Zebra Coverage-Guided Fuzzing Infrastructure

Community Grants Applications
1

Hello everyone,

I am submitting a proposal to Zcash Community Grants (ZCG) to build a coverage-guided fuzzing infrastructure for Zebra, the Zcash Foundation’s Rust consensus node implementation.

This project focuses on systematically testing Zebra’s critical parsing, networking, and cryptographic components against malformed inputs, enabling continuous, automated discovery of security vulnerabilities and edge-case bugs.

Why This Matters

Zebra currently has zero fuzzing coverage. There are no fuzz targets, no cargo-fuzz configuration, and no OSS-Fuzz registration. After NU7, Zebra becomes the sole consensus node for the entire Zcash network. Any exploitable parsing or validation bug could compromise the network’s security and user funds.

For comparison, Bitcoin Core maintains a mature fuzzing infrastructure with over 100 fuzz targets and continuous OSS-Fuzz integration. Zcash, as a privacy-focused cryptocurrency, arguably requires even more rigorous testing, yet has none.

Project Overview

This proposal introduces a complete fuzzing infrastructure for Zebra that includes:

  • Fuzz targets for all major attack surfaces: transaction and block deserialization, P2P protocol parsing, RPC input handling, script and address parsing, note commitment tree operations, and Equihash verification

  • Seed corpora extracted from Zcash mainnet real data

  • CI integration with PR-level smoke fuzzing and nightly extended fuzzing campaigns via GitHub Actions

  • OSS-Fuzz submission, enrolling Zebra in Google’s continuous fuzzing service for 24/7 automated testing

  • Security reporting with structured crash triage, severity classification, reproduction steps, and fix recommendations

Technical Approach

The infrastructure is built on cargo-fuzz with the libFuzzer backend. For complex inputs, the arbitrary crate enables structured fuzzing. All targets run with AddressSanitizer and UndefinedBehaviorSanitizer for maximum bug detection.

Fuzz targets are prioritized by attack surface:

  • P0 (Critical): Transaction deserialization (v1 through v5+), block and header parsing, P2P message parsing

  • P1 (High): RPC input handling, script and address parsing, note commitment tree operations

  • P2 (Medium): Equihash verification, Orchard and Sapling serialization

Deliverables and Milestones

The proposal is structured into three milestones over 6 months:

  1. Core Fuzzing Framework and Initial Targets — zebra-fuzz crate, 3+ fuzz targets for critical deserialization code, seed corpora from mainnet

  2. Extended Targets, Corpus Optimization and CI — 7+ total fuzz targets, corpus minimization, GitHub Actions CI integration, coverage reporting

  3. Security Analysis, OSS-Fuzz and Documentation — crash analysis report, OSS-Fuzz submission PR, documentation for community contributors, upstream PRs to Zebra

Budget

  • Startup Funding: $3,000 (infrastructure setup)

  • Milestones 1 through 3: $27,000 (engineering work)

  • Total: $30,000

Design Principles

  • Standalone: independent crate, no modifications to Zebra core code required

  • Sustainable: OSS-Fuzz integration ensures fuzzing continues indefinitely after project completion

  • Community-oriented: documentation enables anyone to add new fuzz targets as Zebra evolves

Full proposal details are available here:

Thank you for your time and feedback.

1 Like