28 citations · 71 across the 26 of their papers we have counts for
26 papers
NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery
Jikai Wang, Ningyu He, Tianming Liu +2
With WebAssembly widely supported in browsers, containers, IoT devices, and serverless platforms and increasingly adopted as a universal low-level bytecode standard, auditing its h…
CLIR: Liveness-Driven and Structure-Aware Fuzzing for the Cranelift Compiler
Shangtong Cao, Tianlei Song, Qiuping Yi +4
Modern compilers are complex software systems that must correctly translate high-level programming languages into machine code across multiple architectures. Cranelift, a fast and…
When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
Jie Ma, Ningyu He, Jinwen Xi +8
The Ethereum ecosystem, which secures over $381 billion in assets, fundamentally relies on client APIs as the sole interface between users and the blockchain. However, these critic…
An Effective and Cost-Efficient Agentic Framework for Ethereum Smart Contract Auditing
Xiaohui Hu, Wun Yu Chan, Yuejie Shi +5
Smart contract security is paramount, but identifying intricate business logic vulnerabilities remains a persistent challenge because existing solutions consistently fall short: ma…
Cybersquatting in Web3: The Case of NFT
Kai Ma, Ningyu He, Jintao Huang +3
Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Tok…
OpDiffer: LLM-Assisted Opcode-Level Differential Testing of Ethereum Virtual Machine
Jie Ma, Ningyu He, Jinwen Xi +4
As Ethereum continues to thrive, the Ethereum Virtual Machine (EVM) has become the cornerstone powering tens of millions of active smart contracts. Intuitively, security issues in…
WalletProbe: A Testing Framework for Browser-based Cryptocurrency Wallet Extensions
Xiaohui Hu, Ningyu He, Haoyu Wang
Serving as the first touch point for users to the cryptocurrency world, cryptocurrency wallets allow users to manage, receive, and transmit digital assets on blockchain networks an…
The Promise and Pitfalls of WebAssembly: Perspectives from the Industry
Ningyu He, Shangtong Cao, Haoyu Wang +2
As JavaScript has been criticized for performance and security issues in web applications, WebAssembly (Wasm) was proposed in 2017 and is regarded as the complementation for JavaSc…
Following Devils' Footprint: Towards Real-time Detection of Price Manipulation Attacks
Bosi Zhang, Ningyu He, Xiaohui Hu +2
Price manipulation attack is one of the notorious threats in decentralized finance (DeFi) applications, which allows attackers to exchange tokens at an extensively deviated price f…
SeeWasm: An Efficient and Fully-Functional Symbolic Execution Engine for WebAssembly Binaries
Ningyu He, Zhehao Zhao, Hanqin Guan +6
WebAssembly (Wasm), as a compact, fast, and isolation-guaranteed binary format, can be compiled from more than 40 high-level programming languages. However, vulnerabilities in Wasm…
All Your Tokens are Belong to Us: Demystifying Address Verification Vulnerabilities in Solidity Smart Contracts
Tianle Sun, Ningyu He, Jiang Xiao +3
In Ethereum, the practice of verifying the validity of the passed addresses is a common practice, which is a crucial step to ensure the secure execution of smart contracts. Vulnera…
WALLETRADAR: Towards Automating the Detection of Vulnerabilities in Browser-based Cryptocurrency Wallets
Pengcheng Xia, Yanhui Guo, Zhaowen Lin +8
Cryptocurrency wallets, acting as fundamental infrastructure to the blockchain ecosystem, have seen significant user growth, particularly among browser-based wallets (i.e., browser…
Remeasuring the Arbitrage and Sandwich Attacks of Maximal Extractable Value in Ethereum
Tianyang Chi, Ningyu He, Xiaohui Hu +1
Maximal Extractable Value (MEV) drives the prosperity of the blockchain ecosystem. By strategically including, excluding, or reordering transactions within blocks, block producers…
WRTester: Differential Testing of WebAssembly Runtimes via Semantic-aware Binary Generation
Shangtong Cao, Ningyu He, Xinyu She +3
Wasm runtime is a fundamental component in the Wasm ecosystem, as it directly impacts whether Wasm applications can be executed as expected. Bugs in Wasm runtime bugs are frequentl…
SoK: On the Security of Non-Fungible Tokens
Kai Ma, Jintao Huang, Ningyu He +2
Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying t…
WASMixer: Binary Obfuscation for WebAssembly
Shangtong Cao, Ningyu He, Yao Guo +1
WebAssembly (Wasm) is an emerging binary format that draws great attention from our community. However, Wasm binaries are weakly protected, as they can be read, edited, and manipul…
Abusing the Ethereum Smart Contract Verification Services for Fun and Profit
Pengxiang Ma, Ningyu He, Yuhua Huang +2
Smart contracts play a vital role in the Ethereum ecosystem. Due to the prevalence of kinds of security issues in smart contracts, the smart contract verification is urgently neede…
A Deep Dive into NFT Rug Pulls
Jintao Huang, Ningyu He, Kai Ma +2
NFT rug pull is one of the most prominent type of scam that the developers of a project abandon it and then run away with investors' funds. Although they have drawn attention from…
A General Static Binary Rewriting Framework for WebAssembly
Shangtong Cao, Ningyu He, Yao Guo +1
Binary rewriting is a widely adopted technique in software analysis. WebAssembly (Wasm), as an emerging bytecode format, has attracted great attention from our community. Unfortuna…
Fuzzing the Latest NTFS in Linux with Papora: An Empirical Study
Edward Lo, Ningyu He, Yuejie Shi +4
Recently, the first feature-rich NTFS implementation, NTFS3, has been upstreamed to Linux. Although ensuring the security of NTFS3 is essential for the future of Linux, it remains…
Eunomia: Enabling User-specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries
Ningyu He, Zhehao Zhao, Jikai Wang +7
Although existing techniques have proposed automated approaches to alleviate the path explosion problem of symbolic execution, users still need to optimize symbolic execution by ap…
A Survey on EOSIO Systems Security: Vulnerability, Attack, and Mitigation
Ningyu He, Haoyu Wang, Lei Wu +3
EOSIO, as one of the most representative blockchain 3.0 platforms, involves lots of new features, e.g., delegated proof of stake consensus algorithm and updatable smart contracts,…
Understanding the Evolution of Blockchain Ecosystems: A Longitudinal Measurement Study of Bitcoin, Ethereum, and EOSIO
Ningyu He, Weihang Su, Zhou Yu +7
The continuing expansion of the blockchain ecosystems has attracted much attention from the research community. However, although a large number of research studies have been propo…
DEPOSafe: Demystifying the Fake Deposit Vulnerability in Ethereum Smart Contracts
Ru Ji, Ningyu He, Lei Wu +3
Cryptocurrency has seen an explosive growth in recent years, thanks to the evolvement of blockchain technology and its economic ecosystem. Besides Bitcoin, thousands of cryptocurre…