LDfuzz: A Directed Greybox Fuzzer for Solidity Smart Contract

Abstract

Smart contracts are programmable units that possess the ability to execute a wide range of computational tasks, operating on a decentralized ledger called a blockchain, frequently employed for the management of valuable digital assets. Unlike conventional programs, once smart contracts are deployed, they are immutable and cannot be altered. As the value associated with smart contracts increases, they become increasingly enticing targets for potential attackers. It is therefore crucial to conduct comprehensive testing of smart contracts prior to their deployment. Fuzzing is an important testing approach. Regrettably, existing coverage-based fuzzing tools treat all covered code in the same manner and cannot perform extensive tests on specific code fragments. In this research, we present LDfuzz, a targeted greybox fuzzer explicitly developed for Ethereum smart contracts. Its primary goal is to generate inputs that efficiently navigate towards potentially suspicious program locations. We propose suspicious branch marked, an innovative approach that assesses branch-level security implications. Utilizing the suggested metrics as a foundation, we calculate the distance of each fuzzing inputs to the marked branch and formulate a power scheduling algorithm based on simulated annealing, which progressively allocates additional energy to seeds in proximity to the suspicious branch while diminishing energy for seeds that are more distant. We assess the efficacy of LDfuzz by conducting a comparative analysis with a leading fuzzer for smart contracts, benchmarking their respective performance. The results from our experimentation findings demonstrate that LDfuzz exhibits superior efficiency compared to current advanced tools in identifying bugs within real-world contracts. Moreover, LDfuzz excels beyond current tools in achieving broader branch coverage.