ContractFuzzer: Fuzzing Smart Contracts for Vulnerability Detection

By Bo Jiang, Ye Liu, Wing Kwong Chan. International Conference on Automated Software Engineering, 2018

846 citations recorded by the source corpus.

Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to $60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of $30 million and the freezing of $150 million worth of Ether.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/3785839cb695da8a94602a5e1c067ce1fa3123ec

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Smart Contract Development: Challenges and Opportunities (2021, methodology): “developed ContractFuzzer to detect security vulnerabilities through generating fuzzing inputs and instrumenting EVM [67].”
Survey on blockchain based smart contracts: Applications, opportunities and challenges (2021, methodology): “[255] presented ContractFuzzer which is a comprehensive fuzzing framework to detect 7 types of vulnerabilities in Ethereum smart contracts.”
A Survey on Ethereum Systems Security (2019, methodology): “rom the ability of users to deposit their money to their contract accounts with the inability to spend their money from those accounts, eﬀectively freezing their money. The vulnerability is caused by [46]: (i) contracts not providing any function for spending money relying on the money-spending func”
Superion: Grammar-Aware Greybox Fuzzing (2018, neutral): “It is worth mentioning that application-speciﬁc fuzzers have been attracting great interests, e.g., compiler fuzzing [16, 18, 39, 40, 44, 60], kernel fuzzing [17, 31, 58], IoT (Internet of Things) fuzzing [14], OS fuzzing [49] and smart contract fuzzing [36].”
Combining Graph Neural Networks With Expert Knowledge for Smart Contract Vulnerability Detection (2021, methodology): “By investigating previous works including [8], [17], [31], we design three sub-patterns that are closely related to timestamp dependence.”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, methodology): “Indeed, existing fuzzers for contracts such as Echidna [17] and ContractFuzzer [32] randomly generate sequences of transactions that can fail to cover deeper paths and expose vulnerabilities.”
The Roadmap to 6G Security and Privacy (2021, neutral): “The accurate functionality of smart contacts can be checked by identifying semantic flaws [101], [102], using security check tools [103], [104], [105] and performing formal verification [106]–[109].”
sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts (2020, methodology): “Currently, sFuzz supports 8 oracles inspired by the previous work [18, 22].”
Fuzzing: A Survey for Roadmap (2022, background): “The sequences include system calls for kernel code [77, 95, 142], objects for processors of object-oriented programs [59, 117], application programming interfaces (APIs) for services/libraries [8, 83, 110], or application binary interfaces (ABIs) for smart contracts [86].”
Blockchain smart contracts: Applications, challenges, and future trends (2021, background): “Some studies have given solutions to common vulnerabilities, such as Oyente [59], SmartInspect [15], and ContractFuzzer [47].”
Smart Contract Vulnerability Detection using Graph Neural Network (2020, methodology): “The miner in Ethereum has the freedom to set the timestamp of a block within a short time interval ( < 900 seconds) [ Jiang et al. , 2018 ] .”