The Effectiveness of Echidna in Detecting Reentrancy in Ethereum Smart Contracts Using Bug Injection

Abstract

Smart contract vulnerabilities, particularly reentrancy, have caused hundreds of millions of dollars in losses across the Ethereum ecosystem. While static analysis tools dominate current auditing practice, empirical evaluations have consistently demonstrated their high false negative and false positive rates for reentrancy detection. Dynamic analysis, exemplified by property-based fuzzing with Echidna, offers an alternative by evaluating contracts through actual execution. However, systematic empirical evaluation of dynamic tools under controlled ground-truth conditions remains limited. This study adapts the bug injection methodology, previously applied only to static analysis evaluation, to assess Echidna's effectiveness in detecting reentrancy. A dataset of 50 Solidity contracts was instrumented with oracle properties and injected with two reentrancy variants, single-function and cross-function, producing 100 ground-truth contract variants. Three fuzzing configurations of increasing intensity were evaluated across three metrics: detection rate, activation rate, and average detection time. Results show that Echidna achieved 100% activation but detected only 20% to 42% of injected bugs depending on the configuration and variant. Nearly all detections occurred within the first 25 seconds of each campaign, with no benefit from extended timeouts. These findings reveal a fundamental gap between bug reachability and exploitability confirmation under standard fuzzing conditions.