Fuzzing Labs

FuzzingLabs is a Paris-based offensive cybersecurity firm founded in 2019, specializing in vulnerability research, fuzz testing, smart contract security auditing, and security tooling development. The firm applies structured offensive methodologies to firmware, embedded systems, blockchain protocols, and smart contracts, serving clients across Web3, hardware, and enterprise software.

Core Services

FuzzingLabs offers four principal service lines: security assessments and audits, software security engineering (embedding security researchers into client teams throughout the SDLC), applied research and development, and hands-on training courses covering firmware, reverse engineering, and secure coding practices. Their audit methodology follows an eight-phase process: initial consultation, project kickoff, architecture and threat modeling, in-depth code review, dynamic testing and fuzzing, reporting, fix verification, and final sign-off.

Their primary commercial platform is FuzzForge, an AI agent orchestration system designed for continuous offensive validation across firmware, binaries, and embedded systems. FuzzForge automates adversarial testing at scale, enabling clients to integrate security validation directly into CI/CD pipelines rather than treating it as a one-time checkpoint.

Solana-Specific Work

FuzzingLabs has developed meaningful depth in Solana security through both tooling and original research.

Sol-azy is their flagship open-source Solana tool, a unified CLI toolkit for static analysis and reverse engineering of Solana sBPF (Solana Bytecode Format) programs. The tool addresses the problem that analyzing a deployed Solana program previously required juggling multiple separate utilities. Sol-azy combines two engines: a SAST engine using AST-based pattern matching with Starlark scripting to scan Rust source code for vulnerabilities, and a reverse engineering engine that transforms BPF bytecode into readable assembly with annotated Rust equivalents. It reconstructs control flow graphs in Graphviz format, performs dynamic string resolution, and can retrieve on-chain bytecode directly via program ID.

This dual approach covers both open-source Anchor projects via code-level scanning and closed-source deployed programs via bytecode analysis. A November 2025 update added a Recap feature that converts an Anchor project IDL, account attributes, and signer flags into a compact, audit-ready Markdown report, formalizing the reconnaissance phase of an Anchor audit. Sol-azy has accumulated over 100 GitHub stars.

FuzzingLabs has also published research on revival attacks on Solana programs, a class of vulnerability where an attacker prevents proper account closure by refunding lamports within the same transaction, keeping the account rent-exempt and enabling repeated abuse of a closed account to drain staking pools or other on-chain programs. The research details three prevention methods: zeroing out account data, setting a closed account discriminator, and transferring out all lamports, with notes on the Anchor close constraint available from v0.30.0.

Additional Solana research includes an analysis of a crypto syscall vulnerability in Solana virtual machine internals and co-authorship of Fuzz on the Beach: Fuzzing Solana Smart Contracts (arXiv:2309.03006), an academic paper presenting systematic fuzzing approaches for Solana programs.

Broader Blockchain Security Tooling

FuzzingLabs maintains an active open-source presence across multiple blockchain ecosystems. Key repositories include octopus (494 GitHub stars), a security analysis tool for WebAssembly modules and blockchain smart contracts; cairo-fuzzer (130 stars), a fuzzing tool for Cairo and Starknet smart contracts; and mcp-security-hub (759 stars), a collection of MCP servers connecting offensive security tools including Nmap, Ghidra, Nuclei, SQLMap, and Hashcat to AI assistants. Their thoth project (now archived, 272 stars) was a Cairo and Starknet security toolkit for bytecode analysis and decompilation.

Blockchain security coverage extends to protocol design, Layer 1 and Layer 2 implementations, smart contracts, off-chain components, cryptography, and hardware wallets.

Clients and Recognition

FuzzingLabs has worked with major Web3 organizations including the Ethereum Foundation, Coinbase, Sui Foundation, Starkware, Web3 Foundation, Worldcoin, and Filecoin. Outside Web3, the firm counts Meta, Google, Apple, and Amazon among past clients. The team has three Pwn2Own competition wins and has presented research at Black Hat and OffensiveCon.

Tokens and Assets

FuzzingLabs does not issue tokens. The firm operates as a professional services and research organization; its products are security services, open-source tools, and training courses.

Solana Ecosystem Fit

FuzzingLabs addresses a critical gap in Solana security infrastructure: professional, research-grade auditing backed by purpose-built tooling. Sol-azy gives auditors a native toolkit for inspecting both closed-source on-chain deployments and Anchor-based codebases, while published research on revival attacks and syscall vulnerabilities raises developer awareness across the ecosystem. For a blockchain where smart contract exploits result in irreversible fund loss, third-party security firms with native Solana tooling contribute directly to ecosystem health and user trust.