Skip to content

Property-based fuzz tests for Stellar scalar arithmetic #3

@truthixify

Description

@truthixify

Labels: Stellar Wave, stellar, test, crypto, drips, help-wanted, good-first-issue
Tier: M (2–4 days)
Type: test

Context

Stealth address math involves a lot of scalar arithmetic mod L (the ed25519 group order). Unit tests cover specific values, but property-based tests are far better at catching the edge cases that break in production — overflow, wrap-around, near-boundary inputs, zero/identity, etc.

This issue adds fast-check-driven property tests for sdk/src/chains/stellar/scalar.ts.

Scope

Add fast-check as a dev-dependency and write property tests under test/chains/stellar/properties.test.ts:

Properties to cover

For all valid scalars a, b, c and bytes x in the appropriate ranges:

  1. Addition associativity: (a + b) + c == a + (b + c) mod L
  2. Addition commutativity: a + b == b + a mod L
  3. Additive identity: a + 0 == a mod L
  4. Reduction stability: bytesToScalar(scalarToBytes(a)) == a for all valid a
  5. seedToScalar determinism: same seed → same scalar; different seeds → different scalars (with negligible collision probability)
  6. Stealth scalar correctness: for random (m, s_h), (m + s_h) * G == m*G + s_h*G (the equation that makes stealth spending work)
  7. View-tag uniformity: across 10k random shared secrets, the view tag distribution chi-square test passes against uniform[0,255]
  8. signWithScalar round-trip: for any scalar a and message m, verify(signWithScalar(a, m), m, a*G) == true

Configuration

  • Use fast-check's BigInt-aware arbitraries for the scalar space.
  • Default test count: 1000 cases. Add a pnpm test:fuzz script that bumps to 100,000.
  • Add a CI job (slow-tests) that runs the high-case version nightly.

Acceptance criteria

  • All eight properties implemented and passing.
  • CI nightly job configured.
  • If any property fails, file the finding as a security issue (privately) and do not commit the failing test until fixed.
  • README section "Property tests" added.

Why this is a good first issue

The math is well-defined, the harness is contained to one file, and the acceptance criteria are objective (tests pass or don't). Good ramp for someone learning the Wraith codebase before tackling the larger audits.

Resources

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programcryptoCryptographic codedripsFunded via Drips Networkgood first issueGood for newcomershelp wantedExtra attention is neededstellarTouches Stellar / Soroban codetestTest coverage / harness

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions