Fuzzing Tool

WHAT IT DOES

Fuzzing Tool automatically generates random inputs for your contract's view and pure functions and simulates them to find edge cases, unexpected reverts, and potential vulnerabilities. Enter a contract address and its ABI, and the tool will call each view/pure function multiple times with randomly generated values for all parameter types—addresses, integers, booleans, strings, and bytes. It then reports which calls passed and which failed (reverted), giving you a quick way to discover boundary conditions, invalid inputs, and surprising behavior. This is essential for developers wanting to test contract robustness, auditors exploring attack surfaces, or anyone doing quality assurance on smart contracts.

HOW TO USE

Connect your EVM wallet (optional—the tool works read-only). Select the network from the dropdown. Enter the contract address (0x…42) and paste the contract ABI as a JSON array. Set the number of fuzzing iterations per function (default 10, max 50). Click "start fuzzing" to begin. The tool automatically identifies all view and pure functions in the ABI, generates random inputs for each, simulates the calls using provider.call(), and records whether each call passed or failed (reverted). The results display a summary with total calls, pass/fail counts, and a detailed table of the last 20 test cases showing the function name, input parameters, and result or revert reason.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 via the BGWallet provider. It parses the ABI into an ethers.utils.Interface and filters for functions with stateMutability of 'view' or 'pure' (or constant flag). For each function, it generates random values for each input parameter based on the Solidity type: addresses (random hex), uints/ints (random numbers up to a safe limit), booleans (random true/false), strings (random alphanumeric strings), and bytes (random hex). It encodes each call using interface.encodeFunctionData() and simulates it with provider.call(). Results are decoded using interface.decodeFunctionResult(). The tool tracks passes and failures, and reports reverts with the reason string if available.

WHAT IT CANNOT SEE

This tool cannot perform deep stateful fuzzing across multiple transactions—each call is independent and does not build on previous state. It cannot detect logic flaws that require specific sequences of calls or interactions between functions. It cannot generate inputs for complex nested types (arrays of structs, nested arrays) or custom structs beyond basic types. It cannot test state-changing functions (non-view/pure) without sending actual transactions. It cannot detect vulnerabilities that only appear in a specific contract state. It cannot simulate with different msg.sender values. The tool is limited by the accuracy of the provided ABI and the completeness of the simulation environment. A passing result does not guarantee the function is secure.

PLEASE NOTE

Works exclusively on EVM-compatible chains: Ethereum Mainnet, Goerli, Sepolia, Polygon, Arbitrum, and Optimism. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. This is a read-only, free fuzzing tool—use it for initial contract testing and to discover edge cases. For comprehensive fuzzing, consider stateful fuzzing frameworks that can chain multiple transactions and track state changes. Always combine with manual review and professional auditing for production contracts.