Blockchain Papers

Follow blockchain research across journals, conferences, and preprint repositories.

1,010 papersLast indexed Aug 31, 2026
Search papers

Paper index

1,010 results · page 13 of 43

Clear filters
Nov 10, 2025·Anais Estendidos do XXXI Simpósio Brasileiro de Sistemas Multimídia e Web (WebMedia 2025)
0 cites
Repairing DeFi Vulnerabilities: Benchmarking LLMs with Executable Solidity Exploits

Lucas Bastos Germano, Júlio César Duarte

Decentralized finance protocols are frequently exploited, creating a demand for fast and reliable repair of vulnerable smart contracts and validation that reflects runtime security. Large language models are an emerging source of patches, yet many evaluations rely on manual checks or self-assessment, which cannot confirm whether attacker profit is actually prevented. We introduce an executable benchmark that replays verified real-world exploits against patched Solidity contracts under a resilient protocol that permits alternate attack paths and controlled state variation. Our framework compiles candidate patches, deploys them on a forked chain, and tests whether the exploit still yields profit. The benchmark covers six test cases drawn from reproducible incidents and is released as open-source. Among the nine evaluated models, GPT-5, GPT-4.1, and Claude Opus 4.1 performed the best, mitigating four of six test cases. Microsoft Phi-4 was the most reliable open-source model, mitigating two of six exploits and producing compilable patches for the remaining cases. No model mitigated the H2O case once resilient checks were enabled, while a simpler access control flaw, BTNFT, was often repaired with minimal edits. Grounding validation in executable exploit replay provides a precise and scalable method to measure whether proposed repairs harden contracts at runtime.

Open access
Security and Verification in Computing
Advanced Malware Detection Techniques
Web Application Security Vulnerabilities
Original source
Nov 8, 2025·Applied Sciences
0 cites
MiS-PoW: Mirror-Selected Non-Interactive Proof of Ownership for Cloud Storage

Tang Zhou, Le Wang, Minxian Liang, Minhao Li

Cloud storage uses proofs of ownership to avoid redundant uploads while keeping file contents secret. Many existing schemes need extra round trips, or rely on predictable sampling. These choices reduce security when an adversary knows part of the file. We present MiS-PoW, a zero knowledge and non-interactive proof of ownership. The protocol derives a synchronized challenge seed from the existing HTTPS/TLS session. The seed binds a discretized time window and the file identifier. Both parties compute the same challenges locally, and the protocol adds no new messages. MiS-PoW samples blocks with a stratified policy without duplicates. The policy enforces coverage across partitions and reduces the advantage of contiguous knowledge and near duplicate files. The proof layer uses STARKs with simple AIR constraints. The constraints check that indices come from the seed, lie in range, are unique, and meet per partition counts. We analyze security and show seed unpredictability, resistance to replay, and bounds under partial knowledge with limited grinding. A prototype shows that verification time does not grow with file size, and proof and bandwidth costs remain modest. MiS-PoW is deployable, privacy preserving, and scalable for cloud storage.

Open access
Cloud Data Security Solutions
Advanced Data Storage Technologies
Security and Verification in Computing
Original source
Nov 4, 2025·Open MIND
0 cites
PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts

Vivi Andersson, Sofia Bobadilla, Harald Hobbelhagen, Martin Monperrus

Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce PoCo, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. PoCo autonomously generates PoC exploits in an agentic manner by interacting with a set of code-execution tools in a Reason–Act–Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate PoCo on a dataset of 23 real-world vulnerability reports. PoCo consistently outperforms the Zero-shot and Workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides actionable knowledge for the smart contract security community.

Open access
4 source records
cs.CR
cs.AI
cs.SE
Original source
Oct 30, 2025·arXiv (Cornell University)
0 cites
An Introductory Study on the Power Consumption Overhead of ERC-4337 Bundlers

Andrei Arusoaie, Claudiu-Nicu Bărbieru, Oana-Otilia Captarencu, Paul-Flavian Diac · 6 authors

Ethereum is currently the main blockchain ecosystem providing decentralised trust guarantees for applications ranging from finance to e-government. A common criticism of blockchain networks has been their energy consumption and operational costs. The switch from Proof-of-Work (PoW) protocol to Proof-of-Stake (PoS) protocol has significantly reduced this issue, though concerns remain, especially with network expansions via additional layers. The ERC-4337 standard is a recent proposal that facilitates end-user access to Ethereum-backed applications. It introduces a middleware called a bundler, operated as a third-party service, where part of its operational cost is represented by its power consumption. While bundlers have served over 500 million requests in the past two years, fewer than 15 official bundler providers exist, compared to over 100 regular Ethereum access providers. In this paper, we provide a first look at the active power consumption overhead that a bundler would add to an Ethereum access service. Using SmartWatts, a monitoring system leveraging Running Average Power Limit (RAPL) hardware interfaces, we empirically determine correlations between the bundler workload and its active power consumption.

Open access
3 source records
Blockchain Technology Applications and Security
Cloud Computing and Resource Management
Security and Verification in Computing
Original source
Oct 24, 2025·arXiv (Cornell University)
0 cites
LLM-Powered Detection of Price Manipulation in DeFi

Li Liu, Wuqi Zhang, Lili Wei, Hao Guan · 7 authors

Decentralized Finance (DeFi) smart contracts manage billions of dollars, making them a prime target for exploits. Price manipulation vulnerabilities, often via flash loans, are a devastating class of attacks causing significant financial losses. Existing detection methods are limited. Reactive approaches analyze attacks only after they occur, while proactive static analysis tools rely on rigid, predefined heuristics, limiting adaptability. Both depend on known attack patterns, failing to identify novel variants or comprehend complex economic logic. We propose PMDetector, a hybrid framework combining static analysis with Large Language Model (LLM)-based reasoning to proactively detect price manipulation vulnerabilities. Our approach uses a formal attack model and a three-stage pipeline. First, static taint analysis identifies potentially vulnerable code paths. Second, a two-stage LLM process filters paths by analyzing defenses and then simulates attacks to evaluate exploitability. Finally, a static analysis checker validates LLM results, retaining only high-risk paths and generating comprehensive vulnerability reports. To evaluate its effectiveness, we built a dataset of 73 real-world vulnerable and 288 benign DeFi protocols. Results show PMDetector achieves 88% precision and 90% recall with Gemini 2.5-flash, significantly outperforming state-of-the-art static analysis and LLM-based approaches. Auditing a vulnerability with PMDetector costs just $0.03 and takes 4.0 seconds with GPT-4.1, offering an efficient and cost-effective alternative to manual audits.

Open access
2 source records
cs.CR
cs.SE
Blockchain Technology Applications and Security
Original source
Oct 23, 2025·arXiv (Cornell University)
0 cites
Zero-Knowledge Extensions on Solana: A Theory of ZK Architecture

Jotaro Yano

This paper reconstructs zero-knowledge extensions on Solana as an architecture theory. Drawing on the existing ecosystem and on the author's prior papers and implementations as reference material, we propose a two-axis model that normalizes zero-knowledge (ZK) use by purpose (scalability vs. privacy) and by placement (on-chain vs. off-chain). On this grid we define five layer-crossing invariants: origin authenticity, replay-safety, finality alignment, parameter binding, and private consumption, which serve as a common vocabulary for reasoning about correctness across modules and chains. The framework covers the Solana Foundation's three pillars (ZK Compression, Confidential Transfer, light clients/bridges) together with surrounding components (Light Protocol/Helius, Succinct SP1, RISC Zero, Wormhole, Tinydancer, Arcium). From the theory we derive two design abstractions - Proof-Carrying Message (PCM) and a Verifier Router Interface - and a cross-chain counterpart, Proof-Carrying Interchain Message (PCIM), indicating concrete avenues for extending the three pillars.

Open access
2 source records
Security and Verification in Computing
Cryptography and Data Security
Blockchain Technology Applications and Security
Original source
Oct 23, 2025·Scientific Reports
2 cites
Quantum-resilient and adaptive multi-region data aggregation for IoMT using zero-knowledge proofs and edge intelligence

Soufiane Ben Othman, Gyanendra Kumar

The Internet of Medical Things (IoMT) transforms healthcare by enabling real-time monitoring of patient vitals, such as heart rate and glucose levels, but faces significant challenges in securing sensitive data against cyber threats and ensuring reliability in resource-constrained wearable devices, like low-power biosensors with limited computational capacity. The rise of quantum computing, particularly Shor algorithm, threatens to break traditional cryptographic methods (e.g., RSA, ECC) within 5–10 years by efficiently solving their underlying mathematical problems, endangering patient data confidentiality. Post-quantum cryptography (PQC), such as lattice-based schemes, offers resilience but demands high computational resources, challenging IoMT scalability. Unlike other PQC IoMT frameworks, such as those using NTRU, which prioritize computational simplicity but lack advanced privacy mechanisms, Q-PRADAX pioneers a secure, adaptive data aggregation framework, integrating Ring-LWE-based PQC for quantum-resilient confidentiality, compact zk-SNARK proofs for tamper-proof verification of patient vitals, and adaptive clustering for enhanced network reliability and scalability. Evaluated using OMNeT + + 6.0.3 with INET 4.5, Q-PRADAX achieves 94.5% diagnostic accuracy on ECG datasets, 100% tampering detection, and 99.9% packet delivery across 1000 devices in its Baseline scenario, with a security latency of 12.2 ms/packet and energy consumption of 0.38 mJ/packet on ARM Cortex-M4 devices (200 mAh). Outperforming existing IoMT solutions in security and fault tolerance, Q-PRADAX establishes a global standard for a secure, patient-centric IoMT ecosystem, redefining reliable healthcare delivery.

Open access
Cryptography and Data Security
Cloud Data Security Solutions
Security and Verification in Computing
Original source
Oct 22, 2025·arXiv (Cornell University)
0 cites
Trace: Securing Smart Contract Repository Against Access Control Vulnerability

Chong Chen, Jiachi Chen, Lingfeng Bao, David F. Lo · 10 authors

Smart contract vulnerabilities, particularly improper Access Control that allows unauthorized execution of restricted functions, have caused billions of dollars in losses. GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files-these serve as intermediate development artifacts that must be compiled and packaged before deployment. Third-party developers often reference, reuse, or fork code from these repositories during custom development. However, if the referenced code contains vulnerabilities, it can introduce significant security risks. Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories, as they typically require the target contract to be compilable to generate an abstract representation for further analysis. This paper presents TRACE, a tool designed to secure non-compilable smart contract repositories against access control vulnerabilities. TRACE employs LLMs to locate sensitive functions involving critical operations (e.g., transfer) within the contract and subsequently completes function snippets into a fully compilable contract. TRACE constructs a function call graph from the abstract syntax tree (AST) of the completed contract. It uses the control flow graph (CFG) of each function as node information. The nodes of the sensitive functions are then analyzed to detect Access Control vulnerabilities. Experimental results demonstrate that TRACE outperforms state-of-the-art tools on an open-sourced CVE dataset, detecting 14 out of 15 CVEs. In addition, it achieves 89.2% precision on 5,000 recent on-chain contracts, far exceeding the best existing tool at 76.9%. On 83 real-world repositories, TRACE achieves 87.0% precision, significantly surpassing DeepSeek-R1's 14.3%.

Open access
3 source records
cs.SE
Web Application Security Vulnerabilities
Access Control and Trust
Original source
Oct 21, 2025·arXiv (Cornell University)
1 cites
TaintSentinel: Path-Level Randomness Vulnerability Detection for Ethereum Smart Contracts

Hadis Rezaei, Ahmed Afif Monrat, Karl Andersson, Francesco Palmieri

The deterministic nature of blockchain technology creates fundamental difficulties in producing secure random numbers within smart contracts, a limitation that exposes vulnerabilities in applications such as decentralized finance (DeFi) protocols and blockchain-based gaming platforms. From our observations, the current state-of-the-art detection tools suffer from inadequate precision while dealing with random number vulnerabilities. To address this problem, we propose TaintSentinel, a novel path-sensitive vulnerability detection system designed to analyze smart contracts at the execution path level and gradually analyze taint with domain-specific rules. This paper discusses a solution that incorporates a multifaceted approach, integrating rule-based taint analysis to track data flow, a dual-stream neural network to identify complex vulnerability signatures, and evidence-based parameter initialization to minimize false positives. The two-phase operation of the system involves the construction of semantic graphs and the analysis of taint propagation, followed by pattern recognition using PathGNN and global structural analysis via GlobalGCN. Our experiments on 4,844 contracts demonstrate the superior performance of TaintSentinel relative to existing tools, yielding an F1-score of 0.892, an AUC-ROC of 0.94, and a PRA accuracy of 97%.

Open access
3 source records
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Security and Verification in Computing
Original source
Oct 20, 2025·Herald of Khmelnytskyi National University Technical sciences
1 cites
ВПОРЯДКУВАННЯ ТРАНЗАКЦІЙ ЗА ЛОГІЧНИМИ ЧАСОВИМИ МІТКАМИ ЛАМПОРТА ЯК ЗАСІБ ЗМЕНШЕННЯ MEV-ЕКСТРАКЦІЇ У СМАРТ-КОНТРАКТАХ ETHEREUM

Назарій Ігорович Черкас, Анатолій Євгенович Батюк

The increasing prevalence of Maximal Extractable Value (MEV) in blockchain networks has highlighted critical challenges in achieving fair and predictable transaction ordering. On Ethereum, where block builders possess unrestricted control over transaction sequencing, users face significant risks from frontrunning and sandwich attacks, particularly within decentralized finance (DeFi) applications interacting with shared contract states. To address this issue, this paper proposes a hybrid MEV mitigation method employing Lamport-style logical clocks, designed to establish a local causal ordering mechanism within individual smart contracts. The proposed approach equips each smart contract, such as a decentralized exchange liquidity pool, with a local logical timestamp counter. Transactions submitted to the contract carry logical timestamps, enabling the enforcement of a causally consistent execution order. A key benefit of this method is that it does not necessitate alterations to Ethereum’s global consensus mechanism, thus ensuring compatibility with the current Ethereum ecosystem, as well as rollups and modular app-chain architectures. The study details the protocol design, explores various implementation strategies for both on-chain and off-chain execution environments, and addresses resilience against adversarial attempts such as timestamp manipulation and denial-of-service attacks. The primary advantage of this approach lies in its effectiveness in mitigating intra-contract MEV extraction by strictly controlling transaction reordering for conflicting state interactions, while preserving concurrency for non-conflicting transactions. Findings indicate that the use of local Lamport clocks provides a practical, low-overhead solution for MEV-sensitive applications, including decentralized exchanges and rollup sequencing systems.

Open access
Blockchain Technology Applications and Security
Distributed systems and fault tolerance
Security and Verification in Computing
Original source
Oct 16, 2025·Darpan International Research Analysis
0 cites
Cross-Chain Asset Transfer Using Secure State Snapshots and Optimistic Verification

Priyanka Shastri, Alaric V. Koenig

Cross-chain interoperability is essential for the next generation of decentralized finance applications, yet existing bridges suffer from security weaknesses, high latency, and fragmented trust models. This paper introduces SnapBridge, a protocol that transfers assets across heterogeneous blockchains using cryptographic state snapshots combined with optimistic verification. A snapshot aggregator collects Merkleized proofs of account states and transaction histories from the source chain. Instead of verifying all proofs on-chain, SnapBridge relies on optimistic execution: transfers proceed immediately but can be challenged within a fraud-proof window. Fraud detection is performed by light clients using succinct verification rules. We implement SnapBridge across Ethereum, Polygon, and Avalanche testnets and benchmark transfer throughput, failure handling, and gas consumption. Results show up to 3× improvement in transfer latency and a 40% reduction in on-chain verification cost compared to multisig-based bridges. The paper evaluates adversarial scenarios such as corrupted aggregators, delayed snapshots, and chain reorgs. SnapBridge provides a modular, safer alternative for cross-chain liquidity flows.

Open access
Blockchain Technology Applications and Security
Security and Verification in Computing
Cloud Data Security Solutions
Original source
Oct 16, 2025·arXiv (Cornell University)
0 cites
Certifying optimal MEV strategies with Lean

Massimo Bartoletti, Riccardo Marchesin, Roberto Zunino

Maximal Extractable Value (MEV) refers to a class of attacks to decentralized applications where the adversary profits by manipulating the ordering, inclusion, or exclusion of transactions in a blockchain. Decentralized Finance (DeFi) protocols are a primary target of these attacks, as their logic depends critically on transaction sequencing. To date, MEV attacks have already extracted billions of dollars in value, underscoring their systemic impact on blockchain security. Verifying the absence of MEV attacks requires determining suitable upper bounds, i.e. proving that no adversarial strategy can extract more value (if any) than expected by protocol designers. This problem is notoriously difficult: the space of adversarial strategies is extremely vast, making empirical studies and pen-and-paper reasoning insufficiently rigorous. In this paper, we present the first mechanized formalization of MEV in the Lean theorem prover. We introduce a methodology to construct machine-checked proofs of MEV bounds, providing correctness guarantees beyond what is possible with existing techniques. To demonstrate the generality of our approach, we model and analyse the MEV of two paradigmatic DeFi protocols. Notably, we develop the first machine-checked proof of the optimality of sandwich attacks in Automated Market Makers, a fundamental DeFi primitive.

Open access
2 source records
cs.CR
cs.SE
Blockchain Technology Applications and Security
Original source
Oct 14, 2025·arXiv
1 cites
Prompt Engineering vs. Fine-Tuning for LLM-Based Vulnerability Detection in Solana and Algorand Smart Contracts

Biagio Boi, Christian Esposito

Smart contracts have emerged as key components within decentralized environments, enabling the automation of transactions through self-executing programs. While these innovations offer significant advantages, they also present potential drawbacks if the smart contract code is not carefully designed and implemented. This paper investigates the capability of large language models (LLMs) to detect OWASP-inspired vulnerabilities in smart contracts beyond the Ethereum Virtual Machine (EVM) ecosystem, focusing specifically on Solana and Algorand. Given the lack of labeled datasets for non-EVM platforms, we design a synthetic dataset of annotated smart contract snippets in Rust (for Solana) and PyTeal (for Algorand), structured around a vulnerability taxonomy derived from OWASP. We evaluate LLMs under three configurations: prompt engineering, fine-tuning, and a hybrid of both, comparing their performance on different vulnerability categories. Experimental results show that prompt engineering achieves general robustness, while fine-tuning improves precision and recall on less semantically rich languages such as TEAL. Additionally, we analyze how the architectural differences of Solana and Algorand influence the manifestation and detectability of vulnerabilities, offering platform-specific mappings that highlight limitations in existing security tooling. Our findings suggest that LLM-based approaches are viable for static vulnerability detection in smart contracts, provided domain-specific data and categorization are integrated into training pipelines.

Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Original source
Oct 13, 2025·arXiv
1 cites
Cross-Chain Sealed-Bid Auctions Using Confidential Compute Blockchains

Jonas Gebele, Timm Mutzel, Burak Oez, Florian Matthes

Sealed-bid auctions ensure fair competition and efficient allocation but are often deployed on centralized infrastructure, enabling opaque manipulation. Public blockchains eliminate central control, yet their inherent transparency conflicts with the confidentiality required for sealed bidding. Prior attempts struggle to reconcile privacy, verifiability, and scalability without relying on trusted intermediaries, multi-round protocols, or expensive cryptography. We present a sealed-bid auction protocol that executes sensitive bidding logic on a Trusted Execution Environment (TEE)-backed confidential compute blockchain while retaining settlement and enforcement on a public chain. Bidders commit funds to enclave-generated escrow addresses, ensuring confidentiality and binding commitments. After the deadline, any party can trigger resolution: the confidential blockchain determines the winner through verifiable off-chain computation and issues signed settlement transactions for execution on the public chain. Our design provides security, privacy, and scalability without trusted third parties or protocol modifications. We implement it on SUAVE with Ethereum settlement, evaluate its scalability and trust assumptions, and demonstrate deployment with minimal integration on existing infrastructure.

Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Cryptography and Data Security
Original source
Oct 12, 2025·Spiral (Imperial College London)
0 cites
Toxic Ink on Immutable Paper: Content Moderation for Ethereum Input Data Messages (IDMs)

Xihan Xiong, Zhipeng Wang, Qin Wang, William Knottenbelt

Decentralized communication is becoming an important use case within Web3. On Ethereum, users can repurpose the transaction input data field to embed natural-language messages, commonly known as Input Data Messages (IDMs). However, as IDMs gain wider adoption, there has been a growing volume of toxic content on-chain. This trend is concerning, as Ethereum provides no protocol-level support for content moderation. We propose two moderation frameworks for Ethereum IDMs: (i) BUILDERMOD, where builders perform semantic checks during block construction; and (ii) USERMOD, where users proactively obtain moderation proofs from external classifiers and embed them in transactions. Our evaluation reveals that BUILDERMOD incurs high block-time overhead, which limits its practicality. In contrast, USERMOD enables lower-latency validation and scales more effectively, making it a more practical approach in moderation-aware Ethereum environments. Our study lays the groundwork for protocol-level content governance in decentralized systems, and we hope it contributes to the development of a decentralized communication environment that is safe, trustworthy, and socially responsible.

Open access
3 source records
Security and Verification in Computing
Web Application Security Vulnerabilities
Spam and Phishing Detection
Original source
Oct 9, 2025·Proceedings of the 18th ACM SIGPLAN International Haskell Symposium
1 cites
Plinth: A Plugin-Powered Language Built on Haskell (Experience Report)

Ziyang Liu, Kenneth MacKenzie, Roman Kireev, Michael Peyton Jones · 6 authors

The Cardano blockchain is the first to use proof of stake, offers native support for multiple currencies and is evolving toward a distributed governance model. It supports smart contracts through Plutus, a language based on System Fω with recursion. About half a dozen languages compile into Plutus, the first of which is Plinth (formerly Plutus Tx) — a language that reuses a subset of the Haskell syntax, and has been in commercial use since 2021.

Open access
Advanced Malware Detection Techniques
Logic, programming, and type systems
Security and Verification in Computing
Original source
Oct 9, 2025·Proceedings of the ACM on Programming Languages
0 cites
Tabby: A Synthesis-Aided Compiler for High-Performance Zero-Knowledge Proof Circuits

Junrui Liu, Jiaxin Song, Yanning Chen, Hanzhi Liu · 8 authors

Zero-knowledge proof (ZKP) applications require translating high-level programs into arithmetic circuits–a process that demands both correctness and efficiency. While recent DSLs improve usability, they often yield suboptimal circuits, and hand-optimized implementations remain difficult to construct and verify. We present Tabby, a synthesis-aided compiler that automates the generation of high-performance ZK circuits from highlevel code. Tabby introduces a domain-specific intermediate representation designed for symbolic reasoning and applies sketch-based program synthesis to derive optimized low-level implementations. By decomposing programs into reusable components and verifying semantic equivalence via SMT-based reasoning, Tabby ensures correctness while achieving substantial performance improvements. We evaluate Tabby on a suite of real-world ZKP applications and demonstrate significant reductions in proof generation time and circuit size against mainstream ZK compilers.

Open access
Cryptography and Data Security
Security and Verification in Computing
Cryptographic Implementations and Security
Original source
Oct 7, 2025·arXiv (Cornell University)
2 cites
Privacy-Preserving On-chain Permissioning for KYC-Compliant Decentralized Applications

Piper, Fabian, Karl H. Wolf, Jonathan Heiss

Decentralized applications (dApps) in Decentralized Finance (DeFi) face a fundamental tension between regulatory compliance requirements like Know Your Customer (KYC) and maintaining decentralization and privacy. Existing permissioned DeFi solutions often fail to adequately protect private attributes of dApp users and introduce implicit trust assumptions, undermining the blockchain's decentralization. Addressing these limitations, this paper presents a novel synthesis of Self-Sovereign Identity (SSI), Zero-Knowledge Proofs (ZKPs), and Attribute-Based Access Control to enable privacy-preserving on-chain permissioning based on decentralized policy decisions. We provide a comprehensive framework for permissioned dApps that aligns decentralized trust, privacy, and transparency, harmonizing blockchain principles with regulatory compliance. Our framework supports multiple proof types (equality, range, membership, and time-dependent) with efficient proof generation through a commit-and-prove scheme that moves credential authenticity verification outside the ZKP circuit. Experimental evaluation of our KYC-compliant DeFi implementation shows considerable performance improvement for different proof types compared to baseline approaches. We advance the state-of-the-art through a holistic approach, flexible proof mechanisms addressing diverse real-world requirements, and optimized proof generation enabling practical deployment.

Open access
3 source records
Blockchain Technology Applications and Security
Cryptography and Data Security
Access Control and Trust
Original source
Oct 6, 2025·arXiv (Cornell University)
0 cites
Safe and Compliant Cross-Market Trade Execution via Constrained RL and Zero-Knowledge Audits

Ailiya Borjigin, Cong He

We present a cross-market algorithmic trading system that balances execution quality with rigorous compliance enforcement. The architecture comprises a high-level planner, a reinforcement learning execution agent, and an independent compliance agent. We formulate trade execution as a constrained Markov decision process with hard constraints on participation limits, price bands, and self-trading avoidance. The execution agent is trained with proximal policy optimization, while a runtime action-shield projects any unsafe action into a feasible set. To support auditability without exposing proprietary signals, we add a zero-knowledge compliance audit layer that produces cryptographic proofs that all actions satisfied the constraints. We evaluate in a multi-venue, ABIDES-based simulator and compare against standard baselines (e.g., TWAP, VWAP). The learned policy reduces implementation shortfall and variance while exhibiting no observed constraint violations across stress scenarios including elevated latency, partial fills, compliance module toggling, and varying constraint limits. We report effects at the 95% confidence level using paired t-tests and examine tail risk via CVaR. We situate the work at the intersection of optimal execution, safe reinforcement learning, regulatory technology, and verifiable AI, and discuss ethical considerations, limitations (e.g., modeling assumptions and computational overhead), and paths to real-world deployment.

Open access
Adversarial Robustness in Machine Learning
Blockchain Technology Applications and Security
Security and Verification in Computing
Original source
Oct 1, 2025·Forensic Science International Digital Investigation
1 cites
Advanced Monero wallet forensics: Demystifying off-chain artifacts to trace privacy-preserving cryptocurrency transactions

Jeongin Lee, Geunyeong Choi, Jihyo Han, Jungheum Park

Monero, a privacy-preserving cryptocurrency, employs advanced cryptographic techniques to obfuscate transaction participants and amounts, thereby achieving strong untraceability. However, digital forensic approach can still reveal sensitive information by examining off-chain artifacts such as memory and wallet files. In this work, we conduct an in-depth forensic analysis of Monero's wallet application, focusing on the handling of public and private keys and the wallet's data storage formats. We reveal how these keys are managed in memory and develop a memory scanning algorithm capable of identifying key-related data structures. Furthermore, we analyze the wallet keys and cache files, presenting a method for decrypting and interpreting serialized keys and transaction data encrypted with a user-specified passphrase. Our approach is implemented as an open-source Volatility3 plugin and a set of decryption scripts. Finally, we discuss the applicability of our methodology to multi-cryptocurrency wallets that incorporate Monero components, thereby validating the generalizability of our techniques.

Open access
Digital and Cyber Forensics
Internet Traffic Analysis and Secure E-voting
Security and Verification in Computing
Original source
Oct 1, 2025·Indonesian Journal of Electrical Engineering and Computer Science
0 cites
Cryptographically secure digital certificates on a distributed ledger

Umna Iftikhar, Hafiz Muhammad Attaullah, Inam Ullah Khan, Muhammad Mansoor Alam · 6 authors

Verification of a qualification, achievement, quality, or aspect of a person’s background is one of the biggest problems nowadays as we have seen many platforms where students can get fake credentials. Every organization must select professional and academically qualified employees to give quality service. As a result, corporations rely on academic certifications to confirm and measure their prospective employees’ academic qualifications. On the other hand, these employers lack a standardized process for confirming the legitimacy of academic certificates or degrees. Because the present procedures for verifying educational certifications are time-consuming, exhausting, and costly, just a few employers verify certificates for prospective employees. This research examines the issues that are related to the smart verification of someone’s credentials. To make the process of verifying digital credentials quicker, simpler, and more cost-effective, we suggest decentralized architecture. We present the prototype, design, and implementation of the proposed framework.

Open access
Cryptography and Data Security
Cloud Data Security Solutions
Security and Verification in Computing
Original source
Sep 25, 2025·Research Explorer (The University of Manchester)
0 cites
VeriExploit: Automatic Bug Reproduction in Smart Contracts via LLMs and Formal Methods

Chenfeng Wei, Shiyu Cai, Yiannis Charalambous, Tong Wu · 6 authors

Bug reproduction is becoming an important task in the security analysis of Solidity smart contracts. By simulating attacks, developers and auditors can better understand how a vulnerability is triggered in practice. To reproduce a bug, one often needs to define an attacker contract and a specific sequence of interactions that exploit the vulnerability. However, in smart contracts, there are rarely automated tools that can generate such contracts and sequences and validate their correctness. Existing security tools, such as formal verifiers, are effective at detecting bugs, but they are not designed for bug reproduction. They often omit execution traces or produce incomplete ones. Moreover, their reports rarely reflect the behaviour patterns of attacker contracts. This gap motivates our work. We propose VeriExploit, a framework that combines formal methods and large language models to automatically generate, validate, and refine reproduction contracts and execution steps. Given a vulnerable contract and its counterexample, VeriExploit produces a contract that re-triggers the same bug and outputs a concrete trace showing how the exploit works. Experiments show that VeriExploit is effective at automating bug reproduction, achieving a success rate of 85.60% on our benchmark dataset.

Open access
2 source records
Advanced Malware Detection Techniques
Web Application Security Vulnerabilities
Security and Verification in Computing
Original source
Sep 24, 2025·Lecture notes in computer science
0 cites
Confidentiality-Preserving Verifiable Business Processes Through Zero-Knowledge Proofs

Jannis Kiesel, Jonathan Heiss

Ensuring the integrity of business processes without disclosing confidential business information is a major challenge in inter-organizational processes. This paper introduces a zero-knowledge proof (ZKP)-based approach for the verifiable execution of business processes while preserving confidentiality. We integrate ZK virtual machines (zkVMs) into business process management engines through a comprehensive system architecture and a prototypical implementation. Our approach supports chained verifiable computations through proof compositions. On the example of product carbon footprinting, we model sequential footprinting activities and demonstrate how organizations can prove and verify the integrity of verifiable processes without exposing sensitive information. We assess different ZKP proving variants within process models for their efficiency in proving and verifying, and discuss the practical integration of ZKPs throughout the Business Process Management (BPM) lifecycle. Our experiment-driven evaluation demonstrates the automation of process verification under given confidentiality constraints.

Open access
2 source records
Business Process Modeling and Analysis
Security and Verification in Computing
Access Control and Trust
Original source
Sep 23, 2025·arXiv (Cornell University)
0 cites
Revealing Adversarial Smart Contracts through Semantic Interpretation and Uncertainty Estimation

Yating Liu, Xing Su, Hao Wu, Sijin Li · 7 authors

Adversarial smart contracts, mostly on EVM-compatible chains like Ethereum and BSC, are deployed as EVM bytecode to exploit vulnerable smart contracts for financial gain. Detecting such malicious contracts at the time of deployment is an important proactive strategy to prevent losses from victim contracts. It offers a better cost-benefit ratio than detecting vulnerabilities on diverse potential victims. However, existing works are not generic with limited detection types and effectiveness due to imbalanced samples, while the emerging LLM technologies, which show their potential in generalization, have two key problems impeding its application in this task: hard digestion of compiled-code inputs, especially those with task-specific logic, and hard assessment of LLM's certainty in its binary (yes-or-no) answers. Therefore, we propose a generic adversarial smart contracts detection framework FinDet, which leverages LLM with two enhancements addressing the above two problems. FinDet takes as input only the EVM bytecode contracts and identifies adversarial ones among them with high balanced accuracy. The first enhancement extracts concise semantic intentions and high-level behavioral logic from the low-level bytecode inputs, unleashing the LLM reasoning capability restricted by the task input. The second enhancement probes and measures the LLM uncertainty to its multi-round answering to the same query, improving the LLM answering robustness for binary classifications required by the task output. Our comprehensive evaluation shows that FinDet achieves a BAC of 0.9374 and a TPR of 0.9231, significantly outperforming existing baselines. It remains robust under challenging conditions including unseen attack patterns, low-data settings, and feature obfuscation. FinDet detects all 5 public and 20+ unreported adversarial contracts in a 10-day real-world test, confirmed manually.

Open access
2 source records
cs.CR
Adversarial Robustness in Machine Learning
Blockchain Technology Applications and Security
Original source