#32993 fuzz: wallet: add target for tx scanning

ReviewabilityReviewsAgreementSize
#32993 brunoerg fuzz: wallet: add target for tx scanningAuthor silent 142d0 (+1)Strong0 + 111 tests
  • Add automated fuzz testing for wallet transaction scanning to catch rescan boundary and filter edge cases
  • Author silent for over 100 days, so reviews may wait a long time for a response
  • Tested ACK confirming the target runs without crashing (Chand-ra)
  • Past UBSan integer overflow and heap-use-after-free objections were resolved (fanquake, ekzyis)
  • 0 lines added or modified outside tests
  • 111 lines added or modified in tests
  • 0 lines removed in total
  • 2 files, 1 commits
Wallet#76 of 92
P3 · test coverage
  • P3 because it adds dedicated fuzz testing for wallet rescanning edge cases
  • Valuable test coverage that is reasonably deferrable and does not reproduce known crash issue #31474
  • Ranking pass: Moved down: useful coverage, but it does not reproduce the known rescan crash, so it ranks below behavior-affecting work.
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Add a new fuzz target, `wallet_scan`, covering the wallet's `ScanForWalletTransactions` interface. The target builds a mock chain containing fuzzed blocks and transactions with wallet scripts, toggles basic block filter indexing, and calls rescan with fuzzed start blocks and height boundaries.

Problem: Wallet transaction scanning lacked dedicated fuzz testing coverage, leaving edge cases in block processing, block filter usage, and height boundary handling in `ScanForWalletTransactions` undiscovered by automated fuzzing.

Evidence of importance:

  • Addresses part of the wallet fuzzing tracking issue #29901.
  • Author notes the test does not reproduce crash issue #31474 ('Potential crash (assert) rescanning wallet') because reproducing that requires complex asynchronous operations.

Scope: Adds a standalone test file `src/wallet/test/fuzz/scan.cpp` and hooks it into CMake.

Reviewability

Stale · Author silent 142d

No author activity for 142 days; a review may wait a long time for a response.

Agreement

Strong

substantive support, no open objection (Chand-ra)

Thread notes: Initial record. Added CI UBSan failure reported by fanquake and ASan heap-use-after-free reported by ekzyis; both were resolved by fixes pushed by the author. ekzyis's nit on AbortRescan was treated as style/cleanup and addressed.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
fanquake (member)objection, correctnessUBSan signed integer overflow in std::chrono duration cast during fuzzingfixed · fix pushed · v1, not yet re-checkedansweredyes2025-07-16: 'runtime error: signed integer overflow: -9223372036854775808 * 1000000000 cannot be represented in type 'long''
Status from: 2025-07-16: brunoerg: 'Fixed, thanks.'
ekzyis (none)objection, safetyASan heap-use-after-free crash on exit when block filter indexes are not destroyedfixed · fix pushed · v1, not yet re-checkedchangedyes2026-06-12: 'I found an input with an ASan crash *after* fuzzing is done: ... ERROR: AddressSanitizer: heap-use-after-free'
Status from: 2026-06-12: brunoerg: 'Addressed: https://github.com/bitcoin/bitcoin/pull/32993#discussion_r3404019071 and https://github.com/bitcoin/bitcoin/pull/32993#discussion_r3404753306'

Support:

  • Chand-ra (none) (Tested ACK, 2025-12-06): The target runs without crashing.

Participants:

  • fanquake (member, objection, 1 statements 2025-07-16 to 2025-07-16): reported UBSan signed-integer overflow in CI
  • Chand-ra (none, support, 1 statements 2025-12-06 to 2025-12-06): tested ACK that the fuzz target runs without crashing
  • ekzyis (none, objection, 3 statements 2026-06-12 to 2026-06-12): reported ASan heap-use-after-free on shutdown and questioned an unnecessary AbortRescan call

Files

111 lines under test/bench/ci.

  • src/wallet/test/fuzz/scan.cpp +110/-0
  • src/wallet/test/fuzz/CMakeLists.txt +1/-0

Card

The short text the ranking pass compares across PRs.

Adds a new fuzz target covering wallet transaction scanning via ScanForWalletTransactions. The target constructs chains of fuzzed blocks and transactions directed to the wallet, optionally enables basic block filters, and executes rescans across randomized heights and block hashes. This expands coverage under the wallet fuzzing tracking issue #29901, though the author notes it does not reproduce the async rescan crash reported in #31474.

Data

dossier JSON · extract JSON · model ledger, generated 2026-09-18T03:46, confidence high, input hash 29055bcc8790d71f
thread read through 2026-06-12 (10 statements), head fbeba67512
Discussion read under schema 1 rules: suggestions and questions may be missing, and an objection may combine several harms (schema history).
labels: Tests, Fuzzing · draft

Categories

Wallet

P3 · test coverage (ranking pass: Moved down: useful coverage, but it does not reproduce the known rescan crash, so it ranks below behavior-affecting work.)

Adds dedicated fuzz testing for wallet rescanning edge cases. While it addresses part of tracking issue #29901, the author notes it does not reproduce known crash issue #31474, making this valuable test coverage that is reasonably deferrable.

Membership: Adds `src/wallet/test/fuzz/scan.cpp` to exercise `ScanForWalletTransactions` and rescanning logic.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0