Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Security] Formal Invariant Property Testing & Fuzzing Harness for Economic Solvency

Aperta
  • Qualcosa non va?
#1,455 7 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

@aabolari ci sta già lavorando.

Dal 29/9/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

drips-wave fuzzing security smart-contracts Stellar Wave testing

Overview & Background

Smart contracts escrowing user assets must satisfy strict mathematical invariants regardless of sequence ordering, arbitrary timestamps, rate modifications, or extreme token amounts. While standard unit tests cover nominal paths, edge-case rounding errors or balance accounting bugs can lead to protocol insolvency (where the contract's actual token balance is less than the cumulative claimable debt owed to stream recipients).

Detailed Problem Statement

  1. Complex Interleaved State Machine:
    • Complex lifecycle permutations (e.g. create -> pause -> top_up -> cliff_pass -> partial_withdraw -> resume -> cancel) may introduce rounding drift or state inconsistencies.
  2. Integer Truncation & Stroop Precision:
    • Integer division in rate_per_second accrual calculations can accumulate 1-stroop discrepancies over millions of seconds.

Technical Specification & Architecture

1. Invariants to Mathematically Prove

Implement in contracts/stream_contract/src/property_tests.rs:

  • Contract Solvency Invariant:
    $$\text{Contract Balance} \ge \sum_{i \in \text{ActiveStreams}} (\text{Deposited}_i - \text{Withdrawn}_i)$$
  • Zero-Sum Completion Invariant:
    When a stream completes, $\text{Deposited} == \text{Withdrawn}$, with zero stranded dust remaining.
  • Monotonic Claimability Invariant:
    For any stream without top-up, $\text{Claimable}(t_2) \ge \text{Claimable}(t_1)$ for all $t_2 \ge t_1$.
  • Cliff Protection Invariant:
    For all ledger timestamps $t < \text{cliff_time}$, $\text{Claimable}(t) \equiv 0$.
2. Stateful Fuzzing Runner (proptest)
  • Executes 20,000 generated sequences with randomized action selections, amounts up to $10^{18}$, rates, and ledger timestamp increments.
  • Asserts all four invariants after every single state mutation.

Target Files

  • contracts/stream_contract/src/property_tests.rs
  • contracts/stream_contract/Cargo.toml

Acceptance Criteria

  • Property test suite executes 20,000 iterations without panicking or violating invariants.
  • Catches potential integer overflow or negative claimable amounts under adversarial inputs.
  • Added to continuous integration pipeline (cargo test).
Lingua principale
TypeScript
Stelle
18
Fork
250
Merge medio
5g 6h
PR unite (30g)
82

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di LabsCrypt/flowfi

Tutte le issue di LabsCrypt/flowfi

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.