WasmChecker: Effectively Detecting WebAssembly Bugs via Static Program Analysis

WebAssembly, a new binary instruction set, has rapidly gained popularity across fields such as blockchain, edge computing, and cloud computing due to its efficiency, security, and portability. However, recent research has identified limitations in WebAssembly’s type system and linear memory design, leading to security issues such as integer overflows and memory safety vulnerabilities.In this paper, we present WasmChecker, the first static analysis approach for WebAssembly programs based on abstract interpretation. WasmChecker consists of three components: a frontend module for parsing and constructing control flow graphs, a static analysis module for iterative state analysis, and a vulnerability filtering module to identify security flaws. We design and implement a software prototype and conduct extensive evaluations. Experiments demonstrate WasmChecker’s effectiveness, achieving a 97.33% recall in a small dataset and accurately identifying 46 vulnerabilities across four real-world datasets, with a 92% recall rate. Additionally, WasmChecker shows high efficiency, with an average runtime of 13.85 seconds on WebAssembly programs smaller than 1 MB.