EchoFuzz: Empowering Smart Contract Fuzzing with Large Language Models

Evidence record

Primary EchoFuzz paper. Covers VFCS methodology, three evaluation datasets, benchmark and ablation results, the Fundraiser case study, model sensitivity, runtime overhead, false negatives and limitations. The paper identifies ICSE 2026 and DOI 10.1145/3744916.3773166.

Read the original source ↗

Claim-level citations (13)

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: EchoFuzz combines LLM reasoning, Slither-assisted static analysis and runtime fuzzing feedback to generate candidate Vulnerable Function Call Sequences and iteratively redirect fuzzing toward uncovered branches.

  Sections 4.1-4.3, especially 'Vulnerable Function Call Sequence', 'Chain-Guided LLM to Generate Candidate VFCS', and 'LLM-Guided Iterative Fuzzing Process'

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The EchoFuzz authors report 37 previously unknown vulnerabilities across 19 projects in the real-world dataset; the public researcher repository enumerates 19 project/address entries totaling 37 reported vulnerability instances.

  Section 5.2.1 'Vulnerability Detection', paragraph reporting 37 previously unknown vulnerabilities from 19 contract projects

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The reported average time to test one contract is 838 seconds for EchoFuzz versus 603 seconds for MuFuzz; the authors attribute 28% of EchoFuzz's total execution time to LLM overhead and report 376 detected vulnerabilities versus 231 for MuFuzz in this comparison.

  Section 6 'Discussion', 'LLM Overhead Analysis' and Table 7

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The paper reports 62.77% more detected vulnerabilities than MuFuzz on average across D1-D3. In the detailed D1 branch-coverage comparison, EchoFuzz reaches 79.1% on medium contracts (+29.19% over MuFuzz) and 76.70% on large contracts (+32.24% over MuFuzz); the paper also summarizes branch-coverage improvement as 29.19% in its contributions text.

  Section 5.2.1 'Vulnerability Detection', paragraph reporting 48.00%, 42.55%, 146.67% and 62.77% improvements over MuFuzz

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The paper reports 62.77% more detected vulnerabilities than MuFuzz on average across D1-D3. In the detailed D1 branch-coverage comparison, EchoFuzz reaches 79.1% on medium contracts (+29.19% over MuFuzz) and 76.70% on large contracts (+32.24% over MuFuzz); the paper also summarizes branch-coverage improvement as 29.19% in its contributions text.

  Section 5.2.2 'Branch Coverage', medium-contract 79.1% and large-contract 76.70% results

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The paper's ablation study attributes substantial additional coverage and vulnerability discovery to LLM-guided sequence generation and runtime feedback: the complete framework reports 10.65% more coverage than the no-iteration variant at 300 seconds and 54.17% more vulnerabilities on D3.

  Section 5.3.3 'Study on LLM-guided Iteration Process'

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: EchoFuzz appears in the ICSE 2026 Research Track program, with a presentation scheduled for April 16, 2026; the arXiv version identifies DOI 10.1145/3744916.3773166 for the conference publication.

  Paper header and conference metadata identifying ICSE '26 and DOI 10.1145/3744916.3773166

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: In the paper's motivating Fundraiser example, sFuzz, Confuzzius, IR-Fuzz and MuFuzz miss the target bug, while EchoFuzz derives the sequence invest -> invest -> withdraw to trigger it; a later feedback-guided sequence invest -> refund raises reported branch coverage to 100% in the case study.

  Section 3 'Motivating Example', paragraphs describing the Fundraiser sequence dependencies and baseline failures

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: In the paper's motivating Fundraiser example, sFuzz, Confuzzius, IR-Fuzz and MuFuzz miss the target bug, while EchoFuzz derives the sequence invest -> invest -> withdraw to trigger it; a later feedback-guided sequence invest -> refund raises reported branch coverage to 100% in the case study.

  Section 5.5 'Case Study', T1=[invest -> invest -> withdraw] and T2=[invest -> refund] workflow

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: The paper reports that EchoFuzz can still produce false negatives, incurs greater execution time than MuFuzz in the reported setup, and becomes less reliable as contract size exceeds the LLM context capacity.

  Section 5.2.1 'False Negative Analysis' and Section 6 'Discussion', including contract-scale and LLM-overhead analyses

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: EchoFuzz has documented false negatives. The paper attributes two gasless false negatives relative to MuFuzz to insufficient cumulative seed iteration and exploration; an experimental EchoFuzz+LTL variant with manually generated temporal properties resolves both in the reported test.

  Section 5.2.1 'False Negative Analysis' and Section 6 'Sequence Diversity Analysis', Table 8

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: EchoFuzz performance depends materially on the selected LLM. In D1 VFCS generation, Claude 3.5 Sonnet reaches a 94.2% usable-VFCS ratio, while LLaMA 3.1 8B reaches 42.1%; on large contracts several tested models fall below the IR-Fuzz branch-coverage baseline.

  Sections 5.4.1-5.4.2, Figure 10 and Table 5

• supportsEchoFuzz used LLM-guided fuzzing to reach deeper smart-contract states: Section 5.1.2 describes D3 as 146 large and complex contract projects manually scraped from Etherscan, and the disclosure repository also says 146; however, Table 1 of the same paper labels D3 as 145, creating a one-project internal count discrepancy.

  Section 5.1.2 'Dataset' states D3 contains 146 projects; Table 1 'Statistical Overview of Evaluated Datasets' lists D3 (145)