Differential Fuzzing on Lightning Network
summary
Framework bitcoin-fuzz uses libFuzzer with coverage instrumentation to run differential fuzzing across LND, Core Lightning, rust-lightning, eclair and Lightning KMP, sending mutated Bolt11 invoice inputs (with a custom bech32-aware mutator) and comparing parsed outputs. It finds semantic divergences and memory bugs: over 30 total discrepancies so far, including 15+ bugs in Lightning implementations — e.g. signature verification differences (low/high S vs recovery), malformed pubkey acceptance, and an unbounded TLV length allocation in a Kotlin library.
AI-written summary · about
chapters (11)
- 0:00Differential fuzzing on Lightning
- 1:06Why implementations diverge
- 4:14What is fuzzing
- 7:25Fuzzing overflow bug
- 12:12Differential fuzzing explained
- 15:50Bitcoin Fuzz overview
- 18:45Building fuzzing target
- 22:46Real-world demo
- 24:51Bugs in Lightning
- 28:30Contributing to Bitcoin Fuzz
- 30:22Q&A
related talks
21mModern Testing and Fuzzing in Bitcoin Core
46mLightning Security Panel
05mLightning Talk: Securing Envoy: Catching Vulnerabilities With Continuous Fuzz Testing
15mFinding Consensus Bugs in Ethereum via Multi-transaction Differential Fuzzing
01h 15mMake your programs more reliable with Fuzzing
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
39mMaking Fuzzing Part of Your Software Development Lifecycle
53mFuzz Testing for Fun and Profit