Harvey: a greybox fuzzer for smart contracts
Harvey: a greybox fuzzer for smart contracts
复制标题
DOI：
10.1145/3368089.3417064
复制
发表时间：
2019-05
期刊：
影响因子：
--
通讯作者：
Valentin Wüstholz;M. Christakis
中科院分区：
文献类型：
--
作者：
Valentin Wüstholz;M. Christakis
我们介绍了Harvey，这是一款用于智能合约的工业灰箱毛发，是管理区块链上账户的程序。Greybox Fuzing是一种轻量级测试生成方法，可以有效地检测错误和安全漏洞。然而，Greybox模糊器随机地改变程序输入以执行新的路径；这使得覆盖由窄检查保护的代码变得具有挑战性。此外，大多数现实世界中的智能合约在其生命周期内会经历许多不同的状态，例如，拍卖中的每一次出价。为了探索这些状态，从而检测深度漏洞，灰盒模糊将需要生成合同交易序列，例如，通过创建来自多个用户的出价，同时保持搜索空间和测试套件易于处理。在这篇文章中，我们解释了哈维如何通过两项关键技术来缓解这两个挑战。首先，哈维用一种预测新输入的方法扩展了标准的灰盒模糊，这些新输入更有可能覆盖新的路径或揭示智能合同中的漏洞。其次，它以一种有针对性和需求驱动的方式模糊了交易序列。我们已经在27份现实世界的合同上评估了我们的方法。我们的实验表明，我们的技术显著提高了Harvey在实现高覆盖和检测漏洞方面的有效性，在大多数情况下速度要快一个数量级。
We present Harvey, an industrial greybox fuzzer for smart contracts, which are programs managing accounts on a blockchain. Greybox fuzzing is a lightweight test-generation approach that effectively detects bugs and security vulnerabilities. However, greybox fuzzers randomly mutate program inputs to exercise new paths; this makes it challenging to cover code that is guarded by narrow checks. Moreover, most real-world smart contracts transition through many different states during their lifetime, e.g., for every bid in an auction. To explore these states and thereby detect deep vulnerabilities, a greybox fuzzer would need to generate sequences of contract transactions, e.g., by creating bids from multiple users, while keeping the search space and test suite tractable. In this paper, we explain how Harvey alleviates both challenges with two key techniques. First, Harvey extends standard greybox fuzzing with a method for predicting new inputs that are more likely to cover new paths or reveal vulnerabilities in smart contracts. Second, it fuzzes transaction sequences in a targeted and demand-driven way. We have evaluated our approach on 27 real-world contracts. Our experiments show that our techniques significantly increase Harvey's effectiveness in achieving high coverage and detecting vulnerabilities, in most cases orders-of-magnitude faster.