一句话：提出 DepFuzz，用基于距离的函数依赖引导混合模糊测试，高效生成可暴露漏洞的交易序列。
智能合约模糊测试的关键挑战在于合约的状态性：某些漏洞仅在特定合约状态下才会暴露。现有模糊测试器在测试过程中会生成并执行大量无意义或冗余的交易序列，导致效率下降。DepFuzz 是一种混合模糊测试器，它把符号执行模块引入基于反馈的模糊测试，并利用函数之间基于距离的依赖关系进行引导，从而高效生成有助于暴露漏洞或提升代码覆盖率的有意义交易序列。作者在 286 个基准智能合约和 500 个大型真实智能合约上进行了实验。结果表明，与当前先进方法相比，DepFuzz 在更短时间内取得了更高的指令覆盖率，并发现了更多漏洞。
Fuzzing is an effective technique to detect vulnerabilities in smart contracts. The challenge of smart contract fuzzing lies in the statefulness of contracts, which indicates that certain vulnerabilities can only be manifested in specific contract states. State-of-the-art fuzzers may generate and execute a plethora of meaningless or redundant transaction sequences during fuzzing, incurring a penalty in efficiency. To this end, we present DepFuzz , a hybrid fuzzer for efficient smart contract fuzzing, which introduces a symbolic execution module into the feedback-based fuzzer. Guided by the distance-based function dependencies between functions, DepFuzz can efficiently yield meaningful transaction sequences that contribute to vulnerability exposure or code coverage. The experiments on 286 benchmark smart contracts and 500 large real-world smart contracts corroborate that, compared to state-of-the-art approaches, DepFuzz achieves higher instruction coverage rate and uncovers many more vulnerabilities with less time.
@article{paperbot2886,
title = {DepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance},
author = {Chenyang Ma and Wei Song and Jeff Huang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA2},
year = {2025},
doi = {10.1145/3763185}
}