Hello everyone

, here’s my development updates for the Week 3 of ethereum protocol fellowship cohort 4 !

Research on fuzzing

This week I was able to deepen my research on the subject of the project I choose : fuzzing .

The project was suggested by the mentor Fredrik:

Create new fuzzers for software in order to find potential vulnerabilities, or improve on existing fuzzing frameworks. Networking in particular is an area where this could see some improvements on, but clients on the execution layer and consensus layer could also benefit from additional fuzzing.

I started the week by learning more about fuzzing, reading and watching resources on the subject and started practicing.

Last week I said that I was interested to fuzz the ethereum network as proposed by fredrik and also to contribute to reth by fuzzing it .

I spoke about it to the other members of the epf who are interested in this project, and to Fredrik and Mario Havel.

After having their feedback, (thank you again by the way) I had to have a more precise idea of what I was going to fuzz.

Finding the target

So i did more researches on potential targets, what part of ethereum's project need to be fuzzed , i consulted the links that mario gave me in his feedback.

I was interested in fuzzing something that ethereum could benefit the most from, while ensuring that i'm still exited by the target.

And finally I opted for the fuzzing of the ethereum network more precisely the devp2p:

This target was first proposed by Fredrik who said that is a good value for ethereum.

The devp2p is a set of protocols that ethereum uses to establish and maintain the peer to peer network.

Ethereum nodes exchange messages in order to communicate via the devp2p protocols, the fuzzing of these messages could make it possible to find security vulnerabilities and bugs.

So i started to explore the differents protocols of the devp2p, how they work and what are the messages sent.
I also readed some implementations of the devp2p in rust.

Once that was done, I went back to learning fuzzing techniques.

Deep dive into fuzzing techniques

So I went back to fuzzing, I kept reading resources that I hadn't finished before. Then I moved on to the fuzzing book.

The fuzzing book go trought fuzzing with various techniques like : random fuzzing, mutation-based fuzzing, grammar-based test generation, symbolic testing…
All of this explained with code example, quizz and exercices .

However, the book use python, and as mentioned above, I chose to use rust .
Fortunately I have already did some python in the past and reading was not a problem for me .

In addition I decided to recode all the python code in rust , including the examples and the exercices.

Reading is slower, some concepts of python do not exist in rust so I have to adapt.

But it's an excellent exercise to put more into practice my rust skills that I learned the previous weeks and also to better absorb the concepts and the techniques of fuzzing explained by the book.

I had a lot of fun rewriting the python code and doing the exercises in rust

Next Steps

At first I must continue to learn and improve my fuzzing skills as well as my knowledge of devp2p protocols.

Then apply them to the devp2p protocols.

I plan to publish my project proposal by the end of next week, so I will also dedicate some time to do it.

I will probably get back in touch with Fredrik, Mario and the other members of the epf interested in the fuzzing project to present the project proposal and get feedback.

Thank you all again for the previous feedbacks

That's all for my dev update, I hope you liked it.
As usual if you want to get in touch with me for anything I'm available on discord, don't hesitate!

Thanks for reading

Principal ressources i used this week :

• Fuzz Book
• Devp2p specification repo
• Network Layer article from ethereum
• Fuzz week playlist
• Fuzzing repo