From 3ec1e760d6cb2367908e5b7280ccd90da6582083 Mon Sep 17 00:00:00 2001 From: YsielX <332494219@qq.com> Date: Wed, 24 Dec 2025 14:16:03 +0000 Subject: [PATCH 1/2] Filtered test functions --- crates/movy-fuzz/src/meta.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/movy-fuzz/src/meta.rs b/crates/movy-fuzz/src/meta.rs index d426a6e..8a02cd7 100644 --- a/crates/movy-fuzz/src/meta.rs +++ b/crates/movy-fuzz/src/meta.rs @@ -232,7 +232,7 @@ fn collect_target_functions( let mut target_functions: Vec = vec![]; for package_addr in target_packages.iter() { - let Some(package_meta) = base.get_package_metadata(package_addr) else { + let Some(package_meta) = base.get_original_package_metadata(package_addr) else { continue; }; for module in package_meta.modules.iter() { From cbb747e5b2967c164965da5bed4fa0904cc5903d Mon Sep 17 00:00:00 2001 From: YsielX <332494219@qq.com> Date: Wed, 24 Dec 2025 14:16:50 +0000 Subject: [PATCH 2/2] Added cli about oracles --- crates/movy-fuzz/src/executor.rs | 5 +- crates/movy-fuzz/src/operations/sui_fuzz.rs | 43 ++++++++++++----- crates/movy-fuzz/src/operations/sui_replay.rs | 3 +- crates/movy-fuzz/src/oracles/sui/typed_bug.rs | 47 +++++++++++++++++-- crates/movy/src/sui/fuzz.rs | 28 ++++++++++- 5 files changed, 104 insertions(+), 22 deletions(-) diff --git a/crates/movy-fuzz/src/executor.rs b/crates/movy-fuzz/src/executor.rs index 766dc44..65ac69f 100644 --- a/crates/movy-fuzz/src/executor.rs +++ b/crates/movy-fuzz/src/executor.rs @@ -75,7 +75,6 @@ pub struct SuiFuzzExecutor { // pub minted_gas: Object, // pub log_tracer: Option, pub ph: PhantomData<(I, S)>, - pub disable_oracles: bool, pub epoch: u64, pub epoch_ms: u64, } @@ -202,9 +201,7 @@ where if !oracle_vulns.is_empty() { trace_outcome.findings.extend(oracle_vulns.iter().cloned()); } - let kind = if self.disable_oracles { - ExitKind::Ok - } else if !oracle_vulns.is_empty() { + let kind = if !oracle_vulns.is_empty() { ExitKind::Crash } else { trace_outcome.verdict diff --git a/crates/movy-fuzz/src/operations/sui_fuzz.rs b/crates/movy-fuzz/src/operations/sui_fuzz.rs index 464bc7a..87d65b2 100644 --- a/crates/movy-fuzz/src/operations/sui_fuzz.rs +++ b/crates/movy-fuzz/src/operations/sui_fuzz.rs @@ -35,19 +35,23 @@ use movy_types::error::MovyError; use sui_types::storage::BackingStore; use sui_types::storage::{BackingPackageStore, ObjectStore}; -pub fn oracles(disabled: bool) -> impl for<'a> SuiGeneralOracle, S> +pub fn oracles( + typed_bug_abort: bool, + disable_profit_oracle: bool, + disable_defects_oracle: bool, +) -> impl for<'a> SuiGeneralOracle, S> where T: 'static + ObjectStore, S: HasMetadata + HasExtraState> + HasFuzzMetadata, { tuple_list!( - CouldDisabledOralce::new(BoolJudgementOracle, disabled), - CouldDisabledOralce::new(InfiniteLoopOracle::default(), disabled), - CouldDisabledOralce::new(PrecisionLossOracle, disabled), - CouldDisabledOralce::new(TypeConversionOracle, disabled), - CouldDisabledOralce::new(OverflowOracle, disabled), - CouldDisabledOralce::new(ProceedsOracle::default(), disabled), - CouldDisabledOralce::new(TypedBugOracle, disabled), + CouldDisabledOralce::new(BoolJudgementOracle, disable_defects_oracle), + CouldDisabledOralce::new(InfiniteLoopOracle::default(), disable_defects_oracle), + CouldDisabledOralce::new(PrecisionLossOracle, disable_defects_oracle), + CouldDisabledOralce::new(TypeConversionOracle, disable_defects_oracle), + CouldDisabledOralce::new(OverflowOracle, disable_defects_oracle), + CouldDisabledOralce::new(ProceedsOracle::default(), disable_profit_oracle), + CouldDisabledOralce::new(TypedBugOracle::new(typed_bug_abort), disable_defects_oracle), ) } @@ -56,6 +60,9 @@ fn fuzz_impl( env: SuiTestingEnv, output: &Option, time_limit: Option, + typed_bug_abort: bool, + disable_profit_oracle: bool, + disable_defects_oracle: bool, ) -> Result<(), MovyError> where T: ObjectStoreCachedStore @@ -124,8 +131,11 @@ where executor: executor_inner, ob: tuple_list!(code_observer), attacker, - oracles: oracles(true), - disable_oracles: false, + oracles: oracles( + typed_bug_abort, + disable_profit_oracle, + disable_defects_oracle, + ), epoch: state.fuzz_state().epoch, epoch_ms: state.fuzz_state().epoch_ms, ph: std::marker::PhantomData, @@ -240,7 +250,18 @@ pub fn fuzz( >, output: &Option, time_limit: Option, + typed_bug_abort: bool, + disable_profit_oracle: bool, + disable_defects_oracle: bool, ) -> Result<(), MovyError> { - fuzz_impl(meta, env, output, time_limit)?; + fuzz_impl( + meta, + env, + output, + time_limit, + typed_bug_abort, + disable_profit_oracle, + disable_defects_oracle, + )?; Ok(()) } diff --git a/crates/movy-fuzz/src/operations/sui_replay.rs b/crates/movy-fuzz/src/operations/sui_replay.rs index 3cd2149..0c64946 100644 --- a/crates/movy-fuzz/src/operations/sui_replay.rs +++ b/crates/movy-fuzz/src/operations/sui_replay.rs @@ -105,8 +105,7 @@ where executor: executor_inner, ob: tuple_list!(code_observer), attacker, - oracles: super::sui_fuzz::oracles(false), - disable_oracles: false, + oracles: super::sui_fuzz::oracles(false, false, false), epoch: state.fuzz_state().epoch, epoch_ms: state.fuzz_state().epoch_ms, ph: std::marker::PhantomData, diff --git a/crates/movy-fuzz/src/oracles/sui/typed_bug.rs b/crates/movy-fuzz/src/oracles/sui/typed_bug.rs index 759cd6b..cc06eee 100644 --- a/crates/movy-fuzz/src/oracles/sui/typed_bug.rs +++ b/crates/movy-fuzz/src/oracles/sui/typed_bug.rs @@ -1,19 +1,39 @@ -use log::debug; +use log::{debug, trace}; use move_trace_format::format::TraceEvent; use move_vm_stack::Stack; use movy_replay::tracer::{concolic::ConcolicState, oracle::SuiGeneralOracle}; use movy_types::{error::MovyError, input::MoveSequence, oracle::OracleFinding}; use serde_json::json; -use sui_types::{effects::TransactionEffects, storage::ObjectStore}; +use sui_types::{ + effects::{TransactionEffects, TransactionEffectsAPI}, + execution_status::{ExecutionFailureStatus, ExecutionStatus}, + storage::ObjectStore, +}; use crate::{ meta::HasFuzzMetadata, state::{ExtraNonSerdeFuzzState, HasExtraState}, }; -#[derive(Debug, Default, Clone)] -pub struct TypedBugOracle; +const TYPED_BUG_ABORT_CODE: u64 = 19260817; + +#[derive(Debug, Clone)] +pub struct TypedBugOracle { + pub use_abort: bool, +} + +impl Default for TypedBugOracle { + fn default() -> Self { + Self { use_abort: false } + } +} + +impl TypedBugOracle { + pub fn new(use_abort: bool) -> Self { + Self { use_abort } + } +} impl SuiGeneralOracle for TypedBugOracle where @@ -46,6 +66,25 @@ where state: &mut S, _effects: &TransactionEffects, ) -> Result, MovyError> { + trace!("TypedBugOracle done_execution called"); + if self.use_abort { + match _effects.status() { + ExecutionStatus::Failure { + error: ExecutionFailureStatus::MoveAbort(_, code), + .. + } if *code == TYPED_BUG_ABORT_CODE => { + debug!("Typed bug abort detected: code {}", code); + return Ok(vec![OracleFinding { + oracle: "TypedBugOracle".to_string(), + severity: movy_types::oracle::Severity::Critical, + extra: json!({ + "abort_code": code, + }), + }]); + } + _ => return Ok(Vec::new()), + } + } let Some(global_outcome) = state.extra_state().global_outcome.as_ref() else { return Ok(Vec::new()); }; diff --git a/crates/movy/src/sui/fuzz.rs b/crates/movy/src/sui/fuzz.rs index 4caf0ef..f0803d2 100644 --- a/crates/movy/src/sui/fuzz.rs +++ b/crates/movy/src/sui/fuzz.rs @@ -143,6 +143,24 @@ pub struct SuiFuzzArgs { pub target: SuiTargetArgs, #[clap(flatten)] pub filters: FuzzTargetArgs, + #[arg( + long, + help = "Detect typed bug via abort code 19260817 instead of oracle event", + default_value_t = false + )] + pub typed_bug_abort: bool, + #[arg( + long, + help = "Disable profit oracle (ProceedsOracle)", + default_value_t = false + )] + pub disable_profit_oracle: bool, + #[arg( + long, + help = "Disable defect oracles (others including typed bug event-based checks)", + default_value_t = false + )] + pub disable_defects_oracle: bool, } impl SuiFuzzArgs { @@ -264,7 +282,15 @@ impl SuiFuzzArgs { tokio::task::spawn_blocking(move || { let inner = testing_env.into_inner(); let env = SuiTestingEnv::new(Arc::new(inner)); - sui_fuzz::fuzz(meta, env, &self.output, self.time_limit) + sui_fuzz::fuzz( + meta, + env, + &self.output, + self.time_limit, + self.typed_bug_abort, + self.disable_profit_oracle, + self.disable_defects_oracle, + ) }) .await??; Ok(())