EVMFuzz: Differential fuzz testing of Ethereum virtual machine

Ethereum Virtual Machine (EVM) is the run-time environment for smart contracts and its vulnerabilities may lead to serious problems ecology. With lots of techniques being developed validation contracts, security EVM have not been well-studied. In this paper, we propose EVMFuzz, aiming detect EVMs with differential fuzz testing. The core idea EVMFuzz continuously generate seed different EVMs' execution, so as find many inconsistencies among execution results possible, eventually discover output cross-referencing. First, present evaluation metric internal inconsistency indicator, such opcode sequence executed gas used. Then, construct via a set predefined mutators employ dynamic priority scheduling algorithm guide selection maximize inconsistency. Finally, leverage crossreferencing oracles avoid manual checking output. For evaluation, conducted large-scale mutation on 36,295 real-world generated 253,153 contracts. Among them, 66.2% showed performance, including 1,596 variant triggered inconsistent EVMs. Accompanied by root cause analysis, found 5 previously unknown bugs in four widely used EVMs, all had included Common Vulnerabilities Exposures (CVE) database.