WebAssembly Runtimes Fuzzing

[pventuzelo]

Grant Application Checklist

• The application-template.md has been copied, renamed ( "project_name.md") and updated.
• A BTC address for the payment of the milestones is provided inside the application.
• The software of the project will be released under the Apache license version 2.0 as specified in the terms and conditions.
• The total funding amount of the project is below 30k at the time of submission.

[CLAassistant]

All committers have signed the CLA.

[folsen]

I just had one point of clarification, this is work that will go into Octopus right? So Octopus will be the tool to test all these wasm execution engines (we tend to call it that to not confuse it with the runtime term used in Polkadot/Substrate which is a wasm blob).

I think this would be very valuable, particular for new development.

2. | CLI tool | Command line tool allowing execution of wasm modules through all runtimes. |

This would also be quite valuable for us in testing the polkadot runtime (the wasm blob) essentially running a given blob through all possible execution engines and ensuring the result is the same for all.

[pventuzelo]

This tool (WebAssembly Runtimes Fuzzing i.e WARF in short) will be focused on testing/fuzzing wasm execution VM implementation. Octopus is more focused on analysis of wasm module/blob.

This project will be independent of Octopus even if personally I'm planning to use WARF inside octopus to dynamically detect security issues inside wasm module and make in-process fuzzing of wasm module using the CLI tool.

Thx @folsen for the precision regarding polkadot runtime naming.

[Noc2]

Hi Patrick. Sorry for the late reply here. As I previously said, I think the tool sounds useful to me and the pricing seems fair. From looking at the milestone again, I have just one additional request. Could you add docker images, delivery reports (e.g. how to install, compile, run, and/or test the deliverable) as well as unit tests if appropriate to the milestones? Just to make it easier for us to test the deliveries ;-). Also which programming language are you planning to use (python)?

[pventuzelo]

Hi David,
I've updated the milestones ;)

Regarding the programming language used in the project, I think mainly Rust for fuzzing development and Python for scripting.

[Noc2]

Thanks for adding more details. The updated proposal looks good to me.