Coverage-Guided Fuzzing
Coverage-guided fuzzing is a technique where the fuzzer tracks which code paths are executed and prioritizes inputs that explore new, untested paths.
In Depth
Coverage-guided fuzzing uses code coverage feedback to make fuzzing more effective. As the fuzzer generates random inputs, it monitors which branches, lines, and paths in the code are exercised. Inputs that trigger new coverage are saved and mutated further, while inputs that only retrace known paths are deprioritized. This approach is dramatically more efficient than pure random fuzzing, as it systematically drives the fuzzer toward unexplored code regions where bugs are more likely to hide.
Frequently Asked Questions
What is coverage-guided fuzzing?
Coverage-guided fuzzing is a smart fuzzing technique that tracks which code paths each input explores. The fuzzer prioritizes inputs that reach new code paths, making it much more efficient at finding bugs than random input generation.
Which smart contract fuzzers use coverage guidance?
Both Echidna and Medusa use coverage-guided fuzzing. They track EVM opcode coverage and prioritize transaction sequences that explore new contract code paths.