The decentralized finance (DeFi) ecosystem experienced significant growth in 2024, accompanied by a rise in sophisticated cyberattacks. This article analyzes key security incidents, including the PenPie reentrancy attack, flash loan exploits on Radiant Capital and Goledo Finance, a social engineering breach at Concentric Finance, a multi-signature compromise on Orbit Chain, and phishing campaigns targeting Binance users. Detailed technical insights and countermeasures, such as reentrancy guards, decentralized oracles, and enhanced user authentication, highlight strategies for mitigating risks and strengthening DeFi security.
Protecting integrated circuits (ICs) from piracy and theft throughout their lifecycle is a persistent and complex challenge. In order to safeguard against illicit piracy attacks, this work proposes a novel framework utilizing Non-Fungible Tokens (NFTs) called ICtokens, uniquely linked to their corresponding physical ICs. Each ICtoken contains comprehensive information, including authentication data, supply chain stage and status, ownership details, and other IC metadata, while also making provision for the secure integration of a logic-locking key. Designed to be publicly logged, ICtokens securely obscure metering information without compromising functionality. In addition, the ICtracker, a distributed ledger technology powered by a swift and energy-efficient consortium blockchain, is used to register and manage ICtokens and their respective owners, tracking all associated interactions. This robust ledger guarantees the traceability and auditing of ICtokens while simultaneously developing a product-level NFT at every transaction point within the supply chain. Consequently, a scalable framework is established, creating unique, immutable digital twins for ICs and IC-embedded products in the form of ICtokens and their transactions. This provides a robust and reliable supply chain trail back to the original IP owner, while also offering unprecedented assurance to consumers of IC-embedded products. The rich information contained within ICtokens facilitates more detailed audits than previous proposals for IC supply chain monitoring. A proof-of-concept, implemented as an open-source solution, ensures the ease of adoption of the proposed framework.
WebAssembly (WASM) has emerged as a crucial technology in smart contract development for several blockchain platforms. Unfortunately, since their introduction, WASM smart contracts have been subject to several security incidents caused by contract vulnerabilities, resulting in substantial economic losses. However, existing tools for detecting WASM contract vulnerabilities have accuracy limitations, one of the main reasons being the coarse-grained emulation of the on-chain data APIs. In this article, we introduce WACANA, an analyzer for WASM contracts that accurately detects vulnerabilities through fine-grained emulation of on-chain data APIs. WACANA precisely simulates both the structure of on-chain data tables and their corresponding API functions, and integrates concrete and symbolic execution within a coverage-guided loop to balance accuracy and efficiency. Evaluations on a vulnerability dataset of 2,012 contracts show WACANA outperforming state-of-the-art tools in accuracy. Further validation on 5,602 real-world contracts confirms WACANA’s practical effectiveness.
Yibin Yang, David Heath, Carmit Hazay, Vladimir Kolesnikov · 5 authors
We explore Zero-Knowledge Proofs (ZKPs) of statements expressed as programs written in high-level languages, e.g., C or assembly. At the core of executing such programs in ZK is the repeated evaluation of a CPU step, achieved by branching over the CPU's instruction set. This approach is general and covers traversal-execution of a program's control flow graph (CFG): here CPU instructions are straight-line program fragments (of various sizes) associated with the CFG nodes. This highlights the usefulness of ZK CPUs with a large number of instructions of varying sizes.
The frequent security incidents of contracts indicate a pressing need to ensure contract security from deployment to running stages, but the state-of-the-art (SOTA) analysis methods cannot work well for three requirements.(i) Identify contract defective code snippets, while generating exploit call sequences to help developers fix them.(ii) Monitor abnormal call behaviors, especially for multiple continuous transactions.(iii) Validate numerous unexploitable detection results automatically because manual verification is labor-intensive.To tackle these problems, we propose SymX, a symbolic executionbased security analysis art accounting for contract development and running stages.The experiment results demonstrate that it can accurately identify 90.22% of contracts and 98.04% of call transactions, as well as validate misreports as intended, which is superior to SOTAs, thereby protecting contracts better during the contract lifecycle.Currently, SymX is available at https://github.com/Secbrain/SymX.
The preservation of the vaccine cold chain is crucial in order to ensure the proper preservation of vaccines throughout transport in a controlled environment. Maintaining the vaccine at suitable temperature and humidity levels during transportation will significantly significantly impacts vaccine effectiveness and quality. However, exposure to high temperature or improper conditions will result in vaccine degradation and public health concerns. Moreover, centralized real-time monitoring systems often suffer from issues related to integrity, transparency, availability, and single points of failure. This paper aims to transition data infrastructure from centralized to decentralized to enhance confidentiality, integrity, and availability (CIA). The proposed system, InoculLedger, employs IOTA and smart contracts to monitor and control environmental parameters, taking into account the vaccine's manufacturing process until the patient receives it. The system ensures transparency at every stage the vaccine undergoes and disseminates this information to all stakeholders, including the patient. The system utilizes IOTA for data infrastructure and employs smart contracts for data management. Additionally, the proposed system uses the Internet of Things (IoT) to monitor environmental parameters in real time.
The increasing connectivity and complexity of automotive systems require enhanced mechanisms for firmware updates to ensure security and integrity. Traditional methods are insufficient for modern vehicles that require seamless over-the-air (OTA) updates. Current OTA mechanisms often lack robust security measures, leaving vehicles vulnerable to attacks. This paper proposes an innovative approach based on the use of decentralized identifiers (DIDs) and distributed ledger technology (DLT) for secure OTA firmware updates of on-vehicle software. By utilizing DIDs for unique vehicle identification, as well as verifiable credentials (VCs) and verifiable presentations (VPs) for secure information exchange and verification, the solution ensures the integrity and authenticity of software updates. It also allows for the revocation of specific updates, if necessary, thereby improving overall security. The security analysis applied the STRIDE methodology, which enabled the identification of potential threats, including spoofing, tampering, and privilege escalation. The results showed that our solution effectively mitigates these threats, while a performance evaluation indicated low latency during operations.
Ahmad AA Alkhatib, Layla Albdor, Seraj Fayyad, Hussain Ali
The rapid expansion of Internet of Things (IoT) devices underscores the critical importance of robust security protocols, particularly in the realm of children's toys. This study introduces an innovative multi-factor authentication strategy integrating Quick Response (QR) codes with Blockchain technology to fortify the security of IoT toys designed for children. The primary objective is to safeguard young users against potential threats stemming from unauthorized access, thereby ensuring a secure interaction with IoT-enabled toys. By amalgamating authentication factors, including QR codes, the proposed approach establishes a multilayered security framework. Leveraging the inherent immutability and transparency of Blockchain, the system verifies the authenticity of IoT toys by scanning a unique QR code, thus mitigating risks associated with malwares and unauthorized access. The decentralization of Blockchain ensures no single point of failure, enhancing resilience against cyber threats. Extensive usability studies underscore the efficacy and practicality of the advanced multi-factor authentication solution, poised to elevate the safety standards of IoT toys in the digital age. This innovative approach not only bolsters security but also fosters trust among users, enabling seamless and worry-free interaction with IoT-enabled toys for children worldwide.
Hardware security is the root of trust in all modern ICT (Information and Communications Technology) systems. However, hardware security means something different for different communities. It has also a very wide scope. It covers efficient, secure implementations of new generations of cryptography such as light-weight crypto, post-quantum crypto as well as advanced schemes such as zero-knowledge proofs, fully homomorphic encryption, and computing on encrypted data in general [1][2]. Yet, implementations also must resist a wide variety of side-channel, fault, and micro-architectural attacks. Post-quantum algorithms might resist the attacks developed for quantum computers. Yet, they also have to be resistant to these attacks on classic platforms, see e.g. [3]. Security protocols rely on more than only cryptographic algorithms. They require analog and digital circuit techniques to design quality true random number generators, physically unclonable functions, secure key storage, and many more [4]. A recent report on "Revitalizing the U.S. Semiconductor Ecosystem" (from Executive Office of the President, President's Council of Advisors on Science and Technology, September 2022) [5] describes a set of recommendations on semiconductors and system security. In this presentation, we will demonstrate how our research addresses these recommendations and we will illustrate this with recent results and ongoing projects.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Mimouna Abdullah Alkhonaini, Manal Abdullah Alohali, Mohammed Aljebreen, Majdy M. Eltahir · 8 authors
Intrusion detection in the Internet of Things (IoTs) is a vital unit of IoT safety. IoT devices face diverse kinds of attacks, and intrusion detection systems (IDSs) play a significant role in detecting and responding to these threats. A typical IDS solution can be utilized from the IoT networks for monitoring traffic, device behaviour, and system logs for signs of intrusion or abnormal movement. Deep learning (DL) approaches are exposed to promise in enhancing the accuracy and effectiveness of IDS for IoT devices. Blockchain (BC) aided intrusion detection from IoT platforms provides many benefits, including better data integrity, transparency, and resistance to tampering. This paper projects a novel sandpiper optimizer with hybrid deep learning-based intrusion detection (SPOHDL-ID) from the BC-assisted IoT platform. The key contribution of the SPOHDL-ID model is to accomplish security via the intrusion detection and classification process from the IoT platform. In this case, the BC technology can be used for a secure data-sharing process. In the presented SPOHDL-ID technique, the selection of features from the network traffic data takes place using the SPO model. Besides, the SPOHDL-ID technique employs the HDL model for intrusion detection, which involves the design of a convolutional neural network with a stacked autoencoder (CNN-SAE) model. The beetle search optimizer algorithm (BSOA) method is used for the hyperparameter tuning procedure to increase the recognition outcomes of the CNN-SAE technique. An extensive simulation outcome is created to exhibit a better solution to the SPOHDL-ID method. The experimental validation of the SPOHDL-ID method portrayed a superior accuracy value of 99.59 % and 99.54 % over recent techniques under the ToN-IoT and CICIDS-2017 datasets.
Zheng Che, Meng Shen, Zhehui Tan, Hanbiao Du · 9 authors
With the rapid evolution of Web3.0, cryptocurrency has become a cornerstone of decentralized finance. While these digital assets enable efficient and borderless financial transactions, their pseudonymous nature has also attracted malicious activities such as money laundering, fraud, and other financial crimes. Effective detection of malicious transactions is crucial to maintaining the security and integrity of the Web 3.0 ecosystem. Existing malicious transaction detection methods rely on large amounts of labeled data and suffer from low generalization. Label-efficient and generalizable malicious transaction detection remains a challenging task. In this paper, we propose ShadowEyes, a novel malicious transaction detection method. Specifically, we first propose a generalized graph structure named TxGraph as a representation of malicious transaction, which captures the interaction features of each malicious account and its neighbors. Then we carefully design a data augmentation method tailored to simulate the evolution of malicious transactions to generate positive pairs. To alleviate account label scarcity, we further design a graph contrastive mechanism, which enables ShadowEyes to learn discriminative features effectively from unlabeled data, thereby enhancing its detection capabilities in real-world scenarios. We conduct extensive experiments using public datasets to evaluate the performance of ShadowEyes. The results demonstrate that it outperforms state-of-the-art (SOTA) methods in four typical scenarios. Specifically, in the zero-shot learning scenario, it can achieve an F1 score of 76.98% for identifying gambling transactions, surpassing the SOTA method by12.05%. In the scenario of across-platform malicious transaction detection, ShadowEyes maintains an F1 score of around 90%, which is 10% higher than the SOTA method.
The increasing pervasiveness of digital infrastructures, also extending into marine domains, makes Underwater Wireless Sensor Networks (UWSNs) an essential tool for the development of novel marine sustainability and monitoring paradigms. Applications in sensitive scenarios may require data encryption, non-repudiation, and provenance tracking. Moreover, the broadcast nature of the underwater acoustic channel makes the task of identifying and authenticating nodes of critical importance. To meet such requirements, we introduce AquaID, a protocol for resource-constrained hardware that leverages Distributed Ledger Technologies (DLTs) and Decentralised Identities. It guarantees confidentiality, authentication, and integrity using low bandwidth and CPU usage, while supporting high scalability and interoperability. We validate our solution in a threefold manner: via embedded board implementation, network simulation, and sea trials using commercially-available acoustic modems and underwater nodes. We also include a cost comparison among possible DLT choices. Results show AquaID to be robust to scaling, achieving low authentication delays and overhead, thus proving suitable even for large deployments.
A non-fungible token (NFT) is a kind of digital asset that signifies ownership or proof of authenticity of a special good or piece of material, such as artwork, music, films, or tweets. This study investigates how a deep convolutional generative adversarial network (DCGAN) can be used to create distinctive pictures of Cryptopunks that can be converted into NFTs. Cryptopunks, a pioneering form of NFTs, were introduced on the Ethereum blockchain in 2017 as part of a social experiment. In the NFT community, they have since grown in popularity as collectibles. To create brand-new, previously undiscovered characters, we trained a model on a dataset of existing Cryptopunks using the DCGAN architecture. In an effort to raise the calibre of the images produced, we tested various hyper settings and layer combinations. We also assessed the created images using a variety of criteria, such as the inception score and Fréchet inception distance, to make sure they were distinctive and of high calibre. Our experiments yielded a 15 % increase in the inception score and a 20 % decrease in the Fréchet inception distance, showing that our DCGAN model produces images that are more visually appealing and closer in quality to real Cryptopunks. These results highlight the effectiveness of our machine learning algorithms in improving the quality and uniqueness of NFT assets.
Background. A smart contract is a computer program enclosing the terms of a legal agreement between two or more parties which is automatically verified and executed via a computer network called blockchain. Once a smart contract transaction is completed the blockchain is updated and the transaction cannot be changed anymore. This implies that any error codified in the smart contract program cannot be rectified. Therefore, it is of vital importance that developers of smart contracts properly exploit error handling to prevent issues during and after the contract execution. Existing programming languages for smart contracts, support developers in this task by providing a set of Error Handling (EH) features. However, it is unclear the extent to which developers effectively use EH in practice. Aims. Our work aims to fill this gap by empirically investigating the state of practice on the adoption of EH features of one of the most popular programming languages for smart contracts, namely Solidity. Method. We empirically analyse the usage of EH features in 283K unique open-source Solidity smart contracts for the Ethereum blockchain. Results. Our analysis of the documentation of the different versions of Solidity coupled with the empirical evaluation of the EH uses and misuses found in real-word smart contracts, indicate that, among other things, Solidity EH features have been changing frequently across versions, and that the adoption of most of the Solidity EH features has been limited in practice. However, we observe an upward trend in the usage of the require EH feature, which is specifically designed for smart contract development. Conclusions. The insights from our study could help developers improve their EH practice as well as designers of smart contract programming languages to equip their language with appropriate EH features.
Ken Lew, Arijet Sarker, Simeon Wuthier, Jinoh Kim · 6 authors
Computing and networking are increasingly implemented in software. We design and build a software build assurance scheme detecting if there have been injections or modifications in the various steps in the software supply chain, including the source code, compiling, and distribution. Building on the reproducible build and software bill of materials (SBOM), our work is distinguished from previous research in assuring multiple software artifacts across the software supply chain. Reproducible build, in particular, enables our scheme, as our scheme requires the software materials/artifacts to be consistent across machines with the same operating system/specifications. Furthermore, we use blockchain to deliver the proof reference, which enables our scheme to be distributed so that the assurance beneficiary and verifier are the same, i.e., the node downloading the software verifies its own materials, artifacts, and outputs. Blockchain also significantly improves the assurance efficiency. We first describe and explain our scheme using abstraction and then implement our scheme to assure Ethereum as the target software to provide concrete proof-of-concept implementation, validation, and experimental analyses. Our scheme enables more significant performance gains than relying on a centralized server thanks to the use of blockchain (e.g., two to three orders of magnitude quicker in verification) and adds small overheads (e.g., generating and verifying proof have an overhead of approximately one second, which is two orders of magnitude smaller than the software download or build processes).
Cross-chain bridges, one of the foundational infrastructures of blockchain, provide the infrastructure and solutions for inter-operability, asset liquidity, data transfer, decentralized finance, and cross-chain governance between blockchain networks. However, because cross-chain bridges often have to handle communication and asset transfers between multiple blockchains, they involve complex protocols and technologies. This complexity increases the likelihood of vulnerabilities and potential attacks. In order to ensure the security and reliability of cross-chain bridges, this article launches a thorough investigation of existing cross-chain bridge projects, clarifying bridging mechanisms, bridge types, and security features. The following part goes into the subject of security and sheds light on the considerable challenges faced by cross-chain bridges. It conducts a thorough analysis of security flaws, covering problems like smart contract vulnerabilities, centralization risks, liquidity issues, and oracle manipulations. Furthermore, this study promotes a compendium of security solutions and best practises, pointing the way toward a cross-chain bridge scenario that is more secure.
Paul Hancock, Gert Jan van Hardeveld, Jarek Jakubcek, Babak Akhgar · 6 authors
Tracing cryptocurrency transactions is a far from trivial process. This likely explains the increasing utilisation by criminal networks for a significant amount of criminal activity, not just cybercrime, but any crime requiring monetary transfers [ 1 ]. It is, therefore, vitally important that adequate training exists and is readily available for both new and experienced investigators to ensure that they are familiar with the latest techniques, tools and trends. Traditional training methods can be costly and resource-intensive, requiring highly qualified trainers to give their time to conduct training sessions. To address this issue, a training resource, in the form of a serious game, has been created. The game aims at providing a platform to improve the skills and expertise of law enforcement officers whilst reducing the workload of experienced investigators. This article describes the collaborative design and development of the serious game Cryptopol in a partnership between Europol and CENTRIC, which is a multi-disciplinary and end-user focused Center of Excellence, located within Sheffield Hallam University. Cryptopol is the first cryptocurrency-tracing training game of its kind, used by over 1,500 people representing over 550 law enforcement agencies from across the world.
This article examines the application of blockchain technology as a solution for secure and transparent software update distribution. As cyber threats evolve, traditional centralized update mechanisms face increasing vulnerabilities to tampering and unauthorized modifications. We propose a blockchain-based framework that leverages distributed ledger technology to create an immutable, decentralized environment for software updates. Our article demonstrates how this approach can eliminate single points of failure, ensure update integrity through cryptographic signing and network-wide verification, and enhance transparency in the update process. We discuss the system architecture, including update creation, distribution, and verification mechanisms, and evaluate its integration with existing software ecosystems. While acknowledging challenges such as scalability and implementation costs, we argue that blockchain-based solutions significantly advance securing software distribution. Our findings suggest that this approach has the potential to become a standard practice in the industry, substantially improving trust and reliability in software update systems. This article contributes to the growing body of research on blockchain applications in cybersecurity and provides insights for future developments in secure software distribution methods.
Since funds or tokens in smart contracts are maintained through specific state variables, contract audit, an effective means for security assurance, particularly focuses on these variables and their related operations. However, the absence of publicly accessible source code for numerous contracts, with only bytecode exposed, hinders audit efforts. Recovering variables and their types from Solidity bytecode is thus a critical task in smart contract analysis and audit, yet this is a challenging task because the bytecode loses variable and type information, only with low-level data operated by stack manipulations and untyped memory/storage accesses. The state-of-the-art smart contract decompilers miss identifying many variables and incorrectly infer the types for many identified variables. To this end, we propose VarLifter , a lifter dedicated to the precise and efficient recovery of typed variables. VarLifter interprets every read or written field of a data region as at least one potential variable, and after discarding falsely identified variables, it progressively refines the variable types based on the variable behaviors in the form of operation sequences. We evaluate VarLifter on 34,832 real-world Solidity smart contracts. VarLifter attains a precision of 97.48% and a recall of 91.84% for typed variable recovery. Moreover, VarLifter finishes analyzing 77% of smart contracts in around 10 seconds per contract. If VarLifter is used to replace the variable recovery modules of the two state-of-the-art Solidity bytecode decompilers, 52.4%, and 74.6% more typed variables will be correctly recovered, respectively. The applications of VarLifter to contract decompilation, contract audit, and contract bytecode fuzzing illustrate that the recovered variable information improves many contract analysis tasks.
A niche corner of the Web3 world is increasingly making use of hardware-based Trusted Execution Environments (TEEs) to build decentralized infrastructure. One of the motivations to use TEEs is to go beyond the current performance limitations of cryptography-based alternatives such as zero-knowledge proofs (ZKP), fully homomorphic encryption (FHE), and multi-party computation (MPC). Despite their appealing advantages, current TEEs suffer from serious limitations as they are not secure against physical attacks, and their attestation mechanism is rooted in the chip manufacturer's trust. As a result, Web3 applications have to rely on cloud infrastruture to act as trusted guardians of hardware-based TEEs and have to accept to trust chip manufacturers. This work aims at exploring how we could potentially architect and implement chips that would be secure against physical attacks and would not require putting trust in chip manufacturers. One goal of this work is to motivate the Web3 movement to acknowledge and leverage the substantial amount of relevant hardware research that already exists. In brief, a combination of: (1) physical unclonable functions (PUFs) to secure the root-of-trust; (2) masking and redundancy techniques to secure computations; (3) open source hardware and imaging techniques to verify that a chip matches its expected design; can help move towards attesting that a given TEE can be trusted without the need to trust a cloud provider and a chip manufacturer.
• Study analyzes victim reports to understand cryptocurrency scam mechanics and prevention strategies. • Seven scam dimensions: techniques, tools, victim profiling, consequences, info harvesting, manipulation, and culture. • The “Crypto-Cognitive Exploitation Model” (CCEM) is to explain cryptocurrency scam dynamics. • Findings show cryptocurrency scams evolve, needing ongoing research and countermeasure adaptation. • Key recommendations focus on digital strategies and regulatory frameworks to prevent cryptocurrency scams. The rising prominence of cryptocurrency in global finance has unfortunately rendered it a prime target for scams, leading to significant financial losses. This study employs Cognitive Vulnerability Theory and the Social Engineering Approach to examine the dimensions, consequences, and prevention strategies of cryptocurrency scams. We analyzed data from the U.S. Department of Financial Protection and Innovation (DFPI), focusing on the dimensions of scams within the digital landscape and the efficacy of digital strategies and regulations in mitigating them. Our findings reveal seven critical dimensions of cryptocurrency scams and introduce the “Crypto-Cognitive Exploitation Model” (CCEM), which integrates theoretical insights with the unique aspects of these scams. Quantitative analysis indicates that fraudulent trading platform scams are the most prevalent, often intertwined with pig butchering scams, highlighting the complex, multifaceted nature of these fraudulent activities. We demonstrate the practical application of our recommendations, bridging theory and practice in scam mitigation. The study concludes with strategic recommendations for tailored digital approaches and enhanced regulatory mechanisms to combat evolving deceptive practices.
Yibin Xu, Tijs Slaats, Boris Düdder, Thomas Hildebrandt · 5 authors
Abstract Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed and evolved independently and cannot share a joint access control policy. This makes it challenging to ensure the correctness of access control properties and to maintain correctness when the contracts are adapted. We propose using dynamic condition response (DCR) graphs for role‐based and declarative access control for smart contracts and techniques for test‐driven modelling and refinement of DCR graphs to support the safe design and evolution of smart contracts. We show that they allow for capturing and visualizing a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports the straightforward declaration of access control rights, improved code auditing, test‐driven modelling, and safe evolution of smart contracts and improves users' understanding.