Reproduce “xFuzz: Machine Learning Guided Cross-Contract Fuzzing” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Yinxing Xue, Jiaming Ye, Wei Zhang, Jun Sun, Lei Ma, Haijun Wang, Jianjun Zhao
xFuzz, a machine learning-guided fuzzer, detects previously overlooked cross-contract vulnerabilities in smart contracts by employing an ML model to identify suspicious functions and a path prioritization algorithm. The system achieved 100% precision in detecting 18 new cross-contract vulnerabilities and reduced fuzzing search time by over 80% compared to existing tools.
Key insights
- Using an ML model, specifically EEC, for initial filtering allows for a high recall rate (95%) of potentially vulnerable functions, effectively reducing the search space for the fuzzer while minimizing missed vulnerabilities.
- Augmenting Word2Vec bytecode embeddings with carefully selected static features (e.g., `has_modifier`, `callee_external`) significantly enhances the ML model's ability to identify vulnerability-related patterns.
- A two-tiered path prioritization mechanism, combining function-level and caller-level scores, efficiently guides the fuzzer to explore the most promising paths, detecting a majority of vulnerabilities within the first few explored paths.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.