test: basic fuzzing (#79)

Adds basic deserialization fuzzing to the library to avoid unexpected
panics. Updates documentation.

Because this is not part of CI, it should be tested manually. To do so,
[install](https://github.com/rust-fuzz/cargo-fuzz) `cargo-fuzz` and run
it with the nightly toolchain until you get bored: `cargo +nightly fuzz
run proofs`

Closes #78.

README.md

@@ -1,6 +1,7 @@
 [![Build](https://circleci.com/gh/tari-project/tari/tree/development.svg?style=svg)](https://circleci.com/gh/tari-project/tari/tree/development)
 ![](https://github.com/tari-project/bulletproofs-plus/workflows/Security%20audit/badge.svg)
 ![](https://github.com/tari-project/bulletproofs-plus/workflows/Clippy/badge.svg)
+![](https://github.com/tari-project/bulletproofs-plus/workflows/Test/badge.svg)
 [![Coverage Status](https://coveralls.io/repos/github/tari-project/bulletproofs-plus/badge.svg?branch=main)](https://coveralls.io/github/tari-project/bulletproofs-plus?branch=main)
 
 
@@ -26,6 +27,10 @@ As always, your mileage may vary.
 
 This implementation uses the excellent [`zeroize`](https://crates.io/crates/zeroize) library to make a best-effort approach at minimizing exposure of value- and mask-related data in memory, as this is often considered sensitive. However, it is difficult in general to guarantee that there are no coding patterns leading to [unintended copies](https://docs.rs/zeroize/1.6.0/zeroize/#stackheap-zeroing-notes) of data, so care should always be taken not to make too many assumptions about the contents of memory.
 
+## Testing
+
+Unit tests are available via `cargo test`. Basic fuzz testing can be run (on a nightly toolchain) via `cargo fuzz`.
+
 ## References
 
 This implementation takes its cue from the `dalek-cryptography` [Bulletproofs](https://github.com/dalek-cryptography/bulletproofs) implementation, as well as the Monero [Bulletproofs+](https://www.getmonero.org/2020/12/24/Bulletproofs+-in-Monero.html) implementation.

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "tari_bulletproofs_plus_fuzz"
+version = "0.0.0"
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.tari_bulletproofs_plus]
+path = ".."
+
+[workspace]
+members = ["."]
+
+[profile.release]
+debug = 1
+
+[[bin]]
+name = "proofs"
+path = "fuzz_targets/proofs.rs"
+test = false
+doc = false

fuzz/fuzz_targets/proofs.rs

@@ -0,0 +1,15 @@
+// Copyright 2023 The Tari Project
+// SPDX-License-Identifier: BSD-3-Clause
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use tari_bulletproofs_plus::ristretto::RistrettoRangeProof;
+
+// Test basic deserialization and canonical serialization
+fuzz_target!(|data: &[u8]| {
+	// If deserialization succeeds, serialization should be canonical
+	if let Ok(proof) = RistrettoRangeProof::from_bytes(data) {
+		assert_eq!(&proof.to_bytes(), data);
+	}
+});