Concurrent distributed algorithms are crucial for modern applications like cloud computing, IoT, and blockchain, but their verification presents significant challenges. Traditional testing methods often fail to uncover subtle errors related to race conditions and inconsistent states. This paper proposes a novel framework for formally verifying these algorithms using temporal logic, specifically Linear Temporal Logic (LTL). The framework focuses on precisely specifying algorithm behavior through LTL formulas and automatically checking these formulas against simulations of the distributed system. The core contribution lies in the development of an automated tool that translates high-level algorithm descriptions into LTL specifications and executes these specifications within a distributed simulation environment. We demonstrate the effectiveness of this approach by applying it to a simplified consensus algorithm, showcasing the ability to detect potential vulnerabilities that would be missed by conventional testing. The results highlight the potential of formal verification to dramatically improve the reliability and security of concurrent distributed systems.
Abstract Mutation testing is widely used to assess the adequacy of test suite; however, its practical adoption is constrained by the persistent problem of equivalent mutants, i.e., mutants whose observable behavior is indistinguishable from the original program and therefore cannot be killed by any test case. Prior studies report that identifying equivalent mutants often requires substantial manual effort. Meanwhile, fuzzing is increasingly used in real-world systems, especially security-critical software. However, conventional fuzzing oracles typically detect only crash-like failures, thereby missing many behavioral changes introduced by mutants. In this paper, we investigate differential fuzzing as a practical, language-agnostic approach to support mutant classification, focusing on identifying (and confirming) equivalent mutants. We conduct a multi-project study across Bitcoin Core (C++), OpenSSL (C), LND (Go), and Arrow (Python), mutating six real functions with 1,090 valid mutants generated by the universalmutator. We compare unit/functional testing, seed-corpus-only fuzzing, time-bounded fuzzing, and two differential fuzzing configurations (seed-corpus-only and time-bounded). Our results show that conventional fuzzing yields the lowest mutation scores, while time-bounded differential fuzzing (5 minutes per mutant) achieves 98–100\% mutation score in five of six targets, and exposes cases where seed corpora contain valuable test inputs not covered by unit/functional suites. We further analyze runtime variability and observe log-normal behavior in difficult cases, providing practical guidance on stopping criteria (time/execution budgets), as well as evidence that dictionaries and parallel fuzzing can significantly improve effectiveness. Overall, our findings indicate that differential fuzzing is simple to implement and can classify mutants efficiently in practice, while also producing actionable artifacts (seed corpus inputs) to strengthen traditional test suites.
Cyber–physical systems (CPSs) increasingly rely on complex software components whose vulnerabilities may affect both digital services and physical processes. Fuzzing is a practical technique for discovering such vulnerabilities in CPS-facing parsers, protocol handlers, and edge services. Distributed fuzzing improves throughput, but outsourcing fuzzing tasks to multiple untrusted nodes introduces privacy risks: valuable seeds, especially crash-triggering samples, may reveal vulnerability information before affected users are protected. In this paper, we propose PrivFuzz, a privacy-preserving collaborative fuzzing framework. PrivFuzz allows organizations and individuals to collaborate and receive rewards while keeping fuzzing seeds confidential and enabling controlled encrypted seed reuse among untrusted fuzzing nodes. The key idea is to combine trusted execution environments (TEEs) with blockchain-based smart contracts to support confidentiality and fair reward settlement. We give game-based definitions and reduction-style arguments for seed confidentiality, worker soundness, outsourcer atomicity, and duplicate-claim resistance under an attested execution model. We implement a PrivFuzz prototype and evaluate it on four open-source parsing targets. Separately, native AFL++ sanity checks suggest that CPS-facing industrial protocol parsers such as Modbus and OPC UA fall within the same fuzzable target domain. Demonstrating end-to-end PrivFuzz on CPS control programs is left as future work. Using PrivFuzz, we discovered nine bugs and reported them to the developers.
Cryptographic software forms a critical foundation of modern computing systems, but the security guarantees of cryptographic protocols do not automatically extend to their implementations. Errors in arithmetic operations, validation logic, data conversion, constraint generation, or component integration can cause deployed software to deviate from the intended protocol while still producing plausible outputs. Such risks are difficult to detect in compiled binaries and become even more challenging in modern cryptographic systems such as zero-knowledge proofs, where implementations combine finite-field arithmetic, constraint systems, witness generation, proving procedures, verification logic, and serialization formats.Securing cryptographic implementations requires analysis techniques that can reason about both low-level program behavior and high-level cryptographic intent. To address this need, cryptographic function identification in binaries is first examined. It categorizes existing detection techniques, develops a unified benchmarking framework, and evaluates current tools through reproduction and replication studies across different compilers, optimization levels, obfuscation strategies, and algorithm variants. The second part introduces an automated security analysis framework for zkSNARK implementations that combines constraint checking with fuzzing-based testing to detect and locate cryptographic logic errors. This approach helps determine whether an implemented zkSNARK system correctly enforces the intended computation and security design. The third part develops a grey-box differential fuzzing approach for zero-knowledge proof binary applications. It uses structured input generation, coverage monitoring, control-dependency-aware taint tracking, and error localization to guide testing toward security-relevant code and expose inconsistencies in circuit construction, witness conversion, proof generation, and verification logic.Together, these contributions connect binary analysis, automated checking, and protocol-aware fuzzing to improve the practical security of cryptographic software. They provide methods for identifying implementation-level weaknesses that may remain hidden during ordinary testing, especially when programs produce valid-looking outputs despite incorrect cryptographic behavior. By combining systematic evaluation, zkSNARK-specific analysis, and binary-level testing, the resulting methodologies advance the development of more reliable techniques for analyzing, testing, and securing real-world cryptographic systems.
VSAT (Vulnerability Saturation Auditing) makes the completeness of an LLM security audit a measurable, calibrated quantity. It runs several deliberately diverse LLM audit "lenses" over the same codebase and treats each lens as a capture occasion, so the overlap structure yields (i) a far more complete union vulnerability list and (ii) a Chao2 richness estimate of the undiscovered population. VSAT combines this statistical discovery saturation with a deterministic OWASP ASVS structural coverage into a single completeness score (Phi = C_struct x C_hat) and derives a saturation-based stopping rule. Implemented as a security-audit skill on the cc-rsg-web agentic platform, VSAT attains 94.7-100% category recall and 99.1% code-verified precision on three documented benchmark applications (NodeGoat, django.nV, DVWA), delivers a 2.4-3.4x discovery uplift over a single pass with a per-finding proof-of-concept and regression test, and its non-zero residual estimate is corroborated by an independent real-world field validation. To our knowledge this is the first method to bring capture-recapture completeness estimation and a saturation stopping rule to LLM-based web-application security auditing.
Morena Barboni, Filippo Lampa, Andrea Morichetta, Andrea Polini
The immutability of deployed smart contracts increases the impact of undetected faults. Mutation testing evaluates test suite effectiveness by injecting controlled faults (mutants) into contract code and observing whether existing tests detect them. However, the number of generated mutants and the required test executions make mutation testing costly, limiting its scalability in realistic settings. We present ASCENT , an online test prioritization technique based on a Neural Monte Carlo Tree Search (Neural-MCTS) algorithm that dynamically learns and adapts test execution strategies during mutation analysis. The approach prioritizes tests in real time without requiring prior knowledge of the system under test, reducing execution cost while preserving fault detection effectiveness. This paper provides a comprehensive evaluation across five real-world Solidity projects. We analyze behavior under a wide range of hyperparameter configurations, examine how different state representations influence prioritization performance, and evaluate an asynchronous execution model that decouples search, inference, and training to reduce wall-clock execution time. The results show consistent reductions across all projects, ranging from 28–61% depending on project features and hyperparameter configurations, alongside a parallelized variant that substantially reduces wall-clock execution time with controlled trade-offs in prioritization performance.
Smart contracts underpin a wide range of decentralized applications—from financial services to supply-chain management—but their immutability and direct control of assets magnify the impact of any security bugs. Although many fuzz approaches have been proposed and have demonstrated their effectiveness in uncovering vulnerabilities, existing methods often rely on unguided random mutation scheduling, generate redundant inputs, and fail to adapt to smart contract-specific characteristics. To overcome these challenges, we present FuzzMaster, a feedback-driven fuzzing framework that combines deep reinforcement learning (DRL) with lightweight probabilistic scheduling to steer mutation selection at runtime intelligently. By continuously analyzing execution feedback—code coverage, function-call sequences, and vulnerability signals—FuzzMaster’s DRL agent and probabilistic tables prioritize high-impact mutations and avoid wasted effort on redundant seeds. On standard VeriSmart and SmartBugs benchmarks, FuzzMaster achieves a 66.2% detection rate with 100% precision (versus 46.9% for ItyFuzz and 43.1% for Confuzzius) and uncovers most bugs within the first second of execution. Meanwhile, in real-world Ethereum contracts, FuzzMaster identified 97 vulnerabilities in 6 categories. These results demonstrate that dynamic, vulnerability-aware mutation scheduling can dramatically improve both the efficiency and effectiveness of smart contract fuzz testing.
Mingxi Ye, Yuhong Nan, Zhijie Zhong, Jianzhong Su · 7 authors
Given the critical nature of Ethereum, exploiting 1-day vulnerabilities that are patched but not yet widely deployed is essential. Meanwhile, Automatic Patch-based Exploit Generation (APEG) is a promising technique for this, as it helps developers understand root causes, verify fixes in downstream forks, and detect incomplete patches. However, existing exploit generation tools can not work well for vulnerabilities on Ethereum due to three key unique challenges: (1) navigating complex and cross-language exploit paths hidden within patches, (2) synthesizing complicated and stateful environment configurations, and (3) handling non-deterministic inconsistencies between blockchain nodes that lead to false alarms. To address these challenges, we introduce ChainDelta , a novel fuzzing agent framework driven by Large Language Models to automatically generate exploits based on Ethereum security patches. ChainDelta consists of three core modules: a directed fuzzer utilizes call graph analysis to guide testing towards vulnerable code based on the patch information; an agent-based environment fuzzer acts as an expert to automatically set up the necessary blockchain states to trigger vulnerabilities; and finally, a state-aware sanitizer performs differential analysis while monitoring the blockchain transient state to distinguish true inconsistencies from benign non-determinism. We evaluate ChainDelta on a diverse benchmark with real-world patches, covering a wide range of types such as data racing and denial-of-service. ChainDelta successfully generated exploits with a 64% success rate and only a 15.8% false positive rate. An ablation study confirms the contribution of each module to the overall performance. To demonstrate its practical impacts, we conducted a real-world auditing campaign on top of ChainDelta , leading to the discovery of four previously undisclosed vulnerabilities with bug bounties.
Immutable code and steep transaction fees make smart contract deployment uniquely unforgiving. While continuous integration (CI/CD) pipelines excel at catching standard software bugs, applying exhaustive security tests to Web3 applications severely bottlenecks development through massive computational overhead and gas consumption. This paper presents a testing architecture designed specifically to resolve this tension between security depth and execution speed. The system pipelines three core engines. First, an AI-driven pre-execution gate flags immediate vulnerabilities. Next, a structural reduction module applies the k + 1 symmetric pattern to strip out redundant test permutations. Finally, the system constrains the remaining test suite using the NSGA-II evolutionary algorithm. This multi-objective optimizer dynamically schedules execution to maximize fault detection against strict, predefined gas budgets. To evaluate the model empirically, I bridged a localized EVM sandbox with a Python optimization engine. Results confirm the framework collapses exponential test generation and throttlesexecution costs without sacrificing critical security coverage. Ultimately, it offers a highly scalable path forward for modern DevSecOps.
The correct and resilient operation of distributed systems—spanning global financial ledgers, decentralized autonomous organizations, and peer-to-peer energy microgrids—depends fundamentally on the correctness of their underlying consensus mechanisms. These protocols must guarantee agreement on shared state among a collection of potentially faulty or adversarial nodes, upholding the dual properties of safety and liveness even under hostile conditions. Despite the growing diversity of consensus algorithms, from classical crash-fault tolerant approaches such as Paxos and Raft to modern Byzantine fault-tolerant (BFT) variants and Directed Acyclic Graph (DAG)-based structures, the research community lacks a unified architecture for their systematic, cross-platform evaluation. This paper proposes a modular, extensible framework called the Consensus Evaluation and Resilience Framework (CERF) to fill this gap. CERF integrates five core components: a high-fidelity network emulation layer, a pluggable system-under-test (SUT) adapter, a fault injection engine (FIE) capable of simulating both benign and Byzantine failure modes, a multi-dimensional performance monitoring unit (PMU), and a formal consistency checker. By decoupling the testing infrastructure from protocol implementation, CERF enables fair comparisons of throughput, latency, energy efficiency, and scalability. The proposed architecture draws on insights from seminal benchmarking works including BlockBench, Jepsen, and ByzzBench, and extends evaluation criteria to address modern challenges in IoT environments, post-quantum security, and DAG-based ledgers. Graph-theoretical principles are incorporated at the topology design stage to model network vulnerabilities and guide adversarial scenario construction.
Java applications are prone to vulnerabilities stemming from the insecure use of security-sensitive APIs, such as file operations enabling path traversal or deserialization routines allowing remote code execution. These sink APIs encode critical information for vulnerability discovery: the program-specific constraints required to reach them and the exploitation conditions necessary to trigger security flaws. Despite this, existing fuzzers largely overlook such vulnerability-specific knowledge, limiting their effectiveness. We present GONDAR, a sink-centric fuzzing framework that systematically leverages sink API semantics for targeted vulnerability discovery. GONDAR first identifies reachable and exploitable sink call sites through CWE-specific scanning combined with LLM-assisted static filtering. It then deploys two specialized agents that work collaboratively with a coverage-guided fuzzer: an exploration agent generates inputs to reach target call sites by iteratively solving path constraints, while an exploitation agent synthesizes proof-of-concept exploits by reasoning about and satisfying vulnerability-triggering conditions. The agents and fuzzer continuously exchange seeds and runtime feedback, complementing each other. We evaluated GONDAR on real-world Java benchmarks, where it discovers four times more vulnerabilities than Jazzer, the state-of-the-art Java fuzzer. Notably, an earlier GONDAR version contributed to Team Atlanta's first-place CRS in the DARPA AI Cyber Challenge, and is integrated into OSS-CRS, a sandbox project in The Linux Foundation's OpenSSF, to analyze open-source Java projects, where it has already uncovered a zero-day vulnerability.
Gerardo Iuliano, Daniele Carangelo, Carmine T. Calabrese, Dario Di Nucci
Mutation testing is a technique to assess the effectiveness of test suites by introducing artificial faults into programs. Although mutation testing plugins are available for many platforms and languages, none is currently available for Remix-IDE, the most widely used Integrated Development Environment for the entire contract development journey, used by users of all knowledge levels, and serves as a learning lab for teaching and experimenting with Ethereum. The quality and security of smart contracts are crucial in blockchain systems, as even minor issues can result in substantial financial losses. This paper proposes MuSe, a mutation testing plugin for the Remix-IDE. MuSe includes traditional, Solidity-specific, and security-oriented mutation operators. Its integration into the Remix-IDE eliminates the need for additional setup and lowers the entry barrier. As a result, developers and researchers can immediately leverage mutation testing to assess the effectiveness of their test suites and identify potential issues in smart contracts. We provide a demo video showing MuSe: https://www.youtube.com/watch?v=MIFk9exTDu0 and its repository: https://github.com/GerardoIuliano/MuSe-Remix-Plugin.
The Ethereum ecosystem, which secures over $381 billion in assets, fundamentally relies on client APIs as the sole interface between users and the blockchain. However, these critical APIs suffer from widespread implementation inconsistencies, which can lead to financial discrepancies, degraded user experiences, and threats to network reliability. Despite this criticality, existing testing approaches remain manual and incomplete: they require extensive domain expertise, struggle to keep pace with Ethereum’s rapid evolution, and fail to distinguish genuine bugs from acceptable implementation variations. We present APIDiffer , the first specification-guided differential testing framework designed to automatically detect API inconsistencies across Ethereum’s diverse client ecosystem. APIDiffer transforms API specifications into comprehensive test suites through two key innovations: (1) specification-guided test input generation that creates both syntactically valid and invalid requests enriched with real-time blockchain data, and (2) specification-aware false positive filtering that leverages large language models to distinguish genuine bugs from acceptable variations. Our evaluation across all 11 major Ethereum clients reveals the pervasiveness of API bugs in production systems. APIDiffer uncovered 72 bugs, with 90.28% already confirmed or fixed by developers, including one critical error in the official specifications themselves. Beyond these raw numbers, APIDiffer achieves up to 89.67% higher code coverage than existing tools and reduces false positive rates by 37.38%. The Ethereum community’s response validates our impact: developers have integrated our test cases, expressed interest in adopting our methodology, and escalated one bug to the official Ethereum Project Management meeting. By making APIDiffer open-source, we enable continuous validation of Ethereum client API implementations, thereby strengthening the foundational integrity of the entire Ethereum ecosystem.
Elvira Albert, Emanuele De Angelis, Marco Di Ianni, Fabio Fioravanti · 5 authors
Testing has become an integral part of the software development process in order to ensure the correct and safe execution of programs. A powerful approach to testing is property-based testing that aims at generating unit tests that verify that a certain property of interest holds. However, smart contracts are also characterized by important non-functional aspects, such as the gas consumption required to execute their functions. Static gas analyzers are able to obtain parametric gas bounds - that soundly over-approximate - the gas consumption of executing each of the public functions within a smart contract. This paper discusses our ideas towards combining both formal methods, property-based testing and gas analysis, in order to generate gas-aware unit tests that can ensure the gas requirements provided by the programmers.
Elvis Konjoh Selabi, Maurizio Murgia, António Ravara, Emilio Tuosto
The companion paper proposes a formal approach for specifying and implementing decentralised coordination in distributed systems, with a focus on smart contracts. The model captures dynamic roles, data-driven transitions, and external coordination interfaces, enabling high-level reasoning about decentralised workflows. A toolchain supports formal model validation, Solidity code generation (extensible to other smart contract languages), and automated test synthesis. Although targeting blockchain platforms, the methodology is platform-agnostic and may generalise to other service-oriented and distributed architectures. The expressiveness and practicality of the approach are demonstrated through modelling and realising coordination patterns in smart contracts. This artifact accompanies our paper [Elvis Konjoh Selabi et al., 2026]. It provides a toolchain for generating smart contract code from EDAM (Extended Data-Aware Machines) specifications. The artifact includes the complete source code, a Docker image for easy deployment, pre-generated experiment data (generated code, automated tests, and mutation testing results), and reproduction scripts.
Abstract Program verification provides stronger guarantees of correctness than standard testing. The verification process takes a program as input and derives a mathematical formula. Proving that a program is correct then reduces to establishing that this derived formula is unsatisfiable. Traditionally, automated reasoning tools can be used to determine unsatisfiability automatically. Furthermore, modern solvers can also produce a proof of unsatisfiability. However, these techniques typically rely on the proof and the underlying code being publicly available, which may not be desirable for certain applications. This work shows how to address this problem. Our team initially developed a protocol for validating the unsatisfiability of Boolean formulas in privacy-preserving settings. Building on these initial results, we devised ZKSMT, a virtual machine for validating unsatisfiability results produced by SMT solvers in zero-knowledge settings. In this paper we describe the theoretical foundations of such virtual machines and demonstrate how they can be applied to the theories of uninterpreted functions and linear integer arithmetic, two of the most widely used theories in verification. We conclude by outlining how the full formal verification workflow can be adapted to operate in privacy-preserving settings.
Recently, extensive research has focused on addressing the unique challenges of smart contract fuzzing. Nevertheless, existing fuzzers still struggle to generate adequate function call arguments that can explore the deep smart contract states. In this paper, we introduce novel classes of argument constraints that capture the inter-argument relationships required to exercise meaningful contract logic. We propose a static analysis algorithm to extract these constraints from Solidity source code. In addition, we design a constraint-aware argument mutation strategy that leverages the identified constraints to guide test case generation for smart contract fuzzing. We implement our approach in a fuzzer named IConFuzz. Our evaluation on realistic benchmarks with integer overflow, suicidal contract, and ether leakage vulnerabilities demonstrates that IConFuzz outperforms state-of-the-art testing tools in both the number of bugs discovered and the speed of bug detection.
Smart contracts are high-stakes software: their immutable, publicly accessible, code may govern assets worth millions, meaning that even minor defects can have severe consequences. The most used techniques to ensure smart contract correctness are testing and formal verification. Testing is almost always employed but is often restricted to unit tests (which often miss edge cases) and has limited coverage, while formal verification can provide strong guarantees but is often costly and complex to apply, demanding substantial time and expertise. Property-based testing bridges this gap by exploring large input spaces and shrinking failures to minimal counterexamples, helping uncover defects early in development. Formal verification can be left to critical features once testing has filtered out common issues. To add to the challenges smart contract developers face, most languages used were not designed with safety and security guarantees built-in. Daml is a smart contract language designed with correctness in mind, featuring a strong static type system, functional programming paradigms, and built-in abstractions for common smart contract patterns. However, Daml currently lacks support for property-based testing, limiting developers' ability to systematically explore input spaces and verify contract properties. This paper introduces Hypothesis2Daml, an open-source library that brings property-based testing to the Daml ecosystem by connecting the Hypothesis testing framework with the Daml JSON API. Hypothesis2Daml enables developers to specify invariants, preconditions, and stateful workflows over realistic ledger interactions, while providing automatic input generation, shrinking, and isolation of ledger state between test cases. The approach is evaluated using a benchmark consisting of eight contracts, three Daml templates, and twenty-eight property-based tests covering happy paths, negative cases, and alternative interaction orders. The results show that property-based testing is feasible for Daml smart contracts, can systematically expose violated properties with minimal counterexamples, and supports effective debugging of realistic, stateful workflows.
Muhammad Faruq, Rahmad Abdillah, Nazruddin Safaat H., Pizaini
Smart contract vulnerabilities, particularly reentrancy, have caused hundreds of millions of dollars in losses across the Ethereum ecosystem. While static analysis tools dominate current auditing practice, empirical evaluations have consistently demonstrated their high false negative and false positive rates for reentrancy detection. Dynamic analysis, exemplified by property-based fuzzing with Echidna, offers an alternative by evaluating contracts through actual execution. However, systematic empirical evaluation of dynamic tools under controlled ground-truth conditions remains limited. This study adapts the bug injection methodology, previously applied only to static analysis evaluation, to assess Echidna's effectiveness in detecting reentrancy. A dataset of 50 Solidity contracts was instrumented with oracle properties and injected with two reentrancy variants, single-function and cross-function, producing 100 ground-truth contract variants. Three fuzzing configurations of increasing intensity were evaluated across three metrics: detection rate, activation rate, and average detection time. Results show that Echidna achieved 100% activation but detected only 20% to 42% of injected bugs depending on the configuration and variant. Nearly all detections occurred within the first 25 seconds of each campaign, with no benefit from extended timeouts. These findings reveal a fundamental gap between bug reachability and exploitability confirmation under standard fuzzing conditions.
Zero-Knowledge Proofs (ZKPs) have emerged as a transformative cryptographic primitive enabling one party to prove the validity of a statement without revealing any underlying information. This property has made ZKPs a cornerstone in privacypreserving systems, particularly in blockchain, authentication protocols, and secure distributed computing. Despite rapid advancements in ZKP frameworks such as zk-SNARKs and zk-STARKs, the testing and validation of these systems remain a critical challenge. The complexity of arithmetic circuits, the probabilistic nature of proofs, and the potential for subtle vulnerabilities necessitate robust testing methodologies. This paper presents a comprehensive review of testing techniques for Zero-Knowledge Proof systems. It begins by outlining the fundamental properties of ZKPs, including completeness, soundness, and zero-knowledge, which form the basis for testing correctness and security. The study then explores existing literature on testing approaches, including formal verification, fuzz testing, constraint validation, and symbolic execution. Recent research highlights that vulnerabilities such as underconstrained circuits account for a significant portion of ZKP system failures, emphasizing the need for systematic testing strategies. Furthermore, this review categorizes testing techniques into functional, security, and performance testing, providing a structured understanding of their roles in ZKP validation. A comparative analysis of existing methods is also presented to evaluate their effectiveness, scalability, and limitations. The discussion identifies gaps in current research, particularly in automated testing frameworks and standardized benchmarking. The paper concludes by emphasizing the importance of integrating advanced testing methodologies into ZKP development pipelines to ensure reliability, scalability, and security. Future research directions include AI-driven testing, hybrid verification models, and improved tooling for circuit validation. This review aims to serve as a foundational reference for researchers and practitioners working on secure and efficient ZKP systems.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
In Ethereum, DevP2P is the fundamental network-layer protocol set that supports consensus mechanisms, transaction propagation and smart contract execution. Due to the importance of DevP2P, its bugs can be exploited by the attacker to cause security problems like denial of service, leading to property loss on Ethereum. However, existing blockchain testing approaches focus on the bug detection of consensus and application layers, causing many serious DevP2P bugs to be missed. In fact, detecting DevP2P bugs has some key challenges, including how to generate effective inputs and how to detect complex bugs. This paper designs D2PFuzz, the first network-layer differential fuzzing approach of bug detection for Ethereum. It consists of two key techniques: (1) aquery-based fuzzing strategythat dynamically generates valid DevP2P messages according to network, chain and node state changes; and (2) amulti-node differential checking methodthat identifies important differences of DevP2P response messages from multiple nodes in the same blockchain to detect semantic bugs. We have evaluated D2PFuzz on five open-source and popular Ethereum node implementations, including Geth, Erigon, Reth, Besu and Nethermind. D2PFuzz in total finds 15 unique bugs, 12 of which are previously unknown. Compared to two state-of-the-art blockchain testing approaches including LOKI and Hive, D2PFuzz improves testing coverage by 3.7x and 21.6x, respectively, and finds 13 bugs missed by these approaches.
Smart contracts are high-stakes software: their immutable, publicly accessible code may govern assets worth millions. This means that even minor defects can have severe consequences. Unit tests often miss edge cases. Although formal verification is the only route to full correctness, it demands substantial time and expertise. Property-based testing bridges this gap by exploring large input spaces and shrinking failures to minimal counterexamples. Used early, it filters defects and prioritises verification effort on code already validated by tests. Although Solidity benefits from a mature testing ecosystem, comparable support for other languages such as Daml remains limited. This dissertation addresses this gap by introducing Hypothesis2Daml, an open-source library that brings property-based testing to Damlby connecting Hypothesis withthe Daml JSON API. Hypothesis2Daml enables developers to specify invariants, pre/postconditions, and stateful workflows over realistic ledger interactions. It provides automatic input generation, shrinking to minimal counterexamples, party isolation per example, and request helpers that keep tests focused on properties rather than HTTP/JSON wiring. The approach is validated on a benchmark of eight contracts and twenty-seven properties that range from simple invariants to multi-step, role-sensitive workflows. All properties held under testing, with runs completing within practical time bounds, demonstrating that property-based testing is feasible and effective for Daml applications. A comparative evaluation situates Hypothesis2Daml among established tools and methods, highlighting strengths in usability and expressiveness, and acknowledging a throughput trade-off due to JSON-API transport overhead. Contributions include the Hypothesis2Daml library and a reusable benchmark with representative properties. Limitations concern transport overhead, ecosystem specificity, and dependence on developer-authored properties and generators. Future work targets automation, performance, andscope expansion. Together, these results establish a practical path for making property-based testing a routine part of building Daml applications.