Finding Consensus Bugs in Ethereum via Multi-transaction Differential Fuzzing
Talkat 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI '21) · 2021-07-14..07-16·
summary
Fluffy mutates and executes multi-transaction differential fuzzing test cases against multiple Ethereum clients (Geth, OpenEthereum), exercising different pre-transaction program states that single-transaction fuzzers miss. It uses in-process harnesses, skipped verification and semantic-aware mutation to cut invalid cases, collects coverage feedback, and finds state divergences. Fluffy discovers two new consensus bugs (one later triggers a mainnet hard fork), achieves 510× throughput and 2.7× code coverage versus prior work.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:25Nov 11th, 2020 hard-fork
- 1:44Ethereum
- 2:01Consensus bugs
- 3:26Existing fuzzers
- 5:18Key idea
- 5:37Bugs we found
- 5:49Transfer-after-destruct bug
- 9:04Our goal
- 9:28Design challenges
- 9:47Fluffy (Our fuzzer)
- 10:10Fluffy overview
- 11:10Implementation
- 11:46Evaluation
- 13:09Code coverage (Higher is better)
- 13:35Throughput (Higher is better)
related talks
33mDifferential Fuzzing on Lightning Network
12mDepFuzz: Efficient Smart Contract Fuzzing with Function Dependence Guidance
01h 15mMake your programs more reliable with Fuzzing
26mDifferential Testing with Foundry
53mFuzz Testing for Fun and Profit
13mWingFuzz: Implementing Continuous Fuzzing for DBMSs
52mStructure aware fuzzing
13mFuzzing Comes to Solana