docs: add fuzz testing and coverage details to testing.md

docs/security.md

@@ -4,6 +4,15 @@ This document outlines the security considerations, threat model, authorization
 
 ## Threat Model
 
+| Threat | Attacker | Mitigation | Status |
+|---|---|---|---|
+| **Unauthorized sweep** | External attacker / rogue SDK | Ed25519 signature required by SweepController + destination locking | Implemented |
+| **Double-claim** | Replay of a valid sweep call | State machine enforces Active→Swept one-way transition (AlreadySwept error #7) + monotonic nonce on SweepController | Implemented |
+| **Dust attack** | Micro-payment spam to exhaust asset slots | Max 10 assets enforced (TooManyPayments error #14) | Implemented |
+| **Frontrunning** | Miner/validator reorders sweep tx | Signature binds destination + nonce + contract_id; reordering doesn't help attacker | Partially mitigated |
+| **Replay attack** | Reuse of a sweep signature on another account/network | Nonce incremented after each sweep; signature covers contract_id and destination | Implemented |
+| **Upgrade authority abuse** | Unauthorized contract upgrade replacing logic | Soroban contracts are immutable by default; no upgrade authority is set | Implemented |
+
 The Bridgelet Core system is designed to operate in a trust-minimized environment. The following threat vectors have been considered and mitigated:
 
 ### 1. Unauthorized Sweeping

docs/testing.md

@@ -6,6 +6,10 @@ This document explains how to run tests, write new tests, and understand the tes
 
 - [Quick Start](#quick-start)
 - [Running Tests](#running-tests)
+  - [Unit Tests](#unit-tests)
+  - [Integration Tests](#integration-tests)
+  - [Fuzz Testing](#fuzz-testing)
+  - [Test Coverage](#test-coverage)
 - [Testing Strategy](#testing-strategy)
 - [Writing Tests](#writing-tests)
 - [Local Sandbox Testing](#local-sandbox-testing)
@@ -80,6 +84,22 @@ cd contracts/sweep_controller
 cargo test
 ```
 
+### Fuzz Testing
+
+Soroban contracts can be fuzz-tested using [cargo-fuzz](https://rust-fuzz.github.io/book/).
+
+> **Note**: Fuzz targets must be defined in the contract crate under a `fuzz/` directory before running.
+
+```bash
+# Install cargo-fuzz (requires nightly toolchain)
+cargo install cargo-fuzz
+
+# Run a fuzz target (replace <fuzz_target> with the target name defined in fuzz/fuzz_targets/)
+cargo fuzz run <fuzz_target>
+```
+
+See the [Rust Fuzz Book](https://rust-fuzz.github.io/book/) for how to write fuzz targets.
+
 ### Test Coverage
 
 While Rust doesn't have built-in coverage tools, you can use external tools:
@@ -88,8 +108,11 @@ While Rust doesn't have built-in coverage tools, you can use external tools:
 # Install cargo-tarpaulin (coverage tool)
 cargo install cargo-tarpaulin
 
-# Run with coverage
-cargo tarpaulin --out Html
+# Run with coverage and generate an HTML report
+cargo tarpaulin --out Html --output-dir coverage/
+
+# Open the report
+open coverage/tarpaulin-report.html
 ```
 
 ## Testing Strategy
@@ -364,8 +387,13 @@ The project includes test scripts in `scripts/`:
 
 # Deploy to testnet (not local)
 ./scripts/deploy-testnet.sh
+
+# Run the full local sandbox test suite (build + deploy + invoke)
+./scripts/test-local.sh
 ```
 
+> **Note**: `scripts/test-local.sh` automates the sandbox build-deploy-invoke cycle. If it does not exist yet, run the sandbox steps manually as described above.
+
 ### Stopping the Sandbox
 
 ```bash