<![CDATA[Escrow smart contracts automate fund management on blockchain, where errors in authorization logic or state-transition rules can cause unauthorized payments or permanently locked funds. This study compared Slither, a static analysis framework, with Echidna, a property-based fuzzer, in detecting controlled faults injected into Solidity escrow contracts. A paired experiment was conducted on 24 base contracts across four escrow patterns and 144 fault variants across six fault categories, with Echidna executed under 30 independent random seeds per contract. Echidna achieved higher recall than Slither (61.3% vs. 31.9%), with a paired difference of 29.4 percentage points (95% CI: 21.7–36.9 pp). Slither produced substantially more false positives (29.2% vs. 1.8%) and lower precision (48.4% vs. 90.4%). Slither executed in approximately 5 seconds per run, whereas Echidna consistently reached the 300-second limit; however, Echidna required approximately 2.7 times the preparation effort. Slither outperformed Echidna only on reentrancy faults, while Echidna dominated on authorization, double payment, invalid refund, and state-transition categories. Combining both tools raised union recall to approximately 71.6%. These findings suggest complementary deployment of both tools in secure contract development pipelines, leveraging Echidna’s precision for business-logic faults and Slither’s speed for reentrancy detection.]]>
Copyrights © 2026
