We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:

Download:

Current browse context:

cs.CR

Change to browse by:

References & Citations

DBLP - CS Bibliography

Bookmark

(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: xFuzz: Machine Learning Guided Cross-Contract Fuzzing

Abstract: Smart contract transactions are increasingly interleaved by cross-contract calls. While many tools have been developed to identify a common set of vulnerabilities, the cross-contract vulnerability is overlooked by existing tools. Cross-contract vulnerabilities are exploitable bugs that manifest in the presence of more than two interacting contracts. Existing methods are however limited to analyze a maximum of two contracts at the same time. Detecting cross-contract vulnerabilities is highly non-trivial. With multiple interacting contracts, the search space is much larger than that of a single contract. To address this problem, we present xFuzz, a machine learning guided smart contract fuzzing framework. The machine learning models are trained with novel features (e.g., word vectors and instructions) and are used to filter likely benign program paths. Comparing with existing static tools, machine learning model is proven to be more robust, avoiding directly adopting manually-defined rules in specific tools. We compare xFuzz with three state-of-the-art tools on 7,391 contracts. xFuzz detects 18 exploitable cross-contract vulnerabilities, of which 15 vulnerabilities are exposed for the first time. Furthermore, our approach is shown to be efficient in detecting non-cross-contract vulnerabilities as well -- using less than 20% time as that of other fuzzing tools, xFuzz detects twice as many vulnerabilities.
Comments: IEEE Transactions on Dependable and Secure Computing (2022)
Subjects: Cryptography and Security (cs.CR); Software Engineering (cs.SE)
DOI: 10.1109/TDSC.2022.3182373
Cite as: arXiv:2111.12423 [cs.CR]
  (or arXiv:2111.12423v2 [cs.CR] for this version)

Submission history

From: Jiaming Ye [view email]
[v1] Wed, 24 Nov 2021 11:09:49 GMT (5765kb)
[v2] Thu, 30 Jun 2022 05:54:51 GMT (4606kb,D)

Link back to: arXiv, form interface, contact.