一句话：提出基于快照的智能合约模糊测试器 ItyFuzz，用状态快照与单笔交易变异提升探索效率并快速合成攻击利用。
智能合约交易依赖持续区块链状态，传统模糊测试需变异交易序列，难以高效探索输入与程序空间。ItyFuzz 不再保存并变异交易序列，而是对状态和单笔交易做快照；它引入数据流路点识别更有潜力的状态，并用比较路点剪枝状态空间。维护状态快照使其能快速合成重入攻击等具体利用。ItyFuzz 测试合约可达秒级响应，支持链上测试。在真实合约与被攻击 DeFi 项目上，其指令覆盖优于现有模糊测试器，并能快速发现和生成真实利用。
Smart contracts are critical financial instruments, and their security is of utmost importance. However, smart contract programs are difficult to fuzz due to the persistent blockchain state behind all transactions. Mutating sequences of transactions are complex and often lead to a suboptimal exploration for both input and program spaces. In this paper, we introduce a novel snapshot-based fuzzer ItyFuzz for testing smart contracts. In ItyFuzz, instead of storing sequences of transactions and mutating from them, we snapshot states and singleton transactions. To explore interesting states, ItyFuzz introduces a dataflow waypoint mechanism to identify states with more potential momentum. ItyFuzz also incorporates comparison waypoints to prune the space of states. By maintaining snapshots of the states, ItyFuzz can synthesize concrete exploits like reentrancy attacks quickly. Because ItyFuzz has second-level response time to test a smart contract, it can be used for on-chain testing, which has many benefits compared to local development testing. Finally, we evaluate ItyFuzz on real-world smart contracts and some hacked on-chain DeFi projects. ItyFuzz outperforms existing fuzzers in terms of instructional coverage and can find and generate realistic exploits for on-chain projects quickly.