一句话：提出 IcyChecker，利用链上交易重放提供精确上下文，并通过变异模糊测试交易序列、观察状态差异来检测 DApp 状态不一致缺陷。
去中心化应用（DApp）由多个智能合约组成，合约间复杂交互使得漏洞检测十分困难；已有方法因缺乏精确上下文信息，往往误报或漏报较高。本文提出 IcyChecker，一个基于模糊测试的框架，用于有效识别状态不一致（SI）缺陷——这类缺陷可导致重入、复杂模式的前置交易等漏洞。与已有工作不同，IcyChecker 通过重放链上历史交易，为合约模糊测试提供一组准确的上下文信息；同时不依赖特定测试预言，而是实现新机制变异模糊测试交易序列，并通过观察状态差异来识别 SI 缺陷。作者在前 100 个流行 DApp 上评估 IcyChecker，共发现 277 个 SI 缺陷，精确率为 87%。与 Smartian、Confuzzius 和 Sailfish 等先进工具比较，IcyChecker 不仅检出更多 SI 缺陷，而且误报率显著更低，这得益于其对准确链上数据和独特模糊测试策略的整合。
Decentralized applications (DApps) consist of multiple smart contracts running on Blockchain. With the increasing popularity of the DApp ecosystem, vulnerabilities in DApps could bring significant impacts such as financial losses. Identifying vulnerabilities in DApps is by no means trivial, as modern DApps consist of complex interactions across multiple contracts. Previous research suffers from either high false positives or false negatives, due to the lack of precise contextual information which is mandatory for confirming smart contract vulnerabilities when analyzing smart contracts. In this paper, we present IcyChecker, a new fuzzing-based framework to effectively identify State inconsistency (SI) Bugs – a specific type of bugs that can cause vulnerabilities such as re-entrancy, front-running with complex patterns. Different from prior works, IcyChecker utilizes a set of accurate contextual information for contract fuzzing by replaying the on-chain historical transactions. Besides, instead of designing specific testing oracles which are required by other fuzzing approaches, IcyChecker implements novel mechanisms to mutate a set of fuzzing transaction sequences, and further identify SI bugs by observing their state differences. Evaluation of IcyChecker over the top 100 popular DApps showed it effectively identifies a total number of 277 SI bugs, with a precision of 87%. By comparing IcyChecker with other state-of-the-art tools (i.e., Smartian, Confuzzius, and Sailfish), we show IcyChecker not only identifies more SI bugs but also with much lower false positives, thanks to its integration of accurate on-chain data and unique fuzzing strategies. Our research sheds light on new ways of detecting smart contract vulnerabilities in DApps.
@inproceedings{YeNZWL23,
title = {Detecting State Inconsistency Bugs in DApps via On-Chain Transaction Replay and Fuzzing},
author = {Mingxi Ye and Yuhong Nan and Zibin Zheng and Dongpeng Wu and Huizhong Li},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598057}
}