An in-browser fuzzing page for Solana programs. The user configures
worker count, batch size, batch interval, and corpus size, then
Start Discovery launches a campaign; when it finishes, the
completion screen groups results by instruction and lists crash
details with reproducer snippets.
Why it exists
Solana programs fail in ways — compute-budget exhaustion, account
misuse, invalid discriminators — that static analysis can miss. This
page runs targeted fuzzing in Web Workers so the user can explore
those failure modes without a local toolchain.
Who uses it
Auditor — stresses a program’s instructions with random
input data.
Researcher — mines crashes and reproducers for exploit
writing.
How to open it
From /solana-program or /solana-studio on a Solana program.
From /smart-contracts?runtime=svm with a program selected.
Direct URL — /solana-fuzzing with a program selected.
Using the page
Workers — 1–16 Web Workers (default 4).
Batch Size — inputs per batch, 10–1000 (default 100).
Interval — delay between batches in milliseconds,
10–1000 (default 100).
Max Corpus — maximum interesting inputs kept for mutation,
100–100000 (default 10000).
Start Discovery — launches the campaign.
Instruction Results — per-instruction summary on the
completion screen.
Crash Details — per-crash rows with input preview, copy
action, and error string on the completion screen.
Export Results — downloads the full campaign as JSON.
Run Again — restarts the campaign.
View Analysis — links back to the program overview.
Inputs and outputs
Input
Source
Required
Program selection
Upstream context
yes
Workers / Batch Size / Interval / Max Corpus
Form inputs
defaults apply
Output
Format
Destination
Instruction results and crashes
In-page
HTML
Campaign export
JSON
Browser download
Input sample
Clipboard
Copy
Controls reference
Workers / Batch Size / Interval / Max Corpus —
campaign configuration inputs.
Start Discovery — begin fuzzing.
Export Results — JSON download.
Run Again — relaunch with current configuration.
View Analysis — return to the program overview.
Copy — copies the instruction input for a crash row.
Limits
Requires a signed-in account and a Solana program in focus.
Fuzzing runs in the browser — CPU load scales with worker count.
Crash categorisation is narrower than the EVM variant because
Solana runtime errors do not map to an assert/revert axis.
Troubleshooting
Symptom or error
Cause
Action
“No Program Selected” state
No program in focus
Open a program from /smart-contracts?runtime=svm.
Campaign produces no crashes
Instructions are well-guarded
Increase Batch Size or Max Corpus, or expand the target set.