test(verify): de-flake SignatureVerifier SV2 and SV7 invariants#3842
Open
test(verify): de-flake SignatureVerifier SV2 and SV7 invariants#3842
Conversation
Same root cause as #3802: handlers with a single coverage edge get deprioritized by the corpus-guided fuzzer. With ~50k CI runs the deprioritization eventually starves a run of any SV2 (or SV7) calls and trips the coverage assertion. Changes: - Split each SV2 high-s handler (secp/p256/webauthn) into a 'flipped' variant (real-sig-derived high s) and a 'boundary' variant (s = N - 1 or N/2 + 1) — 6 handlers instead of 3. - Split each SV7 keychain handler into a 'validSig' and 'garbageSig' variant — 4 handlers instead of 2. - Extract _sv2SecpCheck/_sv2P256Check/_sv2WebAuthnCheck/_sv7Check helpers so per-handler bodies stay small. Verified with 10 runs at depth 1000 (fuzz-seed 0xdeadbeef): SV2 min: 32 -> 58, SV7 min: 20 -> 35. SV1/SV3/SV6 still have >=28 per-run minimum after the dilution.
Contributor
📊 Tempo Precompiles CoverageprecompilesCoverage: 5618/7707 lines (72.89%) File details
contractsCoverage: 1/253 lines (0.40%) File details
Total: 5619/7960 lines (70.59%) |
grandizzy
requested review from
0xKitsune,
dankrad,
danrobinson and
legion2002
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same root cause as #3802: handlers with a single coverage edge get
deprioritized by the corpus-guided fuzzer. With ~50k CI runs the
deprioritization eventually starves a run of any SV2 (or SV7) calls
and trips the coverage assertion.
Changes:
variant (real-sig-derived high s) and a 'boundary' variant
(s = N - 1 or N/2 + 1) — 6 handlers instead of 3.
variant — 4 handlers instead of 2.
helpers so per-handler bodies stay small.
Verified with 10 runs at depth 1000 (fuzz-seed 0xdeadbeef):
SV2 min: 32 -> 58, SV7 min: 20 -> 35.
SV1/SV3/SV6 still have >=28 per-run minimum after the dilution.