Struct TransactionFuzzer 

pub struct TransactionFuzzer { /* private fields */ }

Generates adversarial Bitcoin transaction byte sequences for fuzz testing.

Implementations

impl TransactionFuzzer

pub fn new(config: FuzzConfig) -> Self

Create a new fuzzer with a custom configuration.

pub fn with_default_config() -> Self

Create a fuzzer with default configuration.

pub fn generate_truncated(&self, rng: &mut impl RngExt) -> Vec<u8>

Generate a raw transaction buffer that has been truncated at a random byte boundary, simulating incomplete network messages or corrupt data.

pub fn generate_random_noise(&self, rng: &mut impl RngExt) -> Vec<u8>

Generate a buffer of completely random bytes of random length within [1, max_tx_size_bytes].

pub fn generate_validish_malformed(&self, rng: &mut impl RngExt) -> Vec<u8>

Generate a structurally plausible but internally inconsistent transaction.

The returned buffer has a valid-looking header with one input whose script_sig length varint claims more bytes than are available. This exercises off-by-one / overflow parsing paths without being pure noise.

pub fn generate_overflow_value(&self, rng: &mut impl RngExt) -> Vec<u8>

Generate a transaction whose single output value is set to u64::MAX, which is far above the 21 million BTC supply cap (2_100_000_000_000_000 satoshis).

pub fn run_batch<F>( &self, category: MalformedTxCategory, parse_fn: F, ) -> FuzzResult

where F: Fn(&[u8]) -> bool,

Run config.max_iterations fuzz iterations for the given category.

For each iteration a byte sequence is generated according to category and passed to parse_fn. Panics are caught via std::panic::catch_unwind so they contribute to FuzzResult::panics rather than aborting the test.

parse_fn should return true if parsing succeeded and false if it returned a structured error.