区块链测试：一个Bug让5亿美元资产蒸发，测试人员如何守住最后防线？

// 脆弱合约
contract Vulnerable {
    mapping(address => uint) public balances;
    
    function withdraw(uint _amount) public {
        require(balances[msg.sender] >= _amount);
        (bool success, ) = msg.sender.call{value: _amount}("");
        require(success);
        balances[msg.sender] -= _amount;
    }
}

// 攻击合约
contract Attacker {
    Vulnerable public vulnerable;
    
    function attack() public payable {
        vulnerable.withdraw(1 ether);
    }
    
    receive() external payable {
        if (address(vulnerable).balance >= 1 ether) {
            vulnerable.withdraw(1 ether);
        }
    }
}

# 模拟一个节点完全失联
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: node-isolation
spec:
  action: partition
  mode: one
  selector:
    namespaces:
      - blockchain
    labelSelectors:
      node-type: validator
  direction: both
  target:
    mode: all
    selector:
      namespaces:
        - blockchain

def test_state_consistency():
    nodes = get_all_validator_nodes()
    state_roots = [node.get_state_root() for node in nodes]
    assert len(set(state_roots)) == 1, f"状态不一致: {state_roots}"
    
    # 模拟网络分区后恢复
    partition_network(50% nodes)
    wait_for_consensus(30)
    heal_network()
    wait_for_sync(60)
    
    final_roots = [node.get_state_root() for node in nodes]
    assert len(set(final_roots)) == 1, "分区后状态不一致"

# .github/workflows/blockchain-test.yml
jobs:
  unit-test:
    runs-on: ubuntu-latest
    steps:
      - run: forge test --match-path "test/unit/*" --gas-report
      
  integration-test:
    runs-on: ubuntu-latest
    services:
      anvil:
        image: ghcr.io/foundry-rs/foundry:latest
        ports:
          - 8545:8545
    steps:
      - run: forge script script/Deploy.s.sol --rpc-url http://localhost:8545
      - run: forge test --match-path "test/integration/*"
      
  fuzz-test:
    runs-on: ubuntu-latest
    steps:
      - run: echidna-test src/ --contract Vulnerable --config echidna.yaml
      
  deployment:
    needs: [unit-test, integration-test, fuzz-test]
    if: github.ref == 'refs/heads/main'
    steps:
      - run: forge script script/Deploy.s.sol --rpc-url $PRODUCTION_RPC

// 简化版漏洞代码
function withdraw(uint _amount) public {
    require(balances[msg.sender] >= _amount);
    balances[msg.sender] -= _amount;
    totalSupply -= _amount; // 这里没有检查下溢
    // 攻击者让totalSupply变成极大值
    // 然后利用跨链桥的验证逻辑，伪造存款证明
}