BitcoinFuzz: Differential Fuzzing of Bitcoin and Lightning Network Implementations
Resumo
Bitcoin and the Lightning Network are critical financial infrastructure supported by multiple independent implementations. When these implementations diverge in behavior, the consequences can range from network splits to loss of funds. This paper presents BitcoinFuzz, a differential fuzzing framework designed to uncover behavioral inconsistencies across Bitcoin and Lightning Network implementations. We describe the motivation, methodology, key challenges encountered in practice, and results - including over 60 bugs found across multiple projects. Our experience reveals not only implementation bugs but also gaps in protocol specifications themselves, offering lessons for the broader open-source and software engineering community.
Palavras-chave:
Fuzzing, Differential Fuzzing, Bitcoin, Blockchain, Software Testing
Referências
Lukas Bernhard, Tobias Scharnowski, Moritz Schloegel, Tim Blazytko, and Thorsten Holz. 2022. JIT-Picking: Differential Fuzzing of JavaScript Engines. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA) (CCS ’22). Association for Computing Machinery, New York, NY, USA, 351–364. DOI: 10.1145/3548606.3560624
Bitcoin Developers. 2026. Bitcoin Improvement Proposals (BIPs). [link]. Accessed: 2026-06-05.
Alex Groce, Kush Jain, Rijnard van Tonder, Goutamkumar Tulajappa Kalburgi, and Claire Le Goues. 2022. Looking for Lacunae in Bitcoin Core’s Fuzzing Efforts. In Proceedings of the 44th International Conference on Software Engineering: Software Engineering in Practice (Pittsburgh, Pennsylvania) (ICSE-SEIP ’22). Association for Computing Machinery, New York, NY, USA, 185–186. DOI: 10.1145/3510457.3513072
Hoyong Jin, Dohyeon An, and Taekyoung Kwon. 2023. Differential Testing of Cryptographic Libraries with Hybrid Fuzzing. In Information Security and Cryptology – ICISC 2022, Seung-Hyun Seo and Hwajeong Seo (Eds.). Springer Nature Switzerland, Cham, 124–144.
Joseph Poon and Thaddeus Dryja. 2016. The bitcoin lightning network: Scalable off-chain instant payments.
Alessandro Sorniotti, Michael Weissbacher, and Anil Kurmus. 2023. Go or no go: Differential fuzzing of native and C libraries. In 2023 IEEE Security and Privacy Workshops (SPW). IEEE, 349–363.
Bitcoin Developers. 2026. Bitcoin Improvement Proposals (BIPs). [link]. Accessed: 2026-06-05.
Alex Groce, Kush Jain, Rijnard van Tonder, Goutamkumar Tulajappa Kalburgi, and Claire Le Goues. 2022. Looking for Lacunae in Bitcoin Core’s Fuzzing Efforts. In Proceedings of the 44th International Conference on Software Engineering: Software Engineering in Practice (Pittsburgh, Pennsylvania) (ICSE-SEIP ’22). Association for Computing Machinery, New York, NY, USA, 185–186. DOI: 10.1145/3510457.3513072
Hoyong Jin, Dohyeon An, and Taekyoung Kwon. 2023. Differential Testing of Cryptographic Libraries with Hybrid Fuzzing. In Information Security and Cryptology – ICISC 2022, Seung-Hyun Seo and Hwajeong Seo (Eds.). Springer Nature Switzerland, Cham, 124–144.
Joseph Poon and Thaddeus Dryja. 2016. The bitcoin lightning network: Scalable off-chain instant payments.
Alessandro Sorniotti, Michael Weissbacher, and Anil Kurmus. 2023. Go or no go: Differential fuzzing of native and C libraries. In 2023 IEEE Security and Privacy Workshops (SPW). IEEE, 349–363.
Publicado
08/09/2026
Como Citar
GARCIA, Bruno Ely Reis; CESTARI, Erick.
BitcoinFuzz: Differential Fuzzing of Bitcoin and Lightning Network Implementations. In: SIMPÓSIO BRASILEIRO DE TESTES DE SOFTWARE SISTEMÁTICO E AUTOMATIZADO (SAST), 11. , 2026, São Paulo/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 271-273.
DOI: https://doi.org/10.5753/sast.2026.29817.
