Abstract:Blockchain smart contracts have given rise to a variety of interesting and compelling applications and emerged as a revolutionary force for the Internet. Quite a few practitioners have devoted themselves to developing tools for detecting bugs in smart contracts. One line of efforts revolve around static analysis techniques, which heavily suffer from high false-positive rates. Another line of works concentrate on fuzzing techniques. Unfortunately, current fuzzing approaches for smart contracts tend to conduct fuzzing starting from the initial state of the contract, which expends too much energy revolving around the initial state and thus is usually unable to unearth bugs triggered by other states. Moreover, most existing methods treat each branch equally, failing to take care of the branches that are rare or more likely to possess bugs. This might lead to resources wasted on normal branches. In this paper, we try to tackle these challenges from three aspects: (1) In generating function invocation sequences, we explicitly consider data dependencies between functions to facilitate exploring richer states. We further prolong a function invocation sequence S1 by appending a new sequence S2, so that S2 can start fuzzing from states that are different from the initial state. (2) We incorporate a branch distance-based measure to evolve test cases iteratively towards a target branch. (3) We engage a branch search algorithm to discover rare and vulnerable branches, and design an energy allocation mechanism to take care of exercising these crucial branches. We implement IR-Fuzz and extensively evaluate it over 12K real-world contracts. Empirical results show that: (i) IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzing approaches, and (ii) IR-Fuzz detects more vulnerabilities and increases the average accuracy of vulnerability detection by 7% over current methods.

sFuzz2.0: Storage‐access pattern guided smart contract fuzzing

Midas: Mining Profitable Exploits in On-Chain Smart Contracts Via Feedback-Driven Fuzzing and Differential Analysis

FunFuzz: A Function-oriented Fuzzer for Smart Contract Vulnerability Detection with High Effectiveness and Efficiency

MuFuzz: Sequence-Aware Mutation and Seed Mask Guidance for Blockchain Smart Contract Fuzzing

CrossFuzz: Cross-Contract Fuzzing for Smart Contract Vulnerability Detection

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

ItyFuzz: Snapshot-Based Fuzzer for Smart Contract

MorFuzz: Fuzzing Processor Via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation.

xFuzz: Machine Learning Guided Cross-Contract Fuzzing

Rethinking Smart Contract Fuzzing: Fuzzing With Invocation Ordering and Important Branch Revisiting

EF/CF: High Performance Smart Contract Fuzzing for Exploit Generation

Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers

ConFuzz: Towards Large Scale Fuzz Testing of Smart Contracts in Ethereum

Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing

Ethchecker: a context-guided fuzzing for smart contracts

LLM4Fuzz: Guided Fuzzing of Smart Contracts with Large Language Models

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

Fuzz on the Beach: Fuzzing Solana Smart Contracts

Detecting Buggy Contracts via Smart Testing

DogeFuzz: A Simple Yet Efficient Grey-box Fuzzer for Ethereum Smart Contracts

V-Fuzz: Vulnerability Prediction-Assisted Evolutionary Fuzzing for Binary Programs