feat: Add initial fuzz targets

.gitignore

@@ -17,4 +17,10 @@
 
 # documentation site
 _site/
+
+# fuzz artifacts
+**/artifacts
+**/corpus
+**/fuzz*.log
+**/coverage
 .aider*

Cargo.toml

@@ -1,12 +1,13 @@
 [workspace]
 resolver = "2"
 members = [
-    "common",
-    "contract/*",
-    "mock/*",
-    "service/*",
-    "test-utils",
-    "universal-account",
+  "common",
+  "contract/*",
+  "fuzz",
+  "mock/*",
+  "service/*",
+  "test-utils",
+  "universal-account",
 ]
 
 [workspace.package]
@@ -17,6 +18,7 @@ version = "1.2.0"
 
 [workspace.dependencies]
 anyhow = "1.0.95"
+arbitrary = { version = "1", features = ["derive"] }
 async-trait = "0.1.88"
 base64 = "0.22.1"
 borsh = { version = "1.5", features = ["unstable__schema"] }
@@ -26,6 +28,7 @@ getrandom = { version = "0.2", features = ["custom"] }
 hex = { version = "0.4.3", features = ["serde"] }
 hex-literal = "0.4"
 itertools = "0.14.0"
+libfuzzer-sys = "0.4"
 near-account-id = "1.1.4"
 near-chain-configs = "0.31.1"
 near-contract-standards = "5.17.2"

common/Cargo.toml

@@ -15,7 +15,7 @@ primitive-types.workspace = true
 schemars.workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-near-primitives.workspace = true
+near-primitives = { workspace = true, optional = true }
 
 [dev-dependencies]
 rstest.workspace = true
@@ -24,3 +24,8 @@ rand = "0.8"
 
 [lints]
 workspace = true
+
+[features]
+default = []
+rpc = ["dep:near-primitives"]
+non-contract-usage = ["near-sdk/non-contract-usage"]

common/src/asset.rs

@@ -4,7 +4,7 @@ use std::{
 };
 
 use near_contract_standards::fungible_token::core::ext_ft_core;
-#[cfg(not(target_arch = "wasm32"))]
+#[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
 use near_primitives::action::FunctionCallAction;
 use near_sdk::{
     env,
@@ -96,6 +96,7 @@ impl<T: AssetClass> FungibleAsset<T> {
         }
     }
 
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn transfer_call_method_name(&self) -> &str {
         match self.kind {
             FungibleAssetKind::Nep141(_) => "ft_transfer_call",
@@ -135,7 +136,7 @@ impl<T: AssetClass> FungibleAsset<T> {
     }
 
     /// Creates a simple `ft_transfer` action (no callback).
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn transfer_action(
         &self,
         receiver_id: &AccountId,
@@ -170,7 +171,7 @@ impl<T: AssetClass> FungibleAsset<T> {
         }
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn transfer_call_action(
         &self,
         receiver_id: &AccountId,
@@ -209,7 +210,7 @@ impl<T: AssetClass> FungibleAsset<T> {
         }
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn balance_of_action(&self, account_id: &AccountId) -> FunctionCallAction {
         let (method_name, args) = match self.kind {
             FungibleAssetKind::Nep141(_) => (

common/src/borrow.rs

@@ -60,15 +60,15 @@ pub enum LiquidationReason {
 pub struct BorrowPosition {
     pub started_at_block_timestamp_ms: Option<U64>,
     pub collateral_asset_deposit: CollateralAssetAmount,
-    borrow_asset_principal: BorrowAssetAmount,
+    pub borrow_asset_principal: BorrowAssetAmount,
     #[serde(alias = "borrow_asset_fees")]
     pub interest: Accumulator<BorrowAsset>,
     #[serde(default)]
     pub fees: BorrowAssetAmount,
     #[serde(default)]
-    borrow_asset_in_flight: BorrowAssetAmount,
+    pub borrow_asset_in_flight: BorrowAssetAmount,
     #[serde(default)]
-    collateral_asset_in_flight: CollateralAssetAmount,
+    pub collateral_asset_in_flight: CollateralAssetAmount,
     #[serde(default)]
     pub liquidation_lock: CollateralAssetAmount,
 }

common/src/market/mod.rs

@@ -8,7 +8,7 @@ use crate::{
     number::Decimal,
 };
 mod configuration;
-pub use configuration::{MarketConfiguration, APY_LIMIT};
+pub use configuration::{MarketConfiguration, ValidAmountRange, APY_LIMIT};
 mod external;
 pub use external::*;
 mod r#impl;

common/src/oracle/price_transformer.rs

@@ -40,7 +40,7 @@ pub struct Call {
 }
 
 impl Call {
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     #[allow(clippy::unwrap_used)]
     pub fn new(
         account_id: &near_sdk::AccountIdRef,
@@ -56,7 +56,7 @@ impl Call {
         }
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn new_simple(account_id: &near_sdk::AccountIdRef, method_name: impl Into<String>) -> Self {
         Self::new(
             account_id,
@@ -75,7 +75,7 @@ impl Call {
         )
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(all(not(target_arch = "wasm32"), feature = "rpc"))]
     pub fn rpc_call(&self) -> near_primitives::views::QueryRequest {
         near_primitives::views::QueryRequest::CallFunction {
             account_id: self.account_id.clone(),

contract/lst-oracle/src/lib.rs

@@ -73,7 +73,7 @@ impl Contract {
             .insert(&price_identifier, &entry)
             .is_some()
         {
-            env::panic_str("Price identifier collision");
+            templar_common::panic_with_message("Price identifier collision");
         }
     }
 
@@ -147,10 +147,11 @@ impl Contract {
     ) -> OracleResponse {
         fn callback_result<T: DeserializeOwned>(index: u64) -> T {
             match env::promise_result(index) {
-                PromiseResult::Successful(vec) => {
-                    serde_json::from_slice(&vec).unwrap_or_else(|e| env::panic_str(&e.to_string()))
+                PromiseResult::Successful(vec) => serde_json::from_slice(&vec)
+                    .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string())),
+                PromiseResult::Failed => {
+                    templar_common::panic_with_message(&format!("Promise index {index} failed"))
                 }
-                PromiseResult::Failed => env::panic_str(&format!("Promise index {index} failed")),
             }
         }
 
@@ -163,12 +164,12 @@ impl Contract {
                 result.insert(price_id, price.clone());
             } else {
                 let Some(entry) = self.transformers.get(&price_id) else {
-                    env::panic_str(&format!(
+                    templar_common::panic_with_message(&format!(
                         "No transformer associated with price ID: {price_id}",
                     ));
                 };
                 let Some(price) = oracle_result.get(&entry.price_id) else {
-                    env::panic_str(&format!(
+                    templar_common::panic_with_message(&format!(
                         "Mapped price ID is not in oracle result: {price_id}",
                     ));
                 };

contract/market/src/impl_helper.rs

@@ -20,7 +20,7 @@ impl Contract {
         self.configuration
             .price_oracle_configuration
             .create_price_pair(&oracle_response)
-            .unwrap_or_else(|e| env::panic_str(&e.to_string()))
+            .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string()))
     }
 
     pub fn execute_supply(&mut self, account_id: AccountId, amount: BorrowAssetAmount) {
@@ -64,7 +64,7 @@ impl Contract {
         let snapshot = self.snapshot();
         let mut borrow_position = self.get_or_create_borrow_position_guard(snapshot, account_id);
         if !borrow_position.inner().liquidation_lock.is_zero() {
-            env::panic_str("Cannot add collateral while liquidation locked");
+            templar_common::panic_with_message("Cannot add collateral while liquidation locked");
         }
         let proof = borrow_position.accumulate_interest();
         borrow_position.record_collateral_asset_deposit(proof, amount);
@@ -98,7 +98,7 @@ impl Contract {
         // Returns the amount that should be returned to the borrower.
         borrow_position
             .record_repay(proof, amount)
-            .unwrap_or_else(|e| env::panic_str(&e.to_string()))
+            .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string()))
     }
 }
 
@@ -122,7 +122,9 @@ impl Contract {
 
         let Some(mut borrow_position) = self.borrow_position_guard(snapshot, account_id.clone())
         else {
-            env::panic_str("No borrower record. Please deposit collateral first.");
+            templar_common::panic_with_message(
+                "No borrower record. Please deposit collateral first.",
+            );
         };
 
         let interest = borrow_position.accumulate_interest();
@@ -135,7 +137,7 @@ impl Contract {
                 &price_pair,
                 env::block_timestamp_ms(),
             )
-            .unwrap_or_else(|e| env::panic_str(&e.to_string()));
+            .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string()));
 
         drop(borrow_position);
 
@@ -155,7 +157,9 @@ impl Contract {
     pub fn borrow_02_finalize(&mut self, account_id: AccountId, initial_borrow: InitialBorrow) {
         let snapshot = self.snapshot();
         let Some(mut borrow_position) = self.borrow_position_guard(snapshot, account_id) else {
-            env::panic_str("Invariant violation: borrow position does not exist after transfer.");
+            templar_common::panic_with_message(
+                "Invariant violation: borrow position does not exist after transfer.",
+            );
         };
 
         let proof = borrow_position.accumulate_interest();
@@ -251,13 +255,15 @@ impl Contract {
             .configuration
             .price_oracle_configuration
             .create_price_pair(&oracle_response)
-            .unwrap_or_else(|e| env::panic_str(&e.to_string()));
+            .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string()));
 
         let result = {
             let snapshot = self.snapshot();
             let mut borrow_position = self
                 .borrow_position_guard(snapshot, msg.account_id.clone())
-                .unwrap_or_else(|| env::panic_str("Borrow position does not exist"));
+                .unwrap_or_else(|| {
+                    templar_common::panic_with_message("Borrow position does not exist")
+                });
 
             let proof = borrow_position.accumulate_interest();
 
@@ -269,7 +275,7 @@ impl Contract {
                     &price_pair,
                     env::block_timestamp_ms(),
                 )
-                .unwrap_or_else(|e| env::panic_str(&e.to_string()))
+                .unwrap_or_else(|e| templar_common::panic_with_message(&e.to_string()))
         };
 
         self.configuration
@@ -316,7 +322,9 @@ impl Contract {
         let mut borrow_position = self
             .borrow_position_guard(snapshot, account_id)
             .unwrap_or_else(|| {
-                env::panic_str("Invariant violation: Liquidation of nonexistent position.")
+                templar_common::panic_with_message(
+                    "Invariant violation: Liquidation of nonexistent position.",
+                )
             });
 
         let proof = borrow_position.accumulate_interest();
@@ -341,7 +349,9 @@ impl Contract {
         let snapshot = self.snapshot();
         let Some(mut borrow_position) = self.borrow_position_guard(snapshot, account_id.clone())
         else {
-            env::panic_str("No borrower record. Please deposit collateral first.");
+            templar_common::panic_with_message(
+                "No borrower record. Please deposit collateral first.",
+            );
         };
 
         let proof = borrow_position.accumulate_interest();
@@ -378,7 +388,7 @@ impl Contract {
 
         let snapshot = self.snapshot();
         let Some(mut position) = self.borrow_position_guard(snapshot, account_id.clone()) else {
-            env::panic_str(
+            templar_common::panic_with_message(
                 "Invariant violation: Borrow position must exist after collateral withdrawal.",
             );
         };
@@ -405,7 +415,9 @@ impl Contract {
     ) {
         if matches!(env::promise_result(0), PromiseResult::Failed) {
             let mut yield_record = self.static_yield.get(&account_id).unwrap_or_else(|| {
-                env::panic_str("Invariant violation: static yield entry must exist during callback")
+                templar_common::panic_with_message(
+                    "Invariant violation: static yield entry must exist during callback",
+                )
             });
             yield_record.add_once(amount);
             self.static_yield.insert(&account_id, &yield_record);