Abstract:Fuzz testing has proven successful in finding security vulnerabilities in large programs. However, traditional fuzz testing tools have a well-known common drawback: they are ineffective if most generated inputs are rejected at the early stage of program running, especially when target programs employ checksum mechanisms to verify the integrity of inputs. This article presents TaintScope, an automatic fuzzing system using dynamic taint analysis and symbolic execution techniques, to tackle the above problem. TaintScope has several novel features: (1) TaintScope is a checksum-aware fuzzing tool. It can identify checksum fields in inputs, accurately locate checksum-based integrity checks by using branch profiling techniques, and bypass such checks via control flow alteration. Furthermore, it can fix checksum values in generated inputs using combined concrete and symbolic execution techniques. (2) TaintScope is a taint-based fuzzing tool working at the x86 binary level. Based on fine-grained dynamic taint tracing, TaintScope identifies the “hot bytes” in a well-formed input that are used in security-sensitive operations (e.g., invoking system/library calls), and then focuses on modifying such bytes with random or boundary values. (3) TaintScope is also a symbolic-execution-based fuzzing tool. It can symbolically evaluate a trace, reason about all possible values that can execute the trace, and then detect potential vulnerabilities on the trace. We evaluate TaintScope on a number of large real-world applications. Experimental results show that TaintScope can accurately locate the checksum checks in programs and dramatically improve the effectiveness of fuzz testing. TaintScope has already found 30 previously unknown vulnerabilities in several widely used applications, including Adobe Acrobat, Flash Player, Google Picasa, and Microsoft Paint. Most of these severe vulnerabilities have been confirmed by Secunia and oCERT, and assigned CVE identifiers (such as CVE-2009-1882, CVE-2009-2688). Vendor patches have been released or are in preparation based on our reports.

A Dynamic Taint Analysis-Based Smart Contract Testing Approach.

Midas: Mining Profitable Exploits in On-Chain Smart Contracts Via Feedback-Driven Fuzzing and Differential Analysis

Smart Contract Vulnerability Detection Technique: A Survey

Detecting Buggy Contracts via Smart Testing

Smart Contract Vulnerability Detection based on Static Analysis and Multi-Objective Search

CrossFuzz: Cross-Contract Fuzzing for Smart Contract Vulnerability Detection

FunFuzz: A Function-oriented Fuzzer for Smart Contract Vulnerability Detection with High Effectiveness and Efficiency

sFuzz2.0: Storage‐access pattern guided smart contract fuzzing

Ethchecker: a context-guided fuzzing for smart contracts

Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing

ConFuzz: Towards Large Scale Fuzz Testing of Smart Contracts in Ethereum

Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers

Research on Security Vulnerability Detection of Smart Contract

Checksum-Aware Fuzzing Combined with Dynamic Taint Analysis and Symbolic Execution.

MuFuzz: Sequence-Aware Mutation and Seed Mask Guidance for Blockchain Smart Contract Fuzzing

EF/CF: High Performance Smart Contract Fuzzing for Exploit Generation

ConvMHSA-SCVD: Enhancing Smart Contract Vulnerability Detection Through a Knowledge-Driven and Data-Driven Framework

Metamorphic Testing for Smart Contract Vulnerabilities Detection

Toward Vulnerability Detection for Ethereum Smart Contracts Using Graph-Matching Network

A dynamic taint tracking optimized fuzz testing method based on multi-modal sensor data fusion

Improving Coverage and Vulnerability Detection in Smart Contract Testing Using Self-Adaptive Learning GA