WalletProbe: A Testing Framework for Browser-based Cryptocurrency Wallet Extensions
Xiaohui Hu, Ningyu He, Haoyu Wang
TL;DR
WalletProbe introduces a mutation-based, automated testing framework with visual-level OCR-based verification to systematically uncover security issues in browser-based cryptocurrency wallet extensions. By applying WalletProbe to 39 popular extensions, the authors identify 13 attack vectors and 21 attack strategies, reporting substantial real-world impact evidenced by 16 confirmations, 26 patches, and eight CVEs. The framework comprises Seed Constructor, Mutator, and Verifier, leveraging a UI-element DAG to generate interaction seeds and an OCR-driven anomaly detection pipeline with three oracles to judge exploitability. The work reveals widespread vulnerabilities across wallet components and demonstrates the importance of rigorous, scalable testing and proactive disclosure to drive security improvements in the cryptocurrency ecosystem.
Abstract
Serving as the first touch point for users to the cryptocurrency world, cryptocurrency wallets allow users to manage, receive, and transmit digital assets on blockchain networks and interact with emerging decentralized finance (DeFi) applications. Unfortunately, cryptocurrency wallets have always been the prime targets for attackers, and incidents of wallet breaches have been reported from time to time. Although some recent studies have characterized the vulnerabilities and scams related to wallets, they have generally been characterized in coarse granularity, overlooking potential risks inherent in detailed designs of cryptocurrency wallets, especially from perspectives including user interaction and advanced features. To fill the void, in this paper, we present a fine-grained security analysis on browser-based cryptocurrency wallets. To pinpoint security issues of components in wallets, we design WalletProbe, a mutation-based testing framework based on visual-level oracles. We have identified 13 attack vectors that can be abused by attackers to exploit cryptocurrency wallets and exposed 21 concrete attack strategies. By applying WalletProbe on 39 widely-adopted browser-based wallet extensions, we astonishingly figure out all of them can be abused to steal crypto assets from innocent users. Identified potential attack vectors were reported to wallet developers timely and 26 issues have been patched already. It is, hence, urgent for our community to take action to mitigate threats related to cryptocurrency wallets. We promise to release all code and data to promote the development of the community.