## 5 Analysis Techniques for WebAssembly
### Detecting Vulnerabilities in WebAssembly Smart Contracts
#### 5.3.1 Static Analysis  
**EVulHunter**. EVulHunter [62] was the first static analysis tool designed to detect vulnerabilities in EOSIO smart contracts. It uses the open source analysis framework Octopus [73] to construct a CFG of the smart contract. The CFG is then traversed to detect vulnerabilities based on predefined patterns. Although EVulHunter is effective at detecting fake notification vulnerabilities, it has low precision when detecting fake EOS transfers.  
\begin{table}
\begin{tabular}{p{42.7 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Type** & **Scheme** & **Technique** & **Runtime** & **Binary-Only** & **WASI Support** & **Overhead** \\ \hline Static & Wassail [53] (2020) & Compositional information flow & - & ✓ & - & - \\  & Wasmati [56] (2022) & CPG & - & ✓ & - & - \\  & WASP\({}_{1}\)[58] (2022) & Concolic execution & - & ✗ & - & - \\ \hline Dynamic & [PERSON] et al. [54] (2018) & Taint tracking & VRD Assembly & & & \\  & TaintAssembly [57] & Taint tracking & VRD (modified) & ✓ & ✓ & 5-12\% \\  & Wasabi [59] (2019) & Binary instrumentation & Any runtime & ✓ & ✓ & 2–163\% \\  & & Any runtime w/ & & & & \\  & Fuzzm (2021) & Fuzzing & WASI- support & ✓ & ✓ & 5–6\% \\  & WAFL [61] (2021) & Fuzzing & WAVM (modified) & ✓ & ✓ & - \\ \hline Hybrid & WASP\({}_{2}\)[55] (2021) & Known vulnerabilities & - & ✓ & ✓ & - \\ \hline \hline \end{tabular} \(\checkmark\): Feature is supported. ✗: Feature is not supported.  
\end{table}
Table 4: Data for detecting vulnerabilities in WebAssembly binaries.  
The authors believe this is due to the limitations of using predefined patterns and suggest that more advanced analysis techniques, such as symbolic execution, are necessary.  
**WNA**. WANA [63] uses symbolic execution and a set of test oracles to detect vulnerabilities in smart contracts. It is cross-platform, meaning that it can detect vulnerabilities in both EOSIO and Ethereum smart contracts. First, Ethereum smart contracts, which are written in Solidity, are converted into Ewasm (Ethereum-flavored WebAssembly) using the SOLL [74] compiler. Then, the symbolic execution engine traverses the paths of the WebAssembly binary. WANA performs vulnerability analysis based on the data collected during symbolic execution using the proposed test oracles. Unlike EVulHunter, WANA can also detect blockinfo dependency vulnerabilities and effectively detect fake EOS transfer vulnerabilities.  
**EOSAFE**. EOSIAFE [37] also uses symbolic execution to detect vulnerabilities in EOSIO smart contracts. Unlike WANA, EOSAFE addresses the problem of path explosion, where the number of feasible paths in a program grows exponentially with the program size. To mitigate this issue, EOSAFE allows users to set the call depth and timeout parameters that are used when symbolically executing the program. Additionally, during vulnerability detection, EOSAFE first identifies valuable functions (i.e., functions that have the ability to invoke actions or change on-chain state) and only analyzes those. This approach allows it to accurately detect more vulnerabilities than previous methods.  
**EOSIOAnalyzer**. EOSIOAnalyzer [65] detects vulnerabilities in EOSIO smart contracts by analyzing the ICFG of the program. The ICFG is the combination of the CFG and the Call Graph (CG) of the program, allowing EOSIOAnalyzer to analyze the data propagation relationships between functions when they call each other. After the ICFG is constructed, the WebAssembly code is translated into a high-level intermediate representation. Then, EOSIOAnalyzer applies a data flow analysis algorithm to determine the data propagation relationships between functions. Finally, it identifies suspicious functions and further analyzes their complete execution paths. To address the issue of path explosion, EOSIOAnalyzer implements a call depth threshold.