An in-browser fuzzing page for EVM contracts. The user configures
worker count, batch size, batch interval, and corpus size, then
Start Discovery launches a campaign that groups results by
function and classifies crashes (security / revert / runtime noise)
with reproducer snippets.
Why it exists
Targeted fuzzing finds bugs static analysis misses — reverts,
unexpected VM failures, and input shapes that trip detector blind
spots. This page runs that fuzzing loop directly in the browser via
Web Workers, so the user does not need a local fuzzing toolchain.
Who uses it
Auditor — stresses a contract’s entry points with random
calldata.
Researcher — explores crash categories and mines reproducers
for exploit writing.
How to open it
From /evm-contract → Exploit Discovery breadcrumb action.
From /smart-contracts with an EVM contract selected.
Direct URL — /evm-fuzzing with a contract selected.
Using the page
Workers — 1–16 Web Workers (default derived from hardware, typically half of navigator.hardwareConcurrency, clamped 2–8).
Batch size — inputs per batch, 10–1000 (default 100).
Interval — delay between batches in milliseconds, 10–1000
(default 100).
Max Corpus — maximum interesting inputs kept for mutation,
100–100000 (default 10000).
Start Discovery — launches the campaign.
Function Results — per-function summary updates live.
Crash Details — grouped crashes with category badges
(security, revert, noise), input variants, and
reproducer commands. Each entry has Copy buttons for the
input or reproducer command.
Export Results — downloads the full campaign as JSON.
Run Again — restarts the campaign with the current
configuration.
View Analysis — links back to the contract overview.
Inputs and outputs
Input
Source
Required
Contract selection
Upstream context
yes
Workers / Batch Size / Interval / Max Corpus
Form inputs
defaults apply
Output
Format
Destination
Function results and crashes
In-page
HTML
Campaign export
JSON
Browser download
Reproducer command
Clipboard
Copy cmd
Controls reference
Workers / Batch Size / Interval / Max Corpus —
campaign configuration inputs.