LLAMA: Multi-Feedback Smart Contract Fuzzing Framework with LLM-Guided Seed Generation

TL;DR

LLAMA is a novel smart contract fuzzing framework that leverages large language models, multi-feedback mechanisms, and evolutionary strategies to improve vulnerability detection and code coverage.

Contribution

This work introduces a multi-feedback, LLM-guided fuzzing framework with hierarchical seed generation and adaptive mutation scheduling for smart contracts.

Findings

Achieves 91% instruction coverage

Detects 132 out of 148 known vulnerabilities

Outperforms state-of-the-art fuzzers in coverage and vulnerability detection

Abstract

Smart contracts play a pivotal role in blockchain ecosystems, and fuzzing remains an important approach to securing smart contracts. Even though mutation scheduling is a key factor influencing fuzzing effectiveness, existing fuzzers have primarily explored seed scheduling and generation, while mutation scheduling has been rarely addressed by prior work. In this work, we propose a Large Language Models (LLMs)-based Multi-feedback Smart Contract Fuzzing framework (LLAMA) that integrates LLMs, evolutionary mutation strategies, and hybrid testing techniques. Key components of the proposed LLAMA include: (i) a hierarchical prompting strategy that guides LLMs to generate semantically valid initial seeds, coupled with a lightweight pre-fuzzing phase to select high-potential inputs; (ii) a multi-feedback optimization mechanism that simultaneously improves seed generation, seed selection, and mutation scheduling by leveraging runtime coverage and dependency feedback; and (iii) an evolutionary fuzzing engine that dynamically adjusts mutation operator probabilities based on effectiveness, while incorporating symbolic execution to escape stagnation and uncover deeper vulnerabilities. Our experiments demonstrate that LLAMA outperforms state-of-the-art fuzzers in both coverage and vulnerability detection. Specifically, it achieves 91% instruction coverage and 90% branch coverage, while detecting 132 out of 148 known vulnerabilities across diverse categories. These results highlight LLAMA's effectiveness, adaptability, and practicality in real-world smart contract security testing scenarios.