code coverage tracking during onchain fuzzing

[elizabethdinella]

Hi, is it possible to track the code coverage percentage during onchain fuzzing as it progresses?

[shouc]

Unfortunately, there is not any elegant way to do this. We will implement a test coverage evaluator based on testcase before next Wednesday.

[shouc]

Nevertheless, coverage is not a good representation of the completeness of fuzzing for smart contracts, esp. for DeFi. During our research, we observe that most of the sequences of exploit (e.g., https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/AES_exp.sol#L45-L47 needs 37x same txns to increase one-side liquidity) do not end up increasing path/branch/instruction coverage over time. Likely due to path/branch/instruction coverage can not encode stateful transitions.