fuzzing-patterns

Fuzz Testing Patterns

Stateless vs Stateful Fuzzing

Stateless = function testFuzz_*(uint256 x) — Foundry randomizes x each run. Stateful = invariant tests with handlers (see invariant-testing skill).

Basic Fuzz Test

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Test} from "forge-std/Test.sol";
import {Vault} from "../src/Vault.sol";

contract VaultFuzzTest is Test {
    Vault vault;

    function setUp() public {
        vault = new Vault(address(token));
        deal(address(token), address(this), type(uint128).max);
        token.approve(address(vault), type(uint256).max);
    }

    // Property: deposit then redeem never yields more than deposited
    function testFuzz_depositRedeemNoProfit(uint256 assets) public {
        assets = bound(assets, 1, type(uint128).max);

        uint256 shares = vault.deposit(assets, address(this));
        uint256 received = vault.redeem(shares, address(this), address(this));

        assertLe(received, assets, "profit from round-trip");
    }

    // Property: transfer preserves total supply
    function testFuzz_transferPreservesSupply(
        address to,
        uint256 mintAmount,
        uint256 transferAmount
    ) public {
        vm.assume(to != address(0) && to != address(this));
        mintAmount = bound(mintAmount, 1, type(uint128).max);
        transferAmount = bound(transferAmount, 0, mintAmount);

        vault.deposit(mintAmount, address(this));
        uint256 supplyBefore = vault.totalSupply();

        vault.transfer(to, transferAmount);
        uint256 supplyAfter = vault.totalSupply();

        assertEq(supplyBefore, supplyAfter, "supply changed on transfer");
    }
}

Input Constraining

bound() vs vm.assume()