一句话:提出首个面向智能合约模糊测试的基准生成工具 Olympia,并据此评测四个 Solidity 模糊器。
智能合约漏洞已造成数十亿美元资产损失,学术界与工业界为此开发了多种智能合约模糊测试器,但客观比较它们的缺陷发现能力一直很困难。本文提出 Olympia——首个专为智能合约(而非通用程序)模糊测试器设计的基准生成工具。作者利用 Olympia 对四个知名的开源 Solidity 智能合约模糊测试器进行了有效性评估。该工作为智能合约模糊测试提供了可复现、可比较的基准生成方法,有助于更客观地衡量不同模糊器的漏洞发现能力。
Over the last few years, smart-contract hacks have resulted in the loss of billions of assets. To efficiently identify such vulnerabilities, academic and industrial researchers have developed several popular smart-contract fuzzers. However, it has been challenging to objectively compare their bug-finding effectiveness. In this paper, we present Olympia, the first benchmark-generation tool that is designed for smart-contract, rather than general-purpose, fuzzers. We have used Olympia to evaluate the effectiveness of four well known, open-source fuzzers for Solidity smart contracts.