ConFuzzius：一种面向智能合约的数据依赖感知混合模糊算法
ConFuzzius: A Data Dependency-Aware Hybrid Fuzzer for Smart Contracts
摘要：
智能合约是在区块链上执行的图灵完备程序。与传统程序不同，一旦部署，它们就无法修改。随着智能合约的价值越来越高，它们成为攻击者的一个令人兴奋的目标。在过去的几年里，由于简单的编程错误，他们遭受了数百万美元的攻击。因此，已经提出了用于检测错误的各种工具。这些工具中的大多数依赖于符号执行，这可能会由于过度近似而产生误报。最近，许多模糊器被提出来检测智能合约中的错误。然而，这些方法在查找浅层bug时更有效，而在查找深层执行中的bug时效果较差，因此实现了低代码覆盖率和许多假阴性。一种在传统程序中被证明可以取得良好效果的替代方法是混合模糊，它是符号执行和模糊的组合。在这项工作中，我们研究了智能合约的混合模糊，并提出了ConFuzzius，第一个智能合约的混合模糊器。ConFuzzius使用进化模糊来执行智能合约的浅层部分和约束求解，以生成满足复杂条件的输入，从而阻止进化模糊探索更深层的部分。此外，ConFuzzius利用动态数据依赖性分析来有效地生成更有可能导致隐藏错误的合同状态的事务序列。我们通过将ConFuzzius与最先进的智能合约符号执行工具和模糊器进行比较来评估其有效性。我们对128个合同和21K个真实合同的策划数据集进行了评估，结果表明，我们的混合方法检测到更多的错误（高达23%），同时在代码覆盖率方面优于最先进的方法（高达69%），并且数据依赖性分析将错误检测提高了18%。
英文摘要：
Smart contracts are Turing-complete programs that are executed across a blockchain. Unlike traditional programs, once deployed, they cannot be modified. As smart contracts carry more value, they become more of an exciting target for attackers. Over the last years, they suffered from exploits costing millions of dollars due to simple programming mistakes. As a result, a variety of tools for detecting bugs have been proposed. Most of these tools rely on symbolic execution, which may yield false positives due to over-approximation. Recently, many fuzzers have been proposed to detect bugs in smart contracts. However, these tend to be more effective in finding shallow bugs and less effective in finding bugs that lie deep in the execution, therefore achieving low code coverage and many false negatives. An alternative that has proven to achieve good results in traditional programs is hybrid fuzzing, a combination of symbolic execution and fuzzing. In this work, we study hybrid fuzzing on smart contracts and present ConFuzzius, the first hybrid fuzzer for smart contracts. ConFuzzius uses evolutionary fuzzing to exercise shallow parts of a smart contract and constraint solving to generate inputs that satisfy complex conditions that prevent evolutionary fuzzing from exploring deeper parts. Moreover, ConFuzzius leverages dynamic data dependency analysis to efficiently generate sequences of transactions that are more likely to result in contract states in which bugs may be hidden. We evaluate the effectiveness of ConFuzzius by comparing it with state-of-the-art symbolic execution tools and fuzzers for smart contracts. Our evaluation on a curated dataset of 128 contracts and 21K real-world contracts shows that our hybrid approach detects more bugs (up to 23%) while outperforming state-of-the-art in terms of code coverage (up to 69%), and that data dependency analysis boosts bug detection up to 18%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
