Abstract:

With the rapid development of blockchain applications and the widespread use of smart contracts, the security incidents caused by smart contract have increased dramatically and have caused huge losses to digital assets. Although there are some tools to detect smart contract security vulnerabilities, these tools mainly target single smart contract and do not take into account cross-contract interdependencies, resulting in more false positives. In order to address the above-mentioned problems of high false positives and high performance consumption of smart contract vulnerability detection tools in cross-contract scenarios, this paper proposed FIFuzz, a cross-contract fuzzing scheme based on function dependencies, the enhanced ContractRank algorithm was used to model inter-contract dependencies and the concept of function importance was proposed to characterize the importance of functions in inter-contract interactions. After the pre-processing was completed, the fuzzy test was performed, and the search space for cross-contract vulnerability detection was reduced by using the function importance-based transaction sequence generation strategy and the address type data generation strategy based on the contract address mapping relationship to improve the detection efficiency. In addition, the contract call simulation was used to reduce the false positives of vulnerability detection. Through comparison experiments with relevant tools, FIFuzz detects vulnerabilities in 80% shorter time compared to other tools, detects twice as many vulnerabilities as other tools, and the accuracy of FIFuzz in detecting cross-contract vulnerabilities is significantly better than other tools. The experimental results show that the solution proposed in this paper can effectively improve the detection accuracy of cross-contract vulnerabilities, reduce the false alarm rate, and shorten the time overhead.

Key words: smart contract, fuzzing test, cross-contract vulnerability