{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T03:57:47Z","timestamp":1782878267160,"version":"3.54.5"},"reference-count":36,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2023,8,21]],"date-time":"2023-08-21T00:00:00Z","timestamp":1692576000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"crossref","award":["62022046, 92167101, U1911401, 62021002, 61802223"],"award-info":[{"award-number":["62022046, 92167101, U1911401, 62021002, 61802223"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Key Research and Development Project","award":["2019YFB1706203"],"award-info":[{"award-number":["2019YFB1706203"]}]},{"name":"Tsinghua-Webank Scholar Project","award":["20212001829"],"award-info":[{"award-number":["20212001829"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2023,8,31]]},"abstract":"<jats:p>Out-of-gas errors occur when smart contract programs are provided with inputs that cause excessive gas consumption and which will be easily exploited to perform Denial-of-Service attacks. Various approaches have been proposed to estimate the gas limit of a function in smart contracts to avoid such error. However, underestimation often occurs when the contract is complex In this work, we propose V-Gas, which automatically generates inputs that maximize the gas cost and reduce underestimation. V-Gas is designed based on static analysis and feedback-directed mutational fuzz testing. First, V-Gas builds the gas weighted control flow graph of functions in smart contracts. Then, V-Gas develops gas consumption guided selection and mutation strategies to generate the input that maximize the gas consumption.<\/jats:p>\n          <jats:p>For evaluation, we implement V-Gas based on js-evm, a widely used Ethereum virtual machine written in Javascript, and conduct experiments on 736 real-world transactions recorded on Ethereum. A total of 44.02% of the transactions would have out-of-gas errors based on the estimation results given by solc, meaning that the recorded real gas consumption for those transactions is larger than the gas limit estimated by solc. In comparison, V-Gas could reduce the underestimation ratio to 13.86%. To evaluate the performance of feedback-directed engine in V-Gas, we implemented other directed fuzzing engines and compared their performance with that of V-Gas. The results showed that V-Gas generates the same or higher gas estimation value on 97.8% of the transactions with less time, usually within 5 minutes. Furthermore, V-Gas has exposed 25 previously unknown out-of-gas vulnerabilities in widely used smart contracts, 6 of which have been assigned unique CVE identifiers in the U.S. National Vulnerability Database.<\/jats:p>","DOI":"10.1145\/3511900","type":"journal-article","created":{"date-parts":[[2022,4,18]],"date-time":"2022-04-18T11:37:41Z","timestamp":1650281861000},"page":"1-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["V-Gas: Generating High Gas Consumption Inputs to Avoid Out-of-Gas Vulnerability"],"prefix":"10.1145","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1360-9814","authenticated-orcid":false,"given":"Fuchen","family":"Ma","sequence":"first","affiliation":[{"name":"Tsinghua University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2639-3941","authenticated-orcid":false,"given":"Meng","family":"Ren","sequence":"additional","affiliation":[{"name":"Tsinghua University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5329-2586","authenticated-orcid":false,"given":"Fu","family":"Ying","sequence":"additional","affiliation":[{"name":"Tsinghua University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9107-183X","authenticated-orcid":false,"given":"Wanting","family":"Sun","sequence":"additional","affiliation":[{"name":"Baidu Online Network Technology Co. Ltd."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2631-9223","authenticated-orcid":false,"given":"Houbing","family":"Song","sequence":"additional","affiliation":[{"name":"Embry-Riddle Aeronautical University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9040-7247","authenticated-orcid":false,"given":"Heyuan","family":"Shi","sequence":"additional","affiliation":[{"name":"Central South University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0955-503X","authenticated-orcid":false,"given":"Yu","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tsinghua University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6034-7992","authenticated-orcid":false,"given":"Huizhong","family":"Li","sequence":"additional","affiliation":[{"name":"WeBank"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,8,21]]},"reference":[{"key":"e_1_3_1_2_2","unstructured":"GitHub. 2019. Ethereum Smart Contract Best Practices. Retrieved April 23 2022 from https:\/\/consensys.github.io\/smart-contract-best-practices\/attacks\/denial-of-service\/#gas-limit-dos-on-the-network-via-block-stuffing."},{"key":"e_1_3_1_3_2","volume-title":"CoRR","volume":"1811","author":"Albert Elvira","year":"2018","unstructured":"Elvira Albert, Pablo Gordillo, Albert Rubio, and Ilya Sergey. 2018. GASTAP: A gas analyzer for smart contracts. CoRR abs\/1811.10403 (2018)."},{"key":"e_1_3_1_4_2","first-page":"1007","article-title":"A survey of attacks on Ethereum smart contracts.","author":"Atzei Nicola","year":"2016","unstructured":"Nicola Atzei, Massimo Bartoletti, and Tiziana Cimoli. 2016. A survey of attacks on Ethereum smart contracts. IACR Cryptology ePrint Archive 2016 (2016), 1007.","journal-title":"IACR Cryptology ePrint Archive"},{"key":"e_1_3_1_5_2","unstructured":"BlockGeeks. 2019. What Is Ethereum Gas? [The Most Comprehensive Step-by-Step Guide Ever!] Retrieved April 23 2022 from https:\/\/blockgeeks.com\/guides\/ethereum-gas\/."},{"key":"e_1_3_1_6_2","article-title":"Vandal: A scalable security analysis framework for smart contracts","author":"Brent Lexi","year":"2018","unstructured":"Lexi Brent, Anton Jurisevic, Michael Kong, Eric Liu, Francois Gauthier, Vincent Gramoli, Ralph Holz, and Bernhard Scholz. 2018. Vandal: A scalable security analysis framework for smart contracts. arXiv preprint arXiv:1809.03981 (2018).","journal-title":"arXiv preprint arXiv:1809.03981"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-72359-4_1"},{"key":"e_1_3_1_8_2","first-page":"81","volume-title":"Proceedings of the 2018 IEEE\/ACM 40th International Conference on Software Engineering: New Ideas and Emerging Technologies Results (ICSE-NIER\u201918)","author":"Chen Ting","year":"2018","unstructured":"Ting Chen, Zihao Li, Hao Zhou, Jiachi Chen, Xiapu Luo, Xiaoqi Li, and Xiaosong Zhang. 2018. Towards saving money in using smart contracts. In Proceedings of the 2018 IEEE\/ACM 40th International Conference on Software Engineering: New Ideas and Emerging Technologies Results (ICSE-NIER\u201918). IEEE, Los Alamitos, CA, 81\u201384."},{"key":"e_1_3_1_9_2","article-title":"Enfuzz: From ensemble learning to ensemble fuzzing","author":"Chen Yuanliang","year":"2018","unstructured":"Yuanliang Chen, Yu Jiang, Jie Liang, Mingzhe Wang, and Xun Jiao. 2018. Enfuzz: From ensemble learning to ensemble fuzzing. arXiv preprint arXiv:1807.00182 (2018).","journal-title":"arXiv preprint arXiv:1807.00182"},{"key":"e_1_3_1_10_2","unstructured":"GitHub. 2019. crytic\/echidna. Retrieved April 23 2022 from https:\/\/github.com\/crytic\/echidna\/."},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.5555\/3103305"},{"key":"e_1_3_1_12_2","unstructured":"GitHub. 2019. duytai\/solidity-types. Retrieved April 23 2022 from https:\/\/github.com\/duytai\/solidity-types."},{"key":"e_1_3_1_13_2","unstructured":"Emil Edholm and David G\u00f6ransson. 2016. Escaping the Fuzz: Evaluating Fuzzing Techniques and Fooling Them with Anti-Fuzzing . Master\u2019s Thesis. Department of Computer Science and Engineering. Chalmers University of Technology Gothenburg Sweden."},{"key":"e_1_3_1_14_2","unstructured":"Ethereum. 2019. Ethereum: A Secure Decentralised Generalised Transaction Ledger. Retrieved April 23 2022 from https:\/\/ethereum.github.io\/yellowpaper\/paper.pdf."},{"key":"e_1_3_1_15_2","unstructured":"Ethereum. 2019. gas_limit. Retrieved April 23 2022 from https:\/\/ethstats.net\/."},{"key":"e_1_3_1_16_2","unstructured":"GitHub. 2019. ethereum\/solidity: solc. Retrieved April 23 2022 from https:\/\/github.com\/ethereum\/solidity."},{"key":"e_1_3_1_17_2","unstructured":"GitHub. 2020. ethereum\/wiki: Safety. Retrieved April 23 2022 from https:\/\/github.com\/ethereum\/wiki\/wiki\/Safety."},{"key":"e_1_3_1_18_2","unstructured":"GitHub. 2021. ethereumjs\/ethereumjs-monorepo. Retrieved April 23 2022 from https:\/\/github.com\/ethereumjs\/ethereumjs-monorepo."},{"key":"e_1_3_1_19_2","unstructured":"Etherscan. 2019. Contract. Retrieved April 23 2022 from https:\/\/etherscan.io\/address\/0x2359ffa8e5b7a7f3d44f4aa9fbe03d061a4b5d0c."},{"key":"e_1_3_1_20_2","article-title":"EVMFuzz: Differential fuzz testing of Ethereum virtual machine","author":"Fu Ying","year":"2019","unstructured":"Ying Fu, Meng Ren, Fuchen Ma, Yu Jiang, Heyuan Shi, and Jiaguang Sun. 2019. EVMFuzz: Differential fuzz testing of Ethereum virtual machine. arXiv preprint arXiv:1903.08483 (2019).","journal-title":"arXiv preprint arXiv:1903.08483"},{"key":"e_1_3_1_21_2","unstructured":"Google. 2019. American Fuzzing Lop (2.52b). Retrieved April 23 2022 from http:\/\/lcamtuf.coredump.cx\/afl\/."},{"key":"e_1_3_1_22_2","first-page":"116","article-title":"MadMax: Surviving out-of-gas conditions in Ethereum smart contracts","volume":"2","author":"Grech Neville","year":"2018","unstructured":"Neville Grech, Michael Kong, Anton Jurisevic, Lexi Brent, Bernhard Scholz, and Yannis Smaragdakis. 2018. MadMax: Surviving out-of-gas conditions in Ethereum smart contracts. Proceedings of the ACM on Programming Languages 2, OOPSLA (2018), 116.","journal-title":"Proceedings of the ACM on Programming Languages"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-89722-6_10"},{"key":"e_1_3_1_24_2","unstructured":"Etherscan. 2019. Etherscan. Retrieved April 23 2022 from https:\/\/etherscan.io\/."},{"key":"e_1_3_1_25_2","doi-asserted-by":"crossref","unstructured":"Bo Jiang Ye Liu and W. K. Chan. 2018. ContractFuzzer: Fuzzing smart contracts for vulnerability detection. In Proceedings of the 33rd ACM\/IEEE International Conference on Automated Software Engineering (ASE\u201918) . 259\u2013269.","DOI":"10.1145\/3238147.3238177"},{"key":"e_1_3_1_26_2","unstructured":"Raimund Kirner Peter Puschner and Ingomar Wenzel. 2004. Measurement-based worst-case execution time analysis using automatic test-data generation. In Third IEEE Workshop on Software Technologies for Future Embedded and Ubiquitous Systems (SEUS\u201905) ."},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213874"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3275525"},{"key":"e_1_3_1_29_2","first-page":"554","article-title":"EVM*: From offline detection to online reinforcement for Ethereum virtual machine","author":"Ma Fuchen","year":"2019","unstructured":"Fuchen Ma, Ying Fu, M. Ren, Mingzhe Wang, Yu Jiang, Kaixiang Zhang, Huizhong Li, and Xiang Shi. 2019. EVM*: From offline detection to online reinforcement for Ethereum virtual machine. In Proceedings of the 2019 IEEE 26th International Conference on Software Analysis, Evolution, and Reengineering (SANER\u201919).554\u2013558.","journal-title":"Proceedings of the 2019 IEEE 26th International Conference on Software Analysis, Evolution, and Reengineering (SANER\u201919)."},{"key":"e_1_3_1_30_2","first-page":"450","volume-title":"Proceedings of the International Symposium on Leveraging Applications of Formal Methods","author":"Marescotti Matteo","year":"2018","unstructured":"Matteo Marescotti, Martin Blicha, Antti E. J. Hyv\u00e4rinen, Sepideh Asadi, and Natasha Sharygina. 2018. Computing exact worst-case gas consumption for smart contracts. In Proceedings of the International Symposium on Leveraging Applications of Formal Methods. 450\u2013465."},{"key":"e_1_3_1_31_2","doi-asserted-by":"crossref","unstructured":"Theofilos Petsios Jason Zhao Angelos D. Keromytis and Suman Jana. 2017. SlowFuzz: Automated domain-independent detection of algorithmic complexity vulnerabilities. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS\u201917) . 2155\u20132168.","DOI":"10.1145\/3133956.3134073"},{"key":"e_1_3_1_32_2","volume-title":"Proceedings of the 3rd International Workshop on Worst-Case Execution Time Analysis (WCET\u201903)","author":"Petters Stefan M.","year":"2003","unstructured":"Stefan M. Petters. 2003. Comparison of trace generation methods for measurement based WCET analysis. In Proceedings of the 3rd International Workshop on Worst-Case Execution Time Analysis (WCET\u201903)."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3409798"},{"key":"e_1_3_1_34_2","volume-title":"Proceedings of the ACM Conference on Computer and Communications Security","author":"Tsankov Petar","year":"2018","unstructured":"Petar Tsankov, Andrei Marian Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Buenzli, and Martin T. Vechev. 2018. Securify: Practical security analysis of smart contracts. In Proceedings of the ACM Conference on Computer and Communications Security."},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3183440.3183494"},{"key":"e_1_3_1_36_2","unstructured":"Wiki. 2019. Markov Chain Monte Carlo. Retrieved April 23 2022 from https:\/\/en.wikipedia.org\/wiki\/Markov_chain_Monte_Carlo."},{"key":"e_1_3_1_37_2","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1109\/IWAST.2009.5069045","article-title":"Test generation strategies to measure worst-case execution time","author":"Williams Nicky","year":"2009","unstructured":"Nicky Williams and Muriel Roger. 2009. Test generation strategies to measure worst-case execution time. In Proceedings of the 2009 ICSE Workshop on Automation of Software Test.88\u201396.","journal-title":"Proceedings of the 2009 ICSE Workshop on Automation of Software Test."}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3511900","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3511900","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:48:50Z","timestamp":1750182530000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3511900"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,21]]},"references-count":36,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,8,31]]}},"alternative-id":["10.1145\/3511900"],"URL":"https:\/\/doi.org\/10.1145\/3511900","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,21]]},"assertion":[{"value":"2021-02-19","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-01-17","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-08-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}