feat: add configurable collision-free EVM edge coverage by 0xalpharush · Pull Request #14853 · foundry-rs/foundry

0xalpharush · 2026-05-20T20:32:37Z

Motivation

in the OG implementation, it is possible for edge IDs to collide which can lose some signal

OSS-249

Solution

implement and make evm_edge_coverage_collision_free the default

PR Checklist

Added Tests
Added Documentation
Breaking changes

DaniPopes · 2026-05-20T22:17:43Z

+    /// Whether EVM edge coverage should use collision-free dense IDs.
+    pub evm_edge_coverage_collision_free: bool,
+    /// Whether EVM edge coverage IDs should include call-frame depth.
+    pub evm_edge_coverage_include_call_depth: bool,


why even have the configs? why not just switch it out directly?

it makes it easier to experiment. there's a couple more things to get in, and then i'd like to search for the best defaults or let some threads run with non-default features enabled

if there's a better way to avoid these be user-facing, i suppose that'd be good to avoid churn

grandizzy · 2026-05-21T10:07:35Z

Benchmark: 1h Aave v4 SCFuzzBench campaign (seed=42)

I ran a 4-way comparison of edge-coverage modes against the Recon-Fuzz/aave-v4-scfuzzbench suite (forge test --mc CryticToFoundry --fuzz-seed 42, FOUNDRY_INVARIANT_TIMEOUT=3600) to validate the default flip in this PR. All runs on the same host, sequentially.

master: 407994620 (PR base)
PR feat: add configurable collision-free EVM edge coverage #14853: e51c6ee (3 configs, varying evm_edge_coverage_collision_free / evm_edge_coverage_include_call_depth)

Results

Config	total txs	tx/s (peak)	edges	features	corpus	inv breaks	handler asserts	total bugs	peak RSS
master (`collision_free=false`, `include_call_depth=false`)	29.95M	~862	352–373	372–488	306–368	3	4	7	4.29 GB
PR ⭐ default (`collision_free=true`, `include_call_depth=false`)	30.27M	~901	376–378	442–475	322–351	4	3	7	4.45 GB
PR (`collision_free=true`, `include_call_depth=true`)	28.45M	~790	396–401	422–447	364–380	3	2	5	4.43 GB
PR (`collision_free=false`, `include_call_depth=true`)	32.16M	~1117	371–409	421–500	325–398	4	3	7	4.39 GB

Unique bugs by config

Bug	master	PR default	PR `+depth`	PR `hash+depth`
`invariant_canary`	✓	✓	✓	✓
`invariant_shouldNotBecomeLiquidatable`	✓	✓	✓	✓
`invariant_totalBorrowedLessThanSupplied_v0`	✓	✓	✓	✓
`invariant_totalBorrowedLessThanSupplied_v1`	—	✓	—	✓
`invariant_totalBorrowedLessThanSupplied_v2`	—	✓	—	✓
`iHub_mintFeeShares_ASSERTION_MINT_FEE_SHARES_PPS_CHANGE`	✓	✓	✓	✓
`iSpoke_repay_ASSERTION_REPAY_DOS`	✓	—	—	—
`iSpoke_withdraw_ASSERTION_WITHDRAW_DOS`	✓	✓	—	✓
`assert_canary_ASSERTION_CANARY`	✓	✓	✓	✓
Total	7	7	5	7

Key findings

The new default (collision-free, no depth) is a clear improvement over master. Same bug count (7), +5% peak throughput, +1% more transactions processed, only +4% peak RSS. The collision-free signal removed two of master's bugs (v0 upgraded to also catching v1 and v2) at no measurable runtime cost.
Adding include_call_depth=true on top hurt on this target. It lost 2 invariant breaks (v1/v2) and 1 handler bug (withdraw_DOS) compared to the default, with ~13% lower throughput and ~6% fewer txs in 1h. Consistent with the "context-sensitivity dilutes corpus features" worry — same code reached via different call depths shows up as multiple novel features, slowing convergence to interesting state.
collision_free=false + include_call_depth=true wasn't catastrophic but is still strictly inferior to the new default (1 fewer invariant break). On this target the 64KiB map absorbed the extra dimensionality without runaway collisions, but it's a strictly worse design point and there's no reason to recommend this combination.
No unbounded memory growth in 1h. Peak RSS for all 4 configs landed within 4.29–4.45 GB (≤4% spread). The EdgeIndexMap + history_map did not blow up on aave-v4 inside a 1h budget. A 3h+ run would be useful confirmation before declaring the new default safe for very long campaigns.

…onfig # Conflicts: # crates/evm/evm/src/executors/mod.rs

Vec::push already grows via the same amortized doubling path (RawVec::grow_amortized) as Vec::reserve(1), so pre-reserving a single slot adds no headroom -- only an extra capacity check.

The fixed-size hash bitmap is only used by EdgeCovKind::Hash. In CollisionFree mode (the new default) it stayed allocated and got memcpy'd on every per-call inspector clone for no benefit.

Previously into_coverage(self) borrowed via dense_hits(&self) and cloned every dense entry despite consuming the inspector. Replace with a single From impl that destructures and moves the HashMap, and use it from both into_hitcount and into_parts.

merge_edge_coverage doesn't need ordered hits, so paying sort_by_key on every per-call inspector drain was wasted work on the new default path. Move the sort into snapshot_edge_fingerprint, which is gated on handler assertion failure -- cold path -- and is the only consumer that needs a deterministic order across HashMap iterations.

Once From<EdgeCovInspector> for EdgeCoverage landed, into_hitcount was just a thin wrapper around self.into() with a misleading name (it returns EdgeCoverage, not a hitcount). No callers exist.

Without a tag byte, an EdgeKey with depth=None serializes identically to depth=Some(0) when include_call_depth is toggled, so fingerprints collide across configs sharing a corpus. Push a 1-byte is_some tag ahead of the depth bytes. Cold path; no impact on default config.

The method took (yes: bool, kind: bool, include_call_depth: bool) and runner.rs sourced all three from the same FuzzCorpusConfig. Replace with collect_edge_coverage_with_config(&FuzzCorpusConfig) that derives both the gate and EdgeCovConfig from one corpus reference, backed by a From<&FuzzCorpusConfig> for EdgeCovConfig impl.

- drop stale TODO in collect_edge_coverage - collapse with_capacity/with_capacity_and_config into with_config - drop tests-only get_hitcount/get_dense_hits; cfg(test)-gate dense_hits - remove vacuous hitcount==0 assertions in collision-free tests - start WorkerCorpus history maps empty; merge paths resize on demand - still preallocate Hash-mode history_map to keep first merge alloc-free

mablr

LGTM

Amp-Thread-ID: https://ampcode.com/threads/T-019e64ab-e0ea-73df-802c-beb11f0ee1e0 Co-authored-by: Amp <amp@ampcode.com>

Add configurable collision-free EVM edge coverage

556d764

0xalpharush requested review from 0xrusowsky, DaniPopes, figtracer, grandizzy, mablr, mattsse, stevencartavia and zerosnacks as code owners May 20, 2026 20:32

github-project-automation Bot added this to Foundry May 20, 2026

DaniPopes reviewed May 20, 2026

View reviewed changes

fix evm edge coverage lint failures

e51c6ee

0xalpharush mentioned this pull request May 21, 2026

Minset corpus edge indices #14856

Open

stevencartavia reviewed May 21, 2026

View reviewed changes

Comment thread crates/evm/evm/src/executors/mod.rs

stevencartavia reviewed May 21, 2026

View reviewed changes

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

stevencartavia reviewed May 21, 2026

View reviewed changes

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

mablr reviewed May 21, 2026

View reviewed changes

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

decofe and others added 6 commits May 26, 2026 07:22

Merge remote-tracking branch 'origin/master' into evm-edge-coverage-c…

e3385ba

…onfig # Conflicts: # crates/evm/evm/src/executors/mod.rs

fuzz(corpus): drop redundant Vec::reserve(1) before push in edge merge

778dcd7

Vec::push already grows via the same amortized doubling path (RawVec::grow_amortized) as Vec::reserve(1), so pre-reserving a single slot adds no headroom -- only an extra capacity check.

fuzz(edge-cov): skip 64 KiB hitcount alloc in collision-free mode

110faba

The fixed-size hash bitmap is only used by EdgeCovKind::Hash. In CollisionFree mode (the new default) it stayed allocated and got memcpy'd on every per-call inspector clone for no benefit.

fuzz(edge-cov): drop orphan into_hitcount wrapper

f2aa445

Once From<EdgeCovInspector> for EdgeCoverage landed, into_hitcount was just a thin wrapper around self.into() with a misleading name (it returns EdgeCoverage, not a hitcount). No callers exist.

grandizzy requested review from DaniPopes, mablr and stevencartavia May 26, 2026 08:46

grandizzy added 2 commits May 26, 2026 12:23

mablr reviewed May 26, 2026

View reviewed changes

Comment thread crates/evm/evm/src/inspectors/stack.rs Outdated

mablr reviewed May 26, 2026

View reviewed changes

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

Comment thread crates/evm/evm/src/inspectors/edge_cov.rs Outdated

mablr reviewed May 26, 2026

View reviewed changes

Comment thread crates/evm/evm/src/executors/corpus.rs Outdated

grandizzy added 2 commits May 26, 2026 14:04

Merge branch 'master' into evm-edge-coverage-config

942056d

mablr previously approved these changes May 26, 2026

View reviewed changes

grandizzy previously approved these changes May 26, 2026

View reviewed changes

chore: trigger ci

183bc7a

Amp-Thread-ID: https://ampcode.com/threads/T-019e64ab-e0ea-73df-802c-beb11f0ee1e0 Co-authored-by: Amp <amp@ampcode.com>

grandizzy enabled auto-merge (squash) May 26, 2026 14:32

fix rustdoc link in edge coverage docs

65e8677

decofe dismissed stale reviews from mablr and grandizzy via 65e8677 May 26, 2026 14:59

grandizzy approved these changes May 26, 2026

View reviewed changes

grandizzy requested a review from mablr May 26, 2026 15:01

stevencartavia approved these changes May 26, 2026

View reviewed changes

mablr approved these changes May 26, 2026

View reviewed changes

grandizzy merged commit 0659e1d into foundry-rs:master May 26, 2026
19 checks passed

github-project-automation Bot moved this to Done in Foundry May 26, 2026

grandizzy mentioned this pull request May 26, 2026

feat(invariant): gas-envelope fuzzing via invariant.gas_fuzz #14902

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add configurable collision-free EVM edge coverage#14853

feat: add configurable collision-free EVM edge coverage#14853
grandizzy merged 14 commits into
foundry-rs:masterfrom
0xalpharush:evm-edge-coverage-config

0xalpharush commented May 20, 2026 •

edited

Loading

Uh oh!

DaniPopes May 20, 2026

Uh oh!

0xalpharush May 20, 2026

Uh oh!

0xalpharush May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grandizzy commented May 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mablr left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

0xalpharush commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Solution

PR Checklist

Uh oh!

DaniPopes May 20, 2026

Choose a reason for hiding this comment

Uh oh!

0xalpharush May 20, 2026

Choose a reason for hiding this comment

Uh oh!

0xalpharush May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grandizzy commented May 21, 2026

Benchmark: 1h Aave v4 SCFuzzBench campaign (seed=42)

Results

Unique bugs by config

Key findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mablr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

0xalpharush commented May 20, 2026 •

edited

Loading