Canfuzz Launches to Help Developers Find Vulnerabilities in Internet Computer Canisters

A new open-source framework is making it easier for developers to identify and address vulnerabilities in Internet Computer (ICP) canisters. Canfuzz, built by the team behind canister_fuzzing, combines automated coverage-guided fuzzing with a lightweight ICP emulator to provide targeted testing for WebAssembly-based smart contracts.

Fuzzing is a method of testing software by supplying unexpected or random inputs to uncover bugs. While traditional fuzzers work well for standard programs, ICP canisters present challenges due to their stateful nature and the WebAssembly sandbox environment. Canfuzz aims to bridge this gap by instrumenting compiled Wasm binaries to track branch coverage and generate inputs that explore new code paths.

The framework integrates LibAFL, a tool for scalable fuzzing, with PocketIC, an ICP emulator, allowing developers to test canisters without modifying the original source code. When a crash or violation occurs, Canfuzz records the input responsible, enabling precise debugging and reproducing errors.

Getting started is straightforward for Rust developers. After adding the Canfuzz crate to a project, users can define a fuzzer orchestrator to manage the testing environment and specify which canister methods to call. The framework then runs the fuzzer, producing a dashboard of interesting inputs and detected crashes.

By offering a specialised approach for ICP canisters, Canfuzz provides developers with a practical tool to strengthen security, improve code quality and reduce vulnerabilities in applications built on the Internet Computer.

The Canfuzz repository and documentation are available on GitHub, and the crate can be found on Crates.io.