ECIFuzz: Fuzzing Distributed Databases via Execution Context Independence

This repository contains the source code, experimental data, and reproduction package for ECIFuzz, a context-aware metamorphic fuzzing framework for distributed RDBMSs.

Double-Blind Notice: To comply with the double-blind review process of ASE 2026, all author names, affiliations, and identifying credentials have been anonymized in this repository.

1. Code & Environment Setup

This section describes the prerequisites and steps to build and run the ECIFuzz tool.

Prerequisites

To build and run ECIFuzz, your environment must meet the following requirements:

• Java: Version 11 or higher.
• Maven: For dependency management and building the Java-based fuzzer core.
• Go: Version 1.22 or higher (needed for TiDB test script).

Building the Project

1. Clone or download this repository.
2. Navigate to the project root directory.
3. Build the core SQLancer-based engine using Maven:

   mvn clean package -DskipTests
   

Test the DBMS

First, you need to setup the DBMS to be tested, and make sure it can be accessed via host and password.

Then, in the directiory /ECIFuzz:

For TiDB:

java -jar /ECIFuzz/target/sqlancer-*.jar  --host=YOUR_HOST --username=YOUR_USER_NAME --password="YOUR_PASSWORD" --num-tries 100000 --num-queries 30 --num-threads 1  tidb --oracle DIST --queries-per-batch 5 --use-seed-pool &

For MySQL NDB Cluster:

java -jar /ECIFuzz/target/sqlancer-*.jar --host=YOUR_HOST --username=YOUR_USER_NAME --password="YOUR_PASSWORD" --num-tries 100000 --num-queries 30 --num-threads 1 mysql --oracle DIST --enable-mutate  &

For CockroachDB:

java -jar /ECIFuzz/target/sqlancer-*.jar --host=YOUR_HOST --username=YOUR_USER_NAME --password="YOUR_PASSWORD" --port=26258 --num-tries 100000 --num-queries 30 cockroachdb --oracle DIST --enable-mutate &

2. Evaluation

Detailed Bug List

ECIFuzz has detected 35 unique bugsacross three distributed RDBMSs. The complete list of identified bugs, their types, severity levels, and current statuses are detailed in the table below.

3. Baseline Comparison & Ablation Study Data

This section provides the raw issue links and logs supporting our comparative analysis and ablation studies as presented in the Evaluation section of the paper.

3.1 Baseline Comparison

We compare ECIFuzz against state-of-the-art database testing tools: SQLancer and Radar. Below are the issues successfully detected by each tool during our evaluation campaigns.

SQLancer

• MySQL NDB Cluster:
  • #119721
  • #119722
  • #119723
• TiDB:
  • #65649 (Cast error)
  • #65650 (Predicate pushdown)
  • #65651 (Right join bug)
  • #65653 (Unstable result)
  • #65654 (Precision issue)
• CockroachDB:
  • #160916

Radar

• TiDB: #61949, #61948, #61946, #61947
• MySQL NDB Cluster: #118551, #118552, #118553, #118555, #118556

3.2 Ablation Study

To evaluate the contribution of each component in ECIFuzz, we conducted ablation studies across different configurations.

MySQL NDB Cluster Configurations

• No Tailored Table Generation and Data Population (mysql_no_env):
  • #119663
  • #119665
• No Mutation (mysql_no_mutation):
  • #119663
• Full Framework (mysql_full):
  • #119663, #119665, #119838

TiDB Configurations

• No Tailored Table Generation and Data Population (tidb_no_env):
  • #53290
  • #65981 (New)
• No Mutation (tidb_no_mutation):
  • #53290
  • #65660
• Full Framework (tidb_full):
  • #53290
  • #65660
  • #65661
  • #65662

CockroachDB Configurations

• No Tailored Table Generation and Data Population (cockroachdb_no_env):
  • #160916
  • #149808
• No Mutation (cockroachdb_no_mutation):
  • #164715
  • #160916
• Full Framework (cockroachdb_full):
  • #160916
  • #149808
  • #164715
  • #166385