Is My RPC Response Reliable? Detecting RPC Bugs in Ethereum Blockchain Client under Context

2026-01-29

AI Summary

Existing approaches struggle to effectively detect RPC vulnerabilities that depend on blockchain context, often leading to abnormal client responses or denial-of-service conditions. This work proposes EthCRAFT, the first framework to incorporate contextual modeling into RPC vulnerability detection. EthCRAFT explores the state transition space of Ethereum clients to generate diverse transactions that construct meaningful execution contexts, enabling the synthesis of context-aware RPC calls. By cross-comparing responses across multiple clients within these generated contexts, EthCRAFT identifies previously undetected vulnerabilities. The approach substantially improves the detection of real-world context-dependent RPC flaws, uncovering six new vulnerabilities in mainstream Ethereum clients—three of which received bug bounties from the Ethereum Foundation and one of which triggered a major codebase revision—demonstrating clear advantages over existing tools.

Technology Category

• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy
• Search and Optimization: Metareasoning and Metaheuristics
• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness

Application Category

• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Economics, Online Markets and Human Computation: Economic aspects of blockchain and cryptocurrencies
• Security and Privacy: Cryptocurrency and smart contracts

Abstract

Blockchain clients are fundamental software for running blockchain nodes. They provide users with various RPC (Remote Procedure Call) interfaces to interact with the blockchain. These RPC methods are expected to follow the same specification across different blockchain nodes, providing users with seamless interaction. However, there have been continuous reports on various RPC bugs that can cause unexpected responses or even Denial of Service weakness. Existing studies on blockchain RPC bug detection mainly focus on generating the RPC method calls for testing blockchain clients. However, a wide range of the reported RPC bugs are triggered in various blockchain contexts. To the best of our knowledge, little attention is paid to generating proper contexts that can trigger these context-dependent RPC bugs. In this work, we propose EthCRAFT, a Context-aware RPC Analysis and Fuzzing Tool for client RPC bug detection. EthCRAFT first proposes to explore the state transition program space of blockchain clients and generate various transactions to construct the context. EthCRAFT then designs a context-aware RPC method call generation method to send RPC calls to the blockchain clients. The responses of 5 different client implementations are used as cross-referring oracles to detect the RPC bugs. We evaluate EthCRAFT on real-world RPC bugs collected from the GitHub issues of Ethereum client implementations. Experiment results show that EthCRAFT outperforms existing client RPC detectors by detecting more RPC bugs. Moreover, EthCRAFT has found six new bugs in major Ethereum clients and reported them to the developers. One of the bug fixes has been written into breaking changes in the client's updates. Three of our bug reports have been offered a vulnerability bounty by the Ethereum Foundation.

Problem

• RPC bugs
• blockchain client
• context-dependent
• Ethereum
• bug detection

Innovation

• context-aware fuzzing
• RPC bug detection
• blockchain client testing
• state transition exploration
• cross-referencing oracle