Rethinking Mutation Strategies in Fuzzing Smart Contracts

Smart contracts are widely employed in the Internet of Things (IoT) to enhance automation, transparency, and security in operations. However, vulnerabilities within smart contracts can compromise the security of IoT systems. Fuzzing is commonly used to efficiently detect these vulnerabilities, utilizing effective mutation strategies such as the random search mechanism called Havoc to generate diverse inputs for achieving edge coverage. Despite its effectiveness, existing fuzzers for smart contracts often utilize Havoc from the fuzzer AFL for C programs without significant adaptation or enhancement. Consequently, the full potential of Havoc remains underexplored. To address this issue, we conduct a comprehensive study involving experiments on 200 meticulously labeled smart contracts using four popular fuzzers integrated with Havoc. Specifically, our research involves optimizing the interaction between Havoc and these fuzzers. We discover that allocating more computational resources to Havoc not only enhances the edge coverage of the fuzzers but also narrows the performance gap among different fuzzers. Furthermore, our investigation into the mutator stacking mechanism of Havoc reveals that dynamically adjusting the stack size and mutator type according to the fitness of seeds can further improve fuzzer performance. Inspired by these findings, we propose Havoc-Ts, which approaches the Havoc mutation strategy as a dynamic recommender system problem to adjust stack size and mutator type adaptively. Evaluation results demonstrate significant improvements in both the edge coverage performance and the vulnerability detection accuracy using our method.