EchoFuzz: Empowering Smart Contract Fuzzing with Large Language Models

2026-09-13

AI Summary

针对智能合约模糊测试中的逻辑鸿沟与路径冗余问题，提出EchoFuzz框架，通过结合静态分析和语言模型生成关键执行路径，提高了漏洞检测效率。

Abstract

Smart contracts, serving as the cornerstone of decentralized applications, autonomously manage trillion-dollar digital assets, making them attractive targets for attacks. Fuzzing has emerged as a promising technique for detecting vulnerabilities in smart contracts, yet existing methods face two main challenges. (1) The logical gap in state transitions and combinatorial redundancy hinders effective tradeoffs between bug detection efficiency and state space exploration cost, leading to critical execution paths to be overlooked. (2) Rule-based sequence mutation strategies suffer from path redundancy and inadequate guidance from contract logic, resulting in performance bottlenecks that stall the exploration of in-depth vulnerability-oriented paths. To tackle these challenges, we propose EchoFuzz, an LLM-guided fuzzing framework introducing Vulnerable Function Call Sequences (VFCS) - minimal, behavior-preserving execution paths that expose bugs through key state transitions. EchoFuzz consists of two key procedures. First, we develop a chain-guided LLM approach, that combines static analysis with logical understanding to generate contract-specific VFCS candidates that eliminate combinatorial redundancy. Second, we adopt an iterative fuzzing strategy that uses LLMs with real-time feedback to adaptively steer fuzzer toward uncovered branches. Experiments show EchoFuzz outperforms state-of-the-art methods, achieving 29\% higher branch coverage and detecting 62\% more vulnerabilities. It also found 37 previously unknown vulnerabilities in real contracts, showing strong practicality.

Problem

• Smart Contracts
• Fuzzing
• Vulnerabilities
• State Transitions
• Combinatorial Redundancy

Innovation

• LLM-guided fuzzing
• Vulnerable Function Call Sequences (VFCS)
• iterative fuzzing strategy
• real-time feedback