Coverage Report

Created: 2025-09-19 18:22

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/root/bitcoin/src/wallet/test/fuzz/coinselection.cpp
Line
Count
Source
1
// Copyright (c) 2022 The Bitcoin Core developers
2
// Distributed under the MIT software license, see the accompanying
3
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5
#include <policy/feerate.h>
6
#include <policy/policy.h>
7
#include <primitives/transaction.h>
8
#include <test/fuzz/FuzzedDataProvider.h>
9
#include <test/fuzz/fuzz.h>
10
#include <test/fuzz/util.h>
11
#include <test/util/setup_common.h>
12
#include <wallet/coinselection.h>
13
14
#include <numeric>
15
#include <span>
16
#include <vector>
17
18
namespace wallet {
19
20
static void AddCoin(const CAmount& value, int n_input, int n_input_bytes, int locktime, std::vector<COutput>& coins, CFeeRate fee_rate)
21
0
{
22
0
    CMutableTransaction tx;
23
0
    tx.vout.resize(n_input + 1);
24
0
    tx.vout[n_input].nValue = value;
25
0
    tx.nLockTime = locktime; // all transactions get different hashes
26
0
    coins.emplace_back(COutPoint(tx.GetHash(), n_input), tx.vout.at(n_input), /*depth=*/0, n_input_bytes, /*solvable=*/true, /*safe=*/true, /*time=*/0, /*from_me=*/true, fee_rate);
27
0
}
28
29
// Randomly distribute coins to instances of OutputGroup
30
static void GroupCoins(FuzzedDataProvider& fuzzed_data_provider, const std::vector<COutput>& coins, const CoinSelectionParams& coin_params, bool positive_only, std::vector<OutputGroup>& output_groups)
31
0
{
32
0
    auto output_group = OutputGroup(coin_params);
33
0
    bool valid_outputgroup{false};
34
0
    for (auto& coin : coins) {
35
0
        if (!positive_only || (positive_only && coin.GetEffectiveValue() > 0)) {
36
0
            output_group.Insert(std::make_shared<COutput>(coin), /*ancestors=*/0, /*descendants=*/0);
37
0
        }
38
        // If positive_only was specified, nothing was inserted, leading to an empty output group
39
        // that would be invalid for the BnB algorithm
40
0
        valid_outputgroup = !positive_only || output_group.GetSelectionAmount() > 0;
41
0
        if (valid_outputgroup && fuzzed_data_provider.ConsumeBool()) {
42
0
            output_groups.push_back(output_group);
43
0
            output_group = OutputGroup(coin_params);
44
0
            valid_outputgroup = false;
45
0
        }
46
0
    }
47
0
    if (valid_outputgroup) output_groups.push_back(output_group);
48
0
}
49
50
static CAmount CreateCoins(FuzzedDataProvider& fuzzed_data_provider, std::vector<COutput>& utxo_pool, CoinSelectionParams& coin_params, int& next_locktime)
51
0
{
52
0
    CAmount total_balance{0};
53
0
    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000)
54
0
    {
55
0
        const int n_input{fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 10)};
56
0
        const int n_input_bytes{fuzzed_data_provider.ConsumeIntegralInRange<int>(41, 10000)};
57
0
        const CAmount amount{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, MAX_MONEY)};
58
0
        if (total_balance + amount >= MAX_MONEY) {
59
0
            break;
60
0
        }
61
0
        AddCoin(amount, n_input, n_input_bytes, ++next_locktime, utxo_pool, coin_params.m_effective_feerate);
62
0
        total_balance += amount;
63
0
    }
64
65
0
    return total_balance;
66
0
}
67
68
static SelectionResult ManualSelection(std::vector<COutput>& utxos, const CAmount& total_amount, const bool& subtract_fee_outputs)
69
0
{
70
0
    SelectionResult result(total_amount, SelectionAlgorithm::MANUAL);
71
0
    std::set<std::shared_ptr<COutput>> utxo_pool;
72
0
    for (const auto& utxo : utxos) {
73
0
        utxo_pool.insert(std::make_shared<COutput>(utxo));
74
0
    }
75
0
    result.AddInputs(utxo_pool, subtract_fee_outputs);
76
0
    return result;
77
0
}
78
79
// Returns true if the result contains an error and the message is not empty
80
0
static bool HasErrorMsg(const util::Result<SelectionResult>& res) { return !util::ErrorString(res).empty(); }
81
82
FUZZ_TARGET(coin_grinder)
83
0
{
84
0
    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
85
0
    std::vector<COutput> utxo_pool;
86
87
0
    const CAmount target{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, MAX_MONEY)};
88
89
0
    FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
90
0
    CoinSelectionParams coin_params{fast_random_context};
91
0
    coin_params.m_subtract_fee_outputs = fuzzed_data_provider.ConsumeBool();
92
0
    coin_params.m_long_term_feerate = CFeeRate{ConsumeMoney(fuzzed_data_provider, /*max=*/COIN)};
93
0
    coin_params.m_effective_feerate = CFeeRate{ConsumeMoney(fuzzed_data_provider, /*max=*/COIN)};
94
0
    coin_params.change_output_size = fuzzed_data_provider.ConsumeIntegralInRange<int>(10, 1000);
95
0
    coin_params.change_spend_size = fuzzed_data_provider.ConsumeIntegralInRange<int>(10, 1000);
96
0
    coin_params.m_cost_of_change= coin_params.m_effective_feerate.GetFee(coin_params.change_output_size) + coin_params.m_long_term_feerate.GetFee(coin_params.change_spend_size);
97
0
    coin_params.m_change_fee = coin_params.m_effective_feerate.GetFee(coin_params.change_output_size);
98
    // For other results to be comparable to SRD, we must align the change_target with SRD’s hardcoded behavior
99
0
    coin_params.m_min_change_target = CHANGE_LOWER + coin_params.m_change_fee;
100
101
    // Create some coins
102
0
    CAmount total_balance{0};
103
0
    CAmount max_spendable{0};
104
0
    int next_locktime{0};
105
0
    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000)
106
0
    {
107
0
        const int n_input{fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 10)};
108
0
        const int n_input_bytes{fuzzed_data_provider.ConsumeIntegralInRange<int>(41, 10000)};
109
0
        const CAmount amount{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, MAX_MONEY)};
110
0
        if (total_balance + amount >= MAX_MONEY) {
111
0
            break;
112
0
        }
113
0
        AddCoin(amount, n_input, n_input_bytes, ++next_locktime, utxo_pool, coin_params.m_effective_feerate);
114
0
        total_balance += amount;
115
0
        CAmount eff_value = amount - coin_params.m_effective_feerate.GetFee(n_input_bytes);
116
0
        max_spendable += eff_value;
117
0
    }
118
119
0
    std::vector<OutputGroup> group_pos;
120
0
    GroupCoins(fuzzed_data_provider, utxo_pool, coin_params, /*positive_only=*/true, group_pos);
121
122
    // Run coinselection algorithms
123
0
    auto result_cg = CoinGrinder(group_pos, target, coin_params.m_min_change_target, MAX_STANDARD_TX_WEIGHT);
124
0
    if (target + coin_params.m_min_change_target > max_spendable || HasErrorMsg(result_cg)) return; // We only need to compare algorithms if CoinGrinder has a solution
125
0
    assert(result_cg);
126
0
    if (!result_cg->GetAlgoCompleted()) return; // Bail out if CoinGrinder solution is not optimal
127
128
0
    auto result_srd = SelectCoinsSRD(group_pos, target, coin_params.m_change_fee, fast_random_context, MAX_STANDARD_TX_WEIGHT);
129
0
    if (result_srd && result_srd->GetChange(CHANGE_LOWER, coin_params.m_change_fee) > 0) { // exclude any srd solutions that don’t have change, err on excluding
130
0
        assert(result_srd->GetWeight() >= result_cg->GetWeight());
131
0
    }
132
133
0
    auto result_knapsack = KnapsackSolver(group_pos, target, coin_params.m_min_change_target, fast_random_context, MAX_STANDARD_TX_WEIGHT);
134
0
    if (result_knapsack && result_knapsack->GetChange(CHANGE_LOWER, coin_params.m_change_fee) > 0) { // exclude any knapsack solutions that don’t have change, err on excluding
135
0
        assert(result_knapsack->GetWeight() >= result_cg->GetWeight());
136
0
    }
137
0
}
138
139
FUZZ_TARGET(coin_grinder_is_optimal)
140
0
{
141
0
    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
142
143
0
    FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
144
0
    CoinSelectionParams coin_params{fast_random_context};
145
0
    coin_params.m_subtract_fee_outputs = false;
146
    // Set effective feerate up to MAX_MONEY sats per 1'000'000 vB (2'100'000'000 sat/vB = 21'000 BTC/kvB).
147
0
    coin_params.m_effective_feerate = CFeeRate{ConsumeMoney(fuzzed_data_provider, MAX_MONEY), 1'000'000};
148
0
    coin_params.m_min_change_target = ConsumeMoney(fuzzed_data_provider);
149
150
    // Create some coins
151
0
    CAmount max_spendable{0};
152
0
    int next_locktime{0};
153
0
    static constexpr unsigned max_output_groups{16};
154
0
    std::vector<OutputGroup> group_pos;
155
0
    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), max_output_groups)
156
0
    {
157
        // With maximum m_effective_feerate and n_input_bytes = 1'000'000, input_fee <= MAX_MONEY.
158
0
        const int n_input_bytes{fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 1'000'000)};
159
        // Only make UTXOs with positive effective value
160
0
        const CAmount input_fee = coin_params.m_effective_feerate.GetFee(n_input_bytes);
161
        // Ensure that each UTXO has at least an effective value of 1 sat
162
0
        const CAmount eff_value{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, MAX_MONEY + group_pos.size() - max_spendable - max_output_groups)};
163
0
        const CAmount amount{eff_value + input_fee};
164
0
        std::vector<COutput> temp_utxo_pool;
165
166
0
        AddCoin(amount, /*n_input=*/0, n_input_bytes, ++next_locktime, temp_utxo_pool, coin_params.m_effective_feerate);
167
0
        max_spendable += eff_value;
168
169
0
        auto output_group = OutputGroup(coin_params);
170
0
        output_group.Insert(std::make_shared<COutput>(temp_utxo_pool.at(0)), /*ancestors=*/0, /*descendants=*/0);
171
0
        group_pos.push_back(output_group);
172
0
    }
173
0
    size_t num_groups = group_pos.size();
174
0
    assert(num_groups <= max_output_groups);
175
176
    // Only choose targets below max_spendable
177
0
    const CAmount target{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, std::max(CAmount{1}, max_spendable - coin_params.m_min_change_target))};
178
179
    // Brute force optimal solution
180
0
    CAmount best_amount{MAX_MONEY};
181
0
    int best_weight{std::numeric_limits<int>::max()};
182
0
    for (uint32_t pattern = 1; (pattern >> num_groups) == 0; ++pattern) {
183
0
        CAmount subset_amount{0};
184
0
        int subset_weight{0};
185
0
        for (unsigned i = 0; i < num_groups; ++i) {
186
0
            if ((pattern >> i) & 1) {
187
0
                subset_amount += group_pos[i].GetSelectionAmount();
188
0
                subset_weight += group_pos[i].m_weight;
189
0
            }
190
0
        }
191
0
        if ((subset_amount >= target + coin_params.m_min_change_target) && (subset_weight < best_weight || (subset_weight == best_weight && subset_amount < best_amount))) {
192
0
            best_weight = subset_weight;
193
0
            best_amount = subset_amount;
194
0
        }
195
0
    }
196
197
0
    if (best_weight < std::numeric_limits<int>::max()) {
198
        // Sufficient funds and acceptable weight: CoinGrinder should find at least one solution
199
0
        int high_max_selection_weight = fuzzed_data_provider.ConsumeIntegralInRange<int>(best_weight, std::numeric_limits<int>::max());
200
201
0
        auto result_cg = CoinGrinder(group_pos, target, coin_params.m_min_change_target, high_max_selection_weight);
202
0
        assert(result_cg);
203
0
        assert(result_cg->GetWeight() <= high_max_selection_weight);
204
0
        assert(result_cg->GetSelectedEffectiveValue() >= target + coin_params.m_min_change_target);
205
0
        assert(best_weight < result_cg->GetWeight() || (best_weight == result_cg->GetWeight() && best_amount <= result_cg->GetSelectedEffectiveValue()));
206
0
        if (result_cg->GetAlgoCompleted()) {
207
            // If CoinGrinder exhausted the search space, it must return the optimal solution
208
0
            assert(best_weight == result_cg->GetWeight());
209
0
            assert(best_amount == result_cg->GetSelectedEffectiveValue());
210
0
        }
211
0
    }
212
213
    // CoinGrinder cannot ever find a better solution than the brute-forced best, or there is none in the first place
214
0
    int low_max_selection_weight = fuzzed_data_provider.ConsumeIntegralInRange<int>(0, best_weight - 1);
215
0
    auto result_cg = CoinGrinder(group_pos, target, coin_params.m_min_change_target, low_max_selection_weight);
216
    // Max_weight should have been exceeded, or there were insufficient funds
217
0
    assert(!result_cg);
218
0
}
219
220
enum class CoinSelectionAlgorithm {
221
    BNB,
222
    SRD,
223
    KNAPSACK,
224
};
225
226
template<CoinSelectionAlgorithm Algorithm>
227
0
void FuzzCoinSelectionAlgorithm(std::span<const uint8_t> buffer) {
228
0
    SeedRandomStateForTest(SeedRand::ZEROS);
229
0
    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
230
0
    std::vector<COutput> utxo_pool;
231
232
0
    const CFeeRate long_term_fee_rate{ConsumeMoney(fuzzed_data_provider, /*max=*/COIN)};
233
0
    const CFeeRate effective_fee_rate{ConsumeMoney(fuzzed_data_provider, /*max=*/COIN)};
234
    // Discard feerate must be at least dust relay feerate
235
0
    const CFeeRate discard_fee_rate{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(DUST_RELAY_TX_FEE, COIN)};
236
0
    const CAmount target{fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, MAX_MONEY)};
237
0
    const bool subtract_fee_outputs{fuzzed_data_provider.ConsumeBool()};
238
239
0
    FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
240
0
    CoinSelectionParams coin_params{fast_random_context};
241
0
    coin_params.m_subtract_fee_outputs = subtract_fee_outputs;
242
0
    coin_params.m_long_term_feerate = long_term_fee_rate;
243
0
    coin_params.m_effective_feerate = effective_fee_rate;
244
0
    coin_params.change_output_size = fuzzed_data_provider.ConsumeIntegralInRange(1, MAX_SCRIPT_SIZE);
245
0
    coin_params.m_change_fee = effective_fee_rate.GetFee(coin_params.change_output_size);
246
0
    coin_params.m_discard_feerate = discard_fee_rate;
247
0
    coin_params.change_spend_size = fuzzed_data_provider.ConsumeIntegralInRange<int>(41, 1000);
248
0
    const auto change_spend_fee{coin_params.m_discard_feerate.GetFee(coin_params.change_spend_size)};
249
0
    coin_params.m_cost_of_change = coin_params.m_change_fee + change_spend_fee;
250
0
    CScript change_out_script = CScript() << std::vector<unsigned char>(coin_params.change_output_size, OP_TRUE);
251
0
    const auto dust{GetDustThreshold(CTxOut{/*nValueIn=*/0, change_out_script}, coin_params.m_discard_feerate)};
252
0
    coin_params.min_viable_change = std::max(change_spend_fee + 1, dust);
253
254
0
    int next_locktime{0};
255
0
    CAmount total_balance{CreateCoins(fuzzed_data_provider, utxo_pool, coin_params, next_locktime)};
256
257
0
    std::vector<OutputGroup> group_pos;
258
0
    GroupCoins(fuzzed_data_provider, utxo_pool, coin_params, /*positive_only=*/true, group_pos);
259
260
0
    int max_selection_weight = fuzzed_data_provider.ConsumeIntegralInRange<int>(0, std::numeric_limits<int>::max());
261
262
0
    std::optional<SelectionResult> result;
263
264
0
    if constexpr (Algorithm == CoinSelectionAlgorithm::BNB) {
265
0
        if (!coin_params.m_subtract_fee_outputs) {
266
0
            auto result_bnb = SelectCoinsBnB(group_pos, target, coin_params.m_cost_of_change, max_selection_weight);
267
0
            if (result_bnb) {
268
0
                result = *result_bnb;
269
0
                assert(result_bnb->GetChange(coin_params.min_viable_change, coin_params.m_change_fee) == 0);
270
0
                assert(result_bnb->GetSelectedValue() >= target);
271
0
                assert(result_bnb->GetWeight() <= max_selection_weight);
272
0
                (void)result_bnb->GetShuffledInputVector();
273
0
                (void)result_bnb->GetInputSet();
274
0
            }
275
0
        }
276
0
    }
277
278
0
    if constexpr (Algorithm == CoinSelectionAlgorithm::SRD) {
279
0
        auto result_srd = SelectCoinsSRD(group_pos, target, coin_params.m_change_fee, fast_random_context, max_selection_weight);
280
0
        if (result_srd) {
281
0
            result = *result_srd;
282
0
            assert(result_srd->GetSelectedValue() >= target);
283
0
            assert(result_srd->GetChange(CHANGE_LOWER, coin_params.m_change_fee) > 0);
284
0
            assert(result_srd->GetWeight() <= max_selection_weight);
285
0
            result_srd->SetBumpFeeDiscount(ConsumeMoney(fuzzed_data_provider));
286
0
            result_srd->RecalculateWaste(coin_params.min_viable_change, coin_params.m_cost_of_change, coin_params.m_change_fee);
287
0
            (void)result_srd->GetShuffledInputVector();
288
0
            (void)result_srd->GetInputSet();
289
0
        }
290
0
    }
291
292
0
    if constexpr (Algorithm == CoinSelectionAlgorithm::KNAPSACK) {
293
0
        std::vector<OutputGroup> group_all;
294
0
        GroupCoins(fuzzed_data_provider, utxo_pool, coin_params, /*positive_only=*/false, group_all);
295
296
0
        for (const OutputGroup& group : group_all) {
297
0
            const CoinEligibilityFilter filter{fuzzed_data_provider.ConsumeIntegral<int>(), fuzzed_data_provider.ConsumeIntegral<int>(), fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
298
0
            (void)group.EligibleForSpending(filter);
299
0
        }
300
301
0
        CAmount change_target{GenerateChangeTarget(target, coin_params.m_change_fee, fast_random_context)};
302
0
        auto result_knapsack = KnapsackSolver(group_all, target, change_target, fast_random_context, max_selection_weight);
303
        // If the total balance is sufficient for the target and we are not using
304
        // effective values, Knapsack should always find a solution (unless the selection exceeded the max tx weight).
305
0
        if (total_balance >= target && subtract_fee_outputs && !HasErrorMsg(result_knapsack)) {
306
0
            assert(result_knapsack);
307
0
        }
308
0
        if (result_knapsack) {
309
0
            result = *result_knapsack;
310
0
            assert(result_knapsack->GetSelectedValue() >= target);
311
0
            assert(result_knapsack->GetWeight() <= max_selection_weight);
312
0
            result_knapsack->SetBumpFeeDiscount(ConsumeMoney(fuzzed_data_provider));
313
0
            result_knapsack->RecalculateWaste(coin_params.min_viable_change, coin_params.m_cost_of_change, coin_params.m_change_fee);
314
0
            (void)result_knapsack->GetShuffledInputVector();
315
0
            (void)result_knapsack->GetInputSet();
316
0
        }
317
0
    }
318
319
0
    std::vector<COutput> utxos;
320
0
    CAmount new_total_balance{CreateCoins(fuzzed_data_provider, utxos, coin_params, next_locktime)};
321
0
    if (new_total_balance > 0) {
322
0
        std::set<std::shared_ptr<COutput>> new_utxo_pool;
323
0
        for (const auto& utxo : utxos) {
324
0
            new_utxo_pool.insert(std::make_shared<COutput>(utxo));
325
0
        }
326
0
        if (result) {
327
0
            const auto weight{result->GetWeight()};
328
0
            result->AddInputs(new_utxo_pool, subtract_fee_outputs);
329
0
            assert(result->GetWeight() > weight);
330
0
        }
331
0
    }
332
333
0
    std::vector<COutput> manual_inputs;
334
0
    CAmount manual_balance{CreateCoins(fuzzed_data_provider, manual_inputs, coin_params, next_locktime)};
335
0
    if (manual_balance == 0) return;
336
0
    auto manual_selection{ManualSelection(manual_inputs, manual_balance, coin_params.m_subtract_fee_outputs)};
337
0
    if (result) {
338
0
        const CAmount old_target{result->GetTarget()};
339
0
        const std::set<std::shared_ptr<COutput>> input_set{result->GetInputSet()};
340
0
        const int old_weight{result->GetWeight()};
341
0
        result->Merge(manual_selection);
342
0
        assert(result->GetInputSet().size() == input_set.size() + manual_inputs.size());
343
0
        assert(result->GetTarget() == old_target + manual_selection.GetTarget());
344
0
        assert(result->GetWeight() == old_weight + manual_selection.GetWeight());
345
0
    }
346
0
}
Unexecuted instantiation: _ZN6wallet26FuzzCoinSelectionAlgorithmILNS_22CoinSelectionAlgorithmE0EEEvSt4spanIKhLm18446744073709551615EE
Unexecuted instantiation: _ZN6wallet26FuzzCoinSelectionAlgorithmILNS_22CoinSelectionAlgorithmE1EEEvSt4spanIKhLm18446744073709551615EE
Unexecuted instantiation: _ZN6wallet26FuzzCoinSelectionAlgorithmILNS_22CoinSelectionAlgorithmE2EEEvSt4spanIKhLm18446744073709551615EE
347
348
0
FUZZ_TARGET(coinselection_bnb) {
349
0
    FuzzCoinSelectionAlgorithm<CoinSelectionAlgorithm::BNB>(buffer);
350
0
}
351
352
0
FUZZ_TARGET(coinselection_srd) {
353
0
    FuzzCoinSelectionAlgorithm<CoinSelectionAlgorithm::SRD>(buffer);
354
0
}
355
356
0
FUZZ_TARGET(coinselection_knapsack) {
357
0
    FuzzCoinSelectionAlgorithm<CoinSelectionAlgorithm::KNAPSACK>(buffer);
358
0
}
359
360
} // namespace wallet