Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers

Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers

2024 | Shuohan Wu, Zihao Li, Luyi Yan, Weimin Chen, Muhui Jiang, Chenxu Wang, Xiapu Luo, Hao Zhou
The paper "Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers" by Shuohan Wu, Zihao Li, Luyi Yan, Weimin Chen, Muhui Jiang, Chenxu Wang, Xiapu Luo, and Hao Zhou, published in the 2024 IEEE/ACM 46th International Conference on Software Engineering (ICSE '24), provides a comprehensive review and empirical evaluation of smart contract fuzzing techniques. The authors highlight the growing importance of smart contracts in various applications and the critical need for ensuring their security and reliability. Despite the widespread adoption of smart contracts, many lack thorough security audits, making them vulnerable to potential attacks. Fuzzing, an effective vulnerability detection technique, has been increasingly applied to smart contracts since 2018. The paper addresses the lack of systematic investigation into smart contract fuzzing techniques by conducting a comprehensive review of existing research and performing an in-depth empirical study to evaluate the usability of state-of-the-art contract fuzzers. To ensure a fair evaluation, the authors employ a carefully labeled benchmark and introduce a set of pragmatic performance metrics, evaluating fuzzers from five complementary perspectives: throughput, detected bugs, effectiveness, coverage, and overhead. The study reveals that current smart contract fuzzers have significant room for improvement, particularly in terms of throughput, test oracle refinement, and initial seed optimization. The authors also conduct surveys with 16 auditors to understand their preferences and needs, which reveal a preference for fuzzers that offer flexibility and convenience in creating customized test oracles. The paper concludes by providing insights into the current state of smart contract fuzzing and suggesting potential directions for future research and development. The authors' codebase and benchmark are released for public use, contributing to the advancement of smart contract security and reliability.The paper "Are We There Yet? Unraveling the State-of-the-Art Smart Contract Fuzzers" by Shuohan Wu, Zihao Li, Luyi Yan, Weimin Chen, Muhui Jiang, Chenxu Wang, Xiapu Luo, and Hao Zhou, published in the 2024 IEEE/ACM 46th International Conference on Software Engineering (ICSE '24), provides a comprehensive review and empirical evaluation of smart contract fuzzing techniques. The authors highlight the growing importance of smart contracts in various applications and the critical need for ensuring their security and reliability. Despite the widespread adoption of smart contracts, many lack thorough security audits, making them vulnerable to potential attacks. Fuzzing, an effective vulnerability detection technique, has been increasingly applied to smart contracts since 2018. The paper addresses the lack of systematic investigation into smart contract fuzzing techniques by conducting a comprehensive review of existing research and performing an in-depth empirical study to evaluate the usability of state-of-the-art contract fuzzers. To ensure a fair evaluation, the authors employ a carefully labeled benchmark and introduce a set of pragmatic performance metrics, evaluating fuzzers from five complementary perspectives: throughput, detected bugs, effectiveness, coverage, and overhead. The study reveals that current smart contract fuzzers have significant room for improvement, particularly in terms of throughput, test oracle refinement, and initial seed optimization. The authors also conduct surveys with 16 auditors to understand their preferences and needs, which reveal a preference for fuzzers that offer flexibility and convenience in creating customized test oracles. The paper concludes by providing insights into the current state of smart contract fuzzing and suggesting potential directions for future research and development. The authors' codebase and benchmark are released for public use, contributing to the advancement of smart contract security and reliability.
Reach us at info@study.space
[slides and audio] Are We There Yet%3F Unraveling the State-of-the-Art Smart Contract Fuzzers