Source-linked AI summary
ContractFuzzer: Fuzzing Smart Contracts for Vulnerability Detection
Bo Jiang, Ye Liu, W. K. Chan
TL;DR
Smart-contract vulnerabilities threaten applications and have caused major losses, while existing verification approaches can suffer from imprecision and path explosion. ContractFuzzer combines ABI-based input generation, vulnerability-specific test oracles, EVM instrumentation, and runtime-log analysis to fuzz Ethereum contracts. Across 6991 contracts, it reported more than 459 vulnerabilities with high precision, while the authors identify remaining false negatives and future extensions as limitations.
Problem
Smart-contract vulnerabilities threaten decentralized applications and users' assets, while existing verification tools can produce false positives or false negatives.
Method
ContractFuzzer generates ABI-conforming fuzzing inputs, defines vulnerability-specific test oracles, instruments the EVM, and analyzes execution logs.
Results
6991 real-world smart contracts yielded more than 459 reported vulnerabilities with very high precision, including the DAO and Parity Wallet bugs.
Takeaways & Limitations
ContractFuzzer provides a practical framework for detecting Ethereum smart-contract vulnerabilities, including vulnerabilities associated with major historical losses.
Takeaways & Limitations
ContractFuzzer has a high false-negative rate for Timestamp Dependency, and future work aims to improve input generation to reduce false negatives.
Abstract
from arXiv · showhide
Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to USD 60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of $30 million and the freezing of USD 150 million worth of Ether.
1 Introduction
Smart contracts support decentralized applications but expose substantial value to security attacks, while existing verification tools face precision and path-explosion limitations. ContractFuzzer addresses these challenges with ABI-based fuzzing, vulnerability-specific oracles, EVM instrumentation, and large-scale evaluation.
- Smart contracts enable decentralized applications and agreements that control digital assets while minimizing trust.
- $60 million was lost through the DAO contract bug, while Parity Wallet vulnerabilities caused $60 million in losses and froze more than $150 million in Ether.
- Smart contracts are vulnerable because executions depend on cooperating contracts, development tools are immature, and deployed code is difficult to update.
- Existing verification tools may produce false positives through imprecise detection and false negatives because symbolic path exploration suffers from path explosion.
- ContractFuzzer generates ABI-conforming inputs, defines vulnerability-specific test oracles, instruments the EVM, and analyzes runtime logs.
- 6991 real-world smart contracts were fuzzed, identifying at least 459 vulnerabilities, including the DAO and Parity Wallet bugs.
2 A Review of Smart Contracts
Ethereum smart contracts execute as bytecode in the EVM and support decentralized applications, but recurring vulnerability classes can expose assets to loss, unauthorized control, or freezing. The reviewed vulnerabilities include gasless sends, exception disorder, reentrancy, timestamp and block-number dependencies, dangerous delegatecalls, and freezing Ether.
- Smart contract code is compiled from Solidity into EVM bytecode, with gas charged to execute transactions and prevent resource-wasting code.
- The reviewed security vulnerabilities occur at the smart-contract level, distinct from vulnerabilities at the blockchain and EVM levels.
- Gasless Send can arise when send invokes an expensive fallback function under a fixed gas stipend, causing an unchecked out-of-gas exception.
- Reentrancy occurs when a malicious contract repeatedly invokes a function, as in the DAO attack that caused a $60 million loss.
- Timestamp and block-number dependencies are risky because miners can manipulate these values, so they cannot safely provide entropy.
- Dangerous delegatecall lets attacker-controlled msg.data select functions in another contract while execution uses the caller's storage, enabling the Parity Wallet attack.
- Freezing Ether occurs when a contract relies on delegatecall for transfers but loses that capability after the delegated library is destroyed.
3 Defining Testing Oracles for Vulnerabilities of Smart Contracts
ContractFuzzer defines runtime test oracles that combine observed EVM operations, call behavior, transferred value, and attacker-agent interactions to identify vulnerability patterns. These oracles are tailored to specific vulnerabilities, including gasless sends, exception disorder, reentrancy, timestamp and block-number dependencies, dangerous delegatecalls, and freezing Ether.
- GaslessSend identifies send() by checking zero call input and a 2300 gas limit, then requires an ErrOutOfGas result during execution.
- ExceptionDisorder is flagged when a nested call throws an exception but its root call does not, indicating the exception was not propagated.
- Reentrancy requires repeated invocation of a function in its call chain plus a positive-value call with sufficient gas to reenter through an agent contract.
- TimestampDependency combines TIMESTAMP opcode use with evidence of Ether transfer through send() or a positive-value call.
- BlockNumDependency parallels TimestampDependency but checks the NUMBER opcode instead of TIMESTAMP.
- DangerDelegateCall flags delegatecalls whose target function is supplied by attacker-controlled input such as msg.data.
- FreezingEther flags contracts that receive Ether and use delegatecall but contain no own transfer, send, call, or suicide mechanism.
4 The Smart Contract Fuzzer
ContractFuzzer combines ABI- and bytecode-based analysis, targeted input generation, reentrancy scenarios, and EVM instrumentation to fuzz smart contracts. Its workflow supports interaction-aware testing and collects runtime information for vulnerability oracles.
- Overview: ContractFuzzer uses offline EVM instrumentation and online fuzzing to monitor executions and analyze smart-contract vulnerabilities.The tool also crawls deployed contracts from Etherscan as part of its workflow.
- Static Analysis: ABI analysis extracts function argument types and signatures, while bytecode analysis identifies function selectors used by each public ABI function.The selector-analysis algorithm maps each ABI function to the selectors found in its implementation.
- Static Analysis: Selector-indexed contract pools supply compatible contract addresses for address arguments and support testing interactions among smart contracts.Contracts sharing a function selector are indexed by that selector and selected for ABI-function fuzzing.
- Fuzzing Input Generation: Input generation creates candidate values from valid domains and seeded values, combines argument candidates, and encodes complete function inputs into bytecode.Fixed-size and non-fixed-size types use different generation strategies.
- Fuzzing Input Generation: Reentrancy testing uses an AttackerAgent contract to invoke target functions through an interactive attack scenario.The method was used to detect reentrancy in the BountyHunt contract.
- Instrumenting EVM: Test oracles collect call or delegatecall attributes, executed opcodes, and contract state to support vulnerability detection.Call attributes are recorded because they support most of the test oracles.
5 Experiment and Results Analysis
ContractFuzzer was evaluated on 6991 real-world Ethereum smart contracts, detecting vulnerabilities across several categories and identifying known DAO and Parity cases. Comparisons with Oyente showed lower false positives for ContractFuzzer but also exposed false negatives caused by difficult-to-trigger conditions and limited input generation.
- 138 Gasless Send vulnerabilities represented about 2.06% of tested contracts, while all manually checked detections were confirmed true positives.The Gasless Send oracle checks for ErrOutOfGas within the EVM.
- 14 Reentrancy vulnerabilities represented about 0.21% of studied contracts, all were confirmed true positives, and the DAO bug was detected.ContractFuzzer missed one vulnerable contract because complex conditions before ether transfer were difficult to trigger.
- 152 Timestamp Dependency and 82 Block Number Dependency vulnerabilities were detected, with true positive rates of 96.05% and 96.34%, respectively.False positives arose because the oracle did not track whether timestamp or block-number values flowed into ether-transfer conditions.
- 6991 smart contracts were fuzzed, and ContractFuzzer precisely detected 459 vulnerable contracts with a very high true positive rate.Detected cases included Dangerous Delegatecall and Freezing Ether vulnerabilities.
- ContractFuzzer detected 152 Timestamp Dependency vulnerabilities compared with Oyente's 273, while its false negatives included contracts whose timestamp conditions could no longer succeed.The authors suggest more extensive fuzzing with different function call sequences to improve this situation.
- Oyente flagged 43 Reentrancy cases versus ContractFuzzer's 14, but 28 of Oyente's cases were false positives under the paper's test-oracle definition.ContractFuzzer required both a reentrant call and ether transfer to an external account, excluding cases that could not be externally triggered.
6 Related Work
Prior work applies auditing, formal verification, symbolic execution, and fuzzing to smart-contract security, but approaches differ in what they can detect and how they handle execution paths. ContractFuzzer uses fuzzing and runtime monitoring to target vulnerabilities that happen during execution while reducing false positives.
- Smart Contracts Security: Auditing and formal-verification efforts identified logical, privacy, call-stack, compiler, arithmetic, and division-by-zero problems in smart contracts.These studies include source-code auditing, Solidity verification, and transformations of Solidity source code or EVM bytecode into F* programs.
- Smart Contracts Security: Oyente builds smart-contract control-flow graphs, symbolically executes them, and checks for vulnerable patterns.
- Smart Contracts Security: MAIAN uses symbolic execution and trace properties to detect greedy, prodigal, and suicidal contracts.
- Smart Contracts Security: ContractFuzzer combines fuzzing with runtime monitoring to detect vulnerabilities that happen during execution and generate fewer false positives.Echidna can generate fuzzing inputs with tester-defined oracles but provides no direct API for security testing of smart contracts.
- Fuzzing Techniques for Vulnerability Detection: Grammar-based fuzzers generate test cases from grammars, and prior studies showed this approach can detect application vulnerabilities.
7 Conclusion
ContractFuzzer is presented as a fuzzing framework for detecting seven types of Ethereum smart-contract vulnerabilities. In experiments on 6991 real-world contracts, it reported 459 vulnerabilities, including the DAO and Parity Wallet bugs, while producing fewer false positives than Oyente; future work targets false negatives and broader platform coverage.
- Conclusion: ContractFuzzer detects 7 types of Ethereum smart-contract vulnerabilities through input generation and test-oracle analysis.
- Conclusion: 6991 real-world smart contracts yielded 459 reported vulnerabilities, including the DAO bug and the Parity Wallet bug.
- Conclusion: Compared with Oyente, ContractFuzzer detects more vulnerability types and has much lower false positives.
- Conclusion: Future work aims to reduce false negatives, detect additional EVM- or blockchain-related vulnerabilities, and generalize testing to other smart-contract platforms.