# WebAssembly and Security: a review

Gaetano Perrone  Simon Pietro Romano

###### Abstract

WebAssembly is revolutionizing the approach to developing modern applications.
Although this technology was born to create portable and performant modules in
web browsers, currently, its capabilities are extensively exploited in
multiple and heterogeneous use-case scenarios. With the extensive effort of
the community, new toolkits make the use of this technology more suitable for
real-world applications. In this context, it is crucial to study the liaisons
between the WebAssembly ecosystem and software security. Indeed, WebAssembly
can be a medium for improving the security of a system, but it can also be
exploited to evade detection systems or for performing crypto-mining
activities. In addition, programs developed in low-level languages such as C
can be compiled in WebAssembly binaries, and it is interesting to evaluate the
security impacts of executing programs vulnerable to attacks against memory in
the WebAssembly sandboxed environment. Also, WebAssembly has been designed to
provide a secure and isolated environment, but such capabilities should be
assessed in order to analyze their weaknesses and propose new mechanisms for
addressing them. Although some research works have provided surveys of the
most relevant solutions aimed at discovering WebAssembly vulnerabilities or
detecting attacks, at the time of writing, there is no comprehensive review of
security-related literature in the WebAssembly ecosystem. We aim to fill this
gap by proposing a comprehensive review of research works dealing with
security in WebAssembly. We analyze 121 papers by identifying seven different
security categories.

We hope that our work will provide insights into the complex landscape of
WebAssembly and guide researchers, developers, and security professionals
towards novel avenues in the realm of the WebAssembly ecosystem.

###### keywords:

Wasm Security , WebAssembly Security , Security Review , WebAssembly Review ,
Cloud Computing Security

[inst1]organization=University of Naples Federico II, Department of Electrical
Engineering and Information Technology, addressline=Via Claudio 21,
city=Naples, postcode=80125, state=Naples, country=Italy

##  1 Introduction

WebAssembly is a formal specification for portable machine code, born to allow
the realization of portable code developed in any language and executed by
modern browsers. This technology was developed to provide a client-side
solution for browsers, but several cloud providers are nowadays offering
WebAssembly runtime environments for the server side. This reveals the key
innovations that WebAssembly promotes in terms of performance, isolation,
distribution, and modularity. With the spread diffusion of WebAssembly, it
becomes crucial to research the liaison between this technology and security.
Security research can involve different topics, such as empirical studies for
evaluating the presence of security flaws in WebAssembly design and systems,
the realization of solutions aimed at enhancing WebAssembly security, the
implementation of novel approaches for discovering vulnerabilities or
detecting attacks in WebAssembly, or the proposal of WebAssembly solutions for
security-related use cases. Although several studies have been developed in
the above-mentioned research fields, to the best of our knowledge, there is no
work that provides an exhaustive survey of the existing literature.

This work aims to contribute to this direction by providing a comprehensive
review of the most relevant works that have investigated the liaisons between
security and the WebAssembly ecosystem. We analyze 121 works, classifying 96
into seven security categories and describing the remaining 25 additional
works that, while not fitting into a specific security category, provide
fundamental knowledge for expanding the literature on WebAssembly and
security. We hence provide a security overview of the WebAssembly world, which
will hopefully represent a starting point for researchers looking to
investigate future works, as well as for security practitioners aiming to
integrate this appealing technology into their systems.

The remainder of this article is structured in six sections. Section 2 conveys
to the readers the preliminary concepts functional to follow subsequent
sections. Section 3 illustrates the review process we followed for retrieving
works relevant to our review. Section 4 shows existing studies that reviewed
WebAssembly research works, with particular emphasis on those that have
concentrated their efforts on security, by illustrating the differences with
our findings. Section 5 describes the reviewed works, while Section 6 provides
a discussion on these by summarizing relevant information and research gaps
that could be addressed in future investigations. Section 7 concludes our
research path by proposing insights for researchers who want to explore
challenging avenues in the WebAssembly security field.

##  2 Preliminary concepts

In this section, we first describe the WebAssembly ecosystem by introducing
the reader to the basics. Then, we introduce the concepts that can be useful
to understand the relevant works that will be illustrated in Section 5,
namely, smart contracts and security techniques for addressing low-level
vulnerabilities.

###  2.1 WebAssembly Introduction

In 2015, Brendan Eich announced the creation of WebAssembly, an innovative
approach to writing assembly programs for the web [1] aimed to replace asm.js
[2]. The main reasons behind the realization of an alternative approach to
asm.js were to simplify the compiler options and to increase performance by
natively decoding code much faster than JavaScript [3]. In 2017, the
WebAssembly Community Group was created with the mission of providing
collaboration on defining a pre-standardization of WebAssembly, and in 2019,
WebAssembly became a World Wide Web Consortium (W3C) recommendation [4].
Design goals are focused on:

  * 1.

Performance: the code execution should be nearest to native code performance
by taking advantage of modern underlying hardware features;

  * 2.

Security: the code should be validated and executed in memory-safe, isolated,
and sandboxed environments;

  * 3.

Portability: the code should be independent from language, hardware, and
platform.

After the WebAssembly foundation, several companies and nonprofit
organizations such as Bytecode Alliance [5] were interested in supporting the
project.

WebAssembly was designed to build C/C++ projects, but today, there is a strong
community effort to increase the number of high-level languages supported. At
the time of writing, it is possible to compile Python, Ruby, PHP, C, and Rust
programs and generate WebAssembly code that can be executed into a WebAssembly
compiler.

As regards the ecosystem, some companies are following the approach of the
Docker community, which developed DockerHub, an open search engine and
repository for finding ready-to-use Docker images [6]. In particular, the
Wasmer team provides a complete WebAssembly framework, constituted by a
WebAssembly runtime for running WebAssembly binaries [7], a Software
Development Kit (SDK) to embed WebAssembly programs in any programming
language [8], a serverless platform for executing programs developed through
the SDK [9], and a publicly available and searchable repository where it is
possible to find any WebAssembly binary developed by the community [10].

####  2.1.1 WebAssembly components

The WebAssembly ecosystem consists of several components that enable the
execution of programs (at runtime or compiled) written in multiple languages.
WebAssembly used to be mainly focused on executing C programs, but currently,
it supports the entire set of most popular programming languages. The
developers write a program in their own preferred language. Then, the source
code can follow two processing steps: (i) it can be compiled by a WebAssembly
compiler and executed by a runtime engine, or (ii) it can be interpreted,
i.e., a WebAssembly interpreter at runtime processes the lines of code and
executes them. The execution is orchestrated by a WebAssembly runtime engine,
that abstracts the execution from the underlying system (i.e., the browser,
the Operating System, etc.) and finally executes either the WebAssembly binary
file (in case of compilation) or the current line of code (in case of
interpretation) on the underlying system architecture.

The development of WebAssembly was motivated by the need to provide a low-
level assembly-like language for compiling arbitrary source code and running
it in the browser. As WebAssembly shows a high level of portability, it has
been extended to include other platforms. The WebAssembly System Interface
(WASI) [11] comprises a collection of standardized API specifications aimed at
providing secure interfaces for programs, thereby extending the capabilities
of WebAssembly. The API facilitates interaction with underlying functionality
such as I/O, clocks, filesystem, HTTP driver, and more.

WebAssembly programs are organized into modules, i.e., units of deployment,
loading, and compilation, that have definitions for types, functions, tables,
memories, and globals. Each module declares imports and exports, and upon
instantiation, a start function is automatically invoked.

####  2.1.2 WebAssembly memory layout and binary format

WebAssembly follows the principle of simplicity by defining a simple linear
memory structure, i.e., a mutable array of raw bytes. Each memory has a
_metadata region_ that keeps information about the memory layout, size, and
properties of the memory in the WebAssembly module. Each program loads and
stores values from/to a linear memory at any byte address.

The computational model of WebAssembly is based on a _stack machine_. The
program’s instructions are executed in order and manipulate values by popping
arguments and pushing results into the stack. Each instruction is encoded as
opcodes of one byte (multiple bytes for control instructions), followed by
immediate arguments if present. There are several instruction types, namely,
control, reference, parametric, variable, table, memory, numeric, vector, and
expression.

WebAssembly has two concrete representations, which map to a common structure:

  * 1.

text format ($.wat$ extension): designed to let developers understand the
structure of a WebAssembly module. It can be used for writing code and
compiling it in binary format;

  * 2.

binary format ($.wasm$ extension): a compact binary instruction format for a
stack-based virtual machine. It is the compilation target of higher-level
languages.

####  2.1.3 WebAssembly use-cases

WebAssembly is designed to ensure high flexibility and portability. As an
example, a program written in C can be compiled and executed in any
architecture, in the browser, on x86 desktop machines, and in arm-embedded
microcontrollers. Typical use cases are focused on browser-based applications
such as games, peer-to-peer applications, or image recognition, but there are
also other application scenarios [12]. Hilbig et al. (2021) [13] sample 100
random WebAssembly binaries used on the web and underline that WebAssembly is
used for gaming, text, and media processing, visualization/animation, as well
as demonstrations of programming languages. A relevant report is provided by
the Cloud Native Computing Foundation, that every year summarizes the state of
WebAssembly in the world [14]. According to their study:

  * 1.

The principal use-cases of WebAssembly are web applications (58%), data
visualization (35%), Internet of things, games, and backend services;

  * 2.

Developers are interested in performance benefits, exploring new use cases and
technology, and sharing code between projects. They confirm performance
benefits when WebAssembly is adopted;

  * 3.

WebAssembly is used both for realizing new applications and migrating existing
applications;

  * 4.

The source code languages used for compiling WebAssembly binaries are
primarily JavaScript, C#, C++, and Python.

In our work, we highlight the most pertinent cybersecurity-focused use cases
documented in the literature (see Section 5.3).

###  2.2 Low-level vulnerabilities in software

WebAssembly is an assembly language typically used to compile basic code
developed in low-level languages such as C. Therefore, it is crucial to
introduce foundational concepts surrounding low-level vulnerabilities that
could impact a program. In order to understand this kind of vulnerability, it
is essential to offer an overview of program execution in machines.

Low-level languages such as C and C++ can lead to various vulnerabilities
stemming from unsafe memory management practices:

  * 1.

_Stack-based overflow_ : this vulnerability occurs when an attacker can
overwrite a memory buffer located in the stack, including function return
addresses, leading to arbitrary code execution;

  * 2.

_Heap-based overflow_ : this vulnerability is similar to stack overflow, but
it occurs in the heap memory section;

  * 3.

_Integer overflow_ : this vulnerability occurs when the result of an
arithmetic operation exceeds the memory size allocated for the variable
holding it, potentially leading to memory corruption or unintended code
execution.

These vulnerabilities often occur when unsafe functions are input-
controllable, allowing a malicious user to send input that overwrites memory
buffers.

####  2.2.1 Security approaches to discover software vulnerabilities

Software vulnerability discovery techniques can be classified into two broad
categories:

  * 1.

_Static analysis_ : involves source code analysis without executing the
program. It is useful to detect vulnerabilities caused by improper input
validation or type mismatches, but cannot discover runtime errors or
vulnerabilities caused by complex interactions with the code;

  * 2.

_Dynamic analysis_ : these approaches try to find vulnerabilities in programs
at runtime by injecting malicious inputs (fuzzing) or by analyzing the code
during execution (tracing or symbolic execution).

These approaches can be further classified into several techniques, as
illustrated in Table LABEL:tab:security-approaches.

Table 1: Static and dynamic techniques to discover vulnerabilities Static
techniques
---
Control graph flow analysis [15] |  Analyze the graphical representation of all the paths that could be traversed during the execution of a program to discover security issues.
Context-sensitive data flow analysis [16] |  Define a set of “contexts”, i.e., scenarios in which a function can be called within the program, and analyze the data flow when the context changes.
Code property graph [17] |  Realize a graph-based representation of the analyzed program that can be searched for obtaining relevant information and potentially discover vulnerabilities.
State machine representation [18] |  A theoretical model based on program states is used to represent the behavior of the program by potentially revealing security flaws.
Dynamic techniques
Black-box fuzzer [19] |  Send random inputs to trigger crashes and detect vulnerabilities. No knowledge about the application’s internal structure.
White-box fuzzing [20] |  Perform fuzzing with full knowledge of the internal structure of the application under test.
Grey-box fuzzer [20] |  Combine black-box and white-box approaches to leverage both of them.
Symbolic execution [21] |  Analyze the program to determine through symbolic variables the inputs that trigger the execution of a specific part of a program.
Concolic execution [22] |  Like symbolic execution, but using concrete values, by increasing the path exploration space.
Tracing and control-data flow [23] |  Monitor the program’s control flow and data flow and keep track of triggered vulnerabilities during the execution.
Bytecode instrumentation and run-time validation [24] |  Modify bytecode at runtime in order to insert additional checks that can be validated to identify security flaws.
|

###  2.3 Smart contracts

This section provides context information useful to follow all the
considerations exposed in Sections 5 and 6. A common use case for WebAssembly
is its application for the implementation of smart contracts. This stems from
the distributed nature of smart contracts that fits perfectly with the
portability and versatility of WebAssembly. Smart contracts are digital
contracts stored on a blockchain, which are executed under a specific set of
satisfied conditions. They are inherently related to blockchains, i.e.,
distributed, shared, and immutable ledgers [25].

One of the most widely deployed blockchain platforms is Ethereum [26], which
extends the capabilities of the blockchain technology beyond simple financial
transactions. It allows developers to create smart contracts as complex
applications with self-executing code. These smart contracts get automatically
executed if and when specific conditions are met, hence providing
transparency, immutability, and trust in transactions. Ethereum also
introduced its native cryptocurrency, known as _Ether_ (ETH), which is used to
compensate network participants for performing computations and/or validating
transactions. The Ethereum documentation [27] provides several relevant
concepts for understanding Blockchain vulnerabilities:

  * 1.

_Ethereum Account_ : a digital identity on the Ethereum blockchain, allowing
users to send and receive Ether, as well as interact with smart contracts;

  * 2.

_Address_ : a unique identifier used for receiving tokens, used to identify
the Ethereum Account;

  * 3.

_Block_ : the data structure where the transactions or digital actions are
stored;

  * 4.

_Blockchain_ : a database of transactions, duplicated or shared on all
computers in the network, ensuring that data cannot be altered retroactively
[28];

  * 5.

_Smart contract_ : a program that automatically executes agreements on a
blockchain, like a self-enforcing digital contract [29];

  * 6.

_Transaction_ : data committed to the Ethereum Blockchain signed by an
originating account, targeting a specific address;

  * 7.

_Contract account_ : an account containing code that executes whenever it
receives a transaction from another account;

  * 8.

_Ethereum Virtual Machine (EVM)_ : a stack-based virtual machine that executes
bytecode;

  * 9.

_Externally Owned Account (EOA)_ : the most common type of Ethereum account,
controlled by a person through private keys;

  * 10.

_Internal transaction_ : a transaction sent from a contract account to another
contract account or an EOA;

  * 11.

_Message_ : an internal transaction thet is never serialized and exists only
in the Ethereum execution environment (i.e., a message is like a transaction,
except it is produced by a contract and not an external actor);

  * 12.

_Message call_ : the act of passing a message from one account to another;

  * 13.

_Delegatecall_ : a message call that uses data of the calling contract;

  * 14.

_Receipt_ : data returned by an Ethereum client to represent the result of a
particular transaction, including a hash of the transaction, its block number,
the amount of gas used, and, in case of deployment of a smart contract, the
address of the contract.

Earlier blockchain platforms suffered from performance issues. For this
reason, researchers have proposed different consensus algorithms, such as
Proof-of-Share (PoS) and Delegated Proof-of-Stake (DPoS). One of the most
relevant DPoS platforms is EOSIO [30]. The EOSIO smart contract is composed of
several concepts:

  * 1.

_action_ , that represents a single operation for communicating between a
smart contract and an account;

  * 2.

_transaction_ , that is composed of several actions;

  * 3.

_apply function_ , that dispatches action handlers for validating smart
contracts. The function has a ‘code’ parameter that is used to identify the
account that authorized the contract;

  * 4.

_eosio.token contract_ , a standard contract that can be used to transfer
tokens with the “transfer” functionality;

  * 5.

_dApp_ , a decentralized application that runs on a decentralized network.

####  2.3.1 Vulnerabilities in smart contracts

Smart contracts are affected by vulnerabilities that are strongly related to
the smart contract domain and to the adopted blockchain platform. He et al.
(2022) [31] provide a comprehensive survey of attacks and vulnerabilities in
EOSIO systems. Table LABEL:tab:relevant-vulnerabilities-smart describes the
most relevant vulnerabilities affecting smart controls.

Table 2: Most relevant vulnerabilities in smart contracts. Vulnerability |  Description
---|---
Fake EOS Transfer |  An improper apply function implementation does not verify the code parameter properly, hence allowing the execution of code logic under fake EOS tokens.
Fake EOS Receipt |  If the notification of a smart contract allows unsecured relays, an attacker may invoke a transfer in eosio.token, notify an accomplice who relays the notification to the victim that will pass EOS checks by tricking the victim into providing services to the attacker, such as transferring tokens.
Fake EOS Notice |  A variant of Fake EOS Transfer that exploits other parameters even if the system provides a valid apply implementation.
Insecure Message Call |  A message call where the authorization is not properly checked.
Greedy Smart Contract |  A greedy smart contract can receive ethers, but it contains no functions to send ethers out.
Dangerous Delegatecall |  Attacker manipulates msg.data by changing the function called by the victim’s contract.
Block Information Dependency |  The improper utilization of a block timestamp or block number for determining a critical operation. As these variables can be manipulated by miners, they cannot be considered as reliable sources.
Mishandled Exceptions |  Improper exception handling can cause inconsistencies during a transaction.
Reentrancy Vulnerability |  Invoke in a reentrant manner a function that was not designed to be reentrant111A reentrant function is a function designed to be called recursively, or by two or more processes.
Rollback |  The attacker exploits an unsafe rollback operation on a blockchain system by conditionally reverting smart contracts. Commonly used in gambling dApps.
Missing Permission Check |  Do not properly validate permissions of sensitive operations.
Pseudo Random Number Generators |  Sensitive operations that trust the insecure implementation of pseudo-random number generators can cause security issues.
Suicidal |  Unprotected interface allows the destruction of a victim contract.
Call injection |  An attacker is able to call a sensitive function.
|

Section 5.5 shows the techniques that have been devised to detect this kind of
attacks.

###  2.4 Trusted Execution Environments and security enclaves

As it will be shown in Section 5.3, several WebAssembly use-cases and
enhancements entail an integration with processor security features. A trusted
execution environment (TEE) is a hardened memory section of the processor
aimed at protecting the confidentiality and integrity of both code and data
[32]. One of the most utilized technologies that implement TEEs is the Intel
Security Guard Extension (SGX) [33]. SGX defines the “security enclave”
concept, i.e., a secure area where sensitive data and code can be executed.
The approach offers scalability by ensuring the execution of an entire
application or just a single function in the enclave. Developers can use an
API to build secure applications based on Intel SGX. Intel also provides a
Software Development Kit (SDK) to handle security enclaves in their code.

##  3 Literature review process

This section illustrates the process used to review the literature on security
for WebAssembly. The review has followed a structured process inspired by the
methodologies outlined in two relevant works: Webster and Watson (2022) [34]
and Kitchemann and Brereton (2013) [35]. The process proceeded through the
following steps:

  1. 1.

_Automatic search_ : We performed an automatic search with specific keywords;

  2. 2.

_Cleaning_ : we removed duplicates obtained from the automatic search, and
excluded out-of-scope works that did not satisfy the inclusion and exclusion
criteria;

  3. 3.

_Backward and forward references review_ : for each included study, we
analyzed both the citations and references to identify other relevant works;

  4. 4.

_Works classification_ : we performed a first examination to identify the
primary contributions of each study and divided them into categories, as
described in Table 3;

  5. 5.

_Works review_ : we reviewed the retrieved works in detail and developed the
concepts presented in Sections 5 and 6.

Category |  Description |  Nr. of studies
---|---|---
Security Analysis |  Analyze the security of the WebAssembly ecosystem |  4
Attack Scenarios |  WebAssembly capabilities for realizing attack scenarios |  7
Use case in cybersecurity |  Leverage WebAssembly to realize a use case in the cybersecurity domain |  21
Vulnerability Discovery |  Discover vulnerabilities in WebAssembly binaries |  16
Security Enhancements |  Extend WebAssembly language and components to increase security |  27
Others |  Relevant works to extend the literature of security works in WebAssembly |  25
Table 3: Security categories for the analyzed literature

Table 4 reports the overall number of publications that we reviewed at each
step of the aforementioned process.

Keywords |  Nr. of papers from SCOPUS |  Nr. of papers from IeeeXplore
---|---|---
“wasm security” |  43 |  20
“wasm vulnerability” |  18 |  8
“webassembly security” |  91 |  44
“webassembly vulnerability” |  26 |  10
|  178 |  82
Merged and without duplicates | 114
After inclusion and exclusion criteria | 62
After reference analysis | 121
Table 4: Publications analyzed at each step of the literature review process

###  3.1 Automatic search

We search for four relevant keyword pairs that relate security to WebAssembly:
(i) “webassembly security”; (ii) “webassembly vulnerability”; (iii) “wasm
security”; (iv) “wasm vulnerability”.

We exclude other keywords, since a quick analysis shows that they basically
provide almost equal results to the utilized keyword combinations. For
instance, “cybersecurity” would provide the same results as “security”. The
same holds true for the use of plural forms such as “vulnerabilities” instead
of “vulnerability”.

We use two relevant platforms containing peer-reviewed articles, i.e., IEEE
Xplore [36] and Scopus [37]. After obtaining the works, we merge them and
remove duplicates. Then, we apply the inclusion and exclusion criteria
described further below, to select just in-scope works. Finally, we perform
the backward and forward reference investigation to find other relevant works.

###  3.2 Works’ inclusion and exclusion criteria

We only include works specifically focused on the security domain. However, we
include into a secondary category named “others” those works that we consider
essential sources for investigating new security research topics in
WebAssembly, even if they are not specifically focused on security. We
primarily consider peer-reviewed articles, but during the backward and forward
reference review, we also include relevant literature from pre-print services
[38], as well as relevant technical papers from highly recognized
international cyber-security conferences [39]. We exclude works not written in
English and mention in Section 5.8 works that explore security topics but do
not provide satisfactory analyses, such as preliminary studies and poster
papers.

###  3.3 Works’ classification

After the document retrieval phase, we first analyze each work’s objective to
categorize and determine its primary contribution. We delineate several
categories and organize items based on their contribution type. Then, we go
deeper into each paper to scrutinize its technical details or gain a better
understanding of any proposed case studies by exploring the features of other
works. Finally, we synthesize our analysis, as detailed in Section 5. For the
specific category of malware detection, we exclude studies that discover
vulnerabilities without involving WebAssembly features, e.g., crypto mining
detection through machine-learning models on network traffic [40, 41], or
dynamic analysis focused on binaries not specifically generated by WebAssembly
code [42]. In order to classify the reviewed works, we identify six main
categories:

  * 1.

_Security Analysis_ : papers that analyze the security of the WebAssembly
ecosystem. These works are useful in providing a preliminary context of
security flaws that affect WebAssembly programs;

  * 2.

_Empirical studies_ : papers that investigate security aspects of WebAssembly
by analyzing real-world scenarios. These works apport relevant empirical
contributions;

  * 3.

_Attack Scenarios_ : these papers illustrate approaches that leverage
WebAssembly capabilities for conducting complex attacks;

  * 4.

_Vulnerability Discovery_ : the contribution of these papers is to provide
approaches to discover vulnerabilities in applications based on WebAssembly;

  * 5.

_Security Enhancements_ : in these papers, authors aim to extend the
WebAssembly components in order to reduce security flaws that are examined in
security analysis works;

  * 6.

_Use cases in security_ : in these papers, authors leverage WebAssembly
features to increase the security aspects of a proposed solution, system,
and/or framework;

  * 7.

_Others_ : some relevant papers are not specifically focused on cybersecurity
but can be considered as preliminary studies representing “cornerstones” for
conducting novel security-related research activities.

##  4 Related Works

Several works offer pertinent reviews on WebAssembly that do not explicitly
center on security.

WebAssembly runtimes are analyzed by Wang and Wenwen (2022) [43]. In their
study, the authors review five predominant standalone WebAssembly runtimes and
construct a benchmark suite for comparative purposes. They assert that
performance is influenced by various factors and outline criteria for
selecting the best runtime based on specific use cases. Additionally, they
offer insights into enhancing runtime performance by including crucial
information into compiled WebAssembly binaries.

In the realm of cloud-edge computing [44], Kakati et al. (2023) [45] provide a
comprehensive review of the adoption of WebAssembly.

The Internet of Things (IoT) is another relevant context where WebAssembly is
widely adopted [46]. Ray and Partha Pratim (2023) [47] provide a comprehensive
survey about the adoption of WebAssembly in IoT systems by illustrating the
potential of WebAssembly characteristics, providing a valuable resource for
developers through a comparison of WebAssembly tools and toolchains, and
illustrating future insights for continuing this research field.

###  4.1 Security studies

Section 5.1 delves into related works offering security analysis for
WebAssembly compilers, runtimes, and the impacts of porting programs written
in unsafe memory languages [48, 49, 50, 51]. Notably, Kim et al. (2022) [52]
and Harnes and Morrison (2024) [53] provide a comprehensive survey on
techniques and methods for WebAssembly binary security. They also propose
future research directions to address open problems identified in their
studies, such as protection from malicious WebAssembly binaries and hardening
the inherent security of WebAssembly.

Tables 5, 7, and 6 present a comparative analysis of reviews. Our study
extends beyond the scope of previous works by encompassing various types of
literature, including those focused on enhancing the security of WebAssembly
components, utilizing WebAssembly for security purposes in various use cases,
conducting empirical studies, and performing security analyses. Furthermore,
we cover five additional categories, culminating in the analysis of 121 works.

|  Kim et al. (2022) [52] |  Harnes and Morrison (2024) [53] |  Our work
---|---|---|---
Security analysis |  |  |  ✓
Security enhancement |  ✓ |  |  ✓
Vulnerability discovery |  ✓ |  ✓ |  ✓
Use case in cybersecurity |  |  |  ✓
Attack scenarios |  |  |  ✓
Attacks’ detection |  ✓ |  ✓ |  ✓
Empirical studies |  ✓ |  |  ✓
Other works |  |  |  ✓
Table 5: Comparison of studies based on our classification and related ones. Our review encompasses additional research by incorporating other types that address both WebAssembly and security. |  Kim et al. (2022) [52] |  Harnes and Morrison (2024) [53] |  Our work
---|---|---|---
Vulnerability discovery |  7 |  15 |  16
Attacks’ detection |  9 |  7 |  12
Security enhancement |  8 |  0 |  27
Table 6: Number of analyzed publications for each category that is covered by related works Kim et al. (2022) [52] |  Harnes and Morrison (2024) [53] |  Our work
---|---|---
24 |  22 |  121
Table 7: Total number of reviewed works.

It is worth noting that we classified certain publications ([54, 55]) under
the “other” category instead of grouping them with related studies. Our
decision was based on our analysis, which found that these publications lacked
sufficient information to be classified as vulnerability discovery efforts.

To the best of our knowledge, this is the first work providing a comprehensive
review of security research in the WebAssembly domain.

##  5 WebAssembly and Security: a review

This section presents the works analyzed in this study. As previously
outlined, Table 3 summarizes the proposed categories detailed in Section 3,
and displays the number of analyzed studies for each category.

###  5.1 Security Analysis

Although WebAssembly has been designed with security in mind, relevant works
underline that it can suffer from security issues. One significant study
conducted by Lehmann et al. (2020) [48] highlights this concern. In their
research, the authors demonstrate that certain classic vulnerabilities, which
are mitigated by compiler system enhancements in native binaries, remain
exploitable in WebAssembly. They conduct an extensive security analysis of
WebAssembly’s linear memory system, present examples of vulnerable
applications, outline attack primitives, demonstrate end-to-end exploits for
identified vulnerabilities, and propose possible mitigation strategies to
harden WebAssembly binaries. In particular, the authors analyze the impact of
classic attack primitives and categorize them into three main types: write
operations (including stack-based buffer overflow [56], stack overflows, and
heap metadata corruptions), data overwrites (such as overwriting stack and
heap variables, as well as “constant” data), and triggers for unexpected
behavior (such as redirecting indirect calls, injecting code into the host
environment, and overwriting application-specific data). They illustrate how
these attack primitives can be combined to execute end-to-end attacks such as
cross-site scripting, remote code execution, and arbitrary file writing.

To mitigate the analyzed security flaws, the authors propose three possible
approaches: extending the WebAssembly language, enhancing compilers and
toolchains, and developing robust and safe libraries for use during
development.

Stievenart et al. (2021) [49] explore the security vulnerabilities stemming
from the absence of protections in WebAssembly compilers. In their study, the
authors compile $4.469$ C programs containing known buffer overflow
vulnerabilities (both stack-based and heap-based) to x86 code and WebAssembly.
They reveal that $1.088$ programs exhibit a different behavior when compiled
to WebAssembly. In particular, WebAssembly is found to be more vulnerable to
stack-smashing attacks due to the absence of security measures like stack
canaries.

As illustrated before, memory management in low-level programs is the primary
cause of security flaws. Therefore, the most affected programming language is
C [57], as it provides the lowest abstraction level with respect to the
underlying machine so that it can fully interact with the hardware.

Stiévenart et al. (2022) [50] investigate the security implications of cross-
compiling C programs to WebAssembly. In their study, the authors compile and
execute $17.802$ programs with common vulnerabilities for both 64-bit x86 and
WebAssembly. They find that $4.911$ binaries yield different results due to
three main reasons: the absence of security measures in WebAssembly, different
semantics of execution environments, and variations in used standard
libraries. Critical differences affecting security include the implementation
of malloc() and free() functions, and the lack of both stack-smashing and
memory protection mechanisms. To address these issues, the authors suggest
extending WebAssembly to incorporate memory semantics in C and C++ code. They
also emphasize the importance of static analysis in identifying security flaws
and highlight related works aiming to enhance the WebAssembly runtime and
mitigate the security impacts [58, 59].

One of the noteworthy resources for developers is the technical study
conducted by Brian McFadden et al. (2018) [51]. In this work, the authors
delve into various facets of WebAssembly security. In particular, they:

  * 1.

analyze Emscripten’s implementation of compiler and linker-level exploit
mitigation;

  * 2.

introduce new attack vectors and methods of exploitation in WebAssembly,
demonstrating that buffer overflow or indirect function calls can lead to
cross-site scripting or remote code execution attacks;

  * 3.

provide examples of memory corruption exploits in the WebAssembly environment;

  * 4.

outline best practices and security considerations for developers aiming to
integrate WebAssembly into their products.

###  5.2 Empirical Studies

These works present empirical case studies to analyze a specific phenomenon in
the WebAssembly ecosystem. Early studies analyze the diffusion of WebAssembly
for executing cryptojacking attacks in the wild.

Rüth et al. (2018) [60] introduce a new fingerprinting method aimed at
identifying miners, which revealed a factor of $5,7$ more miners compared to
publicly available block lists. They also classify mining websites among $138$
million domains sourced from the largest top-level domains and the Alexa top
$1$ million websites [61]. The authors demonstrate that the prevalence of
browser mining is low, at less than $0,08\%$ and that $75\%$ of the mining
sites utilize Coinhive, a web-based mining provider.

Musch et al. (2019) [62, 63] analyze websites from Alexa top one million
ranking [61] in detail and find that $1$ out of $600$ websites uses
WebAssembly. However, they reveal that 50% of all sites using WebAssembly
employ it for mining and obfuscation purposes.

Hilbig et al. (2021) [13] also analyze the usage of WebAssembly worldwide,
presenting different results. They collect $8.461$ WebAssembly binaries from a
wide range of sources and conclude that:

  * 1.

$64,2\%$ of the binaries are compiled from memory-unsafe languages, such as C
and C++;

  * 2.

less than $1\%$ of all binaries are related to crypto mining, with a greater
diffusion of game-based, text processing, visualization, and media
applications;

  * 3.

$29\%$ of all binaries are minified, suggesting a need for approaches to
decompile and reverse engineer WebAssembly.

Romano et al. (2021) [64] conduct two empirical studies to perform a
qualitative analysis of $146$ bugs related to WebAssembly in Emscripten and a
quantitative analysis of $1.054$ bugs in three open-source compilers, namely,
AssemblyScripts, Emscripten, and Rustc/Wasm-Bindgen. They draw the conclusion
that sensitive information can be disclosed in Trusted Execution Environments
(TEE). Puddu et al. (2022) [65] analyze the impacts of executing confidential
code on top of a WebAssembly runtime within a TEE and show that using an
intermediate representation such as WebAssembly can lead to code leakage.

###  5.3 Use cases in cybersecurity

WebAssembly is extensively used in heterogeneous domains where security is a
crucial non-functional requirement. The following subsections summarize the
most interesting contributions we found in the literature, by underlying the
main research paths they have tried to follow.

####  5.3.1 Browser extensions

WebAssembly was designed to provide an assembly language for the web,
especially for modern browsers. Therefore, there is extensive literature about
realizing browser extensions with this technology. As WebAssembly is a
portable language, all the works presented in this section could potentially
be ported toward browser environments. However, the works that we classify as
“Browser extensions” have specifically been realized to extend browser
capabilities and increase portability, isolation, and efficiency.

Baumgärtner et al. (2019) [66] present a Disruption-tolerant Networking (DTN)
system for browsers that leverages WebAssembly and the Bundle Protocol $7$
draft implementation [67]. Narayan et al. (2020) [68] define a new framework
(RLBox) that implements fine-grained isolation for sandboxing third-party
libraries. The framework has been integrated into production Firefox to
sandbox the libGraphite font shaping library. Chen et al. (2023) [69] propose
a novel approach for digital rights management of streaming. The work allows
users to easily fetch videos with a plug-and-play approach and enhances
decryption efficiency by minimizing interactions with the server.

WebAssembly in the browser is employed by Jang et al. (2022) [70] to realize a
distributed public collaborative fuzzing system for the security of
applications emulated inside the browser engine.

####  5.3.2 Cryptography, Trusted Execution Environments and Privacy

Various works aim to safeguard data integrity and confidentiality through
cryptographic techniques, Trusted Execution Environments, and privacy-
preserving methods. These approaches are tailored to specific domains and can
be implemented in hardware, embedded systems, or browsers. Sun et al. (2020)
[71] leverage WebAssembly and the Web Cryptography API to devise a client-side
encrypted storage system capable of storing and sharing data across
heterogeneous platforms. Attrapadung et al. (2018) [72] use WebAssembly to
implement an efficient two-level homomorphic public-key encryption within
prime-order bilinear groups. Seo et al. (2023) [73] introduce a portable and
efficient WebAssembly implementation of the Crystals-Kyber post-quantum Key
Encapsulation Mechanism [74]. Zhao et al. (2023) [75] define a novel approach
for constructing reusable, rapid, and secure enclaves. They introduce three
techniques, namely, enclave snapshot and rewinding, nested attestation, and
multi-layer intra-enclave compartmentalization, for enabling rapid enclave
reset and robust security. WebAssembly is used to realize publish and
subscribe environments for cloud-edge computing. Both Almstedt et al. (2023)
[76] and Ménétrey et al. (2024) [77] design a novel publish and subscribe
middleware running in Intel SGX for trustworthy and distributed
communications. Qiang et al. (2018) [78] utilize the sandbox properties of
WebAssembly combined with Intel SGX enclaves to develop a two-way sandbox.
This approach offers dual protection: safeguarding sensitive data from
potential threats posed by the cloud provider and shielding the host runtime
from potential attacks initiated by malicious users. Other works show that
WebAssembly can be used to implement a performant, memory-safe, and portable
client-side-hashing library (Riera et al. (2023) [79]), or even a fully-
fledged client-side storage platform (Sun et al. (2022) [71]).

####  5.3.3 Identity and Access Management

Another integration of Intel SGX and WebAssembly is provided by Goltzsche et
al. (2019) [80]. In their work, the authors present AccTEE, a framework for
realizing fine-grained permissions for resource accounting by preserving the
confidentiality and integrity of code and data. Also, Zhang et al. (2021) [81]
propose EL PASSO, a portable and “zero-configuration” module to allow the
setup and configuration of privacy-preserving single-sign-on operations.

####  5.3.4 Cloud, cloud-edge computing and IoT

Cloud and cloud-edge computing are common use cases of WebAssembly adoption
[82]. Edgedancer [59] is a platform for supporting portable, provider-
independent, and secure migration of edge services. Ménétrey et al. (2022)
[83] envisage that WebAssembly with TEEs is a promising combination to realize
cloud-edge continuum [84].

Sun et al. (2022) [71] primarily focus on the browser domain as a platform
aimed at realizing a secure cloud storage environment. This subject is also
addressed by Song et al. (2023) [85], who provide a cross-platform secure
storage architecture through the realization of a new primitive called
Controllable Outsourced Attribute-Based Proxy Re-Encryption (COAB-PRE)
alongside the cross-platform capabilities of WebAssembly. Although WebAssembly
provides several security benefits, performance overheads should be
investigated when it is adopted in contexts with constrained resources, such
as IoT and edge devices. Wen et al. (2020) [86] address this problem by
defining a novel operating system that integrates Rust and WebAssembly to make
IoT applications more efficient and secure. A similar approach is also
proposed by Li and Sato (2023) [87], who implement a kernel focused on
isolation, security, and customizability through the combination of
WebAssembly and Rust.

####  5.3.5 Face recognition systems

Preliminary work has been conducted on using WebAssembly to realize face
recognition systems. Indeed, WebAssembly ensures a client-side solution that
preserves image privacy and could potentially reduce the costs of adopting
external services. Pillay et al. (2019) [88] provide a real-time browser-based
application that is able to attain a facial recognition rate of $91.67\%$,
while Martín Manso et al. (2021) [89] compare JavaScript (CPU), WebGL and
WebAssembly for face detection, and conclude that WebAssembly strikes a good
balance in terms of detection accuracy and time overheads.

###  5.4 Attack scenarios

Another research field deals with innovative approaches for conducting attacks
against WebAssembly programs. Most articles fall under two primary categories:

  * 1.

_Side-channel attacks_ : these works demonstrate how it is possible to conduct
side-channel attacks to disclose sensitive keys or realize covert channels
[90, 91, 92, 93];

  * 2.

_Evasion techniques for malware detection_ : these works illustrate in which
way it is possible to bypass malware detection systems through WebAssembly
[94, 95, 96, 97].

Cite | Type of implemented attack
---|---
Genkin et al. (2018) [90] | Side-channel attacks
Easdon et al. (2022) [91] | Side-channel attacks
Rokicki et al. (2022) [92] | Side-channel attacks
Katzman et al. (2023) [93] | Side-channel attacks (cache)
Cabrera-Arteaga et al. (2023) [94] | Malware detection evasion
Romano et al. (2022) [95] | Malware detection evasion
Cao et al. (2023) [96] | Malware detection evasion
Loose et al. (2023) [97] | Malware detection evasion
Oz et al. (2023) [98] | Ransomware attack
Table 8: Works focused on describing attack examples in WebAssembly.

Oz et al. (2023) [98] provide a divergent work by showing how it is possible
to leverage WebAssembly to implement ransomware attacks [99]. Table 8
summarizes the above information.

####  5.4.1 Side-channel attacks

Genkin et al. (2018) [90] utilize WebAssembly to induce CPU cache contention
and extract sensitive data from other programs’ memory accesses. They
demonstrate that this technique can extract sensitive keys from famous
cryptographic libraries. An innovative cache-based attack is also illustrated
in the work of Katzman et al. (2023) [93], where authors conclude that
transient execution can increase the effectiveness of cache attacks.

Easdon et al. (2022) [91] leverage WebAssembly features to demonstrate a novel
technique for prototyping microarchitectural attacks. They achieve this by
implementing two open-source frameworks, libtea and SCFirefox, and developing
proof-of-concepts for executing Foreshadow [100] and Load Value Injection
(LVI) [101] attacks.

Rokicki et al. (2022) [92] introduce the first port contention side-channel
attack conducted entirely within the browser environment. Their study
demonstrates that certain WebAssembly instructions can induce port contention
attacks, enabling the extraction of sensitive data from concurrent processes
executing on the same CPU core.

####  5.4.2 Malware detection evasion

The other two works propose innovative techniques to evade malware detection
in WebAssembly binaries. Cabrera-Arteaga et al. (2023) [94] analyze the
potential of WebAssembly binary diversification to circumvent detection by
antivirus systems. On the other hand, Loose et al. (2023) [97] introduce a
novel approach to embed adversarial payloads into the instruction stream of
binaries, thereby bypassing malware detection systems.

Additionally, Romano et al. (2022) [95] demonstrate the feasibility of
obfuscating JavaScript to evade malware detection systems by converting
specific JavaScript instructions into WebAssembly. Cao et al. (2023) [96]
develop a framework for static binary rewriting, which can be used for various
purposes such as obfuscation. Although the primary focus is not solely on
evading malware detection systems, the framework can be adapted for that
purpose, as well as for patching vulnerabilities or binary instrumentation.

###  5.5 Attack detection solutions

These works focus on detecting attacks in WebAssembly programs, primarily
targeting cryptojacking attacks. As shown in Table LABEL:tab:detected-attacks,
current research is essentially focused on detecting crypto-mining activities
facilitated by WebAssembly technology.

Table 9: Works about detecting attacks against WebAssembly applications Work |  Detection approach |  Type of detected attacks
---|---|---
Konoth et al. (2018) [102] |  Runtime detection on the basis of three approaches discovered through static analysis of WebAssembly malicious binaries |  Cryptojacking
Wang et al. (2018) [103] |  At runtime, monitor execution through in-line scripts |  Cryptojacking
Rodriguez and Possega (2018) [104] |  Analyze WebAssembly and JavaScript APIs and train a Support Vector Machine (SVM). Show the feasibility of deploying the solution as a browser extension |  Cryptojacking
Kharraz et al. (2019) [105] |  Support Vector Machine classifier |  Cryptojacking
Bian et al. (2020) [106] |  At runtime |  Cryptojacking
Kelton et al. (2020) [107] |  At runtime, through a Support Vector Machine (SVM) classifier |  Cryptojacking
Mazaheri et al. (2020) [108] |  Static analysis by analyzing features of web pages that indicate the presence of time-based side-channel attacks. |  Side-channel
Romano et al. (2020) [109] |  Static analysis, by reconstructing binaries in “standard” WebAssembly format, and analyzing the generated intra-procedural and inter-procedural Control-Flow Graphs (CFGs) |  Cryptojacking
Yu et al. (2020) [110] |  Static analysis with machine learning and runtime detection systems. Provide both detection and blocking capabilities. |  Cryptojacking
Naseem et al. (2021) [111] |  At runtime, leveraging a Convolutional Neural Network (CNN) model trained with a comprehensive dataset of current malicious and benign WebAssembly binaries |  Cryptojacking
Tommasi et al. (2022) [112] |  At runtime, browser extension based on a Support Vector Machine (SVM) classifier |  Cryptojacking
Breitfelder et al. (2023) [113] |  Static WebAssenbly analysis that is able to capture call-, control-, and data-flow graphs for further analysis. The detection capability is one of the discussed use-cases. |  Cryptojacking
|  |

###  5.6 Security enhancements

Several studies have extended WebAssembly components or integrated new systems
to enhance their security level. Some authors have extended the semantics of
the WebAssembly language to include protection against various threats. For
instance, Watt et al. (2019) [114] propose CT-Wasm, a type-driven secure
language for writing cryptographic libraries to protect against time-based
side-channel attacks. Similarly, Michael et al. (2023) [115] focus on
protecting WebAssembly program memory by introducing MSWasm, a WebAssembly
semantic addressing memory unsafe vulnerabilities. They introduce a new memory
region called segment memory and new instructions for interacting with it.
Additionally, Geller et al. (2024) [116] extend WebAssembly semantics to
define indexed types [117] to ensure safety properties over program values.
Another language extension aimed at ensuring memory safety is proposed by
Zhang et al. (2023) [118], who allow the definition of canaries in the
program.

Several works modify the WebAssembly compiler to formally verify security
properties [119, 120] or reduce the attack surface in embedded systems [121,
122]. Others focus on enhancing the WebAssembly runtime environment to create
a trusted execution environment that increases isolation and prevents memory
attacks during execution.

In order to protect the execution of WebAssembly programs, several authors
have designed additional mechanisms. For example, Sun et al. (2019) [123]
propose SELWasm, a code protection technique that implements a self-checking
mechanism to prevent code execution on unauthorized websites, along with an
“Encryption & Decryption” approach for ensuring code confidentiality.
Similarly, Brandl et al. (2023) [124] present a novel interpreter for
WebAssembly capable of performing complex analyses such as inter-procedural
control and data-flow information. This study can be considered as a
foundation for future static security analysis approaches.

Additionally, Pop et al. (2022) [125] propose an interpreter that extends
WASMI 14 [126] by adding pausing, serialization, deserialization, and
resumption primitives for implementing a portable enclave service.

Other works explore novel approaches to obfuscate WebAssembly binaries, aiming
to increase protection against reverse engineering or to highlight the
adversarial capabilities of WebAssembly in evading malware detection systems.

Other works introduce verification of programs after compilation. Watt (2018)
[127] mechanizes and verifies the WebAssembly specification using the theorem
prover Isabelle [128], illustrating two demonstrations that implement a
verified type-checker and interpreter for WebAssembly. This work is extended
by Watt et al. (2023) [129], who define a WebAssembly interpreter written in
Isabelle/HOL [130] to validate the Wasmtime interpreter [131]. Johnson et al.
(2021) [132] introduce VeriWasm, a static offline verifier for native x86-64
binaries compiled to WebAssembly. The verifier checks the boundaries of memory
accesses, control flows, and stack usage, ensuring the satisfaction of
Software Fault Isolation (SFI) [133] in binaries. Another area of research
focuses on improving malware detection in WebAssembly binaries. Xia et al.
(2024) [134] highlight the issue of emerging JavaScript-WebAssembly
multilingual malware (JWMM), which reduces the effectiveness of antivirus
solutions. The authors introduce a novel approach to semantically reconstruct
WebAssembly binaries, generating a high-level structure aimed at enhancing
antivirus detection capabilities.

Watt et al. (2021) [135] extend the WebAssembly semantic and provide two
different theorem provers: WasmCert-Isabelle and WasmCert-Coq.

####  5.6.1 Works that enhance WebAssembly indirectly

Some works do not extend WebAssembly components directly but address security
issues by enhancing other systems. Schrammel et al. (2020) [136] improve
WebAssembly security indirectly by enhancing the JavaScript (JS) V8 engine.
The authors underline that the JS engine compiles some JavaScript parts in
WebAssembly and identify several potential attacks against the compiled code.
They propose a JS engine extension that provides isolation mechanisms using
modern CPUs to enforce domain-based access controls on memory pages. Vassena
et al. (2021) [137] introduce Blade, an approach to automatically eliminate
speculative leaks from cryptographic code by extending “Cranelift” [138], a
WebAssembly to x86 compiler. Song et al. (2023) [139] propose an interesting
method for blocking heap memory corruption attacks by shadowing metadata from
linear memory in trusted JavaScript memory. They provide a JavaScript API that
WebAssembly programs can call to shadow and validate the metadata of the used
linear memory.

###  5.7 Vulnerability Discovery

Several works aim to discover vulnerabilities in WebAssembly binaries. Tables
LABEL:tab:vuln-discovery-static and LABEL:tab:vuln-discovery-dynamic
categorize these efforts into two groups: (i) works that leverage static
security analysis and (ii) works proposing dynamic analysis. Each approach is
experimented with various techniques, allowing the discovery of different
types of vulnerabilities.

Many studies focus on identifying issues in smart contracts. This clearly
indicates a significant adoption of WebAssembly in the blockchain domain.

Table 10: Vulnerability discovery works that propose a static analysis approach Work |  Static analysis approach |  Discovered vulnerabilities
---|---|---
Quan et al. (2019) [140] |  Control Graph Flow analysis |  Fake EOS transfer, fake EOS notice
Yang et al. (2020) [141] |  Symbolic Semantic Graph |  Integer overflow, pseudo-random number generator, insecure message call
Li et al. (2022) [142] |  Context-sensitive data flow analysis |  Fake EOS Transfer, Forged Transfer Notification, and Block Information Dependency
Brito et al. (2022) [143] |  Code property graph |  Buffer overflow, use after free, double free, dangerous function usage, and format strings vulnerabilities
Tu et al. (2023) [144] |  State Machine Representation |  Rollback, missing permission check, integer overflow
|  |
Table 11: Vulnerability discovery works that propose a dynamic analysis approach Work |  Dynamic analysis approach |  Detected vulnerabilities
---|---|---
Huang et al. (2021) [145] |  Black-box fuzzer |  Block information dependency, forged transfer notification, fake EOS transfer
Jiang et al. (2021) [146] |  Symbolic execution |  Greedy, dangerous DelegateCall, block information dependency, reentrancy, mishandled exception
He et al. (2021) [147] |  Symbolic execution |  Fake EOS, fake Receipt, rollback, missing permission check
Daniel Lehmann et al. (2021) [148] |  Fuzzing |  Crash in binary programs, mainly related to buffer overflow conditions
Marques et al. (2022) [149] |  Concolic execution |  Not specified
Yang et al. (2022) [150] |  Tracing and control-data flow |  Access control vulnerabilities
Khan et al. (2023) [151] |  Fuzzing |  data races, null pointer dereferences, out-of-bound accesses, division-by-zero errors in SGX enclave applications
Jin et al. (2023) [152] |  Fuzzing |  Overflow, underflow, arbitrary value transfer (e.g., reentrancy), suicidal, call injection
Haßler et al. (2022) [153] |  Coverage-guided fuzzing |  Crash in binary programs
Chen et al. (2022) [154] |  Concolic execution |  Fake EOS transfer, fake notification, missing authorization verification, blockinfo dependency, and rollback vulnerabilities
Zhou et al. (2023) [155] |  Bytecode instrumentation, run-time validation, and grey-box fuzzing |  Integer and stack overflow
|  |

A comparative analysis of the mentioned works allows us to observe that there
is no standardized approach to comparing the effectiveness of the proposed
methods. While some works focus on identifying low-level vulnerabilities such
as integer and stack-based overflows, others target vulnerabilities specific
to the smart contract domain. Some authors use real-world applications for
their evaluations, while others employ well-known yet heterogeneous datasets.
Evaluating real-world applications effectively demonstrates the capability of
security scanners to discover new vulnerabilities. However, this approach does
not yield performance metrics such as false positives or negatives, as the
exact number of vulnerabilities in the applications under test is unknown.
Consequently, each author defines different performance metrics, making it
challenging to compare the proposed methods.

This variability in evaluation metrics is a common issue in vulnerability
discovery approaches [156], and we encourage future research to address this
open problem.

###  5.8 Other works

Many works focus on aspects of WebAssembly beyond security but are still
relevant as they can provide valuable insights for future efforts aimed at
enhancing the security of the WebAssembly domain.

####  5.8.1 Preliminary works

Some preliminary studies offer promising results that may serve as a
foundation for innovative security improvements. Abbadini et al. (2023) [157]
design an approach that combines eBFP features with WebAssembly to enhance
host isolation security in existing runtimes. Narayan et al. (2021) [158]
provide a tutorial on leveraging WebAssembly’s sandboxing feature to run
unsafe C code securely. Stievenart and De Roover (2021) [54] introduce
“Wassail”, one of the first static analysis tools for WebAssembly. Their
technology enables several static analyses, such as call graphs, control-flow
graphs, and dataflow analysis. Cabrera et al. (2021) [55] present the first
version of a code diversification framework for WebAssembly, which is further
extended in a more recent study [159].

Bhansali et al. (2022) [160] provide a preliminary overview of applying
obfuscation techniques to WebAssembly binaries, demonstrating that specific
obfuscation approaches can bypass the MINOS cryptojacking detector (Naseem et
al. (2021) [111]).

Zheng et al. (2023) [161] present a software prototype for dynamic program
analysis capable of detecting memory bugs and integer overflows in WebAssembly
code, serving as an essential reference for investigating vulnerability
discovery in this domain.

####  5.8.2 Works about vulnerability discovery approaches

Many works investigate novel approaches to inspect WebAssembly code and binary
structure, laying the groundwork for future vulnerability discovery research.
William Fu et al. (2018) [162] and Szanto et al. (2018) [163] provide
comprehensive overviews of taint tracking [164] in WebAssembly. Both studies
demonstrate promising results in tracking data flows within WebAssembly
binaries but do not provide detailed security evaluations. Therefore, further
research is needed to assess their effectiveness in real-world scenarios.

Stievenart et al. (2022) [165] and Stiévenart et al. (2023) [166] introduce
methods to minimize WebAssembly binaries through slicing. These approaches are
useful for optimizing dynamic and dependency analysis of WebAssembly binaries.

Cabrera-Arteaga et al. (2024) [159] demonstrate how to automatically transform
a WebAssembly binary into variants without altering its original
functionality. This approach is effective for fuzzing WebAssembly compilers.

Other works can contribute to the realization of static analysis approaches.
Notable examples are Wasm Logic, a program logic for first-order WebAssembly
proposed by Watt et al. (2019) [167], and “Eunomia” (He et al. (2023) [168]),
a symbolic execution engine for WebAssembly.

Stievenart et al. (2020) [169] present a novel procedure based on static
analysis of WebAssembly programs based on compositional information flow. This
method enables an efficient and precise summarization of function behaviors,
facilitating the detection of information flow violations and potential
security breaches.

Lehmann et al. (2019) [170] contribute to the dynamic analysis of WebAssembly
with Wasabi, a framework designed to dynamically analyze WebAssembly programs
to collect runtime information, enabling the detection of dynamic behaviors
such as memory accesses and control flow.

An interesting WebAssembly use case is proposed by Kotenko et al. (2023)
[171], who devise practical guidelines for implementing secure applications in
the power energy sector. Even if WebAssembly is merely mentioned, this work
can pave the ground for future research.

Namjoshi et al. (2021) [172] define an interesting compiler extension that
checks for program correctness against an independent proof validator.
Although the proposed contribution is related to revealing bugs that occurred
in the optimization process of compiled programs, it could be easily broadened
in order to also include security verifications.

To identify bugs in WebAssembly runtimes, Zhou et al. (2023) [173] propose
WADIFF, a differential testing framework that could be specialized to find
security bugs. Debugging code remains an effective approach to manually
discover vulnerabilities [174]. Lauwaerts et al. (2022) [175] extend the
WARDuino WebAssembly microcontroller virtual machine [176] to enable debugging
features. Future works may extend this by proposing security methodologies to
find vulnerabilities in embedded systems designed with WebAssembly through
debugging approaches.

####  5.8.3 Comparison with other works

Another category of works compares WebAssembly security with other
technologies. Dejaeghere et al. (2023) [177] compare the security features of
WebAssembly with those provided by eBPF, a Linux subsystem that allows the
safe execution of untrusted user-defined extensions inside the kernel [178].
They demonstrate that different threat models can be defined for these two
technologies and emphasize that WebAssembly’s design focuses more on security
than performance. While WebAssembly permits the execution of unsafe code,
unlike eBPF, it reduces security risks and exploitation opportunities by
limiting the number of implemented helper system libraries.

In their study, Pham et al. (2023) [179] assess several non-functional
requirements, including performance, maintainability, and security. They
demonstrate that WebAssembly is a viable alternative to Docker containers in
IoT applications. However, the security evaluation is not exhaustive,
suggesting the need for further studies to analyze the security disparities
between these technologies.

Bastys et al. (2022) [180] present a significant contribution with their
SecWasm framework, designed for general-purpose information-flow control in
WebAssembly. SecWasm can be instrumented to perform several relevant security
controls against WebAssembly programs. While the paper provides a
comprehensive description of the approach, it lacks evaluations. Future
research could explore and analyze this promising approach further.

In the realm of kernel isolation, Peng et al. (2023) [181] introduce a novel
kernel context isolation system that offers enhanced isolation functionality
and features an efficient “implicit” context switch to minimize performance
overhead. Although the paper compares the system to WebAssembly to demonstrate
isolation benefits, further evaluation could enhance understanding.

##  6 Discussion

In this section, we discuss the results of our survey and summarize the
characteristics of the analyzed works.

Our research reviewed 121 works. Of these, 96 (85,85%) have been classified
into seven categories. The remaining 25 (14,15%) works do not make significant
contributions to the security domain in WebAssembly, yet represent relevant
references for novel pathways in related research topics.

Figure 1 shows the percentage of works for each category. As it is possible to
observe, most contributions (28,9%) aim to harden WebAssembly security.
Another large set of works (21,6%) leverages the WebAssembly capabilities for
implementing security-based use cases. The other relevant areas are related to
vulnerability discovery (16,5%) and attack detection (12,4%), respectively.

Figure 1: WebAssembly security research papers categorization

###  6.1 WebAssembly security

Studies that explore the security of WebAssembly through analyses, empirical
studies, or by showing attack scenarios led to the following primary
conclusions:

  * 1.

Although WebAssembly was designed to provide better isolation and security,
the lack of security protection mechanisms in its semantics and compilers has
the opposite effect, increasing the risks of memory-based attacks by porting
unsafe programs developed with low-level languages such as C into WebAssembly;

  * 2.

This problem is amplified by the presence of a large number of WebAssembly
binaries derived from memory-unsafe languages in real-world applications;

  * 3.

WebAssembly should provide isolation and protect sensitive data from
disclosure, but several studies confirm that it is possible to extract
sensitive data through specific techniques, such as side-channel attacks based
on cache analysis or port contention;

  * 4.

A significant number of WebAssembly binaries in the wild are obfuscated,
underscoring the need to expand research into reverse engineering and
WebAssembly decompilation;

  * 5.

The obfuscation applied to WebAssembly has led to a performance reduction in
malware detection systems, highlighting the importance of exploring the
research field of WebAssembly binary reverse engineering;

  * 6.

The relevance of crypto-mining activities based on WebAssembly in the world is
a contested matter: while some studies underline that it is the primary usage
of such technology, others state that less than 1% of the analyzed binaries
are related to crypto-mining activities.

###  6.2 Detect attacks and discover vulnerabilities in WebAssembly

Detection efforts primarily focus on cryptojacking attacks, while
vulnerability discovery approaches mainly address vulnerabilities in smart
contracts. Consequently, there is significant interest in analyzing
WebAssembly applications in smart contract environments. As stated in Section
2.1.3, there are relevant use-cases in web applications, data visualization,
and gaming. Future works should analyze the security impact of WebAssembly in
these other domains and propose approaches for addressing security problems.

Another significant issue is the heterogeneity of used benchmarks and
performance metrics. Some authors merely analyze their accuracy, and no common
dataset is used for trials and experiments.

The Alexa top one million website benchmark [61] was extensively employed as
“ground truth” for representing real-world WebAssembly cases. Unfortunately,
such a source was retired in 2022 and is unusable for further studies. We
encourage researchers to expand their scope by including additional sources to
create a more reliable ground truth benchmark.

###  6.3 The interest of WebAssembly for cybersecurity use-cases

Figure 2 shows the number of works published for each security-related domain
and the reasons behind the WebAssembly adoption. As observed, WebAssembly is
utilized across various application types, with particular relevance in cloud
and cryptography domains. WebAssembly is chosen for several reasons, notably
performance, isolation, and portability. Some studies also highlight its
adoption to ensure memory safety. However, as previously stated, several
studies confirm security gaps in using WebAssembly for both isolation and
memory safety, underscoring the necessity for further investigation into the
security of these applications.

Figure 2: WebAssembly use-cases

###  6.4 Enhance WebAssembly security

Figure 3 reports a heatmap illustrating the number of works extending specific
components of WebAssembly to enhance their security properties.

Figure 3: Heatmap for security enhancements works

What can be inferred from the heat map is that most of the works focus on
memory operations and involve modifications to the compiler and runtime. As
regards testability, it is analyzed through formal verification methods.
Indeed, many improvements could be made through the interpreter since it has
less impact compared to changes in the runtime and compiler, thus providing a
potential direction for future works. Additionally, confidentiality and code
signing are other elements that need to be further explored.

###  6.5 Results availability

For each security category, we analyze whether the authors of relevant works
have made available the source code used for the experiments they carried out.
The results of this analysis are condensed in Table 12. A detailed list of the
publicly available repositories we were able to check is instead reported in
Table LABEL:tab:public-work-table in the Appendix. As it is possible to
observe, a significant number of works have publicly released their code. This
open-source release of data and code will enable researchers to expand the
literature on WebAssembly more rapidly and develop novel approaches in the
field. We hope that the collection provided in this work will further boost
research advancements.

Category |  Relevant Works |  Public repositories
---|---|---
Security Analysis |  4 |  2
Empirical studies |  7 |  4
Use case in cybersecurity |  21 |  6
Attack Scenarios |  9 |  3
Attacks’ detection |  12 |  3
Security Enhancements |  27 |  17
Vulnerability Discovery |  16 |  9
Table 12: Security categories and publicly available works

###  6.6 Research gaps in WebAssembly and security

Rethinking the aforementioned considerations, we can summarize the following
research gaps:

  * 1.

WebAssembly has been thoroughly analyzed in the real world, especially through
the Alexa [61] benchmark, which was retired in 2022. Future studies should
investigate additional sources to confirm the empirical results of published
works;

  * 2.

Empirical studies do not address the adoption of WebAssembly on the dark web.
Given that this technology is used for malicious activities such as evading
malware detection and crypto-mining, exploring the relationship between
WebAssembly and the dark web could be a compelling research direction.

  * 3.

Crypto-mining and smart contracts are highly relevant in WebAssembly research,
with different approaches proposed for detecting attacks and discovering
vulnerabilities in these fields. However, empirical studies indicate that
WebAssembly is also applied to other types of applications. More studies
should investigate this relevance and potentially promote research in
unexplored fields where WebAssembly is prominently employed.

  * 4.

WebAssembly is adopted for various security use cases for reasons such as
performance, portability, and isolation. However, other interesting
applications could be examined. One such application is related to cyber
ranges, i.e., realistic offensive and defensive scenarios where people in the
security field can be trained [182].

  * 5.

Almost all security analysis works assess the security of C programs compiled
for WebAssembly. However, WebAssembly developers write programs in other
languages, such as JavaScript and Python. Additionally, the Rust language is
now a memory-safe alternative to C. We suggest expanding security research to
explore these languages.

##  7 Conclusions

In this work, we provide a comprehensive overview of the current state of
security research in WebAssembly, highlighting key studies that address
various security aspects of this emerging technology. We conducted a thorough
review of the most recent literature, analyzing a total of 121 studies,
categorizing them into eight distinct categories, and critically evaluating
the results.

Our analysis reveals significant research gaps in the WebAssembly security
field, which we believe future studies should aim to address. Specifically, we
identify the lack of exploration of cyber-ranges as a promising yet
underutilized security use case in WebAssembly, which has the potential to
revolutionize the way we approach security testing and training. To contribute
to this area, we plan to investigate the benefits of using WebAssembly in
cyber-ranges by comparing our previous research [183, 184, 185] with a cyber-
range solution developed entirely using this technology.

We also highlight the potential for WebAssembly to enable more efficient and
effective security testing and discuss the importance of considering the
security implications of WebAssembly’s unique features, such as its sandboxed
execution environment and memory safety guarantees.

We hope that this work will be useful to researchers seeking to make a
meaningful impact in the challenging field of enhancing the security features
of WebAssembly and provide valuable insights for developers and practitioners
looking to leverage WebAssembly for their security applications.

## References

  * Eich [2008] Brendan Eich.  From asm.js to webassembly.  https://brendaneich.com/2015/06/from-asm-js-to-webassembly/, 2008\.  Online; 14-Mar-2024.
  * Mozilla [2013] Mozilla.  asm.js.  http://asmjs.org/, 2013.  Online; 14-Mar-2024.
  * Alliance [2008] Alliance.  wasm.  https://github.com/WebAssembly/design/blob/main/FAQ.md, 2008.  Online; 14-Mar-2024.
  * Consortium [2008a] W3C Consortium.  Webassembly - core.  https://www.w3.org/TR/wasm-core-1/, 2008a.  Online; 14-Mar-2024.
  * Alliance [2018] Alliance.  Bytecode alliance.  https://bytecodealliance.org/, 2018.  Online; 14-Mar-2024.
  * Lin et al. [2020] Changyuan Lin, Sarah Nadi, and Hamzeh Khazaei.  A large-scale data set and an empirical study of docker images hosted on docker hub.  In _2020 IEEE International Conference on Software Maintenance and Evolution (ICSME)_ , pages 371–381, 2020.  doi: 10.1109/ICSME46990.2020.00043.
  * team [2018a] The Wasmer team.  Wasmer.  https://github.com/wasmerio/wasmer, 2018a.  Online; 08-Apr-2024.
  * team [2018b] The Wasmer team.  Wasmer sdk.  https://github.com/wasmerio/wasmer?#wasmer-sdk, 2018b.  Online; 08-Apr-2024.
  * team [2018c] The Wasmer team.  Wasmer edge.  https://wasmer.io/products/edge, 2018c.  Online; 08-Apr-2024.
  * team [2018d] The Wasmer team.  Wasmer hub.  https://wasmer.io/, 2018d.  Online; 08-Apr-2024.
  * Alliance [2019] Bytecode Alliance.  The state of webassembly in 2023.  https://wasi.dev/, 2019.  Online; 08-Apr-2024.
  * Consortium [2008b] W3C Consortium.  Webassembly - usecases.  https://github.com/WebAssembly/design/blob/main/UseCases.md, 2008b.  Online; 14-Mar-2024.
  * Hilbig et al. [2021] Aaron Hilbig, Daniel Lehmann, and Michael Pradel.  An empirical study of real-world webassembly binaries: Security, languages, use cases.  In _Proceedings of the Web Conference 2021_ , WWW ’21, page 2696–2708, New York, NY, USA, 2021. Association for Computing Machinery.  ISBN 9781450383127.  doi: 10.1145/3442381.3450138.  URL https://doi.org/10.1145/3442381.3450138.
  * Solodkov et al. [2023] SlashData (Nikita Solodkov, Brayton Noll), and Cloud Native Computing Foundation.  The state of webassembly in 2023.  https://www.cncf.io/wp-content/uploads/2023/09/The-State-of-WebAssembly-2023.pdf, 2023.  Online; 08-Apr-2024.
  * Bodei et al. [2005] C. Bodei, P. Degano, and C. Priami.  Checking security policies through an enhanced control flow analysis.  _J. Comput. Secur._ , 13:49–85, 2005.  doi: 10.3233/jcs-2005-13103.
  * Sampaio and Garcia [2016] L. Sampaio and Alessandro F. Garcia.  Exploring context-sensitive data flow analysis for early vulnerability detection.  _J. Syst. Softw._ , 113:337–361, 2016.  doi: 10.1016/j.jss.2015.12.021.
  * Yamaguchi et al. [2014] Fabian Yamaguchi, Nico Golde, Daniel Arp, and Konrad Rieck.  Modeling and discovering vulnerabilities with code property graphs.  In _2014 IEEE Symposium on Security and Privacy_ , pages 590–604, 2014.  doi: 10.1109/SP.2014.44.
  * van der Lee and Verwer [2018] Wesley van der Lee and S. Verwer.  Vulnerability detection on mobile applications using state machine inference.  _2018 IEEE European Symposium on Security and Privacy Workshops (EuroS &PW)_, pages 1–10, 2018.  doi: 10.1109/EuroSPW.2018.00008.
  * Alsaedi et al. [2021] Aseel Alsaedi, Abeer Alhuzali, and Omaimah Bamasag.  Black-box fuzzing approaches to secure web applications: Survey.  _International Journal of Advanced Computer Science and Applications_ , 12(5), 2021.  doi: 10.14569/IJACSA.2021.0120599.  URL http://dx.doi.org/10.14569/IJACSA.2021.0120599.
  * Chen et al. [2018] Chen Chen, Baojiang Cui, Jinxin Ma, Runpu Wu, Jianchao Guo, and Wenqian Liu.  A systematic review of fuzzing techniques.  _Computers and Security_ , 75:118–137, 2018.  ISSN 0167-4048.  doi: https://doi.org/10.1016/j.cose.2018.02.002.  URL https://www.sciencedirect.com/science/article/pii/S0167404818300658.
  * Coward [1988] P. David Coward.  Symbolic execution systems—a review.  _Software Engineering Journal_ , 3(6):229, 1988\.  ISSN 0268-6961.  doi: 10.1049/sej.1988.0029.  URL http://dx.doi.org/10.1049/sej.1988.0029.
  * Sabbaghi and Keyvanpour [2020] Arash Sabbaghi and Mohammad Reza Keyvanpour.  A systematic review of search strategies in dynamic symbolic execution.  _Computer Standards & Interfaces_, 72:103444, 2020.  ISSN 0920-5489.  doi: https://doi.org/10.1016/j.csi.2020.103444.  URL https://www.sciencedirect.com/science/article/pii/S0920548919300066.
  * Foreman and Zweben [1993] Lynn M. Foreman and S. Zweben.  A study of the effectiveness of control and data flow testing strategies.  _J. Syst. Softw._ , 21:215–228, 1993.  doi: 10.1016/0164-1212(93)90024-R.
  * Yang and Zulkernine [2009] Xiaofeng Yang and Mohammad Zulkernine.  Secure method calls by instrumenting bytecode with aspects.  In Ehud Gudes and Jaideep Vaidya, editors, _Data and Applications Security XXIII_ , pages 126–141, Berlin, Heidelberg, 2009. Springer Berlin Heidelberg.  ISBN 978-3-642-03007-9.
  * Li [2019] Yinsheng Li.  Emerging blockchain-based applications and techniques.  _Service Oriented Computing and Applications_ , 13(4):279–285, 2019.  doi: 10.1007/s11761-019-00281-x.  URL https://doi.org/10.1007/s11761-019-00281-x.
  * Wood [2017] Gavin Wood.  Ethereum: A secure decentralised generalised transaction ledger eip-150 revision (759dccd - 2017-08-07), 2017.  URL https://ethereum.github.io/yellowpaper/paper.pdf.  Accessed: 27-Mar-2024.
  * Ethereum [2020] Ethereum.  Ethereum glossary.  https://ethereum.org/en/glossary, 2020.  Online; 14-Mar-2024.
  * Ethereum [2021a] Ethereum.  Introduction to smart contracts.  https://ethereum.org/en/smart-contracts/, 2021a.  Online; 14-Mar-2024.
  * Ethereum [2021b] Ethereum.  Introduction to smart contracts.  https://ethereum.org/en/smart-contracts/, 2021b.  Online; 14-Mar-2024.
  * EOSIO [2020] EOSIO.  eos.io.  https://eos.io/, 2020.  Online; 14-Mar-2024.
  * He et al. [2022] Ningyu He, Haoyu Wang, Lei Wu, Xiapu Luo, Yao Guo, and Xiangqun Chen.  A survey on eosio systems security: Vulnerability, attack, and mitigation, 2022.
  * Sabt et al. [2015] Mohamed Sabt, Mohammed Achemlal, and Abdelmadjid Bouabdallah.  Trusted execution environment: What it is, and what it is not.  In _2015 IEEE Trustcom/BigDataSE/ISPA_ , volume 1, pages 57–64, 2015\.  doi: 10.1109/Trustcom.2015.357.
  * Intel [2021] Intel.  Software guard extension.  https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html, 2021\.  Online; 26-03-2024.
  * Webster and Watson [2002] Jane Webster and Richard T. Watson.  Analyzing the past to prepare for the future: Writing a literature review.  _MIS Quarterly_ , 26(2):xiii–xxiii, 2002.  ISSN 02767783.  URL http://www.jstor.org/stable/4132319.
  * Kitchenham and Brereton [2013] Barbara Kitchenham and Pearl Brereton.  A systematic review of systematic review process research in software engineering.  _Information and Software Technology_ , 55(12):2049–2075, 2013.  ISSN 0950-5849.  doi: https://doi.org/10.1016/j.infsof.2013.07.010.  URL https://www.sciencedirect.com/science/article/pii/S0950584913001560.
  * iee [2000] Ieee xplore.  https://ieeexplore.ieee.org, 2000.  Accessed: 08-Apr-2024.
  * Elsevier [1996] Elsevier.  Scopus.  https://www.scopus.com/, 1996.  Online; 16-Apr-2024.
  * arX [1991] arXiv.org: e-print archive.  https://arxiv.org, 1991.  Accessed: 08-Apr-2024.
  * bla [1997] Black hat.  https://www.blackhat.com, 1997.  Accessed: April 8, 2024.
  * Kwedza and Chindipha [2023] Philip Kwedza and Stones Dalitso Chindipha.  Cryptojacking detection in cloud infrastructure using network traffic.  In _2023 International Conference on Electrical, Computer and Energy Technologies (ICECET)_ , pages 1–6, 2023.  doi: 10.1109/ICECET58911.2023.10389593.
  * 10\. [2023] _MagTracer: Detecting GPU Cryptojacking Attacks via Magnetic Leakage Signals_ , New York, NY, USA, 2023. Association for Computing Machinery.  ISBN 9781450399906.  URL https://doi.org/10.1145/3570361.3613283.
  * Darabian et al. [2020] Hamid Darabian, Sajad Homayounoot, Ali Dehghantanha, Sattar Hashemi, Hadis Karimipour, Reza M. Parizi, and Kim-Kwang Raymond Choo.  Detecting cryptomining malware: a deep learning approach for static and dynamic analysis.  _Journal of Grid Computing_ , 18(2):293–303, 2020\.  doi: 10.1007/s10723-020-09510-6.  URL https://doi.org/10.1007/s10723-020-09510-6.
  * Wang [2022] Wenwen Wang.  How far we’ve come – a characterization study of standalone webassembly runtimes.  In _2022 IEEE International Symposium on Workload Characterization (IISWC)_ , pages 228–241, 2022.  doi: 10.1109/IISWC55918.2022.00028.
  * Cao et al. [2020] Keyan Cao, Yefan Liu, Gongjie Meng, and Qimeng Sun.  An overview on edge computing research.  _IEEE Access_ , 8:85714–85728, 2020.  doi: 10.1109/ACCESS.2020.2991734.
  * Kakati and Brorsson [2023] Sangeeta Kakati and Mats Brorsson.  Webassembly beyond the web: A review for the edge-cloud continuum.  In _2023 3rd International Conference on Intelligent Technologies (CONIT)_ , pages 1–8, 2023.  doi: 10.1109/CONIT59222.2023.10205816.
  * Schoder [2018] Detlef Schoder.  Introduction to the internet of things, May 2018.  URL http://dx.doi.org/10.1002/9781119456735.ch1.
  * Ray [2023] Partha Pratim Ray.  An overview of webassembly for iot: Background, tools, state-of-the-art, challenges, and future directions.  _Future Internet_ , 15(8), 2023.  doi: 10.3390/fi15080275.  Cited by: 0; All Open Access, Gold Open Access.
  * Lehmann et al. [2020] Daniel Lehmann, Johannes Kinder, and Michael Pradel.  Everything old is new again: Binary security of webassembly.  In _29th USENIX Security Symposium (USENIX Security 20)_ , page 217 – 234, 2020.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85091924058&partnerID=40&md5=996f09154d5a3c8001c1c7093dd736c7.  Cited by: 54.
  * Stievenart et al. [2021] Quentin Stievenart, Coen De Roover, and Mohammad Ghafari.  The security risk of lacking compiler protection in webassembly.  In _IEEE International Conference on Software Quality, Reliability and Security, QRS_ , volume 2021-December, page 132 – 139, 2021.  doi: 10.1109/QRS54544.2021.00024.  Cited by: 7; All Open Access, Green Open Access.
  * Stiévenart et al. [2022] Quentin Stiévenart, Coen De Roover, and Mohammad Ghafari.  Security risks of porting c programs to webassembly.  In _Proceedings of the ACM Symposium on Applied Computing_ , page 1713 – 1722, 2022.  doi: 10.1145/3477314.3507308.  Cited by: 9; All Open Access, Green Open Access.
  * Brian McFadden and Engler [2018] Jeff Dileo Brian McFadden, Tyler Lukasiewicz and Justin Engler.  Security chasms of wasm.  https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf, 2018\.  Online; 21-Mar-2024.
  * Kim et al. [2022] Minseo Kim, Hyerean Jang, and Youngjoo Shin.  Avengers, assemble! survey of webassembly security solutions.  In _2022 IEEE 15th International Conference on Cloud Computing (CLOUD)_ , pages 543–553, 2022.  doi: 10.1109/CLOUD55607.2022.00077.
  * Harnes and Morrison [2024] Håkon Harnes and Donn Morrison.  Sok: Analysis techniques for webassembly.  _Future Internet_ , 16(3):84, February 2024.  ISSN 1999-5903.  doi: 10.3390/fi16030084.  URL http://dx.doi.org/10.3390/fi16030084.
  * Stievenart [2021] De Roover Stievenart.  Wassail: a webassembly static analysis library (extended presentation abstract).  https://drive.google.com/file/d/1BWXJIE57O-o2gBjm-pE7YSTWpSnjEnQy/view, 2021\.  Online; 21-Mar-2024.
  * Cabrera Arteaga et al. [2021] Javier Cabrera Arteaga, Orestis Floros, Oscar Vera Perez, Benoit Baudry, and Martin Monperrus.  Crow: Code diversification for webassembly.  In _Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web_ , MADWeb 2021. Internet Society, 2021.  doi: 10.14722/madweb.2021.23004.  URL http://dx.doi.org/10.14722/madweb.2021.23004.
  * One [1996] Aleph One.  Smashing the stack for fun and profit.  Phrack Magazine, Vol. 7 no. 49 pages 14-16, 1996.
  * Kernighan and Ritchie [1988] Brian W. Kernighan and Dennis M. Ritchie.  _The C Programming Language_.  Prentice Hall Professional Technical Reference, 2nd edition, 1988.  ISBN 0131103709.
  * Menetrey et al. [2021] James Menetrey, Marcelo Pasin, Pascal Felber, and Valerio Schiavoni.  Twine: An embedded trusted runtime for webassembly.  In _Proceedings - International Conference on Data Engineering_ , volume 2021-April, page 205 – 216, 2021.  doi: 10.1109/ICDE51399.2021.00025.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85112867383&doi=10.1109%2fICDE51399.2021.00025&partnerID=40&md5=015890b1dd2af1855e44cd3deb61146f.  Cited by: 25; All Open Access, Green Open Access.
  * Nieke et al. [2021] Manuel Nieke, Lennart Almstedt, and Rüdiger Kapitza.  Edgedancer: Secure mobile webassembly services on the edge.  In _EdgeSys 2021 - Proceedings of the 4th International Workshop on Edge Systems, Analytics and Networking, Part of EuroSys 2021_ , page 13 – 18, 2021.  doi: 10.1145/3434770.3459731.  Cited by: 7.
  * Rüth et al. [2018] Jan Rüth, Torsten Zimmermann, Konrad Wolsing, and Oliver Hohlfeld.  Digging into browser-based crypto mining.  In _Proceedings of the Internet Measurement Conference 2018_ , IMC ’18, page 70–76, New York, NY, USA, 2018. Association for Computing Machinery.  ISBN 9781450356190.  doi: 10.1145/3278532.3278539.  URL https://doi.org/10.1145/3278532.3278539.
  * Dave [2004] Peter Dave.  Alexa top 1 million websites.  https://github.com/PeterDaveHello/top-1m-domains, 2004.  Online; 12-Apr-2024; Alexa service was retired in 2022, Peter Dave provides a GitHub repository as an alternative.
  * Musch et al. [2019a] Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck.  New kid on the web: A study on the prevalence of webassembly in the wild.  In Roberto Perdisci, Clémentine Maurice, Giorgio Giacinto, and Magnus Almgren, editors, _Detection of Intrusions and Malware, and Vulnerability Assessment_ , pages 23–42, Cham, 2019a. Springer International Publishing.  ISBN 978-3-030-22038-9.
  * Musch et al. [2019b] Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck.  _New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild_ , page 23–42.  Springer International Publishing, 2019b.  ISBN 9783030220389.  doi: 10.1007/978-3-030-22038-9˙2.  URL http://dx.doi.org/10.1007/978-3-030-22038-9_2.
  * Romano et al. [2021] Alan Romano, Xinyue Liu, Yonghwi Kwon, and Weihang Wang.  An empirical study of bugs in webassembly compilers.  In _2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)_ , pages 42–54, 2021.  doi: 10.1109/ASE51524.2021.9678776.
  * Puddu et al. [2022] Ivan Puddu, Moritz Schneider, Daniele Lain, Stefano Boschetto, and Srdjan Čapkun.  On (the lack of) code confidentiality in trusted execution environments, 2022.
  * Baumgärtner et al. [2019] Lars Baumgärtner, Jonas Höchst, and Tobias Meuser.  B-dtn7: Browser-based disruption-tolerant networking via bundle protocol 7.  In _6th International Conference on Information and Communication Technologies for Disaster Management, ICT-DM 2019_ , 2019.  doi: 10.1109/ICT-DM47966.2019.9032944.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85083227135&doi=10.1109%2fICT-DM47966.2019.9032944&partnerID=40&md5=270bd32a3d57127b5ec195e8eb6b448c.  Cited by: 10.
  * Burleigh et al. [2022] Scott Burleigh, Kevin Fall, and E Birrane.  Bundle protocol version 7.  RFC 9171, RFC Editor, 12 2022.  URL https://www.rfc-editor.org/rfc/rfc9171.txt.
  * Narayan et al. [2020] Shravan Narayan, Craig Disselkoen, Tal Garfinkel, Nathan Froyd, Eric Rahm, Sorin Lerner, Hovav Shacham, and Deian Stefan.  Retrofitting fine grain isolation in the firefox renderer.  In _Proceedings of the 29th USENIX Security Symposium_ , page 699 – 716, 2020.  Cited by: 45.
  * Chen et al. [2023] Ming-Te Chen, Yi Yang Chang, and Ta Jen Wu.  Digital copyright management mechanism based on dynamic encryption for multiplatform browsers.  _Int. J. Semant. Web Inf. Syst._ , 20(1):1–22, dec 2023.  ISSN 1552-6283.  doi: 10.4018/IJSWIS.334591.  URL https://doi.org/10.4018/IJSWIS.334591.
  * Jang et al. [2022] Daehee Jang, Ammar Askar, Insu Yun, Stephen Tong, Yiqin Cai, and Taesoo Kim.  Fuzzing@home: Distributed fuzzing on untrusted heterogeneous clients.  In _Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses_ , RAID ’22, page 1–16, New York, NY, USA, 2022. Association for Computing Machinery.  ISBN 9781450397049.  doi: 10.1145/3545948.3545971.  URL https://doi.org/10.1145/3545948.3545971.
  * Sun et al. [2022] Shuzhou Sun, Hui Ma, Zishuai Song, and Rui Zhang.  Webcloud: Web-based cloud storage for secure data sharing across platforms.  _IEEE Transactions on Dependable and Secure Computing_ , 19(3):1871 – 1884, 2022.  doi: 10.1109/TDSC.2020.3040784.  Cited by: 7.
  * Attrapadung et al. [2018] Nuttapong Attrapadung, Goichiro Hanaoka, Shigeo Mitsunari, Yusuke Sakai, Kana Shimizu, and Tadanori Teruya.  Efficient two-level homomorphic encryption in prime-order bilinear groups and a fast implementation in webassembly.  In _Proceedings of the 2018 on Asia Conference on Computer and Communications Security_ , ASIA CCS ’18. ACM, May 2018.  doi: 10.1145/3196494.3196552.  URL http://dx.doi.org/10.1145/3196494.3196552.
  * Seo and Kim [2023] Seog Chung Seo and HeeSeok Kim.  Portable and efficient implementation of crystals-kyber based on webassembly.  _Computer Systems Science and Engineering_ , 46(2):2091 – 2107, 2023.  doi: 10.32604/csse.2023.035064.  Cited by: 1; All Open Access, Hybrid Gold Open Access.
  * P. Schwabe and J. Bos [2021] R. Avanzi P. Schwabe and E. Kiltz et al. J. Bos, L. Ducas.  Crystals-kyber.  https://pq-crystals.org/kyber/index.shtml, 2021.  Online; 25-03-2024.
  * Zhao et al. [2023] Shixuan Zhao, Pinshen Xu, Guoxing Chen, Mengya Zhang, Yinqian Zhang, and Zhiqiang Lin.  Reusable enclaves for confidential serverless computing.  In _32nd USENIX Security Symposium, USENIX Security 2023_ , volume 6, page 4015 – 4032, 2023.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85176118235&partnerID=40&md5=2432d064107267e826b266971eb8beb9.  Cited by: 1.
  * Almstedt et al. [2023] Lennart Almstedt, Kai Bleeke, Mohammad Mahhouk, Leander Jehl, Rüdiger Kapitza, and Lars Wolf.  Contractbox: Realizing accountable data sharing on the edge using a small scale blockchain.  _Computer Networks_ , 229, 2023.  doi: 10.1016/j.comnet.2023.109768.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85153571862&doi=10.1016%2fj.comnet.2023.109768&partnerID=40&md5=9756e99e5436e81bd535a651e882ee38.  Cited by: 1; All Open Access, Hybrid Gold Open Access.
  * Ménétrey et al. [2024] Jämes Ménétrey, Aeneas Grüter, Peterson Yuhala, Julius Oeftiger, Pascal Felber, Marcelo Pasin, and Valerio Schiavoni.  A Holistic Approach for Trustworthy Distributed Systems with WebAssembly and TEEs.  In Alysson Bessani, Xavier Défago, Junya Nakamura, Koichi Wada, and Yukiko Yamauchi, editors, _27th International Conference on Principles of Distributed Systems (OPODIS 2023)_ , volume 286 of _Leibniz International Proceedings in Informatics (LIPIcs)_ , pages 23:1–23:23, Dagstuhl, Germany, 2024. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.  ISBN 978-3-95977-308-9.  doi: 10.4230/LIPIcs.OPODIS.2023.23.  URL https://drops-dev.dagstuhl.de/entities/document/10.4230/LIPIcs.OPODIS.2023.23.
  * Qiang et al. [2018] Weizhong Qiang, Zezhao Dong, and Hai Jin.  Se-lambda: Securing privacy-sensitive serverless applications using sgx enclave.  _Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST_ , 254:451 – 470, 2018.  doi: 10.1007/978-3-030-01701-9˙25.  Cited by: 14.
  * Izquierdo Riera. et al. [2023] Francisco Izquierdo Riera., Magnus Almgren., Pablo Picazo-Sanchez., and Christian Rohner.  Clipaha: A scheme to perform password stretching on the client.  In _Proceedings of the 9th International Conference on Information Systems Security and Privacy - ICISSP_ , pages 58–69. INSTICC, SciTePress, 2023.  ISBN 978-989-758-624-8.  doi: 10.5220/0011653200003405.
  * Goltzsche et al. [2019] David Goltzsche, Manuel Nieke, Thomas Knauth, and Rüdiger Kapitza.  Acctee: A webassembly-based two-way sandbox for trusted resource accounting.  In _Proceedings of the 20th International Middleware Conference_ , Middleware ’19, page 123–135, New York, NY, USA, 2019. Association for Computing Machinery.  ISBN 9781450370097.  doi: 10.1145/3361525.3361541.  URL https://doi.org/10.1145/3361525.3361541.
  * Zhang et al. [2021a] Zhiyi Zhang, Michał Król, Alberto Sonnino, Lixia Zhang, and Etienne Rivière.  El passo: Efficient and lightweight privacy-preserving single sign on.  _Proceedings on Privacy Enhancing Technologies_ , 2021(2):70–87, January 2021a.  ISSN 2299-0984.  doi: 10.2478/popets-2021-0018.  URL http://dx.doi.org/10.2478/popets-2021-0018.
  * Bhardwaj [2023] Ayush Bhardwaj.  Navigating the complexities of the cloud-native world: A study of developer perspectives.  In _2023 6th International Conference on Advanced Communication Technologies and Networking (CommNet)_ , pages 1–6, 2023.  doi: 10.1109/CommNet60167.2023.10365297.
  * Ménétrey et al. [2022] Jämes Ménétrey, Marcelo Pasin, Pascal Felber, and Valerio Schiavoni.  Webassembly as a common layer for the cloud-edge continuum.  In _FRAME 2022 - Proceedings of the 2nd Workshop on Flexible Resource and Application Management on the Edge, co-located with HPDC 2022_ , page 3 – 8, 2022.  doi: 10.1145/3526059.3533618.  Cited by: 12; All Open Access, Green Open Access.
  * Khalyeyev et al. [2023] Danylo Khalyeyev, Tomas Bureš, and Petr Hnětynka.  Towards characterization of edge-cloud continuum.  In Thais Batista, Tomáš Bureš, Claudia Raibulet, and Henry Muccini, editors, _Software Architecture. ECSA 2022 Tracks and Workshops_ , pages 215–230, Cham, 2023. Springer International Publishing.  ISBN 978-3-031-36889-9.
  * Song et al. [2023a] Zishuai Song, Hui Ma, Rui Zhang, Wenhan Xu, and Jianhao Li.  Everything under control: Secure data sharing mechanism for cloud-edge computing.  _IEEE Transactions on Information Forensics and Security_ , 18:2234–2249, 2023a.  doi: 10.1109/TIFS.2023.3266164.
  * Wen and Weber [2020] Elliott Wen and Gerald Weber.  Wasmachine: Bring the edge up to speed with a webassembly os.  In _IEEE International Conference on Cloud Computing, CLOUD_ , volume 2020-October, page 353 – 360, 2020.  doi: 10.1109/CLOUD49709.2020.00056.  Cited by: 1.
  * Li and Sato [2023] Shaowen Li and Hiroyuki Sato.  W-kernel: An os kernel architecture designed with isolation and customizability.  In _ACM International Conference Proceeding Series_ , page 42 – 50, 2023.  doi: 10.1145/3637792.3637796.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85186520460&doi=10.1145%2f3637792.3637796&partnerID=40&md5=b139edd8697176f23f98a54181642188.
  * Pillay and Viriri [2019] Prashaan Pillay and Serestina Viriri.  Foresight: Real time facial detection and recognition using webassembly and localized deep neural networks.  In _2019 Conference on Information Communications Technology and Society, ICTAS 2019_ , 2019.  doi: 10.1109/ICTAS.2019.8703634.  Cited by: 2.
  * Martín Manso and Escrivá Gallardo [2021] Ricardo Martín Manso and Pablo Escrivá Gallardo.  Face recognition efficiency enhancements using tensorflow and webassembly: A practical approach.  In Pablo H. Ruiz, Vanessa Agredo-Delgado, and André Luiz Satoshi Kawamoto, editors, _Human-Computer Interaction_ , pages 84–97, Cham, 2021\. Springer International Publishing.  ISBN 978-3-030-92325-9.
  * Genkin et al. [2018] Daniel Genkin, Lev Pachmanov, Eran Tromer, and Yuval Yarom.  Drive-by key-extraction cache attacks from portable code.  Cryptology ePrint Archive, Paper 2018/119, 2018.  URL https://eprint.iacr.org/2018/119.  https://eprint.iacr.org/2018/119.
  * Easdon et al. [2022] Catherine Easdon, Michael Schwarz, Martin Schwarzl, and Daniel Gruss.  Rapid prototyping for microarchitectural attacks.  In _31st USENIX Security Symposium (USENIX Security 22)_ , pages 3861–3877, Boston, MA, August 2022. USENIX Association.  ISBN 978-1-939133-31-1.  URL https://www.usenix.org/conference/usenixsecurity22/presentation/easdon.
  * Rokicki et al. [2022] Thomas Rokicki, Clémentine Maurice, Marina Botvinnik, and Yossi Oren.  Port contention goes portable: Port contention side channels in web browsers.  In _Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security_ , ASIA CCS ’22, page 1182–1194, New York, NY, USA, 2022. Association for Computing Machinery.  ISBN 9781450391405.  doi: 10.1145/3488932.3517411.  URL https://doi.org/10.1145/3488932.3517411.
  * Katzman et al. [2023] Daniel Katzman, William Kosasih, Chitchanok Chuengsatiansup, Eyal Ronen, and Yuval Yarom.  The gates of time: Improving cache attacks with transient execution.  In _32nd USENIX Security Symposium, USENIX Security 2023_ , volume 3, page 1955 – 1972, 2023.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85150326033&partnerID=40&md5=eeca3941ae9d6ff5761b13cf0fa4da33.  Cited by: 3.
  * Cabrera-Arteaga et al. [2023] Javier Cabrera-Arteaga, Martin Monperrus, Tim Toady, and Benoit Baudry.  Webassembly diversification for malware evasion.  _Computers and Security_ , 131:103296, 2023.  ISSN 0167-4048.  doi: https://doi.org/10.1016/j.cose.2023.103296.  URL https://www.sciencedirect.com/science/article/pii/S0167404823002067.
  * Romano et al. [2022] Alan Romano, Daniel Lehmann, Michael Pradel, and Weihang Wang.  Wobfuscator: Obfuscating javascript malware via opportunistic translation to webassembly.  In _2022 IEEE Symposium on Security and Privacy (SP)_ , pages 1574–1589, 2022.  doi: 10.1109/SP46214.2022.9833626.
  * Cao et al. [2023] Shangtong Cao, Ningyu He, Yao Guo, and Haoyu Wang.  Brewasm: A general static binary rewriting framework forÂ webassembly.  In Manuel V. Hermenegildo and José F. Morales, editors, _Static Analysis_ , pages 139–163, Cham, 2023. Springer Nature Switzerland.  ISBN 978-3-031-44245-2.
  * Loose et al. [2023] Nils Loose, Felix Mächtle, Claudius Pott, Volodymyr Bezsmertnyi, and Thomas Eisenbarth.  Madvex: Instrumentation-based adversarial attacks on machine learning malware detection.  In Daniel Gruss, Federico Maggi, Mathias Fischer, and Michele Carminati, editors, _Detection of Intrusions and Malware, and Vulnerability Assessment_ , pages 69–88, Cham, 2023. Springer Nature Switzerland.  ISBN 978-3-031-35504-2.
  * Oz et al. [2023] Harun Oz, Ahmet Aris, Abbas Acar, Güliz Seray Tuncay, Leonardo Babun, and Selcuk Uluagac.  RøB: Ransomware over modern web browsers.  In _32nd USENIX Security Symposium (USENIX Security 23)_ , pages 7073–7090, Anaheim, CA, August 2023. USENIX Association.  ISBN 978-1-939133-37-3.  URL https://www.usenix.org/conference/usenixsecurity23/presentation/oz.
  * Tandon and Nayyar [2019] Aditya Tandon and Anand Nayyar.  A comprehensive survey on ransomware attack: A growing havoc cyberthreat.  In Valentina Emilia Balas, Neha Sharma, and Amlan Chakrabarti, editors, _Data Management, Analytics and Innovation_ , pages 403–420, Singapore, 2019. Springer Singapore.  ISBN 978-981-13-1274-8.
  * Van Bulck et al. [2018] Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yuval Yarom, and Raoul Strackx.  Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution.  In _Proceedings of the 27th USENIX Security Symposium_. USENIX Association, August 2018.
  * Van Bulck et al. [2020] Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yarom Yuval, Berk Sunar, Daniel Gruss, and Frank Piessens.  LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection.  In _41th IEEE Symposium on Security and Privacy (S &P’20)_, 2020\.
  * Konoth et al. [2018] Radhesh Krishnan Konoth, Emanuele Vineti, Veelasha Moonsamy, Martina Lindorfer, Christopher Kruegel, Herbert Bos, and Giovanni Vigna.  Minesweeper: An in-depth look into drive-by cryptocurrency mining and its defense.  In _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , CCS ’18, page 1714–1730, New York, NY, USA, 2018\. Association for Computing Machinery.  ISBN 9781450356930.  doi: 10.1145/3243734.3243858.  URL https://doi.org/10.1145/3243734.3243858.
  * Wang et al. [2018] Wenhao Wang, Benjamin Ferrell, Xiaoyang Xu, Kevin W. Hamlen, and Shuang Hao.  Seismic: Secure in-lined script monitors for interrupting cryptojacks.  _Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)_ , 11099 LNCS:122 – 142, 2018.  doi: 10.1007/978-3-319-98989-1“˙7.  Cited by: 44.
  * Rodriguez and Posegga [2018] Juan D. Parra Rodriguez and Joachim Posegga.  Rapid: Resource and api-based detection against in-browser miners.  In _Proceedings of the 34th Annual Computer Security Applications Conference_ , ACSAC ’18. ACM, December 2018.  doi: 10.1145/3274694.3274735.  URL http://dx.doi.org/10.1145/3274694.3274735.
  * Kharraz et al. [2019] Amin Kharraz, Zane Ma, Paul Murley, Charles Lever, Joshua Mason, Andrew Miller, Nikita Borisov, Manos Antonakakis, and Michael Bailey.  Outguard: Detecting in-browser covert cryptocurrency mining in the wild.  In _The World Wide Web Conference_ , WWW ’19, page 840–852, New York, NY, USA, 2019. Association for Computing Machinery.  ISBN 9781450366748.  doi: 10.1145/3308558.3313665.  URL https://doi.org/10.1145/3308558.3313665.
  * Bian et al. [2020] Weikang Bian, Wei Meng, and Mingxue Zhang.  Minethrottle: Defending against wasm in-browser cryptojacking.  In _Proceedings of The Web Conference 2020_ , WWW ’20, page 3112–3118, New York, NY, USA, 2020. Association for Computing Machinery.  ISBN 9781450370233.  doi: 10.1145/3366423.3380085.  URL https://doi.org/10.1145/3366423.3380085.
  * Kelton et al. [2020] Conor Kelton, Aruna Balasubramanian, Ramya Raghavendra, and Mudhakar Srivatsa.  Browser-based deep behavioral detection of web cryptomining with coinspy.  In _Proceedings 2020 Workshop on Measurements, Attacks, and Defenses for the Web_ , MADWeb 2020. Internet Society, 2020.  doi: 10.14722/madweb.2020.23002.  URL http://dx.doi.org/10.14722/madweb.2020.23002.
  * Mazaheri et al. [2020] Mohammad Erfan Mazaheri, Farhad Taheri, and Siavash Bayat Sarmadi.  Lurking eyes: A method to detect side-channel attacks on javascript and webassembly.  In _2020 17th International ISC Conference on Information Security and Cryptology (ISCISC)_ , pages 1–6, 2020.  doi: 10.1109/ISCISC51277.2020.9261920.
  * Romano et al. [2020] Alan Romano, Yunhui Zheng, and Weihang Wang.  Minerray: Semantics-aware analysis for ever-evolving cryptojacking detection.  In _2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)_ , pages 1129–1140, 2020.
  * Yu et al. [2020] Guorui Yu, Guangliang Yang, Tongxin Li, Xinhui Han, Shijie Guan, Jialong Zhang, and Guofei Gu.  Minergate: A novel generic and accurate defense solution against web based cryptocurrency mining attacks.  In Wei Lu, Qiaoyan Wen, Yuqing Zhang, Bo Lang, Weiping Wen, Hanbing Yan, Chao Li, Li Ding, Ruiguang Li, and Yu Zhou, editors, _Cyber Security_ , pages 50–70, Singapore, 2020. Springer Singapore.  ISBN 978-981-33-4922-3.
  * Naseem et al. [2021] Faraz Naseem, Ahmet Aris, Leonardo Babun, Ege Tekiner, and A. Selcuk Uluagac.  Minos: A lightweight real-time cryptojacking detection system.  In _Proceedings 2021 Network and Distributed System Security Symposium_ , NDSS 2021. Internet Society, 2021.  doi: 10.14722/ndss.2021.24444.  URL http://dx.doi.org/10.14722/ndss.2021.24444.
  * Tommasi et al. [2022] Franco Tommasi, Christian Catalano, Umberto Corvaglia, and Ivan Taurino.  Mineralert: an hybrid approach for web mining detection.  _Journal of Computer Virology and Hacking Techniques_ , 18(4):333–346, March 2022.  ISSN 2263-8733.  doi: 10.1007/s11416-022-00420-7.  URL http://dx.doi.org/10.1007/s11416-022-00420-7.
  * Breitfelder et al. [2023] Florian Breitfelder, Tobias Roth, Lars Baumgartner, and Mira Mezini.  Wasma: A static webassembly analysis framework for everyone.  In _Proceedings - 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2023_ , page 753 – 757, 2023.  doi: 10.1109/SANER56733.2023.00085.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85160520868&doi=10.1109%2fSANER56733.2023.00085&partnerID=40&md5=83da4bf28bbbd6b5d4e847423509a331.  Cited by: 2.
  * Watt et al. [2019a] Conrad Watt, John Renner, Natalie Popescu, Sunjay Cauligi, and Deian Stefan.  Ct-wasm: Type-driven secure cryptography for the web ecosystem.  _Proceedings of the ACM on Programming Languages_ , 3(POPL), 2019a.  doi: 10.1145/3290390.  Cited by: 37; All Open Access, Bronze Open Access, Green Open Access.
  * Michael et al. [2023] Alexandra E. Michael, Anitha Gollamudi, Jay Bosamiya, Evan Johnson, Aidan Denlinger, Craig Disselkoen, Conrad Watt, Bryan Parno, Marco Patrignani, Marco Vassena, and Deian Stefan.  Mswasm: Soundly enforcing memory-safe execution of unsafe code.  _Proceedings of the ACM on Programming Languages_ , 7:425 – 454, 2023.  doi: 10.1145/3571208.  Cited by: 2; All Open Access, Bronze Open Access, Green Open Access.
  * Geller et al. [2024] Adam T. Geller, Justin Frank, and William J. Bowman.  Indexed types for a statically safe webassembly.  _Proc. ACM Program. Lang._ , 8(POPL), jan 2024.  doi: 10.1145/3632922.  URL https://doi.org/10.1145/3632922.
  * Zenger [1997] Christoph Zenger.  Indexed types.  _Theoretical Computer Science_ , 187(1):147–165, 1997.  ISSN 0304-3975.  doi: https://doi.org/10.1016/S0304-3975(97)00062-5.  URL https://www.sciencedirect.com/science/article/pii/S0304397597000625.
  * Zhang et al. [2023] Ziyao Zhang, Wenlong Zheng, Baojian Hua, Qiliang Fan, and Zhizhong Pan.  Vmcanary: Effective memory protection for webassembly via virtual machine-assisted approach.  In _IEEE International Conference on Software Quality, Reliability and Security, QRS_ , page 662 – 671, 2023.  doi: 10.1109/QRS60937.2023.00070.  Cited by: 0.
  * Protzenko et al. [2019] Jonathan Protzenko, Benjamin Beurdouche, Denis Merigoux, and Karthikeyan Bhargavan.  Formally verified cryptographic web applications in webassembly.  In _Proceedings - IEEE Symposium on Security and Privacy_ , volume 2019-May, page 1256 – 1274, 2019.  doi: 10.1109/SP.2019.00064.  Cited by: 19; All Open Access, Bronze Open Access, Green Open Access.
  * Bosamiya et al. [2022] Jay Bosamiya, Wen Shih Lim, and Bryan Parno.  Provably-Safe multilingual software sandboxing using WebAssembly.  In _31st USENIX Security Symposium (USENIX Security 22)_ , pages 1975–1992, Boston, MA, August 2022. USENIX Association.  ISBN 978-1-939133-31-1.  URL https://www.usenix.org/conference/usenixsecurity22/presentation/bosamiya.
  * Narayan et al. [2023] Shravan Narayan, Tal Garfinkel, Mohammadkazem Taram, Joey Rudek, Daniel Moghimi, Evan Johnson, Chris Fallin, Anjo Vahldiek-Oberwagner, Michael Lemay, Ravi Sahita, Dean Tullsen, and Deian Stefan.  Going beyond the limits of sfi: Flexible and secure hardware-assisted in-process isolation with hfi.  In _International Conference on Architectural Support for Programming Languages and Operating Systems - ASPLOS_ , volume 3, page 266 – 281, 2023.  doi: 10.1145/3582016.3582023.  Cited by: 2; All Open Access, Bronze Open Access.
  * Yavarzadeh et al. [2023] Hosein Yavarzadeh, Mohammadkazem Taram, Shravan Narayan, Deian Stefan, and Dean Tullsen.  Half&half: Demystifying intel’s directional branch predictors for fast, secure partitioned execution.  In _2023 IEEE Symposium on Security and Privacy (SP)_ , pages 1220–1237, 2023.  doi: 10.1109/SP46215.2023.10179309.
  * Sun et al. [2019] Jian Sun, DingYuan Cao, XiMing Liu, ZiYi Zhao, WenWen Wang, XiaoLi Gong, and Jin Zhang.  Selwasm: A code protection mechanism for webassembly.  In _2019 IEEE Intl Conf on Parallel and Distributed Processing with Applications, Big Data and Cloud Computing, Sustainable Computing and Communications, Social Computing and Networking (ISPA/BDCloud/SocialCom/SustainCom)_ , pages 1099–1106, 2019.  doi: 10.1109/ISPA-BDCloud-SustainCom-SocialCom48970.2019.00157.
  * Brandl et al. [2023] Katharina Brandl, Sebastian Erdweg, Sven Keidel, and Nils Hansen.  Modular abstract definitional interpreters for webassembly.  In _Leibniz International Proceedings in Informatics, LIPIcs_ , volume 263, 2023.  doi: 10.4230/LIPIcs.ECOOP.2023.5.  Cited by: 0.
  * Pop et al. [2022] Vasile Adrian Bogdan Pop, Arto Niemi, Valentin Manea, Antti Rusanen, and Jan-Erik Ekberg.  Towards securely migratingwebassembly enclaves.  In _EuroSec 2022 - Proceedings of the 15th European Workshop on Systems Security_ , page 43 – 49, 2022.  doi: 10.1145/3517208.3523755.  Cited by: 0.
  * Freyler [2022] Robin Freyler.  Wasmi 0.14.0.  https://crates.io/crates/wasmi/0.14.0, 2022.
  * Watt [2018] Conrad Watt.  Mechanising and verifying the webassembly specification.  In _Proceedings of the 7th ACM SIGPLAN International Conference on Certified Programs and Proofs_ , CPP ’18. ACM, Jan 2018.  doi: 10.1145/3167082.  URL http://dx.doi.org/10.1145/3167082.
  * Paulson [1989] Lawrence C. Paulson.  The foundation of a generic theorem prover.  _Journal of Automated Reasoning_ , 5(3):363–397, 1989.  doi: 10.1007/BF00248324.  URL https://doi.org/10.1007/BF00248324.
  * Watt et al. [2023] Conrad Watt, Maja Trela, Peter Lammich, and Florian Märkl.  Wasmref-isabelle: A verified monadic interpreter and industrial fuzzing oracle for webassembly.  _Proc. ACM Program. Lang._ , 7(PLDI), jun 2023.  doi: 10.1145/3591224.  URL https://doi.org/10.1145/3591224.
  * Nipkow et al. [2002] Tobias Nipkow, Lawrence C Paulson, and Markus Wenzel.  _Isabelle/HOL: a proof assistant for higher-order logic_ , volume 2283\.  Springer Science & Business Media, 2002.
  * bytecodealliance [2016] bytecodealliance.  wasmtime.  https://github.com/bytecodealliance/wasmtime, 2016.  Online; 18-Apr-2024.
  * Johnson et al. [2021] Evan Johnson, David Thien, Yousef Alhessi, Shravan Narayan, Fraser Brown, Sorin Lerner, Tyler McMullen, Stefan Savage, and Deian Stefan.  Sfi safety for native-compiled wasm.  In _Network and Distributed Systems Security (NDSS) Symposium_ , 01 2021.  doi: 10.14722/ndss.2021.24078.
  * Wahbe et al. [1993] Robert Wahbe, Steven Lucco, Thomas E. Anderson, and Susan L. Graham.  Efficient software-based fault isolation.  _SIGOPS Oper. Syst. Rev._ , 27(5):203–216, dec 1993.  ISSN 0163-5980.  doi: 10.1145/173668.168635.  URL https://doi.org/10.1145/173668.168635.
  * Xia et al. [2024] Yifan Xia, Ping He, Xuhong Zhang, Peiyu Liu, Shouling Ji, and Wenhai Wang.  Static semantics reconstruction forÂ enhancing javascript-webassembly multilingual malware detection.  In Gene Tsudik, Mauro Conti, Kaitai Liang, and Georgios Smaragdakis, editors, _Computer Security – ESORICS 2023_ , pages 255–276, Cham, 2024\. Springer Nature Switzerland.  ISBN 978-3-031-51476-0.
  * Watt et al. [2021] Conrad Watt, Xiaojia Rao, Jean Pichon-Pharabod, Martin Bodin, and Philippa Gardner.  Two Mechanisations of WebAssembly 1.0.  In _FM 2021 - Formal Methods_ , pages 1–19, Beijing, China, November 2021.  URL https://hal.science/hal-03353748.
  * Schrammel et al. [2020] David Schrammel, Samuel Weiser, Stefan Steinegger, Martin Schwarzl, Michael Schwarz, Stefan Mangard, and Daniel Gruss.  Donky: Domain keys – efficient In-Process isolation for RISC-V and x86.  In _29th USENIX Security Symposium (USENIX Security 20)_ , pages 1677–1694. USENIX Association, August 2020.  ISBN 978-1-939133-17-5.  URL https://www.usenix.org/conference/usenixsecurity20/presentation/schrammel.
  * Vassena et al. [2021] Marco Vassena, Craig Disselkoen, Klaus von Gleissenthall, Sunjay Cauligi, Rami Gökhan Kıcı, Ranjit Jhala, Dean Tullsen, and Deian Stefan.  Automatically eliminating speculative leaks from cryptographic code with blade.  _Proc. ACM Program. Lang._ , 5(POPL), jan 2021.  doi: 10.1145/3434330.  URL https://doi.org/10.1145/3434330.
  * Alliance [2023] Bytecode Alliance.  Cranelift.  https://cranelift.dev/, 2023.  Online; 14-Mar-2024.
  * Song et al. [2023b] Suhyeon Song, Seonghwan Park, and Donghyun Kwon.  metasafer: A technique to detect heap metadata corruption in webassembly.  _IEEE Access_ , 11:124887–124898, 2023b.  doi: 10.1109/ACCESS.2023.3327817.
  * Quan et al. [2019] Lijin Quan, Lei Wu, and Haoyu Wang.  Evulhunter: Detecting fake transfer vulnerabilities for eosio’s smart contracts at webassembly-level, 2019.
  * Yang et al. [2020] Zhiqiang Yang, Han Liu, Yue Li, Huixuan Zheng, Lei Wang, and Bangdao Chen.  Seraph: Enabling cross-platform security analysis for evm and wasm smart contracts.  In _Proceedings - International Conference on Software Engineering_ , page 21 – 24, 2020.  doi: 10.1145/3377812.3382157.  Cited by: 8.
  * Li et al. [2022] Wenyuan Li, Jiahao He, Gansen Zhao, Jinji Yang, Shuangyin Li, Ruilin Lai, Ping Li, Hua Tang, Haoyu Luo, and Ziheng Zhou.  Eosioanalyzer: An effective static analysis vulnerability detection framework for eosio smart contracts.  In _Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022_ , page 746 – 756, 2022.  doi: 10.1109/COMPSAC54236.2022.00124.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85136912302&doi=10.1109%2fCOMPSAC54236.2022.00124&partnerID=40&md5=c8cea9fb73a0310db1da6e5acad1bb15.  Cited by: 1.
  * Brito et al. [2022] Tiago Brito, Pedro Lopes, Nuno Santos, and José Fragoso Santos.  Wasmati: An efficient static vulnerability scanner for webassembly.  _Computers and Security_ , 118, 2022.  doi: 10.1016/j.cose.2022.102745.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85130090453&doi=10.1016%2fj.cose.2022.102745&partnerID=40&md5=08c63bf48f2c9f9f3a4cc09bdccd7dbf.  Cited by: 7; All Open Access, Green Open Access, Hybrid Gold Open Access.
  * Tu et al. [2023] Caichang Tu, Wansen Wang, Kaiwen Shi, Yan Xiong, and Wenchao Huang.  Eosverif: An automated analyzer for eosio smart contracts.  In _Proceedings - 2023 9th International Conference on Big Data Computing and Communications, BigCom 2023_ , page 103 – 109, 2023.  doi: 10.1109/BIGCOM61073.2023.00022.  Cited by: 0.
  * Huang et al. [2021] Yuhe Huang, Bo Jiang, and W. K. Chan.  Eosfuzzer: Fuzzing eosio smart contracts for vulnerability detection.  In _Proceedings of the 12th Asia-Pacific Symposium on Internetware_ , Internetware ’20, page 99–109, New York, NY, USA, 2021. Association for Computing Machinery.  ISBN 9781450388191.  doi: 10.1145/3457913.3457920.  URL https://doi.org/10.1145/3457913.3457920.
  * Jiang et al. [2021] Bo Jiang, Yifei Chen, Dong Wang, Imran Ashraf, and W.K. Chan.  Wana: Symbolic execution of wasm bytecode for extensible smart contract vulnerability detection.  In _IEEE International Conference on Software Quality, Reliability and Security, QRS_ , volume 2021-December, page 926 – 937, 2021.  doi: 10.1109/QRS54544.2021.00102.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85129469733&doi=10.1109%2fQRS54544.2021.00102&partnerID=40&md5=d25d0afbf68b861118e0c1edf4173fb8.  Cited by: 9.
  * He et al. [2021] Ningyu He, Ruiyi Zhang, Haoyu Wang, Lei Wu, Xiapu Luo, Yao Guo, Ting Yu, and Xuxian Jiang.  Eosafe: Security analysis of eosio smart contracts.  In _Proceedings of the 30th USENIX Security Symposium_ , page 1271 – 1288, 2021.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85107913778&partnerID=40&md5=de85f126adfcdfe876acab07482d650d.  Cited by: 33.
  * Lehmann et al. [2021] Daniel Lehmann, Martin Toldam Torp, and Michael Pradel.  Fuzzm: Finding memory bugs through binary-only instrumentation and fuzzing of webassembly, 2021.
  * Marques et al. [2022] Filipe Marques, José Fragoso Santos, Nuno Santos, and Pedro Adão.  Concolic Execution for WebAssembly.  In Karim Ali and Jan Vitek, editors, _36th European Conference on Object-Oriented Programming (ECOOP 2022)_ , volume 222 of _Leibniz International Proceedings in Informatics (LIPIcs)_ , pages 11:1–11:29, Dagstuhl, Germany, 2022. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.  ISBN 978-3-95977-225-9.  doi: 10.4230/LIPIcs.ECOOP.2022.11.  URL https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2022.11.
  * Yang et al. [2022] Shuo Yang, Huizhong Li, and Zibin Zheng.  Wali: Control-flow-based analysis of wasm smart contracts.  _Communications in Computer and Information Science_ , 1679 CCIS:322 – 335, 2022.  doi: 10.1007/978-981-19-8043-5˙23.  Cited by: 0.
  * Khan et al. [2023] Arslan Khan, Muqi Zou, Kyungtae Kim, Dongyan Xu, Antonio Bianchi, and Dave Jing Tian.  Fuzzing sgx enclaves via host program mutations.  In _2023 IEEE 8th European Symposium on Security and Privacy (EuroS &P)_, pages 472–488, 2023.  doi: 10.1109/EuroSP57164.2023.00035.
  * Jin et al. [2023] Ling Jin, Yinzhi Cao, Yan Chen, Di Zhang, and Simone Campanoni.  Exgen: Cross-platform, automated exploit generation for smart contract vulnerabilities.  _IEEE Transactions on Dependable and Secure Computing_ , 20(1):650–664, 2023.  doi: 10.1109/TDSC.2022.3141396.
  * Haßler and Maier [2022] Keno Haßler and Dominik Maier.  Wafl: Binary-only webassembly fuzzing with fast snapshots.  In _Reversing and Offensive-Oriented Trends Symposium_ , ROOTS’21, page 23–30, New York, NY, USA, 2022. Association for Computing Machinery.  ISBN 9781450396028.  doi: 10.1145/3503921.3503924.  URL https://doi.org/10.1145/3503921.3503924.
  * Chen et al. [2022] Weimin Chen, Zihan Sun, Haoyu Wang, Xiapu Luo, Haipeng Cai, and Lei Wu.  Wasai: Uncovering vulnerabilities in wasm smart contracts.  In _ISSTA 2022 - Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis_ , page 703 – 715, 2022\.  doi: 10.1145/3533767.3534218.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85136829573&doi=10.1145%2f3533767.3534218&partnerID=40&md5=02d4bde4b4c9626e4927b48da5eb2bd1.  Cited by: 7; All Open Access, Bronze Open Access, Green Open Access.
  * Zhou and Chen [2023] Jianfei Zhou and Ting Chen.  Wasmod: Detecting vulnerabilities in wasm smart contracts.  _IET Blockchain_ , 3:n/a–n/a, 05 2023.  doi: 10.1049/blc2.12029.
  * Zhang et al. [2021b] Bing Zhang, Jingyue Li, Jiadong Ren, and Guoyan Huang.  Efficiency and effectiveness of web application vulnerability detection approaches: A review.  _ACM Comput. Surv._ , 54(9), oct 2021b.  ISSN 0360-0300.  doi: 10.1145/3474553.  URL https://doi.org/10.1145/3474553.
  * Abbadini et al. [2023] Marco Abbadini, Michele Beretta, Dario Facchinetti, Gianluca Oldani, Matthew Rossi, and Stefano Paraboschi.  Poster: Leveraging ebpf to enhance sandboxing of webassembly runtimes.  In _Proceedings of the ACM Conference on Computer and Communications Security_ , page 1028 – 1030, 2023.  doi: 10.1145/3579856.3592831.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85168163646&doi=10.1145%2f3579856.3592831&partnerID=40&md5=ad1d8a658837b684ca8bf5ab8e106c05.  Cited by: 2; All Open Access, Bronze Open Access.
  * Narayan et al. [2021a] Shravan Narayan, Craig Disselkoen, and Deian Stefan.  Tutorial: Sandboxing (unsafe) c code with rlbox.  In _2021 IEEE Secure Development Conference (SecDev)_ , pages 11–12, 2021a.  doi: 10.1109/SecDev51306.2021.00017.
  * Cabrera-Arteaga et al. [2024] Javier Cabrera-Arteaga, Nicholas Fitzgerald, Martin Monperrus, and Benoit Baudry.  Wasm-mutate: Fast and effective binary diversification for webassembly.  _Computers and Security_ , 139, 2024.  doi: 10.1016/j.cose.2024.103731.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85183204402&doi=10.1016%2fj.cose.2024.103731&partnerID=40&md5=787b8d0138d3d4b0c1366cd98c1584d8.  Cited by: 0; All Open Access, Green Open Access, Hybrid Gold Open Access.
  * Bhansali et al. [2022] Shrenik Bhansali, Ahmet Aris, Abbas Acar, Harun Oz, and A. Selcuk Uluagac.  A first look at code obfuscation for webassembly.  In _Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks_ , WiSec ’22, page 140–145, New York, NY, USA, 2022. Association for Computing Machinery.  ISBN 9781450392167.  doi: 10.1145/3507657.3528560.  URL https://doi.org/10.1145/3507657.3528560.
  * Zheng et al. [2023] Wenlong Zheng, Baojian Hua, and Zhuochen Jiang.  Wasmdypa: Effectively detecting webassembly bugs via dynamic program analysis.  In _Proceedings - 2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security Companion, QRS-C 2023_ , page 867 – 868, 2023.  doi: 10.1109/QRS-C60940.2023.00101.  URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85186746180&doi=10.1109%2fQRS-C60940.2023.00101&partnerID=40&md5=e5cdace21e5b6e08428c33ef754c9c16.
  * Fu et al. [2018] William Fu, Raymond Lin, and Daniel Inge.  Taintassembly: Taint-based information flow control tracking for webassembly, 2018.
  * Szanto et al. [2018] Aron Szanto, Timothy Tamm, and Artidoro Pagnoni.  Taint tracking for webassembly, 2018.
  * Hough and Bell [2021] Katherine Hough and Jonathan Bell.  A practical approach for dynamic taint tracking with control-flow relationships.  _ACM Transactions on Software Engineering and Methodology (TOSEM)_ , 31:1 – 43, 2021.  doi: 10.1145/3485464.
  * Stievenart et al. [2022] Quentin Stievenart, David W. Binkley, and Coen De Roover.  Static stack-preserving intra-procedural slicing of webassembly binaries.  In _2022 IEEE/ACM 44th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)_ , volume 2022-May, page 2031 – 2042, 2022.  doi: 10.1145/3510003.3510070.  Cited by: 12.
  * Stiévenart et al. [2023] Quentin Stiévenart, David Binkley, and Coen De Roover.  Dynamic slicing of webassembly binaries.  In _2023 IEEE International Conference on Software Maintenance and Evolution (ICSME)_ , pages 84–96, 2023.  doi: 10.1109/ICSME58846.2023.00020.
  * Watt et al. [2019b] Conrad Watt, Petar Maksimović, Neelakantan R. Krishnaswami, and Philippa Gardner.  A program logic for first-order encapsulated webassembly.  In _33rd European Conference on Object-Oriented Programming (ECOOP 2019)_. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2019b.  doi: 10.4230/LIPICS.ECOOP.2019.9.  URL https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2019.9.