EchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states

Reconstruction

EchoFuzz targets a recurring problem in stateful smart-contract fuzzing: a vulnerability may require a specific sequence of calls and intermediate state changes before the vulnerable branch becomes reachable. Rule-based or random mutation can spend substantial effort on redundant or ineffective sequences.

The framework introduces Vulnerable Function Call Sequences, candidate minimal call paths intended to move the contract through the state transitions required to expose a vulnerability. An LLM first reasons about high-risk functions and state interactions, static analysis provides control-flow and call information, and the resulting sequence is used as fuzzing input. When coverage stalls, runtime information is fed back to the LLM so that it can generate another contract-specific sequence aimed at unexplored branches.

The reported results place EchoFuzz in a different category from KASS. KASS begins from vulnerability information and attempts to construct and execute an exploit PoC. EchoFuzz primarily attempts to discover vulnerable execution paths in the first place. The two systems therefore cover adjacent stages of an increasingly automated smart-contract security pipeline rather than demonstrating the same capability.

Timeline

1. Apr 16, 2026

   EchoFuzz presented in the ICSE 2026 Research Track

   conference

   The official ICSE program places EchoFuzz in the Testing and Analysis 8 session at 12:00-12:15.

2. Sep 13, 2026

   EchoFuzz arXiv version posted

   report

   arXiv v1 was submitted with ICSE 2026 conference metadata and DOI 10.1145/3744916.3773166.

3. Sep 13, 2026

   Public vulnerability artifact accompanies the research

   disclosure

   The researcher repository enumerates 19 project/address entries and 37 reported findings, states that most teams could not be contacted, and says CVE applications are in progress.

Claims & evidence

Implications

EchoFuzz provides peer-reviewed evidence that LLM reasoning can improve the selection of state-transition sequences used by smart-contract fuzzers, particularly for larger contracts where useful vulnerable states may require non-obvious call ordering. For Digging Beagle it extends the existing KASS record backward in the attack lifecycle: AI assistance is being measured not only in exploit construction after a vulnerability is known, but also in the search process that discovers candidate vulnerabilities.

Controls & mitigations

• Treat EchoFuzz as an additional discovery layer, not a replacement for static analysis, invariant testing, conventional fuzzing, manual audit or exploit validation.
• Independently reproduce high-impact findings with deterministic tests and preserve the exact contract version, transaction sequence, state assumptions and vulnerability oracle.
• Run AI-guided fuzzing in isolated local or forked environments without production signing authority.
• Use multiple analysis strategies: the paper itself documents cases where MuFuzz finds issues EchoFuzz misses.
• For large contracts, use segmentation or hierarchical analysis because the paper reports declining LLM response success as contract size exceeds context capacity.
• Consider temporal/access-control properties or equivalent state-machine constraints when sequence diversity is insufficient; the paper's manual-LTL experiment resolved two documented false negatives.
• Do not label researcher-reported findings as confirmed zero-days until maintainer acknowledgement, independent reproduction, CVE assignment or another strong confirmation exists.

What remains unknown

• Whether any of the 37 researcher-reported findings have since been independently reproduced or acknowledged by the affected project maintainers.
• Whether CVE identifiers have now been assigned to any of the 37 findings.
• Whether any affected contract remained economically active or held material value at the time of testing or disclosure.
• Whether the D3 count is 145 or 146; the paper contains both numbers.
• Whether the 37 findings are all unique root causes rather than multiple oracle classifications over related code paths; the public artifact lists categories and addresses but not full independent triage for each finding.
• Whether later LLMs materially change the model-sensitivity results; the paper evaluates models including Claude 3.5 Sonnet, GPT-4o-mini, GPT-3.5 Turbo and LLaMA/Qwen variants.
• No evidence in the checked sources establishes autonomous mainnet exploitation, theft, governance manipulation or malicious use of EchoFuzz.

Connected research