Fuzz on the Beach: Fuzzing Solana Smart Contracts (2309.03006v3)

Abstract: Solana has quickly emerged as a popular platform for building decentralized applications (DApps), such as marketplaces for non-fungible tokens (NFTs). A key reason for its success are Solana's low transaction fees and high performance, which is achieved in part due to its stateless programming model. Although the literature features extensive tooling support for smart contract security, current solutions are largely tailored for the Ethereum Virtual Machine. Unfortunately, the very stateless nature of Solana's execution environment introduces novel attack patterns specific to Solana requiring a rethinking for building vulnerability analysis methods. In this paper, we address this gap and propose FuzzDelSol, the first binary-only coverage-guided fuzzing architecture for Solana smart contracts. FuzzDelSol faithfully models runtime specifics such as smart contract interactions. Moreover, since source code is not available for the large majority of Solana contracts, FuzzDelSol operates on the contract's binary code. Hence, due to the lack of semantic information, we carefully extracted low-level program and state information to develop a diverse set of bug oracles covering all major bug classes in Solana. Our extensive evaluation on 6049 smart contracts shows that FuzzDelSol's bug oracles find bugs with a high precision and recall. To the best of our knowledge, this is the largest evaluation of the security landscape on the Solana mainnet.

• The paper presents FuzzDelSol, a tool that uses binary-only, coverage-guided fuzzing to detect vulnerabilities in Solana smart contracts.
• It integrates a blockchain emulator, transaction generator, and instrumented execution environment to simulate realistic on-chain interactions.
• The evaluation shows FuzzDelSol detected significant vulnerabilities in 52 of 6049 contracts, processing over 1500 transactions per second.

Essay: "Fuzz on the Beach: Fuzzing Solana Smart Contracts"

Introduction

"Fuzz on the Beach: Fuzzing Solana Smart Contracts" introduces FuzzDelSol, a novel tool designed to address the unique security challenges of Solana smart contracts. Solana's stateless execution environment necessitates new approaches to vulnerability analysis, given current tools largely cater to the Ethereum Virtual Machine. FuzzDelSol employs a binary-only, coverage-guided fuzzing methodology to detect vulnerabilities specific to Solana, such as missing signer checks, arbitrary cross-program invocations, missing owner checks, and integer bugs.

Solana's Execution Environment

Solana separates executable code from raw data in its account model, providing a unique challenge in smart contract execution. Its stateless nature allows for high transaction throughput but introduces vulnerabilities that require careful verification of program interactions. The execution of on-chain programs via the eBPF VM and native programs included in the Solana runtime highlights the need for tailored analysis tools that can handle Solana-specific runtime semantics.

Figure 1: Serialization of an instruction as input of the eBPF VM.

Challenges of Security Analysis

Fuzzing Solana smart contracts is challenging due to the constraints imposed by the blockchain's stateless environment and its reliance on valid ledger snapshots. Modeling such complex interactions, ensuring reproducibility, and handling sysvar accounts are essential to simulate genuine blockchain states accurately. Moreover, detecting Solana-specific vulnerabilities requires advanced taint tracking techniques to trace data flows and identify attack vectors such as unauthorized cross-program invocations.

FuzzDelSol Design and Implementation

FuzzDelSol is an integration of several components designed to provide comprehensive analysis:

1. Blockchain Emulator: Creates valid ledger snapshots comprising program-related and additional accounts to simulate realistic blockchain interactions.
2. Transaction Generator: Translates fuzzing data into valid transactions, ensuring reproducibility and facilitating vulnerability detection.
3. RunDelSol: Executes transactions within an instrumented Solana environment, providing coverage data and a taint tracking engine for detailed vulnerability analysis.
4. Transaction Evaluator: Cross-checks execution outcomes, advising ledger updates, and vulnerability report generation.

   Figure 2: FuzzDelSol Design.

Evaluation

• Neodyme Breakpoint Workshop Dataset: Validates detection capabilities across known vulnerabilities, showcasing FuzzDelSol's precision without false alarms compared to VRust's considerable false alarm rate.
• Mainnet Analysis: Out of 6049 contracts analyzed, 52 revealed significant vulnerabilities. Detection of bugs like missing signer checks and integer bugs demonstrates FuzzDelSol’s applicability to real-world conditions.

  Figure 3: Process to transform randomly generated bytes into a valid transaction.

Performance Metrics

Utilizing high transaction throughput, FuzzDelSol maintains an average processing speed exceeding 1500 transactions per second, validating its efficiency in handling large datasets and complex Solana contracts. The tool's capacity to generate substantial code coverage confirms its effectiveness in uncovering deep-seated vulnerabilities.

Conclusion

FuzzDelSol represents a robust solution to the pressing need for tailored smart contract analysis tools in Solana's ecosystem. By combining runtime modeling, coverage-guided fuzzing, and targeted bug detection oracles, FuzzDelSol sets a new standard in blockchain security analysis. This broad applicability and precision mark it as an essential tool for developers and researchers aiming to ensure the security of decentralized applications on the Solana blockchain.