Fuzzing (fuzz testing)

Instead of writing each test case by hand, a fuzzer generates thousands or millions of inputs, often guided by which code paths they reach, and calls the contract's functions with them. Stateless fuzzing tests one function at a time. Invariant or stateful fuzzing goes further, running random sequences of calls from different users and checking after each step that core properties still hold, such as the vault never owing more than it holds.

Fuzzing has become standard practice in smart contract security. Development frameworks such as Foundry include built-in fuzz and invariant testing, and dedicated tools like Echidna and Medusa are widely used by auditors. Many serious bugs found in audits and contests come from invariants that a fuzzer broke within minutes.

Fuzzers find what their inputs and invariants can reach. Deep bugs that require a very specific sequence, price manipulation through external protocols or flash loans, or flaws in properties nobody wrote down may stay hidden. Results also depend on run time and setup quality. Fuzzing complements formal verification and manual review: it is faster and cheaper than proofs but offers no guarantee of completeness.