The DOI matches its Crossref record; 12 of the 12 references it cites were found in a registry or an index.
ContractFuzzer: fuzzing smart contracts for vulnerability detection
Open accessAbstract
Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to USD 60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of USD 30 million and the freezing of USD 150 million worth of Ether.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bitcoin: A Peer-to-Peer Electronic Cash System
Wright, C. S. (2008) · SSRN Electronic Journal · doi:10.2139/ssrn.3440802 · Cited by 13,922
Making Smart Contracts Smarter
Luu, L., Chu, D.-H., Olickel, H., Saxena, P., & Hobor, A. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978309 · Cited by 2,249
A Survey of Attacks on Ethereum Smart Contracts (SoK)
Atzei, N., Bartoletti, M., & Cimoli, T. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-54455-6_8 · Cited by 1,553
Finding The Greedy, Prodigal, and Suicidal Contracts at Scale
Nikolić, I., Kolluri, A., Sergey, I., Saxena, P., & Hobor, A. (2018) · Proceedings of the 34th Annual Computer Security Applications Conference · doi:10.1145/3274694.3274743 · Cited by 660
Formal Verification of Smart Contracts: Short Paper
Bhargavan, K., Delignat-Lavaud, A., Fournet, C., Gollamudi, A., Gonthier, G., Kobeissi, N., Kulatova, N., Rastogi, A., Sibut-Pinote, T., Swamy, N., et al. (2016) · Proceedings of the 2016 ACM Workshop on Programming Languages and Analysis for Security · doi:10.1145/2993600.2993611 · Cited by 626
Why3 — Where Programs Meet Provers
Filliâtre, J.-C., & Paskevich, A. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-37036-6_8 · Cited by 538
Step by Step Towards Creating a Safe Smart Contract: Lessons and Insights from a Cryptocurrency Lab
Delmolino, K., Arnett, M., Kosba, A., Miller, A., & Shi, E. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-53357-4_6 · Cited by 505
Dependent types and multi-monadic effects in F*
Swamy, N., Hriţcu, C., Keller, C., Rastogi, A., Delignat-Lavaud, A., Forest, S., Bhargavan, K., Fournet, C., Strub, P.-Y., Kohlweiss, M., et al. (2016) · Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages · doi:10.1145/2837614.2837655 · Cited by 314
A sentence generator for testing parsers
Purdom, P. W. (1972) · BIT Numerical Mathematics · doi:10.1007/bf01932975 · Cited by 178
A sentence generator for testing parsers
Purdom, P. W. (1972) · BIT Numerical Mathematics · doi:10.1007/bf01932308 · Cited by 159
Cited by
Smart Contract: Attacks and Protections
Sayeed, S., Marco-Gisbert, H., & Caira, T. (2020) · IEEE Access · doi:10.1109/access.2020.2970495 · Cited by 322
Understanding Security Issues in the NFT Ecosystem
Das, D., Bose, P., Ruaro, N., Kruegel, C., & Vigna, G. (2022) · Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3548606.3559342 · Cited by 195
Rethinking Smart Contract Fuzzing: Fuzzing With Invocation Ordering and Important Branch Revisiting
Liu, Z., Qian, P., Yang, J., Liu, L., Xu, X., He, Q., & Zhang, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3237370 · Cited by 138
Automated Smart Contract Vulnerability Detection using Fine-tuned Large Language Models
Yang, Z., Man, G., & Yue, S. (2023) · Proceedings of the 2023 6th International Conference on Blockchain Technology and Applications · doi:10.1145/3651655.3651658 · Cited by 10
DepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance
Ma, C., Song, W., & Huang, J. (2025) · Proceedings of the ACM on Programming Languages · doi:10.1145/3763185 · Cited by 4
Metadata
- Authors
- Jiang, B., Liu, Y., & Chan, W. K.
- Venue
- Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering
- Publisher
- ACM
- Published
- 2018-09-03
- Pages
- 259-269
- OpenAlex
- W2846896781
- Cited by
- 820
- References
- 12
- FWCI
- 42.65
- Type
- conference paper
- Language
- en
- Open access
- green
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: ContractFuzzer: fuzzing smart contracts for vulnerability detection. https://app.cochat.ai/papers/10.1145/3238147.3238177
- The paper
- Jiang, B., Liu, Y., & Chan, W. K. (2018). ContractFuzzer: fuzzing smart contracts for vulnerability detection. Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering. https://doi.org/10.1145/3238147.3238177
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
