Given the growing importance of smart contracts in various applications, ensuring their security and reliability is critical. Fuzzing, an effective vulnerability detection technique, has recently been widely applied to smart contracts. Despite numerous studies, a systematic investigation of smart contract fuzzing techniques remains lacking. In this paper, we fill this gap by: 1) providing a comprehensive review of current research in contract fuzzing, and 2) conducting an in-depth empirical study to evaluate state-of-the-art contract fuzzers' usability. To guarantee a fair evaluation, we employ a carefully-labeled benchmark and introduce a set of pragmatic performance metrics, evaluating fuzzers from five complementary perspectives. Based on our findings, we provide direction for the future research and development of contract fuzzers.
翻译:摘要:鉴于智能合约在各类应用中日益增长的重要性,确保其安全性和可靠性至关重要。模糊测试作为一种高效的漏洞检测技术,近年来被广泛应用于智能合约领域。尽管已有众多研究,但对智能合约模糊测试技术的系统性调查仍然缺乏。本文通过以下方式填补这一空白:1)对当前合约模糊测试研究进行全面综述;2)开展深入的实证研究以评估最先进合约模糊测试工具的可用性。为保证公平评估,我们采用精心标注的基准测试集,并引入一套实用的性能指标,从五个互补维度评估模糊测试工具。基于研究结果,我们为合约模糊测试的未来研究与发展指明了方向。