This registration documents the creation, structure, and validation workflow of SARMF-Bench, a minimal reproducible benchmark dataset for smart contract vulnerability analysis. SARMF-Bench consists of five intentionally engineered Solidity contracts representing canonical vulnerability classes: Reentrancy, Arithmetic Overflow Behavior, Access Control Weakness, Unchecked External Call, and Denial-of-Service Pattern. Each contract is paired with machine-readable static analysis outputs generated using Slither v0.11.5. The objective of this dataset is to provide a controlled experimental baseline for evaluating static analyzers, symbolic execution engines, fuzzers, and AI-assisted smart contract security tools. All artifacts were created in a controlled Linux environment and validated for reproducibility through consistent detector metadata (impact and confidence levels). No synthetic mutation frameworks or automated vulnerability generators were used. This registration serves as a timestamped, immutable research record documenting dataset structure, methodology, and reproducibility protocol.
The rapid growth of IoT devices has increased security risks, particularly in firmware updates and device authentication. Traditional approaches are vulnerable to attacks such as unauthorised access and data breaches. This study proposes a blockchain-based framework using smart contracts and a proof-of-authority (PoA) consensus mechanism to ensure secure firmware verification and decentralised authentication. The system leverages distributed ledger technology to enhance integrity, trust, and scalability in IoT environments. Experimental results demonstrate reduced latency, improved throughput, and strong resistance to common cyber threats, making the framework suitable for large-scale IoT deployments.
We present Processual Memory Architecture (PMA), a computational framework that unifies data storage and computation by representing all information as transformation functions rather than static state, rendering the traditional ontological distinction between them architecturally unnecessary. In PMA, storing information means encoding it as a mathematical transformation that produces the data when applied to a standardized canonical input; reading means applying the transformation; and computing means composing transformations. This inversion of the conventional von Neumann paradigm yields five emergent architectural properties—structural auditability, transparent reasoning, enforced constraints, tamper evidence, and reversibility—that collectively enable verifiable computation: systems that can mathematically verify the integrity and correctness of their own reasoning chains. We provide a complete mathematical specification of PMA over Galois fields GF(2k) with roundtrip exactness guarantees, constructive algorithms for both invertible and non-invertible encoding modes, and a reference permutation-based embodiment with explicit bit-level storage formats. We analyze thermodynamic properties under reversible logic implementation, demonstrating that PMA operations on adiabatic substrates can approach within 10× of the Landauer limit at the localnode level. We then present the integration architecture for PMA with artificial general intelligence (AGI) safety frameworks, showing how transformation-based reasoning enables safety constraints that are structural rather than advisory—creating systems where unsafe behavior is computationally undefined rather than merely prohibited. We discuss applications to financial auditing, medical AI verification, and autonomous systems governance, and compare PMA's approach to verifiable computation with existing paradigms including blockchain, zero-knowledge proofs, and mechanistic interpretability.
<b><i>Liquidity Exit Drain</i></b>, also referred to as a <b><i>Rug Stream</i></b>, describes a class of gradual capital extraction attacks in decentralized finance (DeFi) and stablecoin ecosystems. Unlike abrupt rug pulls or discrete exploit-based failures, Liquidity Exit Drains operate through prolonged, cumulative actions that remain within protocol-defined operational and governance boundaries. By exploiting trust persistence, governance opacity, and parameter flexibility, these attacks systematically siphon liquidity over extended time horizons while evading conventional audits and user detection. This paper formalizes <b><i>Liquidity Exit Drain</i></b> as a distinct economic attack class, examines its structural enablers and execution patterns, and outlines why existing security, audit, and monitoring frameworks frequently fail to detect it. The analysis highlights the need for longitudinal economic oversight and governance-aware risk assessment beyond static code correctness.
SARMF-Bench is a structured and reproducible benchmark dataset for smart contract vulnerability analysis. It consists of five minimal Solidity contracts representing canonical vulnerability classes: • Reentrancy • Arithmetic Overflow Behavior • Access Control Weakness • Unchecked External Call • Denial-of-Service Pattern Each contract is paired with machine-readable static analysis outputs generated using Slither v0.11.5. The dataset is designed to support controlled benchmarking experiments for: - Static analyzers - Symbolic execution engines - Fuzzers - AI-assisted smart contract security tools Related assets: GitHub repository: https://github.com/profmohit-edu/sarmf-framework Zenodo software DOI: https://doi.org/10.5281/zenodo.18754015 Reproducibility protocol: https://doi.org/10.17504/protocols.io.bp216eyxdgqe/v1 Mendeley dataset DOI (pending moderation): https://doi.org/10.17632/kd3vcpnn9v.1 HAL record: https://hal.science
Decentralized systems are increasingly required to operate across heterogeneous environments involving human presence, real-world assets, regulatory constraints, and adversarial network conditions. Traditional execution models, which assume static infrastructure, context-free computation, and pre-authorized identities, are insufficient for these emerging requirements. This paper introduces a Presence-Centric execution architecture that binds computational validity to verifiable environmental state at execution time. The proposed system is structured around two core components: the Crystal Validator, a context-aware validation layer, and an AI Feedback Loop, which enables adaptive policy enforcement based on observed outcomes. Central to this architecture is <b><i>Environment-Coupled Execution</i></b>, a model in which identity, intent, policy, and environment are jointly evaluated to determine execution validity. By treating environment as a first-class execution dependency, the system enables contextual non-repudiation, replay resistance, regulatory determinism, and post-execution auditability. The proposed approach is applicable to decentralized finance, stablecoins, real-world asset tokenization, governance systems, and presence-driven digital platforms.
<b><i>Governance Voter Loop Reuse</i></b> is a strategic exploit in decentralized finance (DeFi) governance systems whereby the same economic capital is repeatedly reused to exert voting influence across multiple proposals, epochs, or governance venues without maintaining sustained economic exposure. By exploiting snapshot-based voting, token mobility, and weak binding between voting power and duration of risk, attackers can artificially amplify governance influence while avoiding long-term commitment. This paper formalizes the exploit, analyzes its structural enablers and execution mechanisms, and evaluates its systemic impact on DAO legitimacy and protocol security. We further propose mitigation requirements centered on time-weighted exposure, continuity-aware governance models, and behavioral detection mechanisms.
<b><i>Bribe-Based Oracle Echoes</i></b> describe a class of incentive-layer attacks in which economically rational adversaries influence oracle participants to repeatedly reinforce distorted data outputs without directly compromising oracle infrastructure. Unlike overt oracle manipulation, these attacks exploit incentive alignment and tolerance-band logic to create feedback loops in which biased signals are echoed, amplified, and normalized across decentralized finance (DeFi) and stablecoin systems. This paper formalizes the threat model, identifies structural enablers, and demonstrates why decentralization alone is insufficient to prevent economically induced oracle drift.
Hyeonbum Lee, Seunghun Paik, Hyunjung Son, Jae Hong Seo
An inner product argument (IPA) is a cryptographic proof system that serves as a fundamental building block for various applications, such as zero knowledge proofs and verifiable computation. Bulletproofs (IEEE S&P 2018), a well-known IPA under the discrete logarithm (DL) assumption, features a short, logarithmically-sized proof, making it suitable for blockchain applications. However, its major drawback is the linear verifier cost (O(N)), which presents a significant bottleneck in settings like verifiable computation. To address this, recent advancements have successfully reduced the verification complexity to square-root order (O(√N)) under the same assumption (e.g., Asiacrypt 2022, IEEE TIFS). In thiswork, we propose Cougar, a novel IPAthat breaks this square-root barrier to achieve an unprecedented cubic-root verifier complexity (O(3√N)), while strictly maintaining the compact logarithmic proof size (O(logN)) characteristic of Bulletproofs. To achieve this, Cougar introduces a generalized two-tier commitment framework combined with adisjoint interpolationstrategy for efficient consistency checks. We implemented Cougar in Rust and performed a comprehensive benchmarking against Bulletproofs and Leopard (IEEE TIFS). Our evaluation demonstrates that while Cougar incurs a moderate increase in prover overhead, its verification time scales significantly better for large instances. Concretely, for a witness size ofN= 220, Cougar achieves a 50× verification speed-up over Bulletproofs and exhibits a superior asymptotic growth rate compared to existing sublinear IPAs.
Open access
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) have emerged as a critical technology for privacy-preserving computation and blockchain applications. However, systematic performance analysis of practical implementations remains limited, hindering informed technology adoption decisions. This study presents a comprehensive benchmarking analysis of the Groth16 protocol implementation using the widely-adopted Circom-snarkjs framework. We developed an automated benchmarking platform that systematically measures performance across seven representative circuit types with varying computational complexity (1-11 R1CS constraints). Our methodology ensures reproducible measurements through controlled experimental design with statistical validation. The platform captures detailed metrics for all three phases of the Groth16 protocol: witness generation, proof creation, and verification. Results from 35 independent measurements reveal several important findings. Witness generation demonstrates consistent performance across circuit types, averaging 57.6±12.1 milliseconds. Proof generation times range from 832 to 1,147 milliseconds, showing non-linear scaling with circuit complexity. Verification times remain relatively stable (741-884 milliseconds), confirming Groth16's theoretical constant-time verification advantage. All measurements achieved 100% success rate with complete proof validation. Notably, circuit structure significantly impacts performance beyond simple constraint counting. Comparison-based circuits achieve 13.22 constraints per second efficiency, substantially outperforming arithmetic circuits (1.02-4.36 constraints/second). This finding provides actionable guidance for circuit design optimization. The study contributes an open-source benchmarking framework for reproducible zk-SNARK research and provides empirical performance data for technology adoption decisions. Our findings support the practical deployment of Groth16 for applications requiring efficient zero-knowledge proofs while highlighting optimization opportunities for circuit designers.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
Abstract Many compilation stages of smart contracts on the Ethereum blockchain have been transitioned to the intermediate language . Tasks such as smart contract optimization and bytecode generation are—or will soon be—performed directly at the level in the compilers for the higher-level languages such as Solidity. In this paper, we develop a formal semantics of programs in Rocq, suitable for verification, which allows formal reasoning at the level of code or generation tools processing programs. Our semantics is expressive enough to be the basis for formal verification tools, and simple enough to make the development of such tools feasible. In order to prove its adequacy for verification, we develop in Rocq a checker (and associated soundness proofs), based on our semantics, able to verify the results of the liveness analysis stage of the official Solidity compiler , which opens the door towards formally verified Ethereum’s smart contracts compilation. Experiments on more than 1,500 smart contracts show that we are able to automatically verify ’s liveness analysis results in negligible time.
Seema C K, Sharan V Talwar, subhash Chandra K R Patel, S. E. R. Sacha Emile R.
The Internet of Things (IoT) presents critical security challenges including device identity spoofing, replay attacks, and data tampering across billions of deployed endpoints. This work presents ZK-IoTChain, a blockchain-enabled security framework that integrates zk-SNARK-based device authentication with Merkle-anchored data integrity in a unified architecture. The proposed system employs a three-layer design consisting of device-side proof generation, on-chain Groth16 verification, and IPFS-based off-chain storage. This architecture ensures privacy-preserving authentication while maintaining scalability and cost efficiency. Experimental evaluation on the Ethereum Sepolia testnet demonstrates a mean proof generation latency of 3.21 seconds and on-chain verification latency of approximately 125 milliseconds, with an average gas cost of 278,400 per authentication. The framework achieves a 99.98% reduction in storage cost compared to full on-chain approaches. Security analysis under the Dolev–Yao adversary model confirms effective mitigation of identity spoofing, replay attacks, data tampering, and man-in-the-middle (MITM) attacks. The results highlight ZK-IoTChain as a practical and efficient solution for secure, scalable, and privacy-preserving IoT ecosystems.
<b><i>Zero-knowledge proof (ZKP) systems</i></b> such as<b><i> zk-SNARKs</i></b> and<b><i> zk-STARKs</i></b> are increasingly promoted as comprehensive solutions for privacy, scalability, and selective disclosure in blockchain-based systems. While these cryptographic primitives provide strong guarantees regarding computational correctness and data confidentiality, they are frequently mischaracterized as substitutes for regulatory compliance, legal enforceability, or supervisory control mechanisms. This paper presents a structural and functional comparison between zero-knowledge proof systems and the Crystal Validator™ (CV), a logic-layer enforcement architecture designed to encode and enforce jurisdiction?aware regulatory requirements. We demonstrate that cryptographic validity proofs are orthogonal to—and insufficient for—legal compliance, accountability, and regulatory supervision as required under frameworks such as the EU Markets in Crypto-Assets Regulation (MiCA). We argue that regulatory enforcement logic must exist above cryptographic proof layers and cannot be replaced by them without introducing systemic compliance risk.
The integration of continuous Zero Trust Architecture (ZTA) into Segment Routing over IPv6 (SRv6) networks introduces severe performance bottlenecks and physical constraints of the Maximum Transmission Unit (MTU). Specifically, naively embedding massive Zero-Knowledge Proof (ZKP) for per-packet authentication inevitably triggers catastrophic fragmentation and disrupts stateless forwarding. To address these fundamental limitations, this paper proposes a novel session-bound zero-knowledge authorization framework tailored for SRv6 programmable data planes. Our architecture explicitly decouples heavyweight cryptographic validations from the active forwarding path. Massive ZKP payloads are processed asynchronously via payload transmission in the control plane, while the data plane enforces line-rate access control using lightweight 32-byte capability tokens encapsulated in customized SRv6 extension headers. Furthermore, to mathematically balance robust security with forwarding efficiency, we formulate the dynamic verification process as a risk-aware Partially Observable Markov Decision Process (POMDP). Using in-band network telemetry, we derive an Adaptive Threshold Verification (ATV) algorithm that yields a closed-form <inline-formula> <tex-math notation="LaTeX">$O(1)$ </tex-math></inline-formula> complexity optimal scheduling policy. Extensive evaluations demonstrate that the decoupled mechanism seamlessly resolves the MTU bottleneck, maintaining stable baseline throughput under massive concurrent sessions. Concurrently, the ATV algorithm intelligently adapts to real-time threat intensities, conserving control-plane resources during safe periods while instantaneously triggering precise re-verifications against covert and volumetric cyberattacks.
Michael Adjedj, Constantin Blokh, Geoffroy Couteau, Arik Galansky · 6 authors
We present a novel protocol for two-party ECDSA that achieves two rounds (a single back-and-forth communication) at the cost of a single oblivious linear function evaluation (OLE). In comparison, the previous work of Boneh, Haitner, Lindell, and Segev (EUROCRYPT 2025) achieves two rounds but requires expensive zero-knowledge proofs on top of the OLE. We demonstrate this by proving that in the generic group model, any adversary capable of generating forgeries for our protocol can be transformed into an adversary that finds preimages for the ECDSA message digest function (e.g., the SHA family). Interestingly, our analysis is closely related to, and has ramifications for, the ‘presignatures’ mode of operation—Canetti, Gennaro, Goldfeder, Makriyannis, and Peled (CCS 2020), Groth and Shoup (EUROCRYPT 2022).Motivated by applications to embedded cryptocurrency wallets, where a single server maintains distinct, shared public keys with separate clients (i.e., a star-shaped topology), and with the goal of minimizing communication, we instantiate our protocol using Paillier encryption and suitable zero-knowledge proofs. To reduce computational overhead, we thoroughly optimize all components of our protocol under sound cryptographic assumptions, specifically small-exponent variants of RSA-style assumptions.Finally, we implement our protocol and provide benchmarks. At the 128-bit security level, the signing phase requires approximately 50 ms of computation time on a standard linux machine, and 2 KB of bandwidth.
haojia hong, Duan Jia, Wei Ren, Xi Liu · 5 authors
Proxy contracts support logic upgradeability and deployment reuse in decentralized application (DApp). However, the use of proxy mechanisms also introduces new security risks. Although prior work has explored the security of proxy contracts, most prior approaches either depend on source code or fail to handle complex proxy storage layouts at the bytecode level, reducing their applicability to real-world closed-source contracts. In this paper, we propose ProxyLens, a bytecode-level vulnerability detection framework tailored for Ethereum proxy contracts. Without requiring source code, ProxyLens integrates storage structure modeling, proxy pattern recognition, and vulnerability detection. It features (1) a slot recovery mechanism based on symbolic execution and taint analysis for precise variable layout inference, (2) a proxy identification and delegate slot tracing module for accurate proxy architecture recognition, and (3) a semantic-driven vulnerability detection engine that works independently of function names. Experiments show that ProxyLens significantly outperforms existing tools in storage slot recovery (F1 = 96.4%), variable type inference (accuracy = 63.0%), proxy pattern recognition (accuracy > 90% across multiple patterns), and vulnerability detection (e.g., function selector collision F1 = 98.77%, storage collision F1 = 79.50%). As a supplementary contribution, we have publicly released the prototype of ProxyLens.
The Ethereum Virtual Machine (EVM) is a stack-based virtual processor that executes smart contract bytecode sequentially. While this design ensures determinism and correctness, it inherently limits instruction throughput. This paper presents a feasibility study of instruction-level pipelining within the EVM interpreter architecture. By analyzing the internal execution flow of the EVM as implemented in the Go-Ethereum (geth) client, the study identifies the program counter dependency, particularly under jump instructions, as the principal control hazard preventing naïve pipelining. A two-stage pipelined execution model is proposed, separating opcode fetch and decode from execution and program counter update, with a feedback mechanism to preserve EVM semantics. The work focuses on architectural feasibility rather than performance evaluation and optimization, demonstrating that pipelining inside the EVM interpreter is conceptually possible under controlled synchronization. Limitations, design challenges, and future research directions are discussed.
Proof-of-Stake (PoS) consensus protocols commonly employ epochs as temporal abstractions to simplify validator accounting, reward distribution, and slashing enforcement. These designs assume clean and synchronized state transitions across epoch boundaries. In practice, distributed systems exhibit asynchronous execution, delayed finality, and implementation divergence.This paper introduces and analyzes <b><i>Validator Epoch Reset Collisions</i></b>, a class of temporal desynchronization vulnerabilities in which validator state resets, reward counters, slashing windows, or participation flags become inconsistently applied across epoch boundaries. We demonstrate how such collisions create exploitable enforcement gaps that can be leveraged to evade penalties, duplicate rewards, or bypass participation requirements—without violating protocol rules. We argue that epoch-based accounting introduces structural risks to economic security unless continuity-enforcing safeguards are applied.
The growing frequency of malicious attacks on Internet of Things (IoT) devices has rendered conventional approaches with static label-dependent risk assessment models obsolete, especially when coping with unknown and continuo... | Find, read and cite all the research you need on Tech Science Press