Alternative to the mocking of CheckProofOfWork
in #28043 for avoiding fuzzers to be blocked on proof-of-work checks.
More on FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
: https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode
Alternative to the mocking of CheckProofOfWork
in #28043 for avoiding fuzzers to be blocked on proof-of-work checks.
More on FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
: https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode
Unless we are fuzzing `CheckProofOfWork` itself, it makes little sense
to have it be a blocker when fuzzing. We therefore use
`FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` (only defined for fuzz builds
by e.g. clang with -fsanitize=fuzzer, afl-clang-lto, etc.) to replace
the actual proof-of-work checks with checking if the first bit on
`nNonce` is set. This allows the fuzzer to create PoW (in)valid blocks
by controling that one bit instead of having to grind for actual PoW.
Checking for a bit in `nNonce` is preferable over checking for a bit in
the block hash as `nNonce` is chosen by the fuzzer and when whole chains
of blocks are created during fuzzing a change in an old block won't
invalidate the fake PoW on newer blocks.
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
For detailed information about the code coverage, see the test coverage report.
See the guideline for information on the review process. A summary of reviews will appear here.
-fsanitize=fuzzer
does actually not define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
by default.