REVIEW 6 cited by
LLM4Fuzz: Guided Fuzzing of Smart Contracts with Large Language Models
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
LLM4Fuzz: Guided Fuzzing of Smart Contracts with Large Language Models
abstract
As blockchain platforms grow exponentially, millions of lines of smart contract code are being deployed to manage extensive digital assets. However, vulnerabilities in this mission-critical code have led to significant exploitations and asset losses. Thorough automated security analysis of smart contracts is thus imperative. This paper introduces LLM4Fuzz to optimize automated smart contract security analysis by leveraging large language models (LLMs) to intelligently guide and prioritize fuzzing campaigns. While traditional fuzzing suffers from low efficiency in exploring the vast state space, LLM4Fuzz employs LLMs to direct fuzzers towards high-value code regions and input sequences more likely to trigger vulnerabilities. Additionally, LLM4Fuzz can leverage LLMs to guide fuzzers based on user-defined invariants, reducing blind exploration overhead. Evaluations of LLM4Fuzz on real-world DeFi projects show substantial gains in efficiency, coverage, and vulnerability detection compared to baseline fuzzing. LLM4Fuzz also uncovered five critical vulnerabilities that can lead to a loss of more than $247k.
Forward citations
Cited by 6 Pith papers
-
CKG-LLM: LLM-Assisted Detection of Smart Contract Access Control Vulnerabilities Based on Knowledge Graphs
CKG-LLM uses LLMs to generate executable queries over contract knowledge graphs for detecting access control vulnerabilities and reports superior performance versus existing tools.
-
Belobog: Move Language Fuzzing Framework For Real-World Smart Contracts
Belobog is a type-graph-guided fuzzer that generates well-typed transaction sequences for Move smart contracts and claims to reach 93 of 109 audited vulnerabilities, including all 9 critical ones.
-
TraceLLM: Security Diagnosis Through Traces and Smart Contracts in Ethereum
TraceLLM automatically generates human-readable security reports for Ethereum hacks by feeding LLMs a mix of execution traces, decompiled code, and balance changes.
-
Large Language Model assisted Hybrid Fuzzing
HyllFuzz uses LLMs to solve constraints and generate modified inputs for hard-to-reach branches in hybrid fuzzing, reporting 31-59% higher branch coverage than CoFuzz, Intriguer and QSYM plus seven new bugs found.
-
Capturing Monetarily Exploitable Vulnerability in Smart Contracts via Auditor Knowledge-Learning Fuzzing
FAUDITOR is a specialized fuzzer that detected 220 zero-day monetarily exploitable vulnerabilities in smart contracts by combining finance-interface targeting, NLP from auditor reports, and self-learning.
-
V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution
V2E automates PoC generation, triggerability and profitability validation, and iterative refinement using LLMs to confirm exploitable smart contract vulnerabilities, outperforming baselines on 264 labeled contracts.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.