[Paper Review] Rethinking Smart Contract Fuzzing: Fuzzing With Invocation Ordering and Important Branch Revisiting

Zhenguang Liu, Qian Peng+5 more|arXiv (Cornell University)|Jan 10, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes IR-Fuzz, a novel smart contract fuzzer that improves vulnerability detection by generating function invocation sequences with data dependency-aware ordering and prolongation to explore deep contract states, while using branch distance-based evolution and targeted energy allocation to prioritize rare, high-risk branches. IR-Fuzz achieves 28% higher branch coverage and 7% higher detection accuracy than state-of-the-art tools, processing 350 test cases per second.

ABSTRACT

Blockchain smart contracts have given rise to a variety of interesting and compelling applications and emerged as a revolutionary force for the Internet. Quite a few practitioners have devoted themselves to developing tools for detecting bugs in smart contracts. One line of efforts revolve around static analysis techniques, which heavily suffer from high false-positive rates. Another line of works concentrate on fuzzing techniques. Unfortunately, current fuzzing approaches for smart contracts tend to conduct fuzzing starting from the initial state of the contract, which expends too much energy revolving around the initial state and thus is usually unable to unearth bugs triggered by other states. Moreover, most existing methods treat each branch equally, failing to take care of the branches that are rare or more likely to possess bugs. This might lead to resources wasted on normal branches. In this paper, we try to tackle these challenges from three aspects: (1) In generating function invocation sequences, we explicitly consider data dependencies between functions to facilitate exploring richer states. We further prolong a function invocation sequence S1 by appending a new sequence S2, so that S2 can start fuzzing from states that are different from the initial state. (2) We incorporate a branch distance-based measure to evolve test cases iteratively towards a target branch. (3) We engage a branch search algorithm to discover rare and vulnerable branches, and design an energy allocation mechanism to take care of exercising these crucial branches. We implement IR-Fuzz and extensively evaluate it over 12K real-world contracts. Empirical results show that: (i) IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzing approaches, and (ii) IR-Fuzz detects more vulnerabilities and increases the average accuracy of vulnerability detection by 7% over current methods.

Motivation & Objective

• To address the limitation of current smart contract fuzzers that start exclusively from the initial contract state, missing deep or complex states where vulnerabilities may reside.
• To overcome the inefficiency of treating all branches equally by identifying and prioritizing rare or high-risk branches that are more likely to contain vulnerabilities.
• To improve fuzzing efficiency and coverage by generating function invocation sequences that respect data dependencies and enable state transition beyond the initial state.
• To reduce false positives and increase vulnerability detection accuracy by guiding test case evolution toward specific target branches using a distance-based metric.
• To optimize resource allocation by dynamically assigning more fuzzing energy to critical, hard-to-reach branches, improving overall effectiveness.

Proposed method

• IR-Fuzz generates function invocation sequences using data dependency analysis between functions, ensuring that sequences respect read/write dependencies on global variables to enable exploration of richer contract states.
• It prolongs an initial sequence by appending a second sequence that starts from a non-initial state, enabling the fuzzer to explore complex, deep contract states beyond the initial state.
• A branch distance-based measure is used to iteratively evolve test cases toward a target branch, reducing randomness and improving convergence on specific code paths.
• A branch search algorithm identifies rare and vulnerable branches, which are then prioritized through a dynamic energy allocation mechanism to increase their exercise frequency.
• The framework integrates AFL-inspired mutation strategies but enhances them by avoiding mutations on critical input parts to improve the likelihood of triggering deep or guarded branches.
• IR-Fuzz evaluates test cases by monitoring EVM instructions (e.g., BALANCE, compare, jump) to detect patterns indicative of vulnerabilities like dangerous Ether strict equality.

Experimental results

Research questions

• RQ1 How can smart contract fuzzing be improved by generating invocation sequences that explore contract states beyond the initial state?
• RQ2 To what extent can branch distance-based test case evolution improve the convergence and coverage of fuzzing on target branches?
• RQ3 How does dynamic energy allocation to rare or vulnerable branches affect overall fuzzing efficiency and vulnerability detection accuracy?
• RQ4 Can the proposed method detect previously undetected vulnerabilities, such as dangerous Ether strict equality, that existing tools miss?
• RQ5 How does the combination of invocation ordering, sequence prolongation, and energy allocation compare to state-of-the-art fuzzing techniques in real-world contracts?

Key findings

• IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzing tools across 12,000 real-world smart contracts.
• The average accuracy of vulnerability detection increases by 7% compared to existing methods, demonstrating improved precision in identifying real vulnerabilities.
• IR-Fuzz processes an average of 350 test cases per second, indicating strong performance and scalability.
• Removing the energy allocation mechanism (IR-Fuzz-WEA) results in a 43.02% drop in branch coverage and a 4.87% decrease in detection accuracy, proving its significant contribution.
• IR-Fuzz successfully detects a new vulnerability pattern—dangerous Ether strict equality—previously undetected by existing tools, which occurs when contract balance never equals expected user contributions due to pre-existing Ether.
• The framework’s ability to detect the dangerous Ether strict equality vulnerability is validated through a case study on a gambling contract, where IR-Fuzz identifies unreachable winner conditions due to balance mismatches.