Erinys: Efficient fuzzing by function invoke sequence generation for smart contracts

Abstract

Smart contracts are automated programs that run on blockchain platforms and are a crucial component of blockchain technology. Due to their involvement in significant business logic and asset value, the security and reliability of smart contracts is critical. Fuzzing is an effective method for detecting vulnerabilities in smart contracts. However, most existing fuzzers face a common limitation in efficiently satisfying hard-to-cover branch constraints. To address this challenge, this paper introduces Erinys, a fuzzing tool based on sfuzz. We incorporate the definition and usage of state variables to define hard-to-cover branch constraints. Then we employ static analysis techniques to obtain the Define-Use relationships between functions and state variables in smart contracts. Additionally, we construct a graph, known as the State variables Define Use Graph, to describe the logical connections between functions based on state variables. Based on this graph, we design strategies to generate and optimize function invoke sequences. We implemented Erinys by integrating the proposed method into sfuzz. Experimental results conducted on a dataset containing 1970 contracts demonstrate that Erinys can effectively generate high-quality function invoke sequences, leading to improved branch coverage and vulnerability detection capabilities.