ItyFuzz: Snapshot-Based Fuzzer for Smart Contract
ItyFuzz: Snapshot-Based Fuzzer for Smart Contract
复制标题
DOI：
10.1145/3597926.3598059
复制
发表时间：
2023-06
期刊：
影响因子：
--
通讯作者：
Chaofan Shou;Shangyin Tan;Koushik Sen
中科院分区：
文献类型：
--
作者：
Chaofan Shou;Shangyin Tan;Koushik Sen
智能合约是关键的金融工具，其安全至关重要。但是，由于所有交易背后的持续区块链状态，智能合同计划很难模糊。突变交易序列是复杂的，通常会导致输入和程序空间的次优探索。在本文中，我们介绍了一种基于快照的小型绒毛ityfuzz，用于测试智能合约。在Ityfuzz中，我们可以捕捉和辛格尔顿交易，而不是存储交易的序列并突变它们。为了探索有趣的状态，Ityfuzz引入了数据流航路点机制，以识别具有更多潜在动量的状态。 Ityfuzz还结合了比较路点，以修剪国家的空间。通过维护状态的快照，Ityfuzz可以快速综合混凝土漏洞，例如快速重新进入攻击。由于ItyFuzz具有测试智能合约的第二级响应时间，因此可以用于链测试，与本地开发测试相比，它具有许多好处。最后，我们评估了现实世界中智能合约的Ityfuzz和一些被黑的链内defi项目。 Ityfuzz在教学覆盖范围方面优于现有的杂模，可以快速找到并为链上的项目找到现实的利用。
Smart contracts are critical financial instruments, and their security is of utmost importance. However, smart contract programs are difficult to fuzz due to the persistent blockchain state behind all transactions. Mutating sequences of transactions are complex and often lead to a suboptimal exploration for both input and program spaces. In this paper, we introduce a novel snapshot-based fuzzer ItyFuzz for testing smart contracts. In ItyFuzz, instead of storing sequences of transactions and mutating from them, we snapshot states and singleton transactions. To explore interesting states, ItyFuzz introduces a dataflow waypoint mechanism to identify states with more potential momentum. ItyFuzz also incorporates comparison waypoints to prune the space of states. By maintaining snapshots of the states, ItyFuzz can synthesize concrete exploits like reentrancy attacks quickly. Because ItyFuzz has second-level response time to test a smart contract, it can be used for on-chain testing, which has many benefits compared to local development testing. Finally, we evaluate ItyFuzz on real-world smart contracts and some hacked on-chain DeFi projects. ItyFuzz outperforms existing fuzzers in terms of instructional coverage and can find and generate realistic exploits for on-chain projects quickly.