push tx fuzzing

I am interested in finding or writing a fuzzer for push tx APIs. I did not find one after a brief search. Has anyone found otherwise, or is she in the process of writing one?

If not, what features would people recommend for a new push tx fuzzer?

Endpoints I would like to test include:

https://live.blockcypher.com/btc-testnet/pushtx/

https://insight.bitpay.com/tx/send

https://blockchain.info/pushtx

https://coinb.in/#broadcast

https://btc.blockr.io/tx/push

https://chain.localbitcoins.com/tx/send

The fuzzer should be able to send random data, invalid characters, etc. but also fuzz particular aspects of the transaction format such as malformed P2SH and P2PKH transactions, fields such as lock time, size, # inputs, version number, vin size, etc. It should also be able to fuzz a variety of valid and invalid script formats using odd op codes, changing the order of op codes, etc.

If anyone has recommendations about how such a fuzzer should be structured, please let me know.

Finally, if you are interested in collaborating, please contact me via private message.

Thanks!

Kristov

On 2015-09-01 15:50, Kristov Atlas via bitcoin-dev wrote:

> I am interested in finding or writing a fuzzer for push tx APIs. I did
> not find one after a brief search. Has anyone found otherwise, or is
> she in the process of writing one?
>

https://github.com/jonasnick/bitcoinconsensus_testcases

https://jonasnick.github.io/blog/2015/05/09/fuzzing-bitcoin-consensus/

The only implementations with any significant network presence are btcd and Bitcoin Core, fuzzing them should be sufficient if these services are doing validation of transactions using one of the two. For example two of the ones you have linked are based in Insight, which uses Bitcoin Core for validation. If they aren't validating transactions before broadcast they won't make it more than a single hop through the P2P the network so they are of minimum concern.

On Tue, Sep 01, 2015 at 04:59:15PM +0000, Monarch via bitcoin-dev wrote:

> which uses Bitcoin Core for validation.  If they aren't validating
> transactions before broadcast they won't make it more than a single
> hop through the P2P the network so they are of minimum concern.

blockchain.info had some problems here for a while. They were not using a full validating node underneath:

- Signatures were not verified properly. This resulted in some panic when it looked like (on their site) a massive number of very old coins were being spent.

- They were relaying loose coinbase transactions. This caused them to be instantly banned from nodes they were connected to.

So there's certainly some scope for fun with fuzzing those APIs.

Wladimir

Interesting project, Kristov. Two more ideas for fuzzing bitcoin txs:
- random bit flipping from valid txs
- random tx script generators:
  - from a grammar
  - from a stochastic grammar
  - from a random sequence of opcodes

I've made some really small experiments on fuzzing in the past [1][2], and I'm interested in helping out.

Best, Manuel

[1] https://github.com/maraoz/json-fuzzer
[2] https://github.com/maraoz/bitcoin-fuzzer

On Tue, Sep 1, 2015 at 3:03 PM, Wladimir J. van der Laan via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:

> On Tue, Sep 01, 2015 at 04:59:15PM +0000, Monarch via bitcoin-dev wrote:
>
> > which uses Bitcoin Core for validation.  If they aren't validating
> > transactions before broadcast they won't make it more than a single
> > hop through the P2P the network so they are of minimum concern.
>
> blockchain.info had some problems here for a while. They were not using a
> full validating node underneath:
>
> - Signatures were not verified properly. This resulted in some panic when
> it looked like (on their site) a massive number of very old coins were
> being spent.
>
> - They were relaying loose coinbase transactions. This caused them to be
> instantly banned from nodes they were connected to.
>
> So there's certainly some scope for fun with fuzzing those APIs.
>
> Wladimir
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists•linuxfoundation•org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>