Skip to content

test(security): add parameterized fuzz invariants for non-custodial zero balance, nonce replay, and venue gates (fixes #156) - #160

Open
arifrhm wants to merge 1 commit into
decipherhub:mainfrom
arifrhm:test/invariant-assurance-gates
Open

arifrhm wants to merge 1 commit into
decipherhub:mainfrom
arifrhm:test/invariant-assurance-gates

Conversation

@arifrhm

@arifrhm arifrhm commented Oct 28, 2026

Copy link
Copy Markdown

Fixes #156

Summary

Adds parameterized fuzz invariants to test/integration/Invariants.t.sol to provide automated production release gates and property-based verification beyond fixed-amount unit tests:

  1. testFuzz_unregisteredVenue_adapterNotRegistered:

    • Asserts that for any arbitrary unmapped venue address, the router strictly reverts with Errors.AdapterNotRegistered before dispatching or mutating any state.
  2. testFuzz_nonceReplay_nonceUsed:

    • Asserts that for any arbitrary bounded amount (1 ether to 100 ether) and arbitrary uint64 nonce, the initial swap succeeds and replaying the identical caller + nonce tuple strictly reverts with Errors.NonceUsed.
  3. testFuzz_nonCustodial_zeroBalancesAfterSwap:

    • Validates the fundamental non-custodial invariant across all bounded swap amounts: post-swap, both the ExecutionRouter and ExecutionAdapter hold strictly zero balances of both the incoming quote token and outgoing RWA token.
  4. testFuzz_suspendedVenue_blocks:

    • Validates that when an emergency kill-switch is triggered (setVenueSuspended), all subsequent execution attempts across any arbitrary amount strictly revert with Errors.VenueSuspended.

Verification & Quality Checks

  • All 10 tests in InvariantsTest pass (forge test --match-contract InvariantsTest -vv): 256 fuzz runs each, 0 reverts/failures.
  • All 912 tests across the repository pass (forge test).
  • Code formatting verified with forge fmt.
  • Only test/integration/Invariants.t.sol modified.

…ero balance, nonce replay, and venue gates (fixes decipherhub#156)

Signed-off-by: Arif Rahman <arif.rahman.rhm@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test(security): add invariant and independent production assurance gates

1 participant