Midas: Mining Profitable Exploits in On-Chain Smart Contracts via Feedback-Driven Fuzzing and Differential Analysis
This program is tentative and subject to change.
In the context of boosting smart contract applications, prioritizing their security becomes paramount. Smart contract exploits often result in notable financial losses. Ensuring their security is by no means trivial. Rather than resulting in program crashes, most attacks in on-chain smart contracts aim to induce financial loss, referred to as profitable exploits. By constructing seemingly innocuous inputs, profitable exploits try to extract extra profit or compromise the interests of others. However, due to the complexity of call chains in on-chain smart contracts and the need for effective oracles for profitable exploits, smart contract fuzzing suffers from low efficiency and low effectiveness in finding profitable exploits.
In this paper, we present \textit{Midas}, a novel feedback-driven fuzzing framework to mine profitable exploits in on-chain smart contracts effectively. \textit{Midas} consists of two modules: diverse validity fuzzing and profitable transaction identification. The diverse validity fuzzing module applies two waypoints to efficiently generate valid transactions, addressing the complexity of on-chain smart contract call chains. The profitable transaction identification module applies differential analysis to effectively identify profitable exploits, addressing the limitation of ad-hoc oracles. Evaluation of \textit{Midas} over on-chain smart contracts showed it effectively identified 40 real-world exploits with a precision of 80%, outperforming state-of-the-art tools (i.e., ItyFuzz and Slither) in both efficiency and effectiveness. Particularly, \textit{Midas} effectively mines five unknown exploits in valuable smart contracts, and two of them have already been confirmed by their DApp developers.
This program is tentative and subject to change.
Fri 20 SepDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
13:30 - 14:50 | |||
13:30 20mTalk | Empirical Study of Move Smart Contract Security: Introducing MoveScan for Enhanced Analysis Technical Papers Shuwei Song University of Electronic Science and Technology of China, Jiachi Chen Sun Yat-sen University, Ting Chen University of Electronic Science and Technology of China, Xiapu Luo The Hong Kong Polytechnic University, Teng Li University of Electronic Science and Technology of China, Wenwu Yang University of Electronic Science and Technology of China, Leqing Wang University of Electronic Science and Technology of China, Weijie Zhang Jiangsu University of Science and Technology, Feng Luo The Hong Kong Polytechnic University, Zheyuan He University of Electronic Science and Technology of China, Yi Lu BitsLab, Singapore, Pan Li MoveBit, Hong Kong | ||
13:50 20mTalk | FunRedisp: Reordering Function Dispatch in Smart Contract to Reduce Invocation Gas Fees Technical Papers DOI | ||
14:10 20mTalk | Identifying Smart Contract Security Issues in Code Snippets from Stack Overflow Technical Papers Jiachi Chen Sun Yat-sen University, Chong Chen Sun Yat-sen University, Jiang Hu Sun Yat-sen University, John Grundy Monash University, Yanlin Wang Sun Yat-sen University, Ting Chen University of Electronic Science and Technology of China, Zibin Zheng Sun Yat-sen University DOI Pre-print | ||
14:30 20mTalk | Midas: Mining Profitable Exploits in On-Chain Smart Contracts via Feedback-Driven Fuzzing and Differential Analysis Technical Papers Mingxi Ye Sun Yat-sen University, Xingwei Lin Zhejiang University, Yuhong Nan Sun Yat-sen University, Jiajing Wu Sun Yat-sen University, Zibin Zheng Sun Yat-sen University |