fuzz: add target for wallet receive #34333

1. 
   b-l-u-e commented at 7:38 pm on January 18, 2026: contributor

   Tracking issue (https://github.com/bitcoin/bitcoin/issues/29901)

   This adds a fuzz target for wallet receive

   here is the coverage was able to gather for wallet receive target

   File	Regions	Lines	Branches
   src/wallet/receive.cpp	94.92%	97.10%	88.12%
   src/wallet/test/fuzz/receive.cpp	93.50%	94.86%	89.80%
   src/wallet/walletutil.h	57.89%	33.33%	0.00%
   src/wallet/wallet.h	30.85%	38.78%	13.89%
   src/wallet/transaction.h	31.40%	28.66%	14.29%
   src/wallet/test/util.h	38.46%	26.09%	-
   src/wallet/db.h	33.33%	37.14%	0.00%
   src/wallet/scriptpubkeyman.h	18.75%	17.39%	-
   src/wallet/walletdb.h	15.62%	11.86%	10.00%
   src/wallet/test/util.cpp	10.13%	7.95%	11.76%
   src/wallet/scriptpubkeyman.cpp	12.51%	10.29%	6.30%
   src/wallet/wallet.cpp	8.79%	8.87%	5.52%
   src/wallet/walletdb.cpp	3.86%	3.63%	3.10%
   src/wallet/transaction.cpp	5.00%	7.32%	0.00%

2. DrahtBot added the label Fuzzing on Jan 18, 2026
3. 
   DrahtBot commented at 7:38 pm on January 18, 2026: contributor

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/34333.

   Reviews

   See the guideline for information on the review process.

   Type	Reviewers
   Approach NACK	brunoerg

   If your review is incorrectly listed, please copy-paste <!–meta-tag:bot-skip–> into the comment that the bot should ignore.

   Conflicts

   Reviewers, this pull request conflicts with the following ones:

   • #32993 (fuzz: wallet: add target for tx scanning by brunoerg)

   If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

   LLM Linter (✨ experimental)

   Possible places where named args for integral literals may be used (e.g. func(x, /*named_arg=*/0) in C++, and func(x, named_arg=0) in Python):

   • TxStateConfirmed{chainstate.m_chain.Tip()->GetBlockHash(), chainstate.m_chain.Height(), 0} in src/wallet/test/fuzz/receive.cpp

   2026-02-16 11:58:13

4. b-l-u-e force-pushed on Jan 18, 2026
5. b-l-u-e marked this as a draft on Jan 22, 2026
6. b-l-u-e renamed this:
   fuzz:wallet: add target for wallet receive
   fuzz: add target for wallet receive
   on Feb 16, 2026
7. fuzz: add target for wallet receive

   Signed-off-by: b-l-u-e <winnie.gitau282@gmail.com>

   a81d0a7546
8. b-l-u-e force-pushed on Feb 16, 2026
9. b-l-u-e marked this as ready for review on Feb 17, 2026
10. sedited requested review from brunoerg on Mar 19, 2026
11. sedited requested review from marcofleon on Mar 19, 2026
12. 
    brunoerg commented at 6:52 pm on March 19, 2026: contributor

    Concept ACK - will review it tomorrow.
13. in src/wallet/test/fuzz/receive.cpp:149 in a81d0a7546

    144+
    145+    LOCK(fuzzed_wallet.wallet->cs_wallet);
    146+
    147+    for (auto* wtx : wallet_txs) {
    148+        for (const auto& txin : wtx->tx->vin) {
    149+            [[maybe_unused]] bool is_mine = InputIsMine(*fuzzed_wallet.wallet, txin);
    

    ---

    ---

    

    brunoerg commented at 11:51 am on March 20, 2026:

    Here and any other similar place:

    0            (void)InputIsMine(*fuzzed_wallet.wallet, txin);
    

14. 
    brunoerg commented at 12:04 pm on March 20, 2026: contributor

    Approach NACK

    Sorry, but this target has many “red flags” on its design, that would need a complete rework, won’t spend time mentioning every single point but will highlight some of them.

    First, if you run the target you would notice that the performance is really bad - under 20 exec/s on a decent machine. Some points:

    1. For every new transaction added to the wallet, the harness re-iterates all previous wallet_txs to call IsMine() on every output.
    2. Every receive function is tested in its own for (auto* wtx : wallet_txs) loop , I don’t like it, it’s costly.
    3. GetAddressBalances and GetAddressGroupings are always called. These calls are VERY expensive.
    4. I mentioned it in other similar PR but I don’t like catch (const std::runtime_error&) {} blocks with no explanation of what’s expected to throw and why. In a fuzz target this masks issues.
15. 
    b-l-u-e commented at 1:59 pm on March 20, 2026: contributor

    Thank you for your feedback .. I will adjust to the changes

Contributors
b-l-u-e DrahtBot brunoerg

Review Requested
marcofleon

Labels
Fuzzing