CoChat
Sign Up
Cited by 4

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

DepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance

Ma, Chenyang, Song, Wei, Huang, Jeff·2025·Proceedings of the ACM on Programming Languages
DOI 10.1145/3763185
Open this paper in CoChat — free account

Abstract

Fuzzing is an effective technique to detect vulnerabilities in smart contracts. The challenge of smart contract fuzzing lies in the statefulness of contracts, which indicates that certain vulnerabilities can only be manifested in specific contract states. State-of-the-art fuzzers may generate and execute a plethora of meaningless or redundant transaction sequences during fuzzing, incurring a penalty in efficiency. To this end, we present DepFuzz , a hybrid fuzzer for efficient smart contract fuzzing, which introduces a symbolic execution module into the feedback-based fuzzer. Guided by the distance-based function dependencies between functions, DepFuzz can efficiently yield meaningful transaction sequences that contribute to vulnerability exposure or code coverage. The experiments on 286 benchmark smart contracts and 500 large real-world smart contracts corroborate that, compared to state-of-the-art approaches, DepFuzz achieves higher instruction coverage rate and uncovers many more vulnerabilities with less time.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3763185

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Research works printed but not linked: 56

  1. 10.1145/3605098.3635970 · DOI
  2. 10.1109/SP46215.2023.10179346 · DOI
  3. Lexi Brent Anton Jurisevic Michael Kong Eric Liu François Gauthier Vincent Gramoli Ralph Holz and Bernhard Scholz. 2018. Vandal: A Scalable Security Analysis Framework for Smart Contracts. CoRR abs/1809.03981 (2018). arXiv:1809.03981 http://arxiv.org/abs/1809.03981 · arXiv
  4. 10.1007/978-3-030-62822-2_2 · DOI
  5. 10.1109/TSE.2021.3054928 · DOI
  6. 10.1109/SANER.2017.7884650 · DOI
  7. 10.1145/3319535.3354249 · DOI
  8. 10.1109/ASE51524.2021.9678888 · DOI
  9. 10.1109/WETSEB.2019.00008 · DOI
  10. Joel Frank, Cornelius Aschermann, and Thorsten Holz. 2020. ETHBMC: A Bounded Model Checker for Smart Contracts. In Proceedings of the 29th USENIX Security Symposium, USENIX Security’20, August 12-14. USENIX Association, 2757–2774. https://www.usenix.org/conference/usenixsecurity20/presentation/frank
  11. 10.1145/3551349.3559567 · DOI
  12. 10.1109/ICSE48619.2023.00087 · DOI
  13. 10.1145/3395363.3404366 · DOI
  14. Fabio Gritti, Nicola Ruaro, Robert McLaughlin, Priyanka Bose, Dipanjan Das, Ilya Grishchenko, Christopher Kruegel, and Giovanni Vigna. 2023. Confusum Contractum: Confused Deputy Vulnerabilities in Ethereum Smart Contracts. In Proceedings of the 32nd USENIX Security Symposium, USENIX Security’23, Anaheim, CA, USA, August 9-11. USENIX Association, 1793–1810. https://www.usenix.org/conference/usenixsecurity23/presentation/gritti
  15. 10.1007/978-3-030-51280-4_34 · DOI
  16. 10.1145/3319535.3363230 · DOI
  17. 10.1109/SP40000.2020.00063 · DOI
  18. 10.1109/QRS54544.2021.00035 · DOI
  19. 10.1016/j.infsof.2023.107213 · DOI
  20. 10.1145/3238147.3238177 · DOI
  21. 10.1109/ICSE48619.2023.00045 · DOI
  22. 10.14722/ndss.2018.23082 · DOI
  23. Johannes Krupp and Christian Rossow. 2018. teEther: Gnawing at Ethereum to Automatically Exploit Smart Contracts. In Proceedings of the 27th USENIX Security Symposium, USENIX Security’18, Baltimore, MD, USA, August 15-17. USENIX Association, 1317–1333. https://www.usenix.org/conference/usenixsecurity18/presentation/krupp
  24. 10.1145/3660772 · DOI
  25. 10.1145/3689711 · DOI
  26. 10.1145/3650212.3652146 · DOI
  27. 10.1145/2976749.2978309 · DOI
  28. 10.1145/3611643.3616281 · DOI
  29. 10.1109/ASE.2019.00133 · DOI
  30. 10.1145/3377811.3380334 · DOI
  31. 10.1145/3274694.3274743 · DOI
  32. 10.1145/3510454.3516869 · DOI
  33. 10.1109/ICDE60146.2024.00158 · DOI
  34. 10.1109/EuroSP57164.2023.00034 · DOI
  35. 10.1007/S10586-021-03491-1 · DOI
  36. 10.1145/3597926.3598059 · DOI
  37. 10.1145/3485540 · DOI
  38. Sunbeom So, Seongjoon Hong, and Hakjoo Oh. 2021. SmarTest: Effectively Hunting Vulnerable Transaction Sequences in Smart Contracts through Language Model-Guided Symbolic Execution. In Proceedings of the 30th USENIX Security Symposium, USENIX Security’21, August 11-13. USENIX Association, 1361–1378. https://www.usenix.org/conference/usenixsecurity21/presentation/so
  39. Sunbeom So, Seongjoon Hong, and Hakjoo Oh. 2021. SmarTest: Effectively Hunting Vulnerable Transaction Sequences in Smart Contracts through Language Model-Guided Symbolic Execution. In Proceedings of the 30th USENIX Security Symposium, USENIX Security’21, August 11-13. USENIX Association, 1361–1378. https://www.usenix.org/conference/usenixsecurity21/presentation/so
  40. 10.1109/SP40000.2020.00032 · DOI
  41. 10.1109/SP40001.2021.00085 · DOI
  42. 10.1145/3551349.3560429 · DOI
  43. 10.1007/S10515-024-00483-4 · DOI
  44. 10.1145/3597503.3639117 · DOI
  45. 10.1109/EuroSP51992.2021.00018 · DOI
  46. 10.1145/3243734.3243780 · DOI
  47. 10.1145/3658644.3690293 · DOI
  48. 10.1145/3597503.3639152 · DOI
  49. 10.1145/3691620.3695482 · DOI
  50. 10.1145/3368089.3417064 · DOI
  51. 10.1109/TDSC.2022.3182373 · DOI
  52. 10.1109/ISSRE.2019.00052 · DOI
  53. 10.1109/ICSE48619.2023.00061 · DOI
  54. 10.1145/3650212.3680303 · DOI
  55. 10.1109/SP46215.2023.10179435 · DOI
  56. 10.1109/ICSME52107.2021.00009 · DOI

Metadata

Authors
Ma, C., Song, W., & Huang, J.
Venue
Proceedings of the ACM on Programming Languages
Publisher
Association for Computing Machinery (ACM)
Published
2025-10-09
Volume
9
Issue
OOPSLA2
Pages
3755-3783
ISSN
2475-1421
DOI
10.1145/3763185
Cited by
4
References
1
Language
en
Funders
National Natural Science Foundation of China (62472221)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review