DepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance
This program is tentative and subject to change.
Fuzzing is an effective technique to detect vulnerabilities in smart contracts. The challenge of smart contract fuzzing lies in the statefulness of contracts, which indicates that certain vulnerabilities can only be manifested in specific contract states. State-of-the-art fuzzers may generate and execute a plethora of meaningless or redundant transaction sequences during fuzzing, incurring a penalty in efficiency. To this end, we present DepFuzz, a hybrid fuzzer for efficient smart contract fuzzing, which introduces a symbolic execution module into the feedback-based fuzzer. Guided by the distance-based function dependencies between functions, DepFuzz can efficiently yield meaningful transaction sequences that contribute to vulnerability exposure or code coverage. The experiments on 286 benchmark smart contracts and 500 large real-world smart contracts corroborate that, compared to state-of-the-art approaches, DepFuzz achieves higher instruction coverage rate and uncovers many more vulnerabilities with less time.
This program is tentative and subject to change.
Fri 17 OctDisplayed time zone: Perth change
16:00 - 17:30 | |||
16:00 15mTalk | Bennet: Randomized Specification Testing for Heap-Manipulating Programs OOPSLA | ||
16:15 15mTalk | DepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance OOPSLA Chenyang Ma Nanjing University of Science and Technology, Wei Song Nanjing University of Science and Technology, Jeff Huang Texas A&M University | ||
16:30 15mTalk | Extraction and Mutation at a High Level: Template-Based Fuzzing for JavaScript Engines OOPSLA Wai Kin Wong Hong Kong University of Science and Technology, Dongwei Xiao Hong Kong University of Science and Technology, Cheuk Tung LAI VX Research Limited, Yiteng Peng Hong Kong University of Science and Technology, Daoyuan Wu Lingnan University, Shuai Wang Hong Kong University of Science and Technology | ||
16:45 15mTalk | Finding Compiler Bugs through Cross-Language Code Generator and Differential Testing OOPSLA Qiong Feng Nanjing University of Science and Technology, Xiaotian Ma Nanjing University of Science and Technology, Ziyuan Feng Nanjing University of Science and Technology, Marat Akhin JetBrains, Wei Song Nanjing University of Science and Technology, Peng Liang Wuhan University, China | ||
17:00 15mTalk | Formalizing Linear Motion G-code for Invariant Checking and Differential Testing of Fabrication Tools OOPSLA |