{
  "type": "option",
  "name": "Differential and fuzz testing",
  "slug": "differential-and-fuzz-testing",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/differential-and-fuzz-testing/",
  "markdown": "https://zkpick.com/md/audit/differential-and-fuzz-testing.md",
  "category": "Dynamic testing",
  "summary": "Differential and fuzz testing: Dynamic testing. Layer: Circuit / VM. Characteristic finds: Divergence from a reference implementation; witnesses a malicious prover could pass. Blind to: Anything the oracle also gets wrong; bug classes outside the mutation model. Coverage claim: Sampled only. Cost profile: Moderate setup, cheap to re-run. Choose it when: zkVMs, ISA and EVM emulation chips, standard cryptographic gadgets, and any circuit with an independent reference implementation. Also the right home for regression tests from prior findings.",
  "description": "Executing the circuit against an independent oracle and searching for divergence, or mutating the prover to simulate a malicious one and checking the constraints reject it. For zkVMs, conformance suites are the natural oracle — the RISC-V architectural certification tests and the reference tests in Ethereum's execution specs provide an externally defined notion of correct. This is how a specification-conformance bug in a formally verified zkVM was found: by conformance tests, outside the verification effort's scope.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Finds bugs manual review misses in large repetitive constraint sets",
    "Every finding arrives with a reproducing input, so it becomes a regression test immediately",
    "Runs continuously and cheaply once set up",
    "Metamorphic and fault-injection oracles need no full formal specification"
  ],
  "tradeoffs": [
    "No completeness guarantee — absence of findings means nothing",
    "Requires a trustworthy oracle, which novel application circuits often lack",
    "Prover-side fuzzing needs fault injection into witness generation, which not all stacks expose",
    "Coverage over constraint systems is hard to define and harder to measure",
    "Proof generation per test case makes zkVM campaigns expensive"
  ],
  "bestFit": "zkVMs, ISA and EVM emulation chips, standard cryptographic gadgets, and any circuit with an independent reference implementation. Also the right home for regression tests from prior findings.",
  "maintainers": null,
  "maturity": "Research tooling with production impact",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://arxiv.org/abs/2509.10819",
  "facts": [
    {
      "table": "What each assurance technique can and cannot find",
      "url": "https://zkpick.com/audit/#audit-matrix-differential-and-fuzz-testing",
      "tech": "Differential and fuzz testing",
      "layer": "Circuit / VM",
      "catches": "Divergence from a reference implementation; witnesses a malicious prover could pass",
      "blind": "Anything the oracle also gets wrong; bug classes outside the mutation model",
      "coverage": "Sampled only",
      "cost": "Moderate setup, cheap to re-run"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Arguzz — testing zkVMs for soundness and completeness bugs (USENIX Security '26)",
      "url": "https://arxiv.org/abs/2509.10819",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/differential-and-fuzz-testing/",
  "authors": [
    "MarketComp"
  ]
}