一句话：提出 EthCRAFT，通过生成区块链上下文与 RPC 调用，并用多客户端响应交叉验证来检测 RPC 缺陷。
区块链客户端的 RPC 接口应跨节点遵循同一规范，但许多 RPC 缺陷依赖特定区块链上下文触发；现有检测主要生成方法调用，忽视上下文构造。本文提出 EthCRAFT：先探索客户端状态转移程序空间并生成交易来构造上下文，再生成上下文感知的 RPC 调用，并以五个不同客户端实现的响应作为交叉引用预言机来检测缺陷。作者在以太坊客户端 GitHub 问题中的真实 RPC 缺陷上评估，表明其优于现有检测器；在主流客户端新发现六个缺陷，其中一个修复被写入破坏性变更，三个报告获得以太坊基金会漏洞赏金。
Blockchain clients are fundamental software for running blockchain nodes. They provide users with various RPC (Remote Procedure Call) interfaces to interact with the blockchain. These RPC methods are expected to follow the same specification across different blockchain nodes, providing users with seamless interaction. However, there have been continuous reports on various RPC bugs that can cause unexpected responses or even Denial of Service weaknesses. Existing studies on blockchain RPC bug detection mainly focus on generating the RPC method calls for testing blockchain clients. However, a wide range of the reported RPC bugs are triggered in various blockchain contexts. To the best of our knowledge, little attention is paid to generating proper contexts that can trigger these context-dependent RPC bugs. In this work, we propose EthCRAFT, a Context-aware RPC Analysis and Fuzzing Tool for client RPC bug detection. EthCRAFT first proposes to explore the state transition program space of blockchain clients and generate various transactions to construct the context. EthCRAFT then designs a context-aware RPC method call generation method to send RPC calls to the blockchain clients. The responses of five different client implementations are used as cross-referencing oracles to detect the RPC bugs. We evaluate EthCRAFT on real-world RPC bugs collected from the GitHub issues of Ethereum client implementations. Experiment results show that EthCRAFT outperforms existing client RPC detectors by detecting more RPC bugs. Moreover, EthCRAFT has found six new bugs in major Ethereum clients and reported them to the developers. One of the bug fixes has been written into breaking changes in the client’s updates. Three of our bug reports have been offered a vulnerability bounty by the Ethereum Foundation.
@inproceedings{abs-2601-21593,
title = {Is My RPC Response Reliable? Detecting RPC Bugs in Blockchain Client under Context},
author = {Zhijie Zhong and Yuhong Nan and Mingxi Ye and Qing Xue and Jiashui Wang and Long Liu and Xinlei Ying and Zibin Zheng},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773103}
}