English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Blockchain smart contracts have given rise to a variety of interesting andcompelling applications and emerged as a revolutionary force for the Internet.Quite a few practitioners have devoted themselves to developing tools fordetecting bugs in smart contracts. One line of efforts revolve around staticanalysis techniques, which heavily suffer from high false-positive rates.Another line of works concentrate on fuzzing techniques. Unfortunately, currentfuzzing approaches for smart contracts tend to conduct fuzzing starting fromthe initial state of the contract, which expends too much energy revolvingaround the initial state and thus is usually unable to unearth bugs triggeredby other states. Moreover, most existing methods treat each branch equally,failing to take care of the branches that are rare or more likely to possessbugs. This might lead to resources wasted on normal branches. In this paper, wetry to tackle these challenges from three aspects: (1) In generating functioninvocation sequences, we explicitly consider data dependencies betweenfunctions to facilitate exploring richer states. We further prolong a functioninvocation sequence S1 by appending a new sequence S2, so that S2 can startfuzzing from states that are different from the initial state. (2) Weincorporate a branch distance-based measure to evolve test cases iterativelytowards a target branch. (3) We engage a branch search algorithm to discoverrare and vulnerable branches, and design an energy allocation mechanism to takecare of exercising these crucial branches. We implement IR-Fuzz and extensivelyevaluate it over 12K real-world contracts. Empirical results show that: (i)IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzingapproaches, and (ii) IR-Fuzz detects more vulnerabilities and increases theaverage accuracy of vulnerability detection by 7% over current methods.

Rethinking Smart Contract Fuzzing: Fuzzing With Invocation Ordering and Important Branch Revisiting