MoveBit Research Release | Belobog: A Move Fuzzing Framework for Real-World Attacks
MoveBit introduces Belobog, a novel fuzzing framework designed specifically for Move smart contracts to address security challenges beyond syntax and type errors. Unlike traditional fuzzing methods that struggle with Move’s strong type system and resource semantics, Belobog leverages type-guided input generation and mutation. It constructs a type graph to produce semantically valid and executable transaction calls, significantly improving the efficiency and depth of state exploration.
The framework integrates concolic execution (combining concrete and symbolic execution) to penetrate complex constraints and branch conditions, enabling deeper coverage of potential vulnerabilities. Evaluated on 109 real-world Move contracts, Belobog detected 100% of Critical and 79% of Major vulnerabilities confirmed by manual audits. It also demonstrated the ability to reproduce full exploit paths without prior knowledge of vulnerabilities.
Designed to be developer-friendly, Belobog will be released as open-source to encourage community adoption and extension. The work is currently under peer review for PLDI’26.
Preprint: https://arxiv.org/abs/2512.02918
marsbit12/16 09:12
