一句话：提出首个差分模糊测试工具，自动发现 EVM 实现中的安全漏洞。
智能合约依赖以太坊虚拟机（EVM）运行，其漏洞会危害以太坊生态，但 EVM 测试因特殊输入格式和缺乏测试预言而困难。本文提出 EVMFuzzer，首个使用差分模糊测试检测 EVM 漏洞的工具。它通过预定义变异器持续生成种子合约，将其输入目标 EVM 与基准 EVM，并利用动态优先级调度算法选择种子以最大化执行结果的不一致性；最终以多个基准 EVM 作为交叉引用预言，自动判定漏洞。作者在四个广泛使用的 EVM 中发现若干此前未知的安全缺陷，其中 5 个被纳入美国国家漏洞数据库的 CVE 编号。
Ethereum Virtual Machine (EVM) is the run-time environment for smart contracts and its vulnerabilities may lead to serious problems to the Ethereum ecology. With lots of techniques being continuously developed for the validation of smart contracts, the testing of EVM remains challenging because of the special test input format and the absence of oracles. In this paper, we propose EVMFuzzer, the first tool that uses differential fuzzing technique to detect vulnerabilities of EVM. The core idea is to continuously generate seed contracts and feed them to the target EVM and the benchmark EVMs, so as to find as many inconsistencies among execution results as possible, eventually discover vulnerabilities with output cross-referencing. Given a target EVM and its APIs, EVMFuzzer generates seed contracts via a set of predefined mutators, and then employs dynamic priority scheduling algorithm to guide seed contracts selection and maximize the inconsistency. Finally, EVMFuzzer leverages benchmark EVMs as cross-referencing oracles to avoid manual checking. With EVMFuzzer, we have found several previously unknown security bugs in four widely used EVMs, and 5 of which had been included in Common Vulnerabilities and Exposures (CVE) IDs in U.S. National Vulnerability Database. The video is presented at https://youtu.be/9Lejgf2GSOk.
DOI 原文 ·
@inproceedings{paperbot5145,
title = {EVMFuzzer: detect EVM vulnerabilities via fuzz testing},
author = {Ying Fu and Meng Ren and Fuchen Ma and Heyuan Shi and Xin Yang and Yu Jiang and Huizhong Li and Xiang Shi},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3341175}
}