search

gongbell / ContractFuzzer

The Ethereum Smart Contract Fuzzer for Security Vulnerability Detection (ASE 2018)
229 stars 85 forks source link

How to implement to detect 'freezing ether' bug? #11

Open kimdora opened 4 years ago

kimdora commented 4 years ago

I read the 'ContractFuzzer' paper. And I am confused how to detect freezing ether bugs 'exactly' because the paper explained it too rough. I want to know it in detail so I'm looking for code implementing freezing ether bug oracle. But I can't find it. Can you tell me which file implements freezing ether bug oracle?

kimdora commented 4 years ago

Now I think freezing ether detector is removed from the source code. Refer to https://github.com/gongbell/ContractFuzzer/blob/master/contract_fuzzer/src/ContractFuzzer/server/server.go#L291

gongbell commented 4 years ago

Please check this script:

https://github.com/gongbell/ContractFuzzer/blob/master/geFreezingEther.py

This vulnerability is detected mainly through static analysis of the bytecode (no opcode to send ether) and the execution log(balance can be greater than 0 during execution).

This was the implementation realized in the original paper.

A better way to check whether a contract can receive ether is to check whether there is any function having the payable modifier through bytecode analysis.