[论文解读] Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing

Ruichao Liang, Jing Chen+7 more|arXiv (Cornell University)|Aug 19, 2024

Imbalanced Data Classification Techniques被引用 7

一句话总结

Vulseye 是一个有状态的有向灰盒模糊测试器，用于智能合约，目标是易受攻击的代码区域和合约状态，在漏洞发现和效率方面优于 SOTA fuzzers。

ABSTRACT

Smart contracts, the cornerstone of decentralized applications, have become increasingly prominent in revolutionizing the digital landscape. However, vulnerabilities in smart contracts pose great risks to user assets and undermine overall trust in decentralized systems. But current smart contract fuzzers fall short of expectations in testing efficiency for two primary reasons. Firstly, smart contracts are stateful programs, and existing approaches, primarily coverage-guided, lack effective feedback from the contract state. Consequently, they struggle to effectively explore the contract state space. Secondly, coverage-guided fuzzers, aiming for comprehensive program coverage, may lead to a wastage of testing resources on benign code areas. This wastage worsens in smart contract testing, as the mix of code and state spaces further complicates comprehensive testing. To address these challenges, we propose Vulseye, a stateful directed graybox fuzzer for smart contracts guided by vulnerabilities. Different from prior works, Vulseye achieves stateful directed fuzzing by prioritizing testing resources to code areas and contract states that are more prone to vulnerabilities. We introduce Code Targets and State Targets into fuzzing loops as the testing targets of Vulseye. We use static analysis and pattern matching to pinpoint Code Targets, and propose a scalable backward analysis algorithm to specify State Targets. We design a novel fitness metric that leverages feedback from both the contract code space and state space, directing fuzzing toward these targets. With the guidance of code and state targets, Vulseye alleviates the wastage of testing resources on benign code areas and achieves effective stateful fuzzing. In comparison with state-of-the-art fuzzers, Vulseye demonstrated superior effectiveness and efficiency.

研究动机与目标

• 使用静态分析和模式匹配识别智能合约中的易受攻击的代码区域。
• 通过对字节码的向后分析识别利用漏洞所需的关键合约状态。
• 开发一个以适应度为引导的模糊测试循环，联合考虑代码目标和状态目标。
• 将模糊测试资源优先分配给代码目标和状态目标，以提高漏洞发现的效率。
• 在真实世界数据集上评估 Vulseye，并与 state-of-the-art fuzzers 进行比较。

提出的方法

• 将 Solidity 转换为中间表示 (IR)，并进行静态代码分析，通过模式匹配定位 Code Targets。
• 对合约 CFG 进行向后分析，通过求解状态约束推导 State Targets。
• 开发基于向后分析的流程，以推导漏洞路径的状态约束（Algorithms 2 and 3）。
• 定义一种新颖的适应度度量，结合代码距离和状态距离来引导种子调度 (Equations 1-9)。
• 在模糊测试循环中使用遗传算法，进行种子初始化、交叉、变异，并以适应度度量引导漏洞检测。
• 对 py-evm 进行插桩以执行合约并收集带持久状态存储的轨迹以供分析。

Figure 2: Overview of Vulseye .

实验结果

研究问题

• RQ1 如何识别代码目标和状态目标，以实现对智能合约的有状态定向模糊测试？
• RQ2 字节码的向后分析是否可以有效地指定利用漏洞所需的合约状态？
• RQ3 将代码与状态反馈结合，是否比现有 fuzzers 提高漏洞检测的效率和效果？
• RQ4 Vulseye 在大规模 Ethereum 智能合约数据集上的现实世界漏洞发现能力如何？

主要发现

• Vulseye 在 42,738 个真实世界的智能合约中发现了 4,845 个漏洞，比 state-of-the-art 工具高出最多 9.7×。
• Vulseye 达到测试目标的速度比基线快最多 8.4×。
• 它在前 50 个 Ethereum DApps 中发现了 11 个此前未知的漏洞，涉及约 250 万美元。
• 该方法结合代码目标和状态目标反馈来驱动有状态模糊测试，减少对无害代码/状态区域的探索。
• 该方法整合了新颖的适应度度量和种子调度，以优先处理有潜力进行漏洞利用的输入。

Figure 3: Example for State Identification.