Coverage Guided / Mutation Based Fuzzing

[d-xo]

Still very much WIP (and currently based off a pretty outdated commit).

This PR introduces a coverage guided / mutation based approach to fuzzing. All fuzz tests are now run with coverage enabled. We store each path seen, along with the input that we used to get there. When generating calldata for a fuzz run, we sometimes use the existing strategy (random), and sometimes choose instead to mutate one of the examples from the corpus of visited paths.

This should hopefully help us get even deeper inside complex contracts.

Still TODO:

• [ ] rebase on master
• [ ] general tidyup
• [ ] generate coverage reports
• [ ] use the symbolic execution engine to prefill the corpus with interesting calldata
• [ ] apply a weighting to some examples (e.g. paths where the symbolic execution engine timed out can be targeted for fuzzing)

[transmissions11]

does this include constant mining? https://github.com/crytic/echidna/pull/262