Fuzzing CKB-VM Into Shape: The Hidden Work Behind Meepo
Do you know that a big part of Meepo’s development time went into fuzzing test, rather than writing new features?
To ensure the reliability and consistency of CKB-VM upgrades on mainnet and testnet, we fuzzed both valid and invalid transactions to catch any subtle compatibility issues early.
The goal was to:
- Ensure stable and consist transaction execution
- Prevent panics
- Verify compatibility in aspects like cycle consumption and error handling across different versions and hardforks
Here’s how fuzzing helped.
1/ Initial Verification: Transaction Replay 🔁
We began by replaying historical on-chain transactions (via `replay`) from mainnet and testnet to check if `cycle` consumption remained consistent in the upgraded CKB-VM.
This caught several mismatches:
https://image.nostr.build/72d9d82dea118a96f7001cdaf76acd272e2e0ec87f40eeb0d82214d6db7f6aba.png
As the chain only contains valid transactions, this method verifies past compatibility but not future cases. To broaden coverage, we turned to fuzzing to simulate diverse transaction inputs and assess compatibility across versions, including error handling in invalid transactions.
2/ First Fuzzing Attempt 🧪
We compared the execution results of `data0` and `data1` of the pre- and post-upgrade VM versions:
https://image.nostr.build/2604ddaf8c015682330ab1cc363eb4f030c8e13dd7d7aa91e418ca7a3780a178.png
However, most generated test cases were invalid. The test only compared whether the errors matched, but skipped the cycle consumption for valid cases—not enough to meet our goals.
3/ Improved Fuzzing 🔧
To increase valid transaction input coverage, we refined the strategy:
- Corpus Optimization: Added valid transaction data from CKB-VM tests and CKB debugger binaries to the fuzzing corpus.
- Input Filtering: Modified fuzzing logic to only keep valid transactions in the corpus, further increasing the frequency of valid samples and enhancing `cycle` verification.
https://image.nostr.build/fbe59fd5933449e7babf2ea5a3d6b834336f853251804c9a66fb6c81932a0ed9.png
4/ Findings 😃
Improved fuzzing uncovered bugs, including:
- Crash caused by an invalid syscall parameter. Fix: https://github.com/libraries/ckb/commit/38279e118d3fda3c52f1d47d2062f80e19a2d523
- Instruction reordering led to mismatched `cycle` cost and memory out-of-bounds errors. Fix: https://github.com/libraries/ckb/commit/ea4aea7fa4cd87ce5df6dee6616466458ff5a86e
- Inconsistent error handling due to mismatched `DataPieceId` behavior. Fix: https://github.com/libraries/ckb/commit/af87dd355a653eaca19a643866300cc5cd907cf5
- Address truncation in x64. Fix: https://github.com/nervosnetwork/ckb-vm/commit/f6df535bbf8864fd14684c133b1aa8026a0b0868
- Inconsistencies in memory tracking. Fix: https://github.com/nervosnetwork/ckb-vm/commit/065a6457d06aa17da4f7dfa1954a2601fc7d288b
All issues were reproduced, analyzed, and added to the test corpus and the fuzzing crash directory for regression testing.
5/ Went Deeper: ISA-Level Fuzzing 🦾
In addition to compatibility testing, we fuzzed the instruction set to prevent unexpected VM panics.
See: https://github.com/nervosnetwork/ckb-vm-fuzzing-test
6/ Fuzzing isn’t flashy, but it pays off. 🛡️
As we know reliability is what gives developers confidence to build.
We’ll gladly keep things safe and steady—and maybe a little boring—so you don’t have to. 😎
8/ Reference Links 🔗
Fuzzing and tools:
- https://github.com/nervosnetwork/ckb-vm/tree/develop/fuzz
- https://github.com/libraries/schedfuzz
- https://github.com/nervosnetwork/ckb-vm-fuzzing-test/
On VM 2:
-
https://github.com/nervosnetwork/rfcs/blob/master/rfcs/0049-ckb-vm-version-2/0049-ckb-vm-version-2.md
Sorry! I made a mistake in my post.
It looks like I tagged the wrong account.
nostr:nevent1qvzqqqqqqypzqkyn09vqxm8da92mykujjkpczs969h4vhrge88kerfqmuf29u6v5qyxhwumn8ghj77tpvf6jumt9qys8wumn8ghj7un9d3shjtt2wqhxummnw3ezuamfwfjkgmn9wshx5uqpr4mhxue69uhhyetvv9ujumn0wd68ytnhd9ex2erwv46zu6nsqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hszythwden5te0wghxkmm2d9exztnfduq3samnwvaz7tmjv4kxz7fwwdhx7un59eek7cmfv9kqzrthwden5te0dehhxtnvdakqz9nhwden5te0wfjkccte9ec8y6tdv9kzumn9wsq3vamnwvaz7tmjv4kxz7fwdehhxarj9e3xzmnyqqsxzxyc9nznataf5pqdajdz4ln67fckzd3d6zp63dzwfvl32fpnx7cpu7pj6
Super interested in the MicroSeed but couldn't find a way in your store to purchae with Bitcoin.
{"id":"5e0b2a1617c5a4a4fce4860b1dcf35278e9d3009e8af680b83b971b34c5f0559","pubkey":"a401dd1742ee4afd4a6fbc798290115497893133dd5069195f79e2ecc4b3b068","created_at":1748716578,"kind":1,"tags":[],"content":"“If I had maintained an oath of silence my whole lifelong for safety, I would still have suffered, and I would still die”\n\nYour voices are powerful and are changing the world.\n\nI was just deplatformed by Meta. \n\nWill that finally make me silent?\n\nNever.\nhttps://blossom.primal.net/538cada4679cb9cb26290a9f59890b4c643beb41bc83a708bf25b8a6f53623bf.mp4","sig":"e8bbea021c8eaf80a89812f1b79f648144eaf45aecd22e38e0fffbb11c294c9684900b827da5790670e1f3167519c6d46927fb6e46f194f08816c72cb1f6979c"}
{"id":"61e9338f1f88832bb06af5ca936cc089130f20c47c272c8006565b489fa9d537","pubkey":"165b9d37a28903103af9ad24036bdc54270882c01add515791fc9666167cfac1","created_at":1749618497,"kind":1,"tags":[["p","2a89078b66f39e95cf9dbab2d074fd6197efb46de289b9530b7374c813e796a7","wss://relay.mostr.pub"],["e","73dffe80c51983e92135e8bd2ce1b5097bddda3b1ed9007868f5e0005ee34123","wss://relay.mostr.pub","root","2a89078b66f39e95cf9dbab2d074fd6197efb46de289b9530b7374c813e796a7"]],"content":"The first 3 days of protests were marked with an insanely high number of federal agents working as provocateurs. \n\nWhen the police just stand around and let a guy with his face covered do burnouts around a burning car left in rhe centre of the intersection so that journalists can take photos of the burning car and police in the background etc. \nShits just so obvious. \nThey used federal agents carrying Mexican flags going around starting fires smashing windows trying to encourage people to loot and riot. \n\nIf you watched any of the Livestreams of the actual protests you'd see it's two completely different crowds. \nObviously now though all the opportunists have come out to join in on the looting and rioting but that's the whole point. \n\nProblem reaction solution. \nTrump being the Zionist pedophile he is, used a false flag to justify bringing in the national guard, which caused the problem. \nNow people are reacting by blaming Mexicans or migrants in general. \nnext comes solution. ","sig":"7d297dc62f2ab5f83233cf22a828a788c675f4e04a1afc8037d2ee7795de05a63212f0c8712fee7416d0ebc5e8552ac6ba865f8a71525fdb4908efeccc72b5f4"}
Obviously ❗️
nostr:nevent1qqs2tc30v7a5fd6w2upjpvm9th9zju7c8s6cnuaaqzymg5rnsqfup6spzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhg5czers
I’m a fan of the hybrid approach - a static site generator like Hugo with a fully custom ui. you get the best parts of the static site generator like content conventions/tagging/compilation, but the uiux is custom.
good morning
You responded to me once, I think, and I'm a nobody on here (that's fine, I get it, and my stance invites it, too... I don't fit.) But, mainly I wanted to point out that you have 170K+ followers. You scratch your butt and post about it and you probably have 100 responses. You post something interesting, and you could spend a couple days dealing with the responses. You know all of this, of course... I mean, I assume that is the situation. I just scrolled through the responses to see if anybody else pointed this out, and nope, not that I saw, so... here you go.
Ah! Vou precisar tirar férias forçadas do Nostr, fui emparedada. "Se parar de perder tempo com isso, te levo para conhecer minha casa na serra" disse ele.Casa na serra? Casada há três anos e nunca soube dessa casa. Gostei da surpresa.
Aqui fez muito frio, agora está a 6°C. Nos dias gelados, escrevi "O delírio de uma deusa". Na noite passada, finalizei a última estrofe. Mais um poema que mostra minha loucura e arrogância.
Se alguém quiser ler, deixo o link abaixo. E lembre-se da maldição: nunca leia minha poesia em voz alta!
Hoje escutei o Concerto para violino e orquestra em Ré maior, op. 35, de Tchaikovsky. Que música linda.
Eu voltarei... fodam-se!
Ayalah Poemas: O Delírio de uma Deusa
https://ayalahpoemas.blogspot.com/2025/06/o-delirio-de-uma-deusa.html?m=1
{"id":"46f5ecbf7a7d008bc590c5a533558d044da58d9d0564b14388c5401c8924c45d","pubkey":"0018b7ee33fb253843639c62e292fec700a69a93b08ee374c5bda971c9b39564","created_at":1749451724,"kind":1,"tags":[["t","Nostr"],["r","wss://filter.nostr.wine/"],["r","wss://nos.lol/"],["r","wss://nostr-pub.wellorder.net/"],["r","wss://nostr.bitcoiner.social/"],["r","wss://nostr.mom/"],["r","wss://nostrelites.org/"],["r","wss://premium.primal.net/"],["r","wss://atlas.nostr.land/"]],"content":"Round 2 with the legend Dr. Anthony Chaffee just went live on his channel!\n\nUnloaded a pallet of orange pills and a couple sneaky purple pills to his 500K subscribers.\n\nTake 30 seconds to leave a #Nostr comment under his video to help convince him to join us 👀👇\nhttps://youtu.be/kMmvqNnZMbM","sig":"93c4577dda61c07ccb1b5b9b7dccd7787da04a07db39e22d611d5c7f77580ea6e8300cc8c43325276193a2ed4b36b3151746fa2b23c069dd5290506311afe527"}
Bankers: “Quantum computing is a threat to #Bitcoin”
Bitcoin:
The internet is already dead, and according to Luke Smith, we killed it (the centralized services are completely devoid of humans anymore).
That's why I started calling it the "Dead Internet Law".
Also, in terms of all of this, I can't do that unless there are ways to do is using Nostr. On top of that, I already try to make myself hard to surveil due to Catolicism, Jesuitism and Pharisaism being mandated EVERYWHERE.