Finding mispriced opcodes with fuzzing

Trail of Bits built a fuzzing harness for Fuel Labs that identified opcodes in the Fuel VM which may charge too little gas. The harness replaced libFuzzer with a LibAFL shim, raising throughput from about 50 to about 1,000 exec/s on an eight-core machine, and its input format allows compiled Sway programs to serve as seed corpus. Analysis of gas usage against execution time flagged MCLI, SCWQ, K256, SWWQ, and SRWQ, with SCWQ, SWWQ, and K256 already linked to earlier discovered problems. The authors were unsure why MCLI appeared, possibly due to noise, and suggested a possible pricing issue for SRWQ.