DTVMStack · ys8888john · Mar 2, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -53,3 +53,23 @@ All tests can be run via CTest. Make sure the build is up to date.
 
 - `ctest --test-dir build/debug --output-on-failure`
 - to filter tests use `-R <regex>`
+
+## Fuzzing
+
+The fuzzer compares an external EVMC-compatible VM against evmone (the reference).
+
+### Run fuzzer with seed corpus
+
+```bash
+EVMONE_EXTERNAL_OPTIONS=<path_to_external_vm.so> ./build/bin/evmone-fuzzer test/fuzzer/corpus/
+```
+
+### Reproduce a single crash file
+
+```bash
+EVMONE_EXTERNAL_OPTIONS=<path_to_external_vm.so> ./build/bin/evmone-fuzzer crash_files/<crash_file>
+```
+
+### Seed corpus
+
+The seed corpus lives in `test/fuzzer/corpus/`. Each seed file name describes the EVM opcodes it exercises (e.g. `seed_sstore_sload.bin`, `seed_call_return.bin`).
diff --git a/test/fuzzer/corpus/seed_add_mul_div.bin b/test/fuzzer/corpus/seed_add_mul_div.bin
diff --git a/test/fuzzer/corpus/seed_add_tangerine.bin b/test/fuzzer/corpus/seed_add_tangerine.bin
diff --git a/test/fuzzer/corpus/seed_addmod_mulmod.bin b/test/fuzzer/corpus/seed_addmod_mulmod.bin
diff --git a/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin b/test/fuzzer/corpus/seed_address_caller_origin_gasprice.bin
diff --git a/test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin b/test/fuzzer/corpus/seed_and_or_xor_shl_shr.bin
diff --git a/test/fuzzer/corpus/seed_blockhash.bin b/test/fuzzer/corpus/seed_blockhash.bin
diff --git a/test/fuzzer/corpus/seed_byte_swap.bin b/test/fuzzer/corpus/seed_byte_swap.bin
diff --git a/test/fuzzer/corpus/seed_call_return.bin b/test/fuzzer/corpus/seed_call_return.bin
diff --git a/test/fuzzer/corpus/seed_call_zero_all.bin b/test/fuzzer/corpus/seed_call_zero_all.bin
diff --git a/test/fuzzer/corpus/seed_call_zero_value.bin b/test/fuzzer/corpus/seed_call_zero_value.bin
diff --git a/test/fuzzer/corpus/seed_callcode.bin b/test/fuzzer/corpus/seed_callcode.bin
diff --git a/test/fuzzer/corpus/seed_calldataload_dispatcher.bin b/test/fuzzer/corpus/seed_calldataload_dispatcher.bin
diff --git a/test/fuzzer/corpus/seed_calldatasize_calldataload.bin b/test/fuzzer/corpus/seed_calldatasize_calldataload.bin
diff --git a/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin b/test/fuzzer/corpus/seed_callvalue_selfbalance_basefee.bin
diff --git a/test/fuzzer/corpus/seed_codesize_codecopy.bin b/test/fuzzer/corpus/seed_codesize_codecopy.bin
diff --git a/test/fuzzer/corpus/seed_difficulty_xor.bin b/test/fuzzer/corpus/seed_difficulty_xor.bin
diff --git a/test/fuzzer/corpus/seed_dup_swap_add.bin b/test/fuzzer/corpus/seed_dup_swap_add.bin
diff --git a/test/fuzzer/corpus/seed_empty_code.bin b/test/fuzzer/corpus/seed_empty_code.bin
diff --git a/test/fuzzer/corpus/seed_empty_large_input.bin b/test/fuzzer/corpus/seed_empty_large_input.bin
diff --git a/test/fuzzer/corpus/seed_exp.bin b/test/fuzzer/corpus/seed_exp.bin
diff --git a/test/fuzzer/corpus/seed_extcodecopy.bin b/test/fuzzer/corpus/seed_extcodecopy.bin
diff --git a/test/fuzzer/corpus/seed_extcodesize_extcodehash.bin b/test/fuzzer/corpus/seed_extcodesize_extcodehash.bin
diff --git a/test/fuzzer/corpus/seed_invalid_sload_sstore.bin b/test/fuzzer/corpus/seed_invalid_sload_sstore.bin
diff --git a/test/fuzzer/corpus/seed_invalid_with_input.bin b/test/fuzzer/corpus/seed_invalid_with_input.bin
diff --git a/test/fuzzer/corpus/seed_jumpi_jumpdest.bin b/test/fuzzer/corpus/seed_jumpi_jumpdest.bin
diff --git a/test/fuzzer/corpus/seed_loop_jumpdest.bin b/test/fuzzer/corpus/seed_loop_jumpdest.bin
diff --git a/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin b/test/fuzzer/corpus/seed_lt_gt_eq_iszero.bin
diff --git a/test/fuzzer/corpus/seed_mstore8_multi.bin b/test/fuzzer/corpus/seed_mstore8_multi.bin
diff --git a/test/fuzzer/corpus/seed_mstore8_storage.bin b/test/fuzzer/corpus/seed_mstore8_storage.bin
diff --git a/test/fuzzer/corpus/seed_mstore_large_offset.bin b/test/fuzzer/corpus/seed_mstore_large_offset.bin
diff --git a/test/fuzzer/corpus/seed_mstore_log0.bin b/test/fuzzer/corpus/seed_mstore_log0.bin
diff --git a/test/fuzzer/corpus/seed_mstore_log2.bin b/test/fuzzer/corpus/seed_mstore_log2.bin
diff --git a/test/fuzzer/corpus/seed_mstore_mload_chain.bin b/test/fuzzer/corpus/seed_mstore_mload_chain.bin
diff --git a/test/fuzzer/corpus/seed_mstore_mload_sstore.bin b/test/fuzzer/corpus/seed_mstore_mload_sstore.bin
diff --git a/test/fuzzer/corpus/seed_mstore_return_shanghai.bin b/test/fuzzer/corpus/seed_mstore_return_shanghai.bin
diff --git a/test/fuzzer/corpus/seed_mstore_return_simple.bin b/test/fuzzer/corpus/seed_mstore_return_simple.bin
diff --git a/test/fuzzer/corpus/seed_mstore_revert.bin b/test/fuzzer/corpus/seed_mstore_revert.bin
diff --git a/test/fuzzer/corpus/seed_mstore_sha3.bin b/test/fuzzer/corpus/seed_mstore_sha3.bin
diff --git a/test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin b/test/fuzzer/corpus/seed_number_coinbase_timestamp_gaslimit_chainid.bin
diff --git a/test/fuzzer/corpus/seed_pc_msize_gas.bin b/test/fuzzer/corpus/seed_pc_msize_gas.bin
diff --git a/test/fuzzer/corpus/seed_push0_mstore.bin b/test/fuzzer/corpus/seed_push0_mstore.bin
diff --git a/test/fuzzer/corpus/seed_push14_sload.bin b/test/fuzzer/corpus/seed_push14_sload.bin
diff --git a/test/fuzzer/corpus/seed_push17_with_input.bin b/test/fuzzer/corpus/seed_push17_with_input.bin
diff --git a/test/fuzzer/corpus/seed_signextend.bin b/test/fuzzer/corpus/seed_signextend.bin
diff --git a/test/fuzzer/corpus/seed_signextend_slt_sgt.bin b/test/fuzzer/corpus/seed_signextend_slt_sgt.bin
diff --git a/test/fuzzer/corpus/seed_signextend_swap_shr.bin b/test/fuzzer/corpus/seed_signextend_swap_shr.bin
diff --git a/test/fuzzer/corpus/seed_sstore_sload.bin b/test/fuzzer/corpus/seed_sstore_sload.bin
diff --git a/test/fuzzer/corpus/seed_sstore_sload_add.bin b/test/fuzzer/corpus/seed_sstore_sload_add.bin
diff --git a/test/fuzzer/corpus/seed_staticcall_cancun.bin b/test/fuzzer/corpus/seed_staticcall_cancun.bin
diff --git a/test/fuzzer/corpus/seed_staticcall_returndatacopy.bin b/test/fuzzer/corpus/seed_staticcall_returndatacopy.bin