Главная
Study mode:
on
1
Intro
2
Fuzzer No Match for Human Tester, but...
3
Compiler Overview
4
Code generators
5
Threat model
6
Limitation of random fuzzing
7
Yul Input Generation
8
Test program generation
9
Differential testing
10
Execution Tracing Overview
11
Fuzzing Setup
12
Bug 1: Incorrect keccak computation
13
Bug 2: Incorrect Optimization
14
Correct Computation
15
Bugs by component
16
Bugs by impact
17
Bugs by severity
18
Heuristics + Randomness
19
Conclusion
Description:
Explore the intricacies of compiler security testing in this conference talk from the Hack In The Box Security Conference. Delve into the challenges of testing compiler components like optimizers and code generators, which can introduce security vulnerabilities in smart contracts. Learn about structured approaches to overcome limitations of traditional fuzzing techniques when dealing with complex programming languages like Solidity. Discover innovative methods for generating valid test programs, implementing differential testing, and employing execution tracing to uncover bugs in compiler optimizations and code generation. Examine real-world examples of security-relevant bugs found in the Solidity compiler, including incorrect keccak computations and faulty optimizations. Gain insights into the effectiveness of combining heuristics with randomness in compiler testing, and understand the impact and severity of discovered vulnerabilities across different compiler components.

Can A Fuzzer Match A Human

Hack In The Box Security Conference
Add to list