The problem Fuzzied - Continuous Fuzzing for Smart Contracts solves

Introduction

Various ideas, processes, and tools have been adapted by the blockchain space from the traditional information security industry, such as security audits, insurance, bug bounty, and contests. A central piece which has not been adapted yet, is a scalable and distributed fuzzing infrastructure similar to Google's oss-fuzz.

Motivation

Fuzzied provides a scalable and distributed infrastructure for continuous fuzzing. This apporach makes fuzzing very attractive for developers and security auditors, who can focus on writing testcases. At the same time chances of finding vulnerabilities are orders of mangitudes better compared to current fuzzing activities in the blockchain space, which mostly rely on very short runs on single machines.

Workflow

Fuzzied and its workflow are completely open source. Developers needs to create pull requests against the official repository, which is used as the baseline of the continuous fuzzing infrastructure and all fuzzing activities. Relevant stakeholders are informed once a vulnerabiliy is identified during fuzzing. Although Echidna is currently the only integrated fuzzer, the platform is not limited to it, and as such, other fuzzing engines can be integrated in the future.

Outlook

The goal is to integrate fuzzied's workflows with bug bounty programs, what might incentivize security auditors on collaborating on testcases and development of more smart contracts and tool integrations.

Challenges I ran into

Team building