WASDAM: Effectively Detecting Vulnerabilities in Wasm Smart Contracts Based on the Data Access Model

Abstract

As WebAssembly (Wasm) smart contracts are widely deployed in blockchain platforms such as EOSIO, the threat of vulnerability attacks has become increasingly significant. Protecting the legitimate interests of blockchain users necessitates robust vulnerability detection approaches. Despite the advancements in existing approaches, several challenges remain, including state dependency, cross-function state transfer, and path selection. To tackle these issues, we introduce a novel concolic fuzzing approach called WASDAM, which integrates data access modeling, dynamic sensitive code tracing, and shortest path optimization to enhance the effectiveness of vulnerability detection. We have developed an open-source prototype of WASDAM and performed comprehensive experimental evaluations. The evaluation results demonstrate that WASDAM detects vulnerabilities in Wasm smart contracts more effectively than the state-of-the-art concolic fuzzer WASAI in terms of various performance metrics.