Sigvex
EVMWorkspace2 min read

EVM Exploit Discovery

In-browser fuzzing for an EVM contract — throw random calldata at its entry points, then read the crashes grouped by function and category, each with a reproducer.

Open Exploit DiscoveryAll guides
evmfuzzingexploitdiscovery

EVM Exploit Discovery fuzzes a contract right in the browser. You point it at a contract, set how hard to push, and it throws random calldata at the entry points, then groups what breaks — by function, and by whether the crash looks security-relevant, an ordinary revert, or runtime noise — each with a reproducer you can copy.

Why it exists

Fuzzing finds what static analysis misses: reverts, unexpected VM failures, and input shapes that fall in a detector’s blind spot. Running that loop in the browser means you get it without standing up a local fuzzing toolchain — open a contract, start a campaign, and read the results.

Who uses it

  • Auditor — stresses a contract’s entry points with random calldata.
  • Researcher — explores the crash categories and mines reproducers for exploit writing.

How to open it

  1. From an EVM Contract Overview → the Exploit Discovery breadcrumb action.
  2. From the inventory with an EVM contract selected.
  3. Direct URL — /evm-fuzzing with a contract selected.

Running a campaign

Four settings tune the campaign: the number of workers (parallel fuzzing threads, defaulted from your machine’s capacity), the batch size (inputs per batch), the interval between batches, and the max corpus (how many interesting inputs to keep for mutation). Start Discovery launches it.

As it runs, function results update live. Crash details group the crashes with a category badge — security, revert, or noise — plus the input variants and a reproducer command, each with a copy button. Export Results downloads the whole campaign as JSON, and Run Again relaunches with the same settings.

Limits

  • Requires a signed-in account and a contract in focus.
  • Fuzzing runs in the browser, so CPU load scales with the worker count — dial workers down if a campaign overwhelms the tab.
  • A reproducer is emitted when a crash has a deterministic input; noise crashes may not have one. Use the grouped count (× N) as the signal rather than individual near-identical rows.