Build comprehensive fuzz, invariant, and malicious-integration test suites

[stxphxn]

Summary

Stress the complete router with arbitrary multicalls, tokens, pools, signatures, and source failures.

Scope

• Invariant-test asset conservation, allowance cleanup, caller isolation, and quote replay.
• Fuzz native/token directions, exact modes, deadlines, decimals, and rounding.
• Add malicious pools, tokens, callbacks, executors, ERC-1271 signers, and recipients.
• Test forced ETH/token transfers and pre-existing balances.
• Exercise service stale-state, reorg, timeout, and manipulated-response cases.

Acceptance criteria

• No successful call spends another user’s assets or unrelated router balance.
• No sequence leaves an unintended approval or residual balance.
• Reentrant and spoofed callbacks fail.
• Cross-chain and signature-domain mutations fail.
• Seeds and failure artifacts are reproducible in CI.

Dependencies

Complete contract and quote-service MVP.
Inherited ZFi threat model.

Difficulty

Expert — broad stateful adversarial testing across contracts and services.