fuzzy

Less setup.
More fuzzing.

Automated Solidity fuzzing. Fuzzy helps you define invariants, builds the harnesses, and runs GCTM-seeded fuzzing to find bugs in your contracts.

Hi, I’m Fuzzy.Let’s break the ice.

How it works

  1. 1Connect GitHub

    Sign in, install Fuzzy, and choose a repository and branch.

  2. 2Choose your campaign

    Pay for your duration and parallel instances.

  3. 3Plan in an issue

    Fuzzy reads your code and docs, suggests invariants, and asks your team about intended behavior and custom test scenarios.

  4. 4Run and review

    Approve the plan. Fuzzy prepares the harnesses, runs GCTM-seeded fuzzing, and posts findings in the same issue.

snowy-staking / Issues

Define invariants for SnowyStaking #42

Open

Fuzzy opened this issue

Fuzzybot

I’ve read SnowyStaking.sol and the docs. Should this hold after every successful transaction?

totalStaked == Σ userStake

Which interactions worry you?

alex-devDeveloper

Yes. Partial withdrawals worry me. Please test Alice and Bob depositing, Alice withdrawing part of her stake, then Bob depositing again.

Fuzzybot

I can model Alice and Bob as separate callers and check the total after every step. Should the harness use a fresh deployment or a fork?

Findings include broken invariants, reproducing transactions, and what they could mean.

Goal-conditioned
transaction model

GCTM uses our proprietary transformer architecture to suggest deep transaction sequences based on your invariants.

It complements your fuzzer with sequences that can go beyond the familiar scenarios and assumptions in human- and LLM-written seeds.

Your invarianttotalStaked == Σ userStake
Transaction sequences
alice.approve → bob.approve → alice.stake → bob.stake → alice.unstake → bob.stake → alice.unstakeapprove → stake → fundRewards → advanceTime → claim → unstake → claimalice.stake → bob.stake → fundRewards → alice.claim → bob.unstake → alice.unstake
Traditional fuzzer

GCTM-seeded fuzzing, compared

Preview data
Recon medianGCTM medianLowest–highest across 3 runs

Recon

+29%

Broken invariants

Recon: three-trial median and lowest-to-highest rangePreview data, awaiting Fuzzy benchmark measurements. After 24 hours, archived Recon lowest, median and highest are 6, 7, 10. Modeled GCTM values are 8, 9, 13. 05101506121824Run time (hours)
24 hoursLowestMedianHighest
Recon6710
+ GCTM8913
Data and methodology

The measured benchmark will compare three independent 24-hour runs per configuration, using the same contracts, invariants, hardware, and campaign time budget. Lines show the median; shaded bands show the lowest and highest counts.

The current chart is a preview based on archived Recon traces and modeled GCTM uplift. Fuzzy’s own measured results will replace these values. Broken invariants count violated properties, rather than distinct exploits.

Pricing

Choose how long Fuzzy runs and how many instances work in parallel. Each instance has 16 CPU cores and 32 GiB of RAM.

Campaigns start at $20 for four hours on one instance. Longer runs cost less per hour, with additional discounts for parallel instances.

$20
total for 4 hours
1 instance
4 hours24 hours
Parallel instances

4 instance-hours · 16 CPU cores in parallel

Provisional pricing. No payment is taken in this demo.

Install Fuzzy on GitHub

Choose the repositories Fuzzy can access. Invariant discussions and run results stay in GitHub issues.

The GitHub App is waiting for configuration.

Sign in with GitHub

Use your GitHub account to manage Fuzzy credits. Repository access is approved separately when you install Fuzzy.

GitHub sign-in is waiting for app configuration.