一句话：提出混合执行模糊测试器 WASAI，高效发现 Wasm 智能合约漏洞并能生成利用载荷。
WebAssembly 智能合约在 EOSIO 等区块链上日益流行，但同样面临各类漏洞攻击；更棘手的是，多数合约未开源，给漏洞检测带来困难。现有 Wasm 合约漏洞检测方法存在代码覆盖率低、准确率低、可扩展性差、无法生成利用载荷等局限。为此，作者设计并实现了 WASAI——一个针对 Wasm 智能合约的混合执行（concolic）模糊测试器，并解决了若干技术挑战。实验表明，WASAI 的代码覆盖率达到基线的 2 倍，检测 F1 值高达 99.2%，且能处理混淆、复杂验证等困难合约。作者将 WASAI 应用于 991 个实际部署的智能合约，发现超过 70% 存在漏洞，其中 300 多个合约至今未修补，仍在 EOSIO 主网上运行；其报告的一个虚假 EOS 漏洞近期被分配了 CVE 编号（CVE-2022-27134）。
WebAssembly (Wasm) smart contracts have shown growing popularity across blockchains (e.g., EOSIO) recently. Similar to Ethereum smart contracts, Wasm smart contracts suffer from various attacks exploiting their vulnerabilities. Even worse, few developers released the source code of their Wasm smart contracts for security review, raising the bar for uncovering vulnerable contracts. Although a few approaches have been proposed to detect vulnerable Wasm smart contracts, they have several major limitations, e.g., low code coverage, low accuracy and lack of scalability, unable to produce exploit payloads, etc. To fill the gap, in this paper, we design and develop WASAI, a new concolic fuzzer for uncovering vulnerabilities in Wasm smart contract after tackling several challenging issues. We conduct extensive experiments to evaluate WASAI, and the results show that it outperforms the state-of-the-art methods. For example, it achieves 2x code coverage than the baselines and surpasses them in detection accuracy, with an F1-measure of 99.2%. Moreover, WASAI can handle complicated contracts (e.g., contracts with obfuscation and sophisticated verification). Applying WASAI to 991 deployed smart contracts in the wild, we find that over 70% of smart contracts are vulnerable. By the time of this study, over 300 vulnerable contracts have not been patched and are still operating on the EOSIO Mainnet. One fake EOS vulnerability reported to the EOSIO ecosystem was recently assigned a CVE identifier (CVE-2022-27134).