Seminar-Security-Blockchain/SemSEpaper/exercise.bib

@INPROCEEDINGS{9678888,
	author={Choi, Jaeseung and Kim, Doyeon and Kim, Soomin and Grieco, Gustavo and Groce, Alex and Cha, Sang Kil},
	booktitle={2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)}, 
	title={SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Data-Flow Analyses}, 
	year={2021},
	volume={},
	number={},
	pages={227-239},
	doi={10.1109/ASE51524.2021.9678888}}

@inproceedings{10.1145/3578527.3578538,
	author = {Pani, Siddhasagar and Nallagonda, Harshita Vani and Vigneswaran and Medicherla, Raveendra Kumar and Rajan M},
	title = {SmartFuzzDriverGen: Smart Contract Fuzzing Automation for Golang},
	year = {2023},
	isbn = {9798400700644},
	publisher = {Association for Computing Machinery},
	address = {New York, NY, USA},
	url = {https://doi.org/10.1145/3578527.3578538},
	doi = {10.1145/3578527.3578538},
	abstract = {Greybox fuzzers require intermediate programs called fuzz drivers to test smart contract APIs. These fuzz drivers use the semi-random inputs (bytes) generated by fuzzers to prepare suitable inputs required to test APIs. Further, fuzz driver also uses this input to decide sequence in which APIs to be invoked and enables the fuzzer to execute the APIs in that sequence to find the vulnerabilities, if any. Manually writing such complex and intelligent fuzz drivers is laborious, requires deep technical skills, hence can be cumbersome and error prone. In this paper, we propose SmartFuzzDriverGen framework to automatically generate fuzz drivers which invoke smart contract APIs using different strategies: unit-level, sequence-based (random, user-defined), and heuristics based. We evaluate the proposed framework by testing a prototype implementation of it with Golang smart contracts (targeted for Hyperledger Fabric platform) and study the effectiveness of the generated fuzz drivers in terms of code coverage as well as bug finding abilities. We observed that fuzzing of APIs in random sequences performed better than the other methods.},
	booktitle = {Proceedings of the 16th Innovations in Software Engineering Conference},
	articleno = {14},
	numpages = {11},
	keywords = {smart contracts, vulnerability detection, automated driver generation, blockchain, fuzzing, sequencing},
	location = {Allahabad, India},
	series = {ISEC '23}
}

@inproceedings {217464,
	author = {Johannes Krupp and Christian Rossow},
	title = {{teEther}: Gnawing at Ethereum to Automatically Exploit Smart Contracts},
	booktitle = {27th USENIX Security Symposium (USENIX Security 18)},
	year = {2018},
	isbn = {978-1-939133-04-5},
	address = {Baltimore, MD},
	pages = {1317--1333},
	url = {https://www.usenix.org/conference/usenixsecurity18/presentation/krupp},
	publisher = {USENIX Association},
	month = aug
}

@inproceedings{10.1145/3243734.3243780,
	author = {Tsankov, Petar and Dan, Andrei and Drachsler-Cohen, Dana and Gervais, Arthur and B\"{u}nzli, Florian and Vechev, Martin},
	title = {Securify: Practical Security Analysis of Smart Contracts},
	year = {2018},
	isbn = {9781450356930},
	publisher = {Association for Computing Machinery},
	address = {New York, NY, USA},
	url = {https://doi.org/10.1145/3243734.3243780},
	doi = {10.1145/3243734.3243780},
	abstract = {Permissionless blockchains allow the execution of arbitrary programs (called smart contracts), enabling mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. To address this problem, we present Securify, a security analyzer for Ethereum smart contracts that is scalable, fully automated, and able to prove contract behaviors as safe/unsafe with respect to a given property. Securify's analysis consists of two steps. First, it symbolically analyzes the contract's dependency graph to extract precise semantic information from the code. Then, it checks compliance and violation patterns that capture sufficient conditions for proving if a property holds or not. To enable extensibility, all patterns are specified in a designated domain-specific language. Securify is publicly released, it has analyzed >18K contracts submitted by its users, and is regularly used to conduct security audits by experts. We present an extensive evaluation of Securify over real-world Ethereum smart contracts and demonstrate that it can effectively prove the correctness of smart contracts and discover critical violations.},
	booktitle = {Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security},
	pages = {67–82},
	numpages = {16},
	keywords = {smart contracts, stratified datalog, verification, security analysis},
	location = {Toronto, Canada},
	series = {CCS '18}
}