Clean up warnings and reduce readme (#46)

Author: AgeManning

README.md

@@ -13,12 +13,12 @@ SSV (Secret Shared Validator) is a protocol that enables the distributed control
 - Message receiving pipeline
 
 ### Differential Fuzzing
-**Critical for network security**: Compares behavior between Go and Rust SSV implementations to identify discrepancies that could cause:
-- **Network splits** due to consensus disagreements
-- **Chain forks** from encoding/validation differences  
-- **Validator penalties** from inconsistent message handling
+Critical for network security: Compares behavior between Go and Rust SSV implementations to identify discrepancies that could cause:
+- Network splits due to consensus disagreements
+- Chain forks from encoding/validation differences  
+- Validator penalties from inconsistent message handling
 
-See [`diff_fuzzing/README.md`](diff_fuzzing/README.md) for detailed information about differential fuzzing targets, risk assessment, and implementation roadmap.
+Check out [TROPHY.md](TROPHY.md) to see real bugs and discrepancies discovered through differential fuzzing that have been fixed in both implementations.
 
 ## Prerequisites
 
@@ -117,60 +117,54 @@ cargo afl build --bin diff_fuzz_split
 
 ## Fuzzing Targets
 
-This project includes two categories of fuzzing targets:
-
-### 📋 Standard Fuzzing Targets (Traditional Component Testing)
-1. **validate_ssv_message**: Tests SSVMessage validation against malformed messages
-2. **qbft_target**: Tests the QBFT consensus mechanism with arbitrary messages
-3. **receive_target**: Tests the message receiving pipeline
-4. **custom_ssz**: Tests SSZ encoding/decoding implementations
-5. **combine_signatures**: Tests BLS signature combination functionality
-6. **fuzz_key_id_try_from**: Tests KeyId conversion operations
-
-### 🔄 Differential Fuzzing Targets (Go vs Rust Comparison)
-
-**High Priority Network Split Risk Targets:**
-7. **diff_fuzz_ssv_message_encode_decode**: SSVMessage encoding/decoding comparison between Go and Rust
-8. **diff_fuzz_qbft_message_encode_decode**: QBFT message serialization comparison 
-9. **diff_fuzz_message_id_generation**: MessageID construction and parsing comparison
-
-**Medium Priority Validator/Committee Issues:**
-10. **diff_fuzz_signed_ssv_msg_decode_encode**: Differential fuzzing for message decode/encode operations
-11. **diff_fuzz_structured_signed_ssv_msg_decode_encode**: Differential fuzzing for structured message operations
-12. **diff_fuzz_split**: Differential fuzzing for key splitting implementations
-13. **diff_fuzz_partial_signature_validation**: Partial signature validation comparison
-14. **diff_fuzz_committee_quorum_calculation**: Committee quorum calculation comparison
-15. **diff_fuzz_message_validation_state**: Message validation state comparison
-
-**Lower Priority Performance/Edge Cases:**
-16. **diff_fuzz_round_change_handling**: Round change handling comparison
-17. **diff_fuzz_justification_validation**: Justification validation comparison
-
-> **Note**: Differential fuzzing targets compare behavior between Go (ssv-spec) and Rust (Anchor) implementations to identify discrepancies that could cause network splits or consensus failures.
+### Standard Targets (Component Testing)
+- `validate_ssv_message` - SSVMessage validation
+- `qbft_target` - QBFT consensus mechanism
+- `custom_ssz` - SSZ encoding/decoding
+- `receive_target` - Message receiving pipeline
+- `combine_signatures` - BLS signature combination
+- `fuzz_key_id_try_from` - KeyId conversion
+- `fuzz_database_states` - Database states consistency
+
+### Differential Targets (Go vs Rust Comparison)
+
+High Priority (Network Split Risk):
+- `diff_fuzz_qbft` - QBFT consensus state machine
+- `diff_fuzz_ssv_message_encode_decode` - SSVMessage serialization
+- `diff_fuzz_complete_message_validation` - Complete validation pipeline
+- `diff_fuzz_message_id_generation` - MessageID construction
+- `diff_fuzz_validator_consensus_data_decode_encode` - Validator consensus data
+
+Medium Priority (Validator/Committee Issues):
+- `diff_fuzz_signed_ssv_msg_decode_encode` - Basic signed message encoding
+- `diff_fuzz_structured_signed_ssv_msg_decode_encode` - Structured message parsing
+- `diff_fuzz_split` - Key splitting
+- `diff_fuzz_partial_signature_validation` - Partial signature validation
+- `diff_fuzz_committee_quorum_calculation` - Quorum calculation
+- `diff_fuzz_message_validation_state` - Message validation state
+
+Lower Priority (Performance/Edge Cases):
+- `diff_fuzz_round_change_handling` - Round change mechanism
+- `diff_fuzz_justification_validation` - Justification validation
 
 ## Running Fuzz Tests
 
-### 🚀 Interactive Fuzzing Script (Recommended)
+### Interactive Fuzzing Script (Recommended)
 
-The **run_fuzzer.sh** script is the primary interface for all fuzzing operations and includes enhanced capabilities:
+The `run_fuzzer.sh` script is the primary interface for all fuzzing operations:
 
 ```bash
 ./run_fuzzer.sh
 ```
 
-**🎯 Complete Fuzzing Workflow:**
-- **Target Selection**: Interactive menu with all 17+ fuzzing targets (standard + differential)
-- **Integrated Corpus Generation**: Built-in option to generate optimized test cases using the intelligent corpus generator
-- **Built-in Crash Analysis**: Analyze and debug crashes found during fuzzing sessions
-- **Build Management**: Handles AFL++ instrumentation and compilation
-- **Session Management**: Seamless resuming of previous fuzzing sessions
-- **Real-time Monitoring**: Built-in statistics and progress tracking
-- **Smart Setup**: Creates proper directory structure and dependencies
-
-**Key Features:**
-- **Integrated corpus generation**: Access to corpus generation directly from the fuzzing script menu
-- **Crash debugging support**: Integrated tools for analyzing discovered crashes and implementation discrepancies
-- **One-stop fuzzing**: Everything from setup to analysis in a single interactive interface
+Features:
+- Target selection with interactive menu
+- Integrated corpus generation
+- Built-in crash analysis
+- Build management with AFL++ instrumentation
+- Session management and resuming
+- Real-time monitoring and statistics
+- Automatic directory structure setup
 
 ### Manual Setup (Optional)
 
@@ -193,64 +187,25 @@ cargo afl fuzz -i afl_workdir/validate_ssv_message/input -o afl_workdir/validate
 
 ## Corpus Generation
 
-### Integrated Corpus Generation
-
-The **run_fuzzer.sh** script includes corpus generation as a built-in option, providing easy access to the intelligent corpus generator:
-
-- **Menu-driven corpus generation**: Select corpus generation from the script's interactive menu
-- **Target-specific optimization**: Generate test cases tailored for specific fuzzing targets
-- **Structural variation strategy**: Maximize AFL coverage with high-quality, non-redundant test cases
-- **Efficiency optimization**: Achieve 20-75% efficiency (unique files after afl-cmin)
-- **Seamless integration**: No need to leave the fuzzing script to generate corpus
+The `run_fuzzer.sh` script includes built-in corpus generation accessible from the menu. It provides target-specific optimization and structural variation for maximum AFL coverage.
 
-### Manual Corpus Generator (Optional)
-
-For advanced users who want manual control over corpus generation:
+For manual control:
 
 ```bash
 cd corpus_generator
-cargo run  # Interactive mode - shows all available targets
-cargo run -- <target_name>  # Generate corpus for specific target
+cargo run  # Interactive mode
+cargo run -- <target_name>  # Generate for specific target
 ```
 
-**Supported targets:**
-- `diff_fuzz_ssv_message_encode_decode`
-- `diff_fuzz_qbft_message_encode_decode` 
-- `diff_fuzz_message_id_generation`
-- `diff_fuzz_signed_ssv_msg_decode_encode`
-- `diff_fuzz_structured_signed_ssv_msg_decode_encode`
-- `diff_fuzz_split`
-- `diff_fuzz_partial_signature_validation`
-- `diff_fuzz_committee_quorum_calculation`
-- `diff_fuzz_message_validation_state`
-- `diff_fuzz_round_change_handling`
-- `diff_fuzz_justification_validation`
-
-> **Note**: Manual corpus generation is only needed for specialized testing scenarios. The run_fuzzer.sh script provides corpus generation as an integrated option.
-
 ## Advanced Usage
 
 ### Corpus Management
 
-The fuzzing script automatically handles:
-- **Resuming sessions**: Detects existing fuzzing results and offers to resume
-- **Input generation**: Creates basic test cases for new targets automatically
-- **Directory management**: Sets up proper input/output directory structure
+The fuzzing script automatically handles session resuming, input generation, and directory management.
 
 For manual corpus management:
-- **Generate optimized corpus**: Use the corpus generator (see above) before fuzzing
-- **Minimize corpus**: Use `afl-cmin -i afl_workdir/<target>/output/queue -o minimized_corpus -- target/debug/<target>`
-- **View statistics**: Use `cargo afl whatsup -s afl_workdir/<target>/output` or select option 2 in the fuzzing script
-
-### Fuzzing Script Features
-
-The `run_fuzzer.sh` script provides:
-- **Interactive menu**: Easy target selection from all available fuzzing targets
-- **Automatic setup**: Creates input/output directories and basic test cases
-- **Smart resuming**: Detects previous sessions and offers to continue
-- **Build integration**: Automatically builds targets with AFL instrumentation
-- **Statistics viewing**: Built-in stats display for monitoring progress
-- **Error handling**: Validates dependencies and project structure
+- Minimize corpus: `afl-cmin -i afl_workdir/<target>/output/queue -o minimized_corpus -- target/debug/<target>`
+- View statistics: `cargo afl whatsup -s afl_workdir/<target>/output`
 
 ## Project Structure
 

TROPHY.md

@@ -0,0 +1,63 @@
+# Trophy Case
+
+This document tracks bugs and implementation discrepancies discovered through differential fuzzing between the Anchor (Rust) and SSV (Go) implementations. 
+
+**Note**: This is an ongoing effort. The issues listed here are current findings, and more discrepancies are likely to be discovered as fuzzing continues.
+
+## Discovered Issues
+
+### Anchor (Rust) Implementation
+
+1. **Bump round on future justified proposal** ([PR #529](https://github.com/sigp/anchor/pull/529))
+   - Issue: Incorrect round handling when receiving justified proposals from future rounds
+   - Impact: Could cause validators to remain stuck in old rounds
+
+2. **Allow reaching consensus in PREPARE state** ([PR #527](https://github.com/sigp/anchor/pull/527))
+   - Issue: Consensus logic prevented valid state transitions from PREPARE
+   - Impact: Potential liveness issues in certain consensus scenarios
+
+3. **Validation for prepared round changes before insertion** ([PR #528](https://github.com/sigp/anchor/pull/528))
+   - Issue: Missing validation before inserting prepared round change messages
+   - Impact: Could allow invalid messages into the state machine
+
+4. **Store messages without full data** ([PR #538](https://github.com/sigp/anchor/pull/538))
+   - Issue: Message storage logic required unnecessary full data
+   - Impact: Memory inefficiency and potential state inconsistencies
+
+5. **Partial roundchange quorum** ([PR #541](https://github.com/sigp/anchor/pull/541))
+   - Issue: Incorrect quorum calculation for partial round change sets
+   - Impact: Could prevent or incorrectly trigger round changes
+
+6. **COMMIT and PREPARE must be of the exact current round** ([PR #530](https://github.com/sigp/anchor/pull/530))
+   - Issue: Accepted COMMIT and PREPARE messages from incorrect rounds
+   - Impact: State machine could process out-of-order messages incorrectly
+
+7. **Check round change quorum disregarding root** ([PR #571](https://github.com/sigp/anchor/pull/571))
+   - Issue: Round change quorum logic incorrectly considered root values
+   - Impact: Could prevent legitimate round changes from completing
+
+### SSV (Go) Implementation
+
+1. **Threshold key split validation of 0** ([PR #2466](https://github.com/ssvlabs/ssv/pull/2466))
+   - Issue: Missing validation for zero threshold in key splitting
+   - Impact: Could create invalid key shares with zero threshold
+
+2. **Redundant Round-Change message** ([Issue #579](https://github.com/ssvlabs/ssv-spec/issues/579))
+   - Issue: Implementation sent redundant round change messages
+   - Impact: Network bandwidth waste and potential confusion in consensus
+
+3. **Comparison mismatched** ([Issue #580](https://github.com/ssvlabs/ssv-spec/issues/580))
+   - Issue: Inconsistent comparison logic between implementations
+   - Impact: Could cause different validation results for the same input
+
+4. **Add message validation rule** ([Issue #582](https://github.com/ssvlabs/ssv-spec/issues/582))
+   - Issue: Missing validation rule that Rust implementation enforced
+   - Impact: Could accept invalid messages that should be rejected
+
+## Contributing
+
+If you discover additional issues through fuzzing:
+1. Verify the discrepancy is reproducible
+2. Create a minimal test case
+3. Report to the relevant implementation team
+4. Submit a PR adding the issue to this trophy case

corpus_generator/src/generators/message_validation_state.rs

@@ -372,6 +372,10 @@ impl SSVMessageBuilder {
                 msg.signatures = vec![vec![1; 256]]; // Only one signature
                 msg
             }
+            "round_change" => {
+                // RoundChange messages are critical for consensus liveness
+                self.create_consensus_message(rng, QBFTMsgType::RoundChangeMsgType)
+            }
             _ => self.create_consensus_message(rng, QBFTMsgType::ProposalMsgType),
         }
     }
@@ -510,6 +514,12 @@ impl MessageValidationStateGenerator {
         CorpusUtils::save_corpus_file(output_dir, "validation_sig_mismatch", &mismatch_data)?;
         count += 1;
 
+        // RoundChange message case
+        let round_change_msg = builder.create_edge_case_message(rng, "round_change");
+        let round_change_data = create_corpus_entry_with_context(20, 300, 9, &round_change_msg);
+        CorpusUtils::save_corpus_file(output_dir, "validation_round_change", &round_change_data)?;
+        count += 1;
+        
         Ok(count)
     }