skip to main content
Idioma:

ContractFuzzer: fuzzing smart contracts for vulnerability detection

Jiang, Bo ; Liu, Ye ; Chan, W. K.

2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE), 2018, p.259-269

New York, NY, USA: ACM

Texto completo disponível

Citações Citado por
  • Título:
    ContractFuzzer: fuzzing smart contracts for vulnerability detection
  • Autor: Jiang, Bo ; Liu, Ye ; Chan, W. K.
  • Assuntos: Blockchain ; Ethereum ; Fuzzer ; Fuzzing ; Security and privacy -- Software and application security ; Smart contract ; Software and its engineering -- Software creation and management -- Software verification and validation -- Software defect analysis -- Software testing and debugging ; Test oracle ; Vulnerability
  • É parte de: 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE), 2018, p.259-269
  • Descrição: Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to USD 60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of USD 30 million and the freezing of USD 150 million worth of Ether.
  • Editor: New York, NY, USA: ACM
  • Idioma: Inglês
Voltar para lista de resultados
Resultado  1 AvançarIr para próxima página

  • Realização: ABCD-USP USP   Logos de Redes Sociais: Freepik

Buscando em bases de dados remotas. Favor aguardar.