> pause -> top_up -> cliff_pass -> partial_withdraw -> resume -> cancel) may introduce rounding drift or state inconsistencies.
  2. Integer Truncation & Stroop Precision:
    • Integer division in rate_per_second accrual calculations can accumulate 1-stroop discrepancies over millions of seconds.

Technical Specification & Architecture

1. Invariants to Mathematically Prove

Implement in contracts/stream_contract/src/property_tests.rs:

  • Contract Solvency Invariant:
    $$\text{Contract Balance} \ge \sum_{i \in \text{ActiveStreams}} (\text{Deposited}_i - \text{Withdrawn}_i)$$
  • Zero-Sum Completion Invariant:
    When a stream completes, $\text{Deposited} == \text{Withdrawn}$, with zero stranded dust remaining.
  • Monotonic Claimability Invariant:
    For any stream without top-up, $\text{Claimable}(t_2) \ge \text{Claimable}(t_1)$ for all $t_2 \ge t_1$.
  • Cliff Protection Invariant:
    For all ledger timestamps $t < \text{cliff_time}$, $\text{Claimable}(t) \equiv 0$.
2. Stateful Fuzzing Runner (proptest)
  • Executes 20,000 generated sequences with randomized action selections, amounts up to $10^{18}$, rates, and ledger timestamp increments.
  • Asserts all four invariants after every single state mutation.

Target Files

  • contracts/stream_contract/src/property_tests.rs
  • contracts/stream_contract/Cargo.toml

Acceptance Criteria

  • Property test suite executes 20,000 iterations without panicking or violating invariants.
  • Catches potential integer overflow or negative claimable amounts under adversarial inputs.
  • Added to continuous integration pipeline (cargo test).
Lenguaje dominante
TypeScript
Estrellas
18
Forks
250
Merge medio
5 d 6 h
PR fusionados (30 d)
82

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de LabsCrypt/flowfi

Todos los issues de LabsCrypt/flowfi

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.