Belobog: Move Language Fuzzing Framework For Real-World Smart Contracts
Ziqiao Kong, Wanxu Xia, Zhengwei Li, Yi Lu, Pan Li, Liqun Yang, Yang Liu, Xiapu Luo, Shaohua Li

TL;DR
Belobog is a novel type-aware fuzzing framework designed for Move smart contracts, effectively generating valid transactions to detect vulnerabilities and reproduce exploits in real-world blockchain projects.
Contribution
It introduces the first type-aware fuzzing framework for Move smart contracts, incorporating a type graph and concolic execution to improve vulnerability detection.
Findings
Detected 100% of manually audited critical vulnerabilities.
Reproduced full exploits for Cetus and Nemo projects.
Discovered new vulnerabilities in ongoing audits.
Abstract
Move is a research-oriented programming language designed for secure and verifiable smart contract development and has been widely used in managing billions of digital assets in blockchains, such as Sui and Aptos. Move features a strong static type system and explicit resource semantics to enforce safety properties such as the prevention of data races, invalid asset transfers, and entry vulnerabilities. However, smart contracts written in Move may still contain certain vulnerabilities that are beyond the reach of its type system. It is thus essential to validate Move smart contracts. Unfortunately, due to its strong type system, existing smart contract fuzzers are ineffective in producing syntactically or semantically valid transactions to test Move smart contracts. This paper introduces the first fuzzing framework, Belobog, for Move smart contracts. Belobog is type-aware and ensures…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsBlockchain Technology Applications and Security · Security and Verification in Computing · Cryptography and Data Security
