WASAIUP: A Demand-driven Concolic Fuzzer for EOSIO Smart Contracts

Attacks exploiting vulnerabilities in EOSIO smart contracts have caused serious economic losses. To detect these vulnerabilities, some approaches have been proposed, and concolic fuzzing is one of the most popular techniques among them. However, the existing concolic fuzzers have problems such as path explosion and adopting redundant constraint solving strategies, which reduce the detection efficiency. In order to alleviate these problems, we propose a demand-driven concolic fuzzing approach to discovering vulnerabilities in EOSIO smart contracts. In the approach, execution information is first collected to guide the execution of the system in a demand-driven manner. To improve the efficiency of vulnerability detection, we design a pruning strategy to eliminate the paths that are not relevant to the discovery of vulnerabilities and redundant paths to be explored. Meanwhile, an incremental constraint solving method is used to process only paths that can explore new branches. In addition, we also design a path prioritization method to preferentially explore paths which are more conducive to discovering vulnerabilities, so as to find vulnerabilities in smart contracts as early as possible. We have implemented our approach in a tool called WASAIUP and evaluated it on 3441 smart contracts. The experimental results show that WASAIUP improves the performance by 25.1% to 149.8% compared with the state-of-the-art tool WASAI in terms of efficiency, while maintaining high detection accuracy.