Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces FAUDITOR, a novel fuzzing framework specifically designed to detect Monetarily Exploitable Vulnerabilities (MEVuls) in smart contracts by focusing on finance-related interfaces. FAUDITOR incorporates auditor reports processed via NLP to extract exploitation patterns, and employs a self-learning mechanism to refine detection strategies based on prior fuzzing results. Evaluation demonstrates FAUDITOR's effectiveness in revealing 220 zero-day MEVuls, outperforming existing fuzzers in speed and instruction coverage.
Smart contracts are riddled with 220 previously unknown vulnerabilities that can be exploited for financial gain, and this new fuzzer found them.
Smart contracts extended blockchain functionality beyond simple transactions, powering complex applications like decentralized finance (DeFi). However, this complexity introduces serious security challenges, including price manipulation and inflation attacks. Despite the development of various security tools, the rapid rise in financially motivated exploits continues to pose a significant threat to the blockchain ecosystem. These financially motivated exploits often stem from Monetarily Exploitable Vulnerabilities (MEVuls), which refer to vulnerabilities arising from exploitable implementations in monetary transactions or value-transfer logic. Due to their complexity, intricate chains of function calls, multifaceted logic, and diverse manifestations across different smart contracts, MEVuls are particularly challenging for current security tools to identify. Instead of providing actionable insights, existing tools frequently generate excessive warnings that overwhelm developers without effectively mitigating risks. To address the challenge of recognizing MEVuls, we first formalize MEVuls based on common real-world financial exploits. Then, we introduce FAUDITOR, a specialized fuzzer designed to detect MEVuls in smart contracts. The key insight is that leveraging smart contracts'finance-related interfaces directly exposes critical vulnerabilities, making detection more targeted. We further integrate auditors'reports using NLP to extract valuable insights on exploitation patterns, enabling a more informed search strategy. Additionally, FAUDITOR employs a self-learning mechanism that refines its detection strategies over time, allowing it to improve based on prior fuzzing results. In our evaluation, FAUDITOR impressively reveals 220 zero-day MEVuls. Meanwhile, compared to existing fuzzers, FAUDITOR detects vulnerabilities faster and achieves better instruction coverage.