# Zebra Coverage-Guided Fuzzing Infrastructure **URL:** \ **Category:** Applications\ **Created:** [March 16, 2026, 12:32am UTC](https://forum.zcashcommunity.com/t/zebra-coverage-guided-fuzzing-infrastructure/54972 "2026-03-16T00:32:13Z")\ **Posts on this page:** 1\ **Showing post:** 13
**Author:** ![robustfengbin](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/robustfengbin/32/42095_2.png) [@robustfengbin](https://forum.zcashcommunity.com/u/robustfengbin)\ **Post date:** [May 2, 2026, 6:50am UTC](https://forum.zcashcommunity.com/t/zebra-coverage-guided-fuzzing-infrastructure/54972/13 "2026-05-02T06:50:06Z")
### M1 Month 1 — Coverage detail + disclosure follow-up Two finer-grained pieces of evidence from the closed Month 1 window (2026-03-30 → 2026-04-30): a per-target coverage breakdown for the five fuzz harnesses, and a short coordinated-disclosure follow-up. M1 Month 2 (May) is the harden + ship window and is in progress; the M1 final delivery report will be posted ahead of the **2026-05-30** sign-off. * * * #### 1. Coverage snapshot — 5 fuzz targets Per-target line coverage at the close of Month 1, measured with `cargo fuzz coverage` against each target’s corpus and aggregated via `llvm-cov report`. ![coverage-snapshot-may-2026](https://global.discourse-cdn.com/zcash/original/3X/b/c/bca097ba259975f7f856244fbaf9b3d9c9f1385d.png) (Same data in text form for screen readers.) | Target | Corpus files | Key file | Line coverage | | --- | --- | --- | --- | | `block_deserialize` | 1,494 | `zebra-chain/src/block/serialize.rs` | **64.38%** | | `block_deep_fuzz` | 353 | `zebra-chain/src/block/serialize.rs` | **64.38%** | | `p2p_message_parse` | 283 | `zebra-network/src/protocol/external/codec.rs` | **32.85%** | | `p2p_deep_fuzz` | 344 | `zebra-network/src/protocol/external/codec.rs` | **35.48%** | | `addr_message_fuzz` | 16 | `zebra-network/src/protocol/external/addr/v1.rs` | corpus expansion in flight | **Block deserialization — coverage on key zebra-chain files:** | File | Lines | Line coverage | | --- | --- | --- | | `zebra-chain/src/transaction/serialize.rs` | 828 | **83.45%** | | `zebra-chain/src/sapling/output.rs` | 123 | **83.74%** | | `zebra-chain/src/orchard/action.rs` | 62 | **87.10%** | | `zebra-chain/src/sapling/spend.rs` | 147 | **74.83%** | | `zebra-chain/src/orchard/note/nullifiers.rs` | 22 | **77.27%** | | `zebra-chain/src/serialization/compact_size.rs` | 116 | **81.03%** | | `zebra-chain/src/serialization/zcash_deserialize.rs` | 106 | 57.55% | | `zebra-chain/src/serialization/zcash_serialize.rs` | 96 | 53.12% | | `zebra-chain/src/serialization/read_zcash.rs` | 36 | 50.00% | | `zebra-chain/src/block/serialize.rs` | 160 | 64.38% | A note on `block/serialize.rs`: the residual ~36% un-covered region is composed mostly of the `CountedHeader` serialize/deserialize impls (used by P2P “headers”-only messages, not on the `block_deserialize` fuzz path) and the `SerializedBlock` conversion `impl`s (the serialize direction; this target only exercises deserialize). These regions are unreachable from `Block::zcash_deserialize` regardless of corpus or fuzz duration — they need a separate ser-direction target, which is a Month 2 hardening candidate. The block target reaches deep into transaction-internal deserialization paths because mainnet blocks embed real V5 / V4 transactions. That’s why `transaction/serialize.rs`, `sapling/output.rs`, and `orchard/action.rs` all sit at **80%+** line coverage from the block target alone. * * * #### 2. Coordinated disclosure update While preparing M1 Month 2 work, we identified a panic in Zebra’s V6 transaction hash path that was reachable through a recently exercised code path. We submitted the report through the standard GitHub Security Advisory workflow on the Zebra repository. The Zebra Foundation security team triaged the report promptly, then converted it to a public tracking issue with **High** severity and the appropriate `C-bug` / `S-needs-triage` labels. We would like to thank **@conradoplg** and the Zebra Foundation security team for the **rapid and constructive triage** — initial submission to public tracking inside one working day. * * * #### 3. Where this leaves M1 going into the final stretch Month 2 is the consolidation window: - Hardening of the existing targets and corpus seeding for the queued candidates - Initial CI smoke scaffold (M2 deliverable preparation) - Upstream re-baselining - M1 final delivery report ahead of the **2026-05-30** sign-off All scope and quality remain anchored to the proposal verbatim deliverables and acceptance criteria. Thanks again to ZCG, the Zebra Foundation, and the broader Zcash community for the support and the responsive coordination on disclosure. --- _[View the full topic](https://forum.zcashcommunity.com/t/zebra-coverage-guided-fuzzing-infrastructure/54972)._