arXiv subjects

Shuwei Song

Publications and source records attributed to Shuwei Song.

3 recordsLinked to original sources

arXiv2024

Nurgle: Exacerbating Resource Consumption in Blockchain State Storage via MPT Manipulation

Blockchains, with intricate architectures, encompass various components, e.g., consensus network, smart contracts, decentralized applications, and auxiliary services. While offering numerous advantages, these components expose various attack surfaces, leading to severe threats to blockchains. In this study, we unveil a novel attack surface, i.e., the state storage, in blockchains. The state storage, based on the Merkle Patricia Trie, plays a crucial role in maintaining blockchain state. Besides, we design Nurgle, the first Denial-of-Service attack targeting the state storage. By proliferating intermediate nodes within the state storage, Nurgle forces blockchains to expend additional resources on state maintenance and verification, impairing their performance. We conduct a comprehensive and systematic evaluation of Nurgle, including the factors affecting it, its impact on blockchains, its financial cost, and practically demonstrating the resulting damage to blockchains. The implications of Nurgle extend beyond the performance degradation of blockchains, potentially reducing trust in them and the value of their cryptocurrencies. Additionally, we further discuss three feasible mitigations against Nurgle. At the time of writing, the vulnerability exploited by Nurgle has been confirmed by six mainstream blockchains, and we received thousands of USD bounty from them.

cs.CR↗

arXiv2022

The odd-even effect of mosaic modulation period of quasi-periodic hopping on the Anderson localization in a one-dimensional lattice model

In this study, we investigate Anderson localization in a one-dimensional lattice with a mosaic off-diagonal quasiperiodic hopping. Our findings reveal that the localization behavior of zero-energy states is highly dependent on the parity of the mosaic modulation period, denoted as $\kappa$. Specifically, when $\kappa$ is an odd integer, there is no Anderson localization transition even for large quasiperiodic hopping strengths, and the zero-energy state remains in a critical state. On the other hand, for an even $\kappa$ and a generic quasiperiodic hopping, the zero-energy state becomes a localized edge state at either the left or right end of the system. Additionally, we observe that the geometric mean value of the energy spectrum is equal to the constant hopping for an even $\kappa$, while for an odd $\kappa$, it is equal to the geometric mean value of the hopping. This odd-even effect of the mosaic period also extends to other eigenstates near zero energy. More specifically, for an odd $\kappa$, there exists an energy window in which the eigenstates remain critical even for strong quasiperiodic hopping. In contrast, for an even $\kappa$, an Anderson localization transition occurs as the hopping strength increases. Furthermore, we are able to accurately determine the Lyapunov exponent $\gamma(E)$ and the mobility edges $E_c$. By analyzing the Lyapunov exponent, we identify critical regions in the hopping-energy parameter planes. Additionally, as the energy approaches the mobility edges, we observe a critical index of localization length of $\nu=1$. Finally, we demonstrate that different systems can be characterized by their Lyapunov exponent $\gamma(E)$ and Avila's acceleration $\omega(E)$.

cond-mat.dis-nn↗

arXiv2022

AntFuzzer: A Grey-Box Fuzzing Framework for EOSIO Smart Contracts

In the past few years, several attacks against the vulnerabilities of EOSIO smart contracts have caused severe financial losses to this prevalent blockchain platform. As a lightweight test-generation approach, grey-box fuzzing can open up the possibility of improving the security of EOSIO smart contracts. However, developing a practical grey-box fuzzer for EOSIO smart contracts from scratch is time-consuming and requires a deep understanding of EOSIO internals. In this work, we proposed AntFuzzer, the first highly extensible grey-box fuzzing framework for EOSIO smart contracts. AntFuzzer implements a novel approach that interfaces AFL to conduct AFL-style grey-box fuzzing on EOSIO smart contracts. Compared to black-box fuzzing tools, AntFuzzer can effectively trigger those hard-to-cover branches. It achieved an improvement in code coverage on 37.5% of smart contracts in our benchmark dataset. AntFuzzer provides unified interfaces for users to easily develop new detection plugins for continually emerging vulnerabilities. We have implemented 6 detection plugins on AntFuzzer to detect major vulnerabilities of EOSIO smart contracts. In our large-scale fuzzing experiments on 4,616 real-world smart contracts, AntFuzzer successfully detected 741 vulnerabilities. The results demonstrate the effectiveness and efficiency of AntFuzzer and our detection pl

cs.CR↗