一句话：提出开源智能合约模糊测试器 Echidna，可轻松自动生成测试以发现断言和自定义属性违规。
以太坊智能合约常控制金融与知识产权交易，其关键作用要求完整、全面且有效的测试生成。本文提出开源智能合约模糊测试器 Echidna，旨在以最小用户成本和最大速度发现真实缺陷。Echidna 安装简单，无需复杂配置或将合约部署到本地区块链，并提供响应式反馈；其默认配置基于实验数据校准。它支持 Truffle、Embark 等常见框架，并可检测断言违规和用户自定义属性违规。Echidna 已用于 10 余次大型付费安全审计，审计反馈推动了其可用性与测试生成策略的改进。
Ethereum smart contracts---autonomous programs that run on a blockchain---often control transactions of financial and intellectual property. Because of the critical role they play, smart contracts need complete, comprehensive, and effective test generation. This paper introduces an open-source smart contract fuzzer called Echidna that makes it easy to automatically generate tests to detect violations in assertions and custom properties. Echidna is easy to install and does not require a complex configuration or deployment of contracts to a local blockchain. It offers responsive feedback, captures many property violations, and its default settings are calibrated based on experimental data. To date, Echidna has been used in more than 10 large paid security audits, and feedback from those audits has driven the features and user experience of Echidna, both in terms of practical usability (e.g., smart contract frameworks like Truffle and Embark) and test generation strategies. Echidna aims to be good at finding real bugs in smart contracts, with minimal user effort and maximal speed.
DOI 原文 ·
@inproceedings{paperbot6054,
title = {Echidna: effective, usable, and fast fuzzing for smart contracts},
author = {Gustavo Grieco and Will Song and Artur Cygan and Josselin Feist and Alex Groce},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3404366}
}