SAEFUZZ：通过静态引导的进化模糊测试实现智能合约漏洞检测
SAEFUZZ: Smart Contract Vulnerability Detection through Statically Guided Evolutionary Fuzzing
浏览论文内容
中文总结 AI 辅助
SAEFUZZ是一种基于静态引导进化模糊测试的智能合约漏洞检测方法，通过构建以太坊虚拟机控制流图等技术，在带标签合约检测中获98.50%准确率等指标，各关键组件均对性能有贡献。
中文摘要 AI 辅助
智能合约模糊测试的有效性很大程度上取决于生成的交易是否能触及深度的、依赖状态的执行路径。现有的模糊测试工具通常生成高度随机的调用序列，将执行资源浪费在语义无效或低价值的状态上，且未探索需要特定调用顺序的漏洞。我们提出一种在字节码级别静态引导下生成模糊测试用例的轻量方法：构建以太坊虚拟机控制流图，提取包含漏洞相关指令的路径，恢复函数选择器，并根据存储读写依赖关系对外部可调用函数排序；随后采用覆盖引导的进化策略生成、评估、重组和变异可执行种子；5个专用运行时断言分别针对重入、整数溢出或下溢、区块状态依赖、不安全委托调用以及冻结以太。评估使用已部署的以太坊合约，包括带标签的易受攻击合约，SAEFUZZ检测到大多数带标签的易受攻击合约，准确率达98.50%，精确率90.00%，召回率81.82%，还实现了84.07%的平均指令覆盖率，有效测试用例占生成用例的93.48%； ablation实验结果表明，静态引导、定向种子生成和漏洞专用断言均对最终性能有贡献。
英文摘要
The effectiveness of smart contract fuzzing depends strongly on whether generated transactions reach deep, state-dependent execution paths. Existing fuzzers often generate highly random call sequences, wasting executions on semantically invalid or low-value states and leaving vulnerabilities that require specific invocation orders unexplored. We present a lightweight method for generating fuzz test cases under bytecode-level static guidance. We construct an Ethereum virtual machine control-flow graph, extract paths containing vulnerability-relevant instructions, recover function selectors, and order externally callable functions according to storage read-write dependencies. A coverage-guided evolutionary strategy then generates, evaluates, recombines, and mutates executable seeds. Five dedicated runtime oracles target reentrancy, integer overflow or underflow, block-state dependence, unsafe delegate calls, and frozen Ether. The evaluation uses deployed Ethereum contracts, including labelled vulnerable contracts. SAEFUZZ detects most labelled vulnerable contracts, yielding 98.50% accuracy, 90.00% precision, and 81.82% recall. It also achieves 84.07% mean instruction coverage, with valid test cases accounting for 93.48% of generated cases. Ablation results indicate that static guidance, directed seed generation, and vulnerability-specific oracles each contribute to the final performance.
