Trident: guided fuzzing for Anchor programs

Trident: guided fuzzing for Anchor programs. Trident (Ackee Blockchain) is a Rust fuzzer purpose-built for Solana: up to thousands of transactions per second, Anchor-like macros, and manually guided strategies so the search stays on realistic program flows instead of pure random instruction soup.

Click to zoom

Why guided fuzzing

Black-box random txs thrash the SVM but rarely build the account graphs your program needs (mint → ATA → vault → authority). Unit tests cover the paths you already understand. Guided fuzzing sits between them: you specify setup → action permutations → teardown; Trident mutates data and ordering inside those rails and watches for panics, constraint failures, and invariant breaks.

Install and scaffold

# CLI
cargo install trident-cli

# inside an Anchor workspace
trident init
# generates fuzz test scaffolding from IDL when available

trident fuzz run <fuzz_target>
# or follow current CLI subcommands from usetrident.xyz / README

Prefer pinning a release that matches your Anchor version. Ackee documents IDL-driven generation so instruction builders stay aligned with the program interface.

Writing a guided target

Structure mirrors how a real user (or attacker) would call the program:

1. Setup — create mints, fund payers, initialize config PDAs with legal constraints.
2. Sequence body — deposit / withdraw / update / close in orders that matter; allow Trident to shuffle and mutate amounts, seeds, and optional accounts inside bounds you define.
3. Invariants — vault balance vs sum of user shares, authority still the expected pubkey, no token account with wrong owner.

// Illustrative shape — check Trident macros for your installed version
// Fuzz transactions are built with Anchor-like instruction helpers.

fn fuzz_escrow_flow(fuzzer: &mut Fuzzer) {
    // 1) always-valid setup
    initialize_escrow(fuzzer);

    // 2) guided permutations
    match fuzzer.gen_range(0..3) {
        0 => deposit_random(fuzzer),
        1 => withdraw_random(fuzzer),
        _ => cancel_random(fuzzer),
    }

    // 3) invariant: vault tokens == sum of open escrows
    assert_vault_consistent(fuzzer);
}

The value is the middle step: random legal-looking calls that still violate a missing has_one, an unchecked account, or a CPI signer seed typo.

What it typically finds

• Missing or incomplete account constraints on Anchor contexts
• Token amount / decimals edge cases and empty vault paths
• Unauthorized state transitions (wrong authority still succeeds)
• Reinitialization / close-and-reuse surprises

When a campaign crashes, keep the seed and replay under Seer or a minimal LiteSVM test so the fix is regression-locked.

Ops tips

People and links

Resources

• Trident site
• GitHub — Ackee-Blockchain/trident
• QuickNode — How to fuzz with Trident
• Seer debugger
• Ackee Blockchain