一句话：提出强化学习引导的模糊测试器 RLF，生成易受攻击交易序列，以高效检测智能合约复杂漏洞。
智能合约在区块链上运行，若存在漏洞可能造成巨大经济损失。已有模糊测试器难以检测需要特定易受攻击交易序列才能触发的复杂漏洞。为此，作者提出 RLF：将智能合约模糊测试过程建模为马尔可夫决策过程，并设计同时考虑漏洞发现与代码覆盖率的奖励函数，用强化学习引导生成特定交易序列，尤其针对跨多个函数的漏洞。实验表明，RLF 优于当前最先进的漏洞检测工具，在 30 分钟内可多检测 8%–69% 的漏洞。
As computer programs run on top of blockchain, smart contracts have proliferated a myriad of decentralized applications while bringing security vulnerabilities, which may cause huge financial losses. Thus, it is crucial and urgent to detect the vulnerabilities of smart contracts. However, existing fuzzers for smart contracts are still inefficient to detect sophisticated vulnerabilities that require specific vulnerable transaction sequences to trigger. To address this challenge, we propose a novel vulnerability-guided fuzzer based on reinforcement learning, namely RLF, for generating vulnerable transaction sequences to detect such sophisticated vulnerabilities in smart contracts. In particular, we firstly model the process of fuzzing smart contracts as a Markov decision process to construct our reinforcement learning framework. We then creatively design an appropriate reward with consideration of both vulnerability and code coverage so that it can effectively guide our fuzzer to generate specific transaction sequences to reveal vulnerabilities, especially for the vulnerabilities related to multiple functions. We conduct extensive experiments to evaluate RLF’s performance. The experimental results demonstrate that our RLF outperforms state-of-the-art vulnerability-detection tools (e.g., detecting 8%-69% more vulnerabilities within 30 minutes).
@inproceedings{paperbot7303,
title = {Effectively Generating Vulnerable Transaction Sequences in Smart Contracts with Reinforcement Learning-guided Fuzzing},
author = {Jianzhong Su and Hong-Ning Dai and Lingjun Zhao and Zibin Zheng and Xiapu Luo},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3560429}
}