[Dev Fund] daml-fuzz — property-based fuzzing for Daml (working PoC, 8/8 mutation score) — seeking a Daml Tooling SIG champion

Hi all,

I’ve built a working proof of concept for daml-fuzz — a property-based fuzzer
for Daml/Canton contracts. You declare the rules a contract must never break
(“value is conserved”, “only the owner can act”, “Eve can never see this”), and
it fires randomized multi-party transaction sequences until it finds one that
breaks a rule — then prints the exact recipe to reproduce it.

Why it’s worth funding: Canton has coverage (DamlCov #323) and formal-
verification proposals (#12), but nothing that generates adversarial inputs.
And it’s the only approach that can test Canton’s unique risk surface —
multi-party authorization and privacy/disclosure — which no EVM fuzzer can
express.

It’s not vaporware. The PoC runs today on Daml 3.4.11 and is validated by
mutation testing: it catches 8/8 planted bugs across all four property tiers,
with zero false positives on the correct contract.

• Repo (Apache-2.0, runnable today): GitHub - fronow/daml-fuzz-canton: Daml Fuzzer for Canton network · GitHub
• 2.5-minute demo (live break → catch → fix): https://youtu.be/QZ2AnSY_Fps
• Draft proposal PR (auto-parked as needs-champion): Proposal: daml-fuzz — property-based fuzzing for Daml contracts by fronow · Pull Request #579 · canton-foundation/canton-dev-fund · GitHub

SIG alignment: daml-tooling.

Would a Daml Tooling SIG member be willing to champion this — or point me to
the right person?

Thanks,
dfrnw

Hi @Dfrnw ! Not a possible champion here, but I wanted to reach out regarding this proposal.

We looked into fuzzing some time back, so I have some context. I was going to point you to #52, but from the latest comments on your proposal, I assume someone else already pointed you there.

Aside from that, nice work. Personally, I think shipping a runnable PoC plus a demo, rather than only a write-up, is a great way to showcase value. The same applies to running it with current standards to evaluate results.

From a Canton dev perspective, what turns a fuzzer into something we would actually adopt is a clear developer workflow and a stable API. If #52 moves forward, count us in as supporters and early users!

Hi Тomimor, thanks a lot, and I appreciate you reaching out. Yes, I’ve been pointed to #52 (by Matthieu)

On your main point… a clear developer workflow and real API connection, that’s where I focused. It’s not just Daml Script, it connects to a live Canton participant over the JSON Ledger API v2, introspects any compiled .dar, and fires randomized multi-party transactions at a real ledger (one command with a local sandbox, or against a running participant). I’ve also run it against the CIP-0056 Token Standard to evaluate on current standards, not just toy contracts.

Thanks again.

It is live and open source in github

github.com