DPFuzz: Dynamic-Static Branch Distance and Branch Priority-Driven Fuzzing for Smart Contract
Year: 2026
Type: article
Abstract: With the widespread adoption of blockchain smart contracts, vulnerabilities in complex, state-dependent execution paths pose serious risks to user assets and system trustworthiness. Existing fuzzers often allocate resources uniformly, generate ineffective transaction sequences, and provide limited guidance toward deep branches. We propose DPFuzz, a smart contract fuzzing framework driven by branch priority and dynamic-static branch distance. DPFuzz assigns resources according to normalized branch complexity, security importance, and runtime coverage, constructs state-relevant transaction sequences from read-after-write dependencies, and combines dynamic operand feedback with static control-flow distance for seed guidance. Within each contract, the scheduler normalizes branch scores and updates allocations after every scheduling cycle, directing the finite testing budget toward difficult and security-sensitive branches. Experiments on three complementary datasets show DPFuzz's effectiveness. Compared with ConFuzzius, sFuzz, and IR-Fuzz, it improves branch coverage on Dataset 1 by an average of 11.2% and 14.4% for small and large contracts, respectively. On Dataset 2, DPFuzz detects 173 true positives, 46 more than IR-Fuzz. On 200 real-world contracts from Dataset 3, it achieves 95.04% precision and 97.10% recall, showing its practical applicability.
Authors: Yingbiao Yao, Enrui Xu, Yang Zhang, Yuhan Gao, Yaoqi Sun
Institutions: Lishui University, Hangzhou Dianzi University
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Estimated APC paid: $2,645
OpenAlex ID: W7225752082