一句话：提出结合静态与动态数据流分析的智能合约模糊测试工具SMARTIAN，有效发现真实合约漏洞。
智能合约由一系列共享持久状态的交易组成，传统模糊测试难以发现关键交易序列。本文提出SMARTIAN，将静态与动态数据流分析结合到模糊测试中。首先静态分析合约字节码，预测哪些交易序列值得测试并提取每笔交易需满足的约束，用于构建初始种子语料；模糊测试过程中进行轻量级动态数据流分析，收集数据流反馈以指导测试。SMARTIAN无需源码即可在真实合约中发现漏洞。实验表明，它在发现真实合约已知CVE方面优于现有先进工具，代码覆盖率也更高。
Unlike traditional software, smart contracts have the unique organization in which a sequence of transactions shares persistent states. Unfortunately, such a characteristic makes it difficult for existing fuzzers to find out critical transaction sequences. To tackle this challenge, we employ both static and dynamic analyses for fuzzing smart contracts. First, we statically analyze smart contract bytecodes to predict which transaction sequences will lead to effective testing, and figure out if there is a certain constraint that each transaction should satisfy. Such information is then passed to the fuzzing phase and used to construct an initial seed corpus. During a fuzzing campaign, we perform a lightweight dynamic data-flow analysis to collect data-flow-based feedback to effectively guide fuzzing. We implement our ideas on a practical open-source fuzzer, named SMARTIAN. SMARTIAN can discover bugs in real-world smart contracts without the need for the source code. Our experimental results show that SMARTIAN is more effective than existing state-of-the-art tools in finding known CVEs from real-world contracts. SMARTIAN also outperforms other tools in terms of code coverage.
DOI 原文 ·
@inproceedings{paperbot6514,
title = {SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Data-Flow Analyses},
author = {Jaeseung Choi and Doyeon Kim and Soomin Kim and Gustavo Grieco and Alex Groce and Sang Kil Cha},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678888}
}