From f4959eb55894caef04578c8d912e8b117f2fa202 Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 16:31:59 -0600
Subject: [PATCH 1/6] test(fuzz): add asset lock/unlock validation fuzz targets

---
 src/Makefile.test.include           |   1 +
 src/test/fuzz/asset_lock_unlock.cpp | 210 ++++++++++++++++++++++++++++
 2 files changed, 211 insertions(+)
 create mode 100644 src/test/fuzz/asset_lock_unlock.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index dd6dda7178c3..2e73d0abaaef 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -278,6 +278,7 @@ test_fuzz_fuzz_SOURCES = \
  test/fuzz/addition_overflow.cpp \
  test/fuzz/addrman.cpp \
  test/fuzz/asmap.cpp \
+ test/fuzz/asset_lock_unlock.cpp \
  test/fuzz/asmap_direct.cpp \
  test/fuzz/autofile.cpp \
  test/fuzz/banman.cpp \
diff --git a/src/test/fuzz/asset_lock_unlock.cpp b/src/test/fuzz/asset_lock_unlock.cpp
new file mode 100644
index 000000000000..b430e91ba9eb
--- /dev/null
+++ b/src/test/fuzz/asset_lock_unlock.cpp
@@ -0,0 +1,210 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <consensus/validation.h>
+#include <evo/assetlocktx.h>
+#include <evo/specialtx.h>
+#include <primitives/transaction.h>
+#include <script/script.h>
+#include <streams.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <version.h>
+
+#include <cassert>
+#include <cstdint>
+#include <exception>
+#include <limits>
+#include <vector>
+
+namespace {
+CScript ConsumeScript(FuzzedDataProvider& fuzzed_data_provider, size_t max_size = 64)
+{
+    const std::vector<uint8_t> raw_script = fuzzed_data_provider.ConsumeBytes<uint8_t>(
+        fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_size));
+    return CScript(raw_script.begin(), raw_script.end());
+}
+
+CScript ConsumeP2PKHScript(FuzzedDataProvider& fuzzed_data_provider)
+{
+    const std::vector<uint8_t> key_hash = fuzzed_data_provider.ConsumeBytes<uint8_t>(20);
+    return CScript() << OP_DUP << OP_HASH160 << key_hash << OP_EQUALVERIFY << OP_CHECKSIG;
+}
+
+CAmount ConsumeAmount(FuzzedDataProvider& fuzzed_data_provider)
+{
+    return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(
+        -1,
+        static_cast<CAmount>(MAX_MONEY) + 1);
+}
+
+std::vector<uint8_t> BuildAssetLockPayload(const uint8_t version, const std::vector<CTxOut>& credit_outputs)
+{
+    CDataStream ds(SER_NETWORK, PROTOCOL_VERSION);
+    ds << version;
+    ds << credit_outputs;
+    return {UCharCast(ds.data()), UCharCast(ds.data() + ds.size())};
+}
+
+CBLSSignature ConsumeBLSSignature(FuzzedDataProvider& fuzzed_data_provider)
+{
+    CBLSSignature sig;
+    auto bytes = fuzzed_data_provider.ConsumeBytes<uint8_t>(CBLSSignature::SerSize);
+    bytes.resize(CBLSSignature::SerSize);
+    sig.SetBytes(bytes, fuzzed_data_provider.ConsumeBool());
+    return sig;
+}
+
+uint256 ConsumeUInt256(FuzzedDataProvider& fuzzed_data_provider)
+{
+    uint256 value;
+    auto it = value.begin();
+    const std::vector<uint8_t> bytes = fuzzed_data_provider.ConsumeBytes<uint8_t>(32);
+    for (uint8_t b : bytes) {
+        *it = b;
+        ++it;
+    }
+    return value;
+}
+
+void initialize_asset_lock_unlock()
+{
+    SelectParams(CBaseChainParams::REGTEST);
+}
+} // namespace
+
+FUZZ_TARGET(asset_lock_tx, .init = initialize_asset_lock_unlock)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+
+    CMutableTransaction tx;
+    tx.nVersion = CTransaction::SPECIAL_VERSION;
+    tx.nType = TRANSACTION_ASSET_LOCK;
+
+    std::vector<CTxOut> credit_outputs;
+    const size_t num_credit_outputs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 4);
+    CAmount credit_outputs_total{0};
+    for (size_t i = 0; i < num_credit_outputs; ++i) {
+        const CAmount amount = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(1, 10 * COIN);
+        assert(MoneyRange(amount));
+        assert(MoneyRange(credit_outputs_total + amount));
+        credit_outputs_total += amount;
+        credit_outputs.emplace_back(amount, ConsumeP2PKHScript(fuzzed_data_provider));
+    }
+
+    SetTxPayload(tx, CAssetLockPayload(credit_outputs));
+
+    tx.vout.emplace_back(credit_outputs_total, CScript() << OP_RETURN << std::vector<uint8_t>{});
+
+    const size_t num_regular_outputs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4);
+    for (size_t i = 0; i < num_regular_outputs; ++i) {
+        tx.vout.emplace_back(ConsumeAmount(fuzzed_data_provider), ConsumeScript(fuzzed_data_provider));
+    }
+
+    const uint8_t scenario = fuzzed_data_provider.ConsumeIntegralInRange<uint8_t>(0, 11);
+    switch (scenario) {
+    case 0: // bad-assetlocktx-type
+        tx.nType = fuzzed_data_provider.ConsumeBool() ? TRANSACTION_ASSET_UNLOCK : TRANSACTION_NORMAL;
+        break;
+    case 1: // bad-assetlocktx-non-empty-return
+        tx.vout[0].scriptPubKey = CScript() << OP_RETURN << fuzzed_data_provider.ConsumeBytes<uint8_t>(
+            fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 16));
+        break;
+    case 2: // bad-assetlocktx-opreturn-outofrange
+        tx.vout[0].nValue = fuzzed_data_provider.ConsumeBool() ? 0 : static_cast<CAmount>(MAX_MONEY) + 1;
+        break;
+    case 3: // bad-assetlocktx-multiple-return
+        tx.vout.emplace_back(1, CScript() << OP_RETURN << std::vector<uint8_t>{});
+        break;
+    case 4: // bad-assetlocktx-no-return
+        tx.vout[0].scriptPubKey = ConsumeScript(fuzzed_data_provider);
+        if (!tx.vout[0].scriptPubKey.empty() && tx.vout[0].scriptPubKey[0] == OP_RETURN) {
+            tx.vout[0].scriptPubKey = CScript() << OP_1;
+        }
+        break;
+    case 5: // bad-assetlocktx-payload
+        tx.vExtraPayload = fuzzed_data_provider.ConsumeBytes<uint8_t>(
+            fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 8));
+        break;
+    case 6: // bad-assetlocktx-version
+        tx.vExtraPayload = BuildAssetLockPayload(
+            fuzzed_data_provider.ConsumeBool() ? uint8_t{0} : std::numeric_limits<uint8_t>::max(),
+            credit_outputs);
+        break;
+    case 7: // bad-assetlocktx-emptycreditoutputs
+        tx.vExtraPayload = BuildAssetLockPayload(CAssetLockPayload::CURRENT_VERSION, {});
+        break;
+    case 8: { // bad-assetlocktx-credit-outofrange
+        auto bad_credit_outputs = credit_outputs;
+        bad_credit_outputs[0].nValue = fuzzed_data_provider.ConsumeBool() ? 0 : static_cast<CAmount>(MAX_MONEY) + 1;
+        tx.vExtraPayload = BuildAssetLockPayload(CAssetLockPayload::CURRENT_VERSION, bad_credit_outputs);
+        break;
+    }
+    case 9: { // bad-assetlocktx-pubKeyHash
+        auto bad_credit_outputs = credit_outputs;
+        bad_credit_outputs[0].scriptPubKey = ConsumeScript(fuzzed_data_provider);
+        if (bad_credit_outputs[0].scriptPubKey.IsPayToPublicKeyHash()) {
+            bad_credit_outputs[0].scriptPubKey = CScript() << OP_1;
+        }
+        tx.vExtraPayload = BuildAssetLockPayload(CAssetLockPayload::CURRENT_VERSION, bad_credit_outputs);
+        break;
+    }
+    case 10: { // bad-assetlocktx-creditamount
+        auto bad_credit_outputs = credit_outputs;
+        bad_credit_outputs[0].nValue += fuzzed_data_provider.ConsumeBool() ? 1 : -1;
+        tx.vExtraPayload = BuildAssetLockPayload(CAssetLockPayload::CURRENT_VERSION, bad_credit_outputs);
+        break;
+    }
+    case 11: // Valid path
+        break;
+    }
+
+    TxValidationState state;
+    const bool result = CheckAssetLockTx(CTransaction(tx), state);
+    assert(result == state.IsValid());
+}
+
+FUZZ_TARGET(asset_lock_tx_raw, .init = initialize_asset_lock_unlock)
+{
+    CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
+    try {
+        const CTransaction tx(deserialize, ds);
+        TxValidationState state;
+        const bool result = CheckAssetLockTx(tx, state);
+        assert(result == state.IsValid());
+    } catch (const std::exception&) {
+    }
+}
+
+FUZZ_TARGET(asset_unlock_fee, .init = initialize_asset_lock_unlock)
+{
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+
+    CMutableTransaction tx;
+    tx.nVersion = CTransaction::SPECIAL_VERSION;
+    tx.nType = TRANSACTION_ASSET_UNLOCK;
+
+    const uint8_t payload_version = fuzzed_data_provider.ConsumeIntegral<uint8_t>();
+    const uint64_t index = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
+    const uint32_t fee = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
+    const uint32_t requested_height = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
+    const uint256 quorum_hash = ConsumeUInt256(fuzzed_data_provider);
+    const CBLSSignature quorum_sig = ConsumeBLSSignature(fuzzed_data_provider);
+    SetTxPayload(tx, CAssetUnlockPayload(payload_version, index, fee, requested_height, quorum_hash, quorum_sig));
+
+    if (fuzzed_data_provider.ConsumeBool()) {
+        // Trigger payload deserialization failures with short/truncated random bytes.
+        tx.vExtraPayload = fuzzed_data_provider.ConsumeBytes<uint8_t>(
+            fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 16));
+    } else if (fuzzed_data_provider.ConsumeBool()) {
+        // Trigger bad-txns-assetunlock-fee-outofrange.
+        SetTxPayload(tx, CAssetUnlockPayload(payload_version, index, 0, requested_height, quorum_hash, quorum_sig));
+    }
+
+    CAmount txfee{0};
+    TxValidationState state;
+    const bool result = GetAssetUnlockFee(CTransaction(tx), txfee, state);
+    assert(result == state.IsValid());
+}

From c80c9f7d1c6aba9071a40eda57ffcac2dcb5e4f8 Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 19:35:21 -0600
Subject: [PATCH 2/6] chore(ci): retrigger flaky sqlite functional test


From fa5e710781e975b187918da32cbb2e1a4970cebe Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 20:58:33 -0600
Subject: [PATCH 3/6] fix: correct alphabetical ordering in
 Makefile.test.include

Move asset_lock_unlock.cpp after asmap_direct.cpp to maintain
alphabetical ordering in the fuzz source list.
---
 src/Makefile.test.include | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 2e73d0abaaef..f4f770154c73 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -278,8 +278,8 @@ test_fuzz_fuzz_SOURCES = \
  test/fuzz/addition_overflow.cpp \
  test/fuzz/addrman.cpp \
  test/fuzz/asmap.cpp \
- test/fuzz/asset_lock_unlock.cpp \
  test/fuzz/asmap_direct.cpp \
+ test/fuzz/asset_lock_unlock.cpp \
  test/fuzz/autofile.cpp \
  test/fuzz/banman.cpp \
  test/fuzz/base_encode_decode.cpp \

From 197187ce0962dc1195daf238f4ef350a6cfc91ff Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:02:29 -0600
Subject: [PATCH 4/6] fix: add fuzz target to non-backported.txt

Required for clang-format CI enforcement on Dash-specific files.
---
 test/util/data/non-backported.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/util/data/non-backported.txt b/test/util/data/non-backported.txt
index 79ba20f5ec2d..d9bb55e077fe 100644
--- a/test/util/data/non-backported.txt
+++ b/test/util/data/non-backported.txt
@@ -50,7 +50,7 @@ src/stacktraces.*
 src/stats/*.cpp
 src/stats/*.h
 src/test/block_reward_reallocation_tests.cpp
-src/test/bls_tests.cpp
+src/test/fuzz/asset_lock_unlock.cppsrc/test/bls_tests.cpp
 src/test/coinjoin_*.cpp
 src/test/dip0020opcodes_tests.cpp
 src/test/dynamic_activation*.cpp

From 0fcd95546ec2608fe5aa0053da6864155ebfb862 Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:46:53 -0600
Subject: [PATCH 5/6] fix: add missing newline in non-backported.txt

---
 test/util/data/non-backported.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/util/data/non-backported.txt b/test/util/data/non-backported.txt
index d9bb55e077fe..2a24e86944ba 100644
--- a/test/util/data/non-backported.txt
+++ b/test/util/data/non-backported.txt
@@ -50,7 +50,8 @@ src/stacktraces.*
 src/stats/*.cpp
 src/stats/*.h
 src/test/block_reward_reallocation_tests.cpp
-src/test/fuzz/asset_lock_unlock.cppsrc/test/bls_tests.cpp
+src/test/fuzz/asset_lock_unlock.cpp
+src/test/bls_tests.cpp
 src/test/coinjoin_*.cpp
 src/test/dip0020opcodes_tests.cpp
 src/test/dynamic_activation*.cpp

From 3c4073c9e42dbb4c732b9684d8d616f1a8647d55 Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:51:45 -0600
Subject: [PATCH 6/6] style: apply clang-format to asset lock fuzz target

---
 src/test/fuzz/asset_lock_unlock.cpp | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/src/test/fuzz/asset_lock_unlock.cpp b/src/test/fuzz/asset_lock_unlock.cpp
index b430e91ba9eb..4a0c0ea9f041 100644
--- a/src/test/fuzz/asset_lock_unlock.cpp
+++ b/src/test/fuzz/asset_lock_unlock.cpp
@@ -35,9 +35,7 @@ CScript ConsumeP2PKHScript(FuzzedDataProvider& fuzzed_data_provider)
 
 CAmount ConsumeAmount(FuzzedDataProvider& fuzzed_data_provider)
 {
-    return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(
-        -1,
-        static_cast<CAmount>(MAX_MONEY) + 1);
+    return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-1, static_cast<CAmount>(MAX_MONEY) + 1);
 }
 
 std::vector<uint8_t> BuildAssetLockPayload(const uint8_t version, const std::vector<CTxOut>& credit_outputs)
@@ -69,10 +67,7 @@ uint256 ConsumeUInt256(FuzzedDataProvider& fuzzed_data_provider)
     return value;
 }
 
-void initialize_asset_lock_unlock()
-{
-    SelectParams(CBaseChainParams::REGTEST);
-}
+void initialize_asset_lock_unlock() { SelectParams(CBaseChainParams::REGTEST); }
 } // namespace
 
 FUZZ_TARGET(asset_lock_tx, .init = initialize_asset_lock_unlock)
@@ -109,8 +104,9 @@ FUZZ_TARGET(asset_lock_tx, .init = initialize_asset_lock_unlock)
         tx.nType = fuzzed_data_provider.ConsumeBool() ? TRANSACTION_ASSET_UNLOCK : TRANSACTION_NORMAL;
         break;
     case 1: // bad-assetlocktx-non-empty-return
-        tx.vout[0].scriptPubKey = CScript() << OP_RETURN << fuzzed_data_provider.ConsumeBytes<uint8_t>(
-            fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 16));
+        tx.vout[0].scriptPubKey = CScript() << OP_RETURN
+                                            << fuzzed_data_provider.ConsumeBytes<uint8_t>(
+                                                   fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 16));
         break;
     case 2: // bad-assetlocktx-opreturn-outofrange
         tx.vout[0].nValue = fuzzed_data_provider.ConsumeBool() ? 0 : static_cast<CAmount>(MAX_MONEY) + 1;
@@ -129,9 +125,9 @@ FUZZ_TARGET(asset_lock_tx, .init = initialize_asset_lock_unlock)
             fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 8));
         break;
     case 6: // bad-assetlocktx-version
-        tx.vExtraPayload = BuildAssetLockPayload(
-            fuzzed_data_provider.ConsumeBool() ? uint8_t{0} : std::numeric_limits<uint8_t>::max(),
-            credit_outputs);
+        tx.vExtraPayload = BuildAssetLockPayload(fuzzed_data_provider.ConsumeBool() ? uint8_t{0}
+                                                                                    : std::numeric_limits<uint8_t>::max(),
+                                                 credit_outputs);
         break;
     case 7: // bad-assetlocktx-emptycreditoutputs
         tx.vExtraPayload = BuildAssetLockPayload(CAssetLockPayload::CURRENT_VERSION, {});