fuzz: Extend `spend` coverage #34264

Chand-ra · 2026-01-12T15:12:26Z

Make the wallet/spend fuzz target stateful and extend coverage for several missing methods.

Update the `wallet_create_transaction` fuzz target to move the transaction creation logic inside a `CallOneOf` block. This refactoring is a structural preparation for stateful fuzzing, allowing commits to easily add and interleave other wallet operations within the same loop.

Move the `CCoinControl` parameter configuration inside the fuzzing loop to allow mutation of settings between operations. Additionally, introduce logic to randomly `Select` or `UnSelect` specific available outpoints within `coin_control`. This allows the fuzzer to simulate scenarios where a user manually mandates specific inputs.

DrahtBot · 2026-01-12T15:12:33Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/34264.

Reviews

See the guideline for information on the review process.
A summary of reviews will appear here.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#34032 (util: Add some more Unexpected and Expected methods by maflcko)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

DrahtBot · 2026-01-12T17:24:43Z

🚧 At least one of the CI tasks failed.
_{Task tidy: https://github.com/bitcoin/bitcoin/actions/runs/20924396327/job/60120935082}
_{LLM reason (✨ experimental): CI failure due to clang-tidy errors in spend.cpp (unnecessary temporary object in emplace_back and unused-return-value).}

Hints

Try to run the tests locally, according to the documentation. However, a CI failure may still
happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being
incompatible with the current code in the target branch). If so, make sure to rebase on the latest
commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the
affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

brunoerg · 2026-01-12T18:30:46Z

From CI:

[515/729][5.2s] clang-tidy-21 -p=/home/admin/actions-runner/_work/_temp/build -quiet -load=/tidy-build/libbitcoin-tidy.so /home/admin/actions-runner/_work/_temp/src/test/fuzz/block_index_tree.cpp
1126 warnings generated.
+ echo '^^^ ⚠️ Failure generated from clang-tidy'
+ false

[516/729][8.1s] clang-tidy-21 -p=/home/admin/actions-runner/_work/_temp/build -quiet -load=/tidy-build/libbitcoin-tidy.so /home/admin/actions-runner/_work/_temp/src/wallet/test/fuzz/spend.cpp
/home/admin/actions-runner/_work/_temp/src/wallet/test/fuzz/spend.cpp:125:41: error: unnecessary temporary object created while calling emplace_back [modernize-use-emplace,-warnings-as-errors]
  125 |                     tx.vin.emplace_back(CTxIn(out));
      |                                         ^~~~~~   ~
/home/admin/actions-runner/_work/_temp/src/wallet/test/fuzz/spend.cpp:152:23: error: the value returned by this function should not be disregarded; neglecting it may lead to errors [bugprone-unused-return-value,-warnings-as-errors]
  152 |                 (void)FundTransaction(*fuzzed_wallet.wallet, tx, recipients, change_pos, lockUnspents, coin_control);
      |                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2392 warnings generated.

[517/729][3.6s] clang-tidy-21 -p=/home/admin/actions-runner/_work/_temp/build -quiet -load=/tidy-build/libbitcoin-tidy.so /home/admin/actions-runner/_work/_temp/src/qt/bitcoinaddressvalidator.cpp
^^^ ⚠️ Failure generated from clang-tidy
Command '['docker', 'exec', '88e904189f27a153218451cb9cc2cf6a3600de9821f8b631509e657c4e1d73df', '/home/admin/actions-runner/_work/_temp/ci/test/03_test_script.sh']' returned non-zero exit status 1.

frankomosh

I think that the variables int next_locktime and CAmount all_values become dead code after you’ve refactored?
Also some inline nits below.

frankomosh · 2026-01-13T07:32:20Z

src/wallet/test/fuzz/spend.cpp

+                int num_inputs = fuzzed_data_provider.ConsumeIntegralInRange<int>(0, available_outpoints.size());
+                for (int i = 0; i < num_inputs; i++) {
+                    auto out = PickValue(fuzzed_data_provider, available_outpoints);
+                    tx.vin.emplace_back(CTxIn(out));


Could simplify to tx.vin.emplace_back(out)

frankomosh · 2026-01-13T07:48:35Z

src/wallet/test/fuzz/spend.cpp

+                if (fuzzed_data_provider.ConsumeBool()) change_pos = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+                bool lockUnspents = fuzzed_data_provider.ConsumeBool();
+
+                (void)FundTransaction(*fuzzed_wallet.wallet, tx, recipients, change_pos, lockUnspents, coin_control);


Also, should FundTransaction have wallet lock protection i.e wrap it in LOCK(fuzzed_wallet.wallet -> cs_wallet), as has been done in ListCoins ?

Not really, FundTransaction() doesn't require an exclusive lock unlike ListCoins() does.

frankomosh · 2026-01-13T08:08:12Z

src/wallet/test/fuzz/spend.cpp

+                    tx.vin.emplace_back(CTxIn(out));
+                }
+                std::vector<CRecipient> recipients;
+                LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 50) {


I notice that this logic appears twice. Would it make sense to extract it into a lambda helper at the top of the function?

Chand-ra · 2026-01-13T15:48:20Z

I think that the variables int next_locktime and CAmount all_values become dead code after you’ve refactored? Also some inline nits below.

I believe next_locktime and all_values are still necessary in the setup loop. next_locktime ensures that we generate unique TXIDs and all_values is used to enforce the MAX_MONEY cap so we don't overflow the wallet balance during setup.

Extend the target to cover `FundTransaction()`.

Extend the fuzz target to cover `ListCoins()`.

Chandra Pratap added 2 commits January 12, 2026 15:10

DrahtBot added the Fuzzing label Jan 12, 2026

DrahtBot added the CI failed label Jan 12, 2026

DrahtBot mentioned this pull request Jan 13, 2026

util: Add some more Unexpected and Expected methods #34032

Open

frankomosh reviewed Jan 13, 2026

View reviewed changes

Chandra Pratap added 2 commits January 13, 2026 16:08

fuzz: Add coverage for FundTransaction()

80b4cf2

Extend the target to cover `FundTransaction()`.

fuzz: Add coverage for ListCoins()

6242b12

Extend the fuzz target to cover `ListCoins()`.

Chand-ra force-pushed the spend branch from e3619a3 to 6242b12 Compare January 13, 2026 16:11

DrahtBot removed the CI failed label Jan 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fuzz: Extend `spend` coverage #34264

fuzz: Extend `spend` coverage #34264

Chand-ra commented Jan 12, 2026

Uh oh!

DrahtBot commented Jan 12, 2026 •

edited

Loading

Uh oh!

DrahtBot commented Jan 12, 2026

Uh oh!

brunoerg commented Jan 12, 2026

Uh oh!

frankomosh left a comment

Uh oh!

frankomosh Jan 13, 2026

Uh oh!

frankomosh Jan 13, 2026

Uh oh!

Chand-ra Jan 13, 2026 •

edited

Loading

Uh oh!

frankomosh Jan 13, 2026

Uh oh!

Chand-ra commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fuzz: Extend spend coverage #34264

Are you sure you want to change the base?

fuzz: Extend spend coverage #34264

Conversation

Chand-ra commented Jan 12, 2026

Uh oh!

DrahtBot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage & Benchmarks

Reviews

Conflicts

Uh oh!

DrahtBot commented Jan 12, 2026

Uh oh!

brunoerg commented Jan 12, 2026

Uh oh!

frankomosh left a comment

Choose a reason for hiding this comment

Uh oh!

frankomosh Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

frankomosh Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Chand-ra Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

frankomosh Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Chand-ra commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fuzz: Extend `spend` coverage #34264

fuzz: Extend `spend` coverage #34264

DrahtBot commented Jan 12, 2026 •

edited

Loading

Chand-ra Jan 13, 2026 •

edited

Loading