Add Absolution-based fuzzing by N3ur0sis · Pull Request #1059 · LedgerHQ/app-ethereum

N3ur0sis · 2026-06-15T13:39:44Z

Description

This PR integrates the SDK's Absolution-based, state-aware fuzzing framework into the Ethereum app, the app ships three targets: fuzz_app drives a sequence of APDUs through the real apdu_parser() → handleApdu() path; fuzz_plugin drives one internal plugin through the production eth_plugin_call() sequence; fuzz_parser drives the generic tx parser, EIP-712 and the calldata store at their own entry points. The latter two exist because the APDU path structurally cannot reach that code. All three go through the framework contract, so they inherit the prefix-aware mutator and the lane split.

Input is [ prefix | tail ]: the prefix restores globals to a target state via the declarative Absolution model, the tail drives the harness. Sequences matter because tlv_from_apdu() accumulates a descriptor across APDUs and one APDU carries at most 253 bytes — a single dispatch can never complete a descriptor carrying a signature.

Changes include

Bugfix (non-breaking change that solves an issue)
New feature (non-breaking change that adds functionality)
Breaking change (change that is not backwards-compatible and/or changes current functionality)
Tests
Documentation
Other (for changes that might not fit in any category)

codecov-commenter · 2026-06-15T13:42:08Z

Codecov Report

❌ Patch coverage is 34.53815% with 163 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.48%. Comparing base (6cead6c) to head (14fd424).

Files with missing lines	Patch %	Lines
src/handle_apdu.c	4.71%	101 Missing ⚠️
src/app_context.c	43.13%	29 Missing ⚠️
src/utils/utils.c	50.00%	3 Missing and 2 partials ⚠️
...eatures/generic_tx_parser/gtp_param_token_amount.c	63.63%	2 Missing and 2 partials ⚠️
src/features/generic_tx_parser/gtp_field.c	62.50%	3 Missing ⚠️
src/features/generic_tx_parser/gtp_param_token.c	57.14%	1 Missing and 2 partials ⚠️
src/features/generic_tx_parser/gtp_param_unit.c	25.00%	1 Missing and 2 partials ⚠️
src/features/sign_message/cmd_sign_message.c	72.72%	3 Missing ⚠️
src/features/generic_tx_parser/gtp_param_raw.c	75.00%	2 Missing ⚠️
...eatures/generic_tx_parser/gtp_param_trusted_name.c	75.00%	2 Missing ⚠️
... and 5 more

Additional details and impacted files

@@             Coverage Diff              @@
##           develop    #1059       +/-   ##
============================================
- Coverage    88.00%   59.48%   -28.52%     
============================================
  Files          136      162       +26     
  Lines         9786    14540     +4754     
  Branches      1612     3476     +1864     
============================================
+ Hits          8612     8649       +37     
- Misses         990     5703     +4713     
- Partials       184      188        +4

Flag	Coverage Δ
functionaltests	`81.73% <77.08%> (+0.03%)`	⬆️
fuzzing	`0.00% <0.00%> (?)`
unittests	`86.81% <33.33%> (-0.65%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-06-15T13:42:14Z

elf sizes
source = source branch aro/fuzzing-framework
target = target branch develop

Device	.text source	.text target	.text delta	.bss source	.bss target	max stack size source	max stack size target
nanox	124771	127587	-2816	21964	21964	8192	8192
stax	191230	194302	-3072	23252	23252	13604	13604
apex_p	170137	173209	-3072	23252	23252	17700	17700
nanos2	125027	127075	-2048	21948	21948	19004	19004
flex	191309	194381	-3072	23252	23252	13604	13604

Stack consumption summary (clone_app_stack_consumption)

⚠️ This summary is for informative purpose only. It may not give the application actual worst case, for example if the test coverage is low.

Device	Worst case (bytes)	Remaining stack (bytes)	Test
apex_p	2833	37943	`test_clone.py::test_clone_thundercore_tx[apex_p]`
flex	2881	33799	`test_clone.py::test_clone_thundercore_tx[flex]`
nanosp	2705	38071	`test_clone.py::test_clone_thundercore_tx[nanosp]`
nanox	2697	25791	`test_clone.py::test_clone_thundercore_tx[nanox]`
stax	2881	33799	`test_clone.py::test_clone_thundercore_tx[stax]`

Full details

Stack consumption summary

⚠️ This summary is for informative purpose only. It may not give the application actual worst case, for example if the test coverage is low.

Device	Worst case (bytes)	Remaining stack (bytes)	Test
apex_p	5805	11895	`test_gcs_formatters.py::test_gcs_group_sequential[apex_p]`
flex	5805	7799	`test_gcs_formatters.py::test_gcs_group_sequential[flex]`
nanosp	5813	13191	`test_gcs_formatters.py::test_gcs_group_sequential[nanosp]`
nanox	5817	883	`test_gcs_formatters.py::test_gcs_group_sequential[nanox]`
stax	5805	7799	`test_gcs_formatters.py::test_gcs_group_sequential[stax]`

Full details

github-code-quality · 2026-06-15T13:42:18Z

Code Coverage Overview

Languages: C

C / code-coverage/unittests

The overall coverage in commit 14fd424 in the aro/fuzzing-framewor... branch is 93%. Coverage data for the develop branch is not yet available.

Show a code coverage summary of the most covered files.

File	`develop`	`aro/fuzzing-framewor...` 14fd424	+/-
`src/uint256.c`	—	100%	—
`src/plugins/eth...lugin_handler.c`	—	97%	—
`src/features/ge...ser/gtp_field.c`	—	95%	—
`src/features/ge...gtp_param_raw.c`	—	95%	—
`src/features/si...x/eth_ustream.c`	—	94%	—
`src/features/pr.../trusted_name.c`	—	90%	—
`src/features/pr...md_get_gating.c`	—	90%	—
`src/features/ge...gtp_data_path.c`	—	89%	—
`src/features/pr...tx_simulation.c`	—	89%	—
`src/features/si...logic_sign_tx.c`	—	83%	—

_{Updated August 13, 2026 08:47 UTC}

ledger-wiz-cspm-secret-detection · 2026-07-20T09:55:12Z

Wiz Scan Summary

Scanner	Findings
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1 1
SAST Findings	-
Software Management Findings	-

Total	1 1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Found by the fuzzing harness added in this PR: - NULL source passed to memcpy() when an EIP-712 struct-impl APDU or a zero-length typed-data leaf carries no payload, which apdu_parser() reports as a NULL data pointer whenever Lc is 0 - missing bounds and NULL checks across the generic tx parser fields - zero-length copies while streaming a personal message - out-of-range integer conversions in the signature parity byte and the ETH2 public-key status word

github-actions · 2026-08-13T08:47:15Z

Code coverage report

Per-file coverage

Package	Line Rate	Branch Rate	Health
src	99%	98%	✔
src.features.generic_tx_parser	93%	81%	✔
src.features.get_app_configuration	100%	100%	✔
src.features.get_challenge	100%	100%	✔
src.features.get_eth2_public_key	100%	96%	✔
src.features.get_public_key	100%	100%	✔
src.features.perform_privacy_operation	100%	87%	✔
src.features.provide_enum_value	96%	87%	✔
src.features.provide_erc20_token_information	94%	88%	✔
src.features.provide_gating	90%	83%	✔
src.features.provide_map_entry	93%	76%	✔
src.features.provide_network_info	90%	82%	✔
src.features.provide_nft_information	91%	80%	✔
src.features.provide_proxy_info	97%	89%	✔
src.features.provide_safe_account	95%	88%	✔
src.features.provide_trusted_name	90%	82%	✔
src.features.provide_tx_simulation	89%	85%	✔
src.features.set_eth2_withdrawal_index	100%	100%	✔
src.features.set_external_plugin	86%	72%	✔
src.features.set_plugin	95%	90%	✔
src.features.sign_authorization_eip7702	87%	79%	✔
src.features.sign_message	89%	76%	✔
src.features.sign_tx	89%	79%	✔
src.nbgl	97%	87%	✔
src.plugins.eip7002	95%	86%	✔
src.plugins.eip7251	97%	86%	✔
src.plugins.erc1155	91%	81%	✔
src.plugins.erc20	91%	86%	✔
src.plugins.erc721	93%	86%	✔
src.plugins.eth2	94%	89%	✔
src.plugins	97%	91%	✔
src.plugins.swap_with_calldata	98%	94%	✔
src.swap	96%	93%	✔
src.utils	92%	88%	✔
Summary	93% (6866 / 7395)	84% (3351 / 3993)	✔

N3ur0sis force-pushed the aro/fuzzing-framework branch 4 times, most recently from 69e1276 to 9bbddb3 Compare June 17, 2026 10:13

N3ur0sis changed the title ~~Aro/fuzzing framework~~ Add Absolution-based fuzzing Jun 17, 2026

N3ur0sis marked this pull request as ready for review June 22, 2026 09:06

N3ur0sis requested a review from a team as a code owner June 22, 2026 09:06

bboilot-ledger requested changes Jun 22, 2026

View reviewed changes

Comment thread tests/fuzzing/mock/mocks.c Outdated

Comment thread tests/fuzzing/src/fuzz_handle_apdu.c Outdated

Comment thread tests/fuzzing/src/fuzz_command_registry.inc Outdated

N3ur0sis force-pushed the aro/fuzzing-framework branch 4 times, most recently from 9bbe16e to cc2242c Compare June 29, 2026 11:42

N3ur0sis force-pushed the aro/fuzzing-framework branch 2 times, most recently from b96f763 to d605851 Compare July 7, 2026 09:02

bboilot-ledger requested a review from cedelavergne-ledger July 7, 2026 09:25

cedelavergne-ledger reviewed Jul 7, 2026

View reviewed changes

N3ur0sis force-pushed the aro/fuzzing-framework branch from 67ef1d0 to b137628 Compare July 9, 2026 14:42

N3ur0sis requested a review from cedelavergne-ledger July 9, 2026 15:01

N3ur0sis force-pushed the aro/fuzzing-framework branch from b137628 to 8ef88da Compare July 20, 2026 09:52

cedelavergne-ledger reviewed Jul 27, 2026

View reviewed changes

N3ur0sis force-pushed the aro/fuzzing-framework branch 2 times, most recently from 1b58caf to 6ba3cdc Compare August 12, 2026 09:02

N3ur0sis added 3 commits August 12, 2026 11:47

refactor(eth): extract APDU dispatch and app context from main.c

cf0148c

refactor(eth): drop the fuzz-only ifdefs from the UI code

9bbd0b0

N3ur0sis force-pushed the aro/fuzzing-framework branch from 6ba3cdc to 7bb89c5 Compare August 12, 2026 10:15

cedelavergne-ledger reviewed Aug 12, 2026

View reviewed changes

Comment thread tests/fuzzing/mock/mocks.c Outdated

Comment thread tests/fuzzing/CMakeLists.txt

Comment thread tests/fuzzing/README.md

N3ur0sis force-pushed the aro/fuzzing-framework branch 2 times, most recently from 688ba56 to e9621f9 Compare August 12, 2026 13:00

test(fuzzing): add the Absolution-based fuzzing framework

14fd424

N3ur0sis force-pushed the aro/fuzzing-framework branch from e9621f9 to 14fd424 Compare August 13, 2026 08:44

cedelavergne-ledger approved these changes Aug 13, 2026

View reviewed changes

bboilot-ledger self-requested a review August 13, 2026 09:26

bboilot-ledger approved these changes Aug 13, 2026

View reviewed changes

N3ur0sis merged commit 5cda885 into develop Aug 13, 2026
321 checks passed

N3ur0sis deleted the aro/fuzzing-framework branch August 13, 2026 09:28

Uh oh!

Conversation

N3ur0sis commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes include

Uh oh!

codecov-commenter commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-code-quality Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

C / code-coverage/unittests

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ledger-wiz-cspm-secret-detection Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026

Code coverage report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

N3ur0sis commented Jun 15, 2026 •

edited

Loading

codecov-commenter commented Jun 15, 2026 •

edited

Loading

github-actions Bot commented Jun 15, 2026 •

edited

Loading

github-code-quality Bot commented Jun 15, 2026 •

edited

Loading

ledger-wiz-cspm-secret-detection Bot commented Jul 20, 2026 •

edited

Loading