fuzz-tests: verify round‑trip scriptpubkey <-> addr conversion
What the developer wrote
Authored by Chandra Pratap
fuzz-tests: verify round‑trip scriptpubkey <-> addr conversion
Changelog-None: Currently, fuzz-addr only tests encoding via
encode_scriptpubkey_to_addr(), without checking decoding. Add a
round‑trip assertion: if encoding produces an address, decode
it back with decode_scriptpubkey_from_addr() and confirm the
result matches the original scriptpubkey.
What changed, and why it matters
This commit adds a new check inside an existing automated test (a fuzz test) for Core Lightning. It makes sure that when the software converts a Bitcoin script into a human-readable address and then converts that address back, the result matches the original script. It does not change any production code, user-facing behavior, or network handling. It is purely a stronger test case.
No action required. This is a test-only improvement. Reviewers may optionally run the fuzz target to confirm the new assertion does not trigger false positives.
Security signals we found
No production code modified
No input validation, parsing, or cryptographic logic changed
No memory-unsafe code added beyond standard assertions
No network, RPC, or wallet code touched
No changelog or security note from vendor
Evidence from the diff
The change is in tests/fuzz/fuzz-addr.c. Previously the fuzz target only called encode_scriptpubkey_to_addr() on arbitrary input. Now it also calls decode_scriptpubkey_from_addr() on any produced address and asserts the decoded scriptPubKey equals the original. This is a round-trip correctness assertion added to a fuzz harness. No library or runtime logic is modified.
Changed components
tests/fuzz/fuzz-addr.cInspect captured patch +7 / −1
diff --git a/tests/fuzz/fuzz-addr.c b/tests/fuzz/fuzz-addr.c
index e31088f5..be933c01 100644
--- a/tests/fuzz/fuzz-addr.c
+++ b/tests/fuzz/fuzz-addr.c
@@ -3,6 +3,7 @@
#include <common/addr.h>
#include <common/setup.h>
#include <common/utils.h>
+#include <assert.h>
#include <tests/fuzz/libfuzz.h>
void init(int *argc, char ***argv)
@@ -15,7 +16,12 @@ void run(const uint8_t *data, size_t size)
{
uint8_t *script_pubkey = tal_dup_arr(tmpctx, uint8_t, data, size, 0);
- encode_scriptpubkey_to_addr(tmpctx, chainparams, script_pubkey);
+ char *addr = encode_scriptpubkey_to_addr(tmpctx, chainparams, script_pubkey);
+ if (addr) {
+ uint8_t *decoded_script_pubkey;
+ assert(decode_scriptpubkey_from_addr(tmpctx, chainparams, addr, &decoded_script_pubkey));
+ assert(tal_arr_eq(script_pubkey, decoded_script_pubkey));
+ }
clean_tmpctx();
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.