Smart contract fuzzing improves with large language models
EchoFuzz: Empowering Smart Contract Fuzzing with Large Language Models
Software EngineeringCryptography and Security
Summary
Smart contracts are computer programs that manage lots of digital money automatically, but they can have hidden bugs that hackers exploit. The authors created EchoFuzz, a method that uses large language models (LLMs) to better find bugs by understanding important steps in the contract’s behavior. EchoFuzz generates targeted test paths and adapts as it tests, uncovering more bugs than older methods. In tests, it found many more issues and even discovered new vulnerabilities in real contracts.
What this means in practice
- •For blockchain developers: Identify more hidden security flaws in smart contracts during development, improving contract safety before deployment.
- •For cybersecurity teams: Use enhanced fuzzing to uncover previously unknown vulnerabilities in deployed smart contracts to prevent attacks.
Authors
Juanen Li, Peng Qian, Guanyan Li, Rui Wang, Peixin Wang, Zhiqing Tang, Fuchen Ma, Yuanliang Chen, Lun Zhang
Abstract
Smart contracts, serving as the cornerstone of decentralized applications, autonomously manage trillion-dollar digital assets, making them attractive targets for attacks. Fuzzing has emerged as a promising technique for detecting vulnerabilities in smart contracts, yet existing methods face two main challenges. (1) The logical gap in state transitions and combinatorial redundancy hinders effective tradeoffs between bug detection efficiency and state space exploration cost, leading to critical execution paths to be overlooked. (2) Rule-based sequence mutation strategies suffer from path redundancy and inadequate guidance from contract logic, resulting in performance bottlenecks that stall the exploration of in-depth vulnerability-oriented paths. To tackle these challenges, we propose EchoFuzz, an LLM-guided fuzzing framework introducing Vulnerable Function Call Sequences (VFCS) - minimal, behavior-preserving execution paths that expose bugs through key state transitions. EchoFuzz consists of two key procedures. First, we develop a chain-guided LLM approach, that combines static analysis with logical understanding to generate contract-specific VFCS candidates that eliminate combinatorial redundancy. Second, we adopt an iterative fuzzing strategy that uses LLMs with real-time feedback to adaptively steer fuzzer toward uncovered branches. Experiments show EchoFuzz outperforms state-of-the-art methods, achieving 29\% higher branch coverage and detecting 62\% more vulnerabilities. It also found 37 previously unknown vulnerabilities in real contracts, showing strong practicality.