xFuzz: Machine Learning Guided Cross-Contract Fuzzing

Smart contract transactions are increasingly interleaved by cross-contract calls. While many tools have been developed to identify a common set of vulnerabilities, the vulnerability is overlooked existing tools. Cross-contract vulnerabilities exploitable bugs that manifest in presence more than two interacting contracts. Existing methods however limited analyze maximum contracts at same time. Detecting highly non-trivial. With multiple contracts, search space much larger single contract. To address this problem, we present xFuzz, machine learning guided smart fuzzing framework. The models trained with novel features (e.g., word vectors and instructions) used filter likely benign program paths. Comparing static tools, model proven be robust, avoiding directly adopting manually-defined rules specific We compare xFuzz three state-of-the-art on 7,391 detects 18 which 15 exposed for first Furthermore, our approach shown efficient detecting non-cross-contract as well—using less 20% time other twice vulnerabilities.