论文标题
sfuzz：有效的自适应绒毛固体智能合约
sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts
论文作者
论文摘要
智能合约是图灵完整的计划，这些程序在区块链的基础架构上执行，该计划通常管理有价值的数字资产。 Solidity是在以太坊平台上编写智能合约的最受欢迎的编程语言之一。像传统计划一样，智能合约可能包含漏洞。与传统程序不同，一旦部署了智能合约，就无法轻松修补它们。因此，重要的是要在部署前对智能合约进行彻底的测试。在这项工作中，我们在名为Sfuzz的以太坊平台上介绍了一个自适应绒毛绒毛。与现有的固体模糊不清相比，Sfuzz将AFL模糊器中的策略与针对这些难以掩盖的分支机构的有效轻巧的多目标自适应策略相结合。 Sfuzz已应用于4000多个智能合约，实验结果表明，（1）Sfuzz高效，例如，两个数量级要比最先进的工具快两个数量级； （2）Sfuzz有效地实现了高码覆盖范围和发现漏洞； （3）Sfuzz中不同的模糊策略相互补充。
Smart contracts are Turing-complete programs that execute on the infrastructure of the blockchain, which often manage valuable digital assets. Solidity is one of the most popular programming languages for writing smart contracts on the Ethereum platform. Like traditional programs, smart contracts may contain vulnerabilities. Unlike traditional programs, smart contracts cannot be easily patched once they are deployed. It is thus important that smart contracts are tested thoroughly before deployment. In this work, we present an adaptive fuzzer for smart contracts on the Ethereum platform called sFuzz. Compared to existing Solidity fuzzers, sFuzz combines the strategy in the AFL fuzzer and an efficient lightweight multi-objective adaptive strategy targeting those hard-to-cover branches. sFuzz has been applied to more than 4 thousand smart contracts and the experimental results show that (1) sFuzz is efficient, e.g., two orders of magnitude faster than state-of-the-art tools; (2) sFuzz is effective in achieving high code coverage and discovering vulnerabilities; and (3) the different fuzzing strategies in sFuzz complement each other.
