This program is tentative and subject to change.
Billions of dollars are transacted through smart contracts, making vulnerabilities a major financial risk. One focus in the security arms race is on profitable vulnerabilities that attackers can exploit. Fuzzing is a key method for identifying these vulnerabilities. However, current solutions face two main limitations: 1. a lack of profit-centric techniques for expediting detection and, 2. insufficient automation in maximizing the profitability of discovered vulnerabilities, leaving the analysis to human experts.
To address these gaps, we have developed VERITE, a profit-centric smart contract fuzzing framework that not only effectively detects those profitable vulnerabilities but also maximizes the exploited profits. VERITE has three key features: 1. DeFi action-based mutators for boosting the exploration of transactions with different fund flows; 2. potentially profitable candidates identification criteria, which checks whether the input has caused abnormal fund flow properties during testing; 3. a gradient descent-based profit maximization strategy for these identified candidates.
VERITE is fully developed from scratch and evaluated on a dataset consisting of 61 exploited real-world DeFi projects with an average of over 1.1 million dollars loss. The results show that VERITE can automatically extract more than 18 million dollars in total and is significantly better than state-of-the-art fuzzer ItyFuzz in both detection (29/10) and exploitation (134 times more profits gained on average). Remarkably, in 12 targets, it gains more profits than real-world attacking exploits (1.01 to 11.45 times more). VERITE is also applied by auditors in contract auditing, where 6 (5 high severity) zero-day vulnerabilities are found with over $2,500 bounty rewards.
This program is tentative and subject to change.
Tue 24 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:30 - 12:20 | Blockchain and Smart ContractIdeas, Visions and Reflections / Research Papers at Vega Chair(s): Cuiyun Gao Harbin Institute of Technology, Shenzhen | ||
10:30 10mTalk | SmartShift: A Secure and Efficient Approach to Smart Contract Migration Ideas, Visions and Reflections Tahrim Hossain Syracuse University, Faisal Haque Bappy Syracuse University, Tarannum Shaila Zaman University of Maryland Baltimore County, Raiful Hasan Kent State University, Tariqul Islam Syracuse University | ||
10:40 20mTalk | LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts Research Papers Shoupeng Ren Zhejiang University, Lipeng He University of Waterloo, Tianyu Tu Zhejiang University, Di Wu Zhejiang University, Jian Liu Zhejiang University, Kui Ren Zhejiang University, Chun Chen Zhejiang University DOI Pre-print | ||
11:00 20mTalk | SmartShot: Hunt Hidden Vulnerabilities in Smart Contracts using Mutable Snapshots Research Papers Ruichao Liang Wuhan University, Jing Chen Wuhan University, Ruochen Cao Wuhan University, Kun He Wuhan University, Ruiying Du Wuhan University, Shuhua Li Wuhan University, Zheng Lin University of Hong Kong, Cong Wu Wuhan University DOI | ||
11:20 20mTalk | Automated and Accurate Token Transfer Identification and Its Applications in Cryptocurrency Security Research Papers Shuwei Song University of Electronic Science and Technology of China, Ting Chen University of Electronic Science and Technology of China, Ao Qiao University of Electronic Science and Technology of China, Xiapu Luo Hong Kong Polytechnic University, Leqing Wang University of Electronic Science and Technology of China, Zheyuan He University of Electronic Science and Technology of China, Ting Wang Penn State University, Xiaodong Lin University of Guelph, Peng He University of Electronic Science and Technology of China, Wensheng Zhang University of Electronic Science and Technology of China, Xiaosong Zhang University of Electronic Science and Technology of China DOI | ||
11:40 20mTalk | Detecting Smart Contract State-Inconsistency Bugs via Flow Divergence and Multiplex Symbolic Execution Research Papers Yinxi Liu Rochester Institute of Technology, Wei Meng Chinese University of Hong Kong, Yinqian Zhang Southern University of Science and Technology DOI | ||
12:00 20mTalk | Smart Contract Fuzzing Towards Profitable Vulnerabilities Research Papers Ziqiao Kong Nanyang Technological University, Cen Zhang Nanyang Technological University, Maoyi Xie Nanyang Technological University, Ming Hu Singapore Management University, Yue Xue MetaTrust Labs, Ye Liu Singapore Management University, Haijun Wang Xi'an Jiaotong University, Yang Liu Nanyang Technological University DOI Pre-print | ||
Vega is close to the registration desk.
Facing the registration desk, its entrance is on the left, close to the hotel side entrance.