AI-FUZZ: Reinforcement Learning–Guided Stateful Fuzzing for Secure Smart Contracts

Abstract

Smart contracts power decentralised applications, but once deployed, their flaws stay exploitable. Existing fuzzers such as ConFuzzius, Smartian, and VULSEYE use hybrid static and dynamic analysis but depend on   fixed heuristics and lack adaptive learning. AI-FUZZ is an adaptive machine learning guided fuzzing framework that  pairs deep reinforcement learning with stateful graybox fuzzing. It learns from execution traces to improve input generation, focus on high-risk contract states, and cut redundant executions. The framework also includes static  analysis, adaptive mutation, and an oracle-based validation to boost accuracy and reduce false positives. Tested on  42,738 real-world contracts, AI-FUZZ achieved a 96.8% true positive rate, 4.2% false positive rate, 27% higher detection  coverage than leading fuzzers, and a 33% reduction in average detection time. It scales across small, medium, and large contracts and offers a self-improving, efficient, and reliable approach for large-scale blockchain security audits.