Smart contracts (SC), which serve as the backbone of decentralized applications (dApps), self-execute key functions on blockchain platforms. They currently manage assets valued in the trillions of dollars in the cryptocurrency space. However, their immutability after deployment makes them particularly vulnerable to exploitation if any weaknesses are present. Identifying and addressing these vulnerabilities is critical to avoiding significant financial and reputational damage. One of the commonly used automated methods for fast and efficient vulnerability detection is Fuzzing. However, both traditional fuzzing techniques and also those based on machine learning (ML) encounter challenges, such as selecting ineffective transaction sequences, either by generating them randomly or pre-generating them before running the fuzzer. This leads to a failure in updating transaction sequences based on the dynamical SC states during the fuzzing process. Additionally, some methods mutate test cases and store them in a pool, which becomes problematic when physical memory is no unlimited. In this paper, we present MADFuzz, a Multi-Agent Deep Reinforcement Learning (DRL)-based approach designed to address the challenges of SC fuzzing. To improve the selection of effective transaction sequences, we develop agents that dynamically generate optimal functions and arguments based on the current state of the SC. By utilizing DRL, our approach generates transaction sequences in real-time without the need for memory storage, efficiently overcoming the limitations of previous methods. Finally, we conduct experiments to compare MADFuzz with existing state-of-the-art techniques, and the results demonstrate that our approach significantly outperforms the competition.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

MADFuzz: A Study on Automatic Exploitation of Smart Contract Vulnerabilities Using Multi-agent Reinforcement Learning-Guided Fuzzing

  • Nguyen Nhat Quan,
  • Pham Trung Thanh,
  • Tran Nguyen Tien Thanh,
  • Nguyen Huu Quyen,
  • Phan The Duy,
  • Van-Hau Pham

摘要

Smart contracts (SC), which serve as the backbone of decentralized applications (dApps), self-execute key functions on blockchain platforms. They currently manage assets valued in the trillions of dollars in the cryptocurrency space. However, their immutability after deployment makes them particularly vulnerable to exploitation if any weaknesses are present. Identifying and addressing these vulnerabilities is critical to avoiding significant financial and reputational damage. One of the commonly used automated methods for fast and efficient vulnerability detection is Fuzzing. However, both traditional fuzzing techniques and also those based on machine learning (ML) encounter challenges, such as selecting ineffective transaction sequences, either by generating them randomly or pre-generating them before running the fuzzer. This leads to a failure in updating transaction sequences based on the dynamical SC states during the fuzzing process. Additionally, some methods mutate test cases and store them in a pool, which becomes problematic when physical memory is no unlimited. In this paper, we present MADFuzz, a Multi-Agent Deep Reinforcement Learning (DRL)-based approach designed to address the challenges of SC fuzzing. To improve the selection of effective transaction sequences, we develop agents that dynamically generate optimal functions and arguments based on the current state of the SC. By utilizing DRL, our approach generates transaction sequences in real-time without the need for memory storage, efficiently overcoming the limitations of previous methods. Finally, we conduct experiments to compare MADFuzz with existing state-of-the-art techniques, and the results demonstrate that our approach significantly outperforms the competition.