  Ethereum is a permissionless blockchain ecosystem that supports execution of
smart contracts, the key enablers of decentralized finance (DeFi) and
non-fungible tokens (NFT). However, the expressiveness of Ethereum smart
contracts is a double-edged sword: while it enables blockchain programmability,
it also introduces security vulnerabilities, i.e., the exploitable
discrepancies between expected and actual behaviors of the contract code. To
address these discrepancies and increase the vulnerability coverage, we propose
a new smart contract security testing approach called transaction
encapsulation. The core idea lies in the local execution of transactions on a
fully-synchronized yet isolated Ethereum node, which creates a preview of
outcomes of transaction sequences on the current state of blockchain. This
approach poses a critical technical challenge -- the well-known
time-of-check/time-of-use (TOCTOU) problem, i.e., the assurance that the final
transactions will exhibit the same execution paths as the encapsulated test
transactions. In this work, we determine the exact conditions for guaranteed
execution path replicability of the tested transactions, and implement a
transaction testing tool, TxT, which reveals the actual outcomes of Ethereum
transactions. To ensure the correctness of testing, TxT deterministically
verifies whether a given sequence of transactions ensues an identical execution
path on the current state of blockchain. We analyze over 1.3 billion Ethereum
transactions and determine that 96.5% of them can be verified by TxT. We
further show that TxT successfully reveals the suspicious behaviors associated
with 31 out of 37 vulnerabilities (83.8% coverage) in the smart contract
weakness classification (SWC) registry. In comparison, the vulnerability
coverage of all the existing defense approaches combined only reaches 40.5%.
