一句话：提出智能合约模糊测试器 sFuzz，融合 AFL 策略与轻量级多目标自适应策略，高效覆盖难达分支并发现漏洞。
智能合约是运行在区块链上的图灵完备程序，常管理有价值的数字资产，而 Solidity 是以太坊上最流行的合约语言。与传统程序不同，合约一旦部署就难以修补，因此部署前的充分测试至关重要。本文提出面向以太坊智能合约的自适应模糊测试器 sFuzz。与已有 Solidity 模糊测试工具相比，sFuzz 将 AFL 模糊测试器的策略与一种高效的轻量级多目标自适应策略相结合，专门针对难以覆盖的分支进行探索，从而在有限测试预算下提升覆盖率与漏洞发现能力。作者将 sFuzz 应用于 4000 多个真实智能合约进行实验，结果表明：sFuzz 效率高，比当时最先进的工具快约两个数量级；能够取得较高的代码覆盖率并发现漏洞；且其内部不同模糊测试策略之间具有互补性。
Smart contracts are Turing-complete programs that execute on the infrastructure of the blockchain, which often manage valuable digital assets. Solidity is one of the most popular programming languages for writing smart contracts on the Ethereum platform. Like traditional programs, smart contracts may contain vulnerabilities. Unlike traditional programs, smart contracts cannot be easily patched once they are deployed. It is thus important that smart contracts are tested thoroughly before deployment. In this work, we present an adaptive fuzzer for smart contracts on the Ethereum platform called sFuzz. Compared to existing Solidity fuzzers, sFuzz combines the strategy in the AFL fuzzer and an efficient lightweight multi-objective adaptive strategy targeting those hard-to-cover branches. sFuzz has been applied to more than 4 thousand smart contracts and the experimental results show that (1) sFuzz is efficient, e.g., two orders of magnitude faster than state-of-the-art tools; (2) sFuzz is effective in achieving high code coverage and discovering vulnerabilities; and (3) the different fuzzing strategies in sFuzz complement each other.
DOI 原文 ·
@inproceedings{paperbot5611,
title = {sFuzz},
author = {Tai D. Nguyen and Long H. Pham and Jun Sun and Yun Lin and Quang Tran Minh},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380334}
}