An Empirical Study on the Effects of Entry Function Pairs in Fuzzing Smart Contracts

Abstract

Ethereum smart contracts may incur security vulnerabilities. Fuzzing is an industry-standard practice to detect them in improving the dependability of programs. Existing fuzz testing techniques for Ethereum smart contracts are insensitive to whether consecutive seeds of the same function are used for fuzzing the smart contract under test. Nonetheless, smart contracts are often designed to have collaborations among different functions for business activity to complete. We wonder whether this mismatch will make fuzzing techniques less effective than they should be. In this paper, to the best of our knowledge, we present the first work to show that security vulnerability detection can be significantly more effective in smart contract fuzzing if the entry functions of recent past test cases can be distinct. The empirical results show that the performance boost can be as large as 10.4% by simply enabling any test case not invoking the same entry functions as a few recent past test cases. The empirical result also shows that the cost-effectiveness also increases by up to 21.9%.