GasFuzzer: Fuzzing Ethereum Smart Contract Binaries to Expose Gas-Oriented Exception Security Vulnerabilities

Abstract

Ethereum is a kind of blockchain platform where developers may develop and run programs called smart contracts. It inherently relies on gas consumption within a specified allowance to constrain code execution, making every instruction along an execution path to be a location for raising an exception. In this paper, we present GasFuzzer, the first work in exploring the effects of gas allowance manipulation to expose gas-oriented exception security vulnerabilities. GasFuzzer consists of two phases. The first phase introduces a gas-greedy strategy to favor transactions having higher gas consumption for mutation to obtain test transactions with different gas consumptions. The second phase introduces a novel notion of fractional gas consumption coverage and a novel gas-leveling strategy. It applies them to mutate the gas allowances of some of these transactions resulting in the highest gas consumptions produced in the first phase followed by applying these allowance-mutated transactions together with those which remained non-mutated to fuzz test the smart contract. We report an evaluation of GasFuzzer via an experiment on 3170 real-world smart contracts deployed on the public Ethereum Blockchain between October 2017 and July 2019. The findings show that GasFuzzer with gas-greedy strategy can detect more Exceptions Disorder kind of security vulnerabilities (7 more cases) than the previous state-of-the-art black-box fuzzer, and GasFuzzer with gas-leveling strategy and gas coverage criterion can detect 6 additional cases of Exceptions Disorder security vulnerabilities, which is significant.

Systematic Review of Security Vulnerabilities in Ethereum Blockchain Smart Contract

“…SPL -V8 (Gasless 'send') [26]: Gas is required in Ethereum smart contract as an execution fee. When ethers are transferred to a smart contract via send and if the fallback function in the Calle contract has the maximum gas limit [80] of twenty-three hundred units, then an out-of-gas exception can be thrown. If this exception is not handled properly, then malicious users can take benefit from this vulnerability by keeping non-transferred ethers wrongfully even though it was assumed to give them away.…”

SmartGift: Learning to Generate Practical Inputs for Testing Smart Contracts

“…Vulnerabilities in smart contracts are further critical since they are immutable once deployed. To improve the robustness of smart contract programs, various testing approaches [25], [29], [30], [31], [33]. have been proposed in the literature for detecting the vulnerabilities in smart contracts.…”

“…In the literature, the generation of test inputs for smart contracts mainly relies on fuzzing and mutation [27], [28], [25], [29], [30], [31], [32], [33]. For example, Jiang et al [34] proposed to build seed inputs with the valid input domain and the inputs frequently used by some data types in smart contracts, to further fuzz inputs for testing ABI of smart contracts.…”

Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference

“…Fuzzing is a powerful automatic testing tool to detect software vulnerabilities. After decades of development, fuzzing has been widely used as a base in several security testing domains, such as the OS kernel [12,36], servers [33], and the blockchain [3].…”