PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Improving the state of Cosmos fuzzing

blog.trailofbits.com | blog | #web3 | #fuzzing | #go | #blockchain | #trail-of-bits | #cosmos-sdk | #smart-fuzzing | #simulation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits added smart fuzzing on top of Cosmos SDK's high-level simulation framework, combining smart low-level fuzzing with dumb high-level simulation and uncovering three minor issues.
Published
Collected

Related coverage

blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Detect Go’s silent arithmetic bugs with go-panikint
go-panikint, a modified Go compiler from Trail of Bits, turns silent integer overflows into explicit panics; it uncovered a real overflow in Cosmos SDK RPC pagination, closing a fuzzing blind spot.
research · aikido.dev
Graphalgo campaign spreads to Terraform providers and Go Modules
Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
Back