Blockchain Papers

Oumaima Fadi, Adil Bahaj, Karim Zkik, Abdellatif El Ghazi · 6 authors

No abstract is available for this record.

Peter Ince, Xiapu Luo, Jiangshan Yu, Joseph K. Liu · 5 authors

In this paper, we test the hypothesis that although OpenAI's GPT-4 performs well generally, we can fine-tune open-source models to outperform GPT-4 in smart contract vulnerability detection. We fine-tune two models from Meta's Code Llama and a dataset of 17k prompts, Detect Llama - Foundation and Detect Llama - Instruct, and we also fine-tune OpenAI's GPT-3.5 Turbo model (GPT-3.5FT). We then evaluate these models, plus a random baseline, on a testset we develop against GPT-4, and GPT-4 Turbo's, detection of eight vulnerabilities from the dataset and the two top identified vulnerabilities - and their weighted F1 scores. We find that for binary classification (i.e., is this smart contract vulnerable?), our two best-performing models, GPT-3.5FT and Detect Llama - Foundation, achieve F1 scores of $0.776$ and $0.68$, outperforming both GPT-4 and GPT-4 Turbo, $0.66$ and $0.675$. For the evaluation against individual vulnerability identification, our top two models, GPT-3.5FT and Detect Llama - Foundation, both significantly outperformed GPT-4 and GPT-4 Turbo in both weighted F1 for all vulnerabilities ($0.61$ and $0.56$ respectively against GPT-4's $0.218$ and GPT-4 Turbo's $0.243$) and weighted F1 for the top two identified vulnerabilities ($0.719$ for GPT-3.5FT, $0.674$ for Detect Llama - Foundation against GPT-4's $0.363$ and GPT-4 Turbo's $0.429$).

Olha Kovalchuk, Ruslan Shevchuk, Serhiy Banakh

Digital trends like blockchain have led to cryptocurrency payments becoming popular in e-commerce. While cryptocurrencies have benefited users, they have also attracted criminals who use them to commit cyberattacks and harm security. In this research paper, we present an analysis of the following factors that can strongly influence the development of the cryptocurrency environment and be associated with cryptocurrency-related crime at the national level: GDP, digital development, e-commerce market size, the level of mass adoption of cryptocurrency, the level of national cybersecurity, and fraud in cryptocurrency crime for selected countries worldwide. By applying correspondence analysis, we constructed visually intuitive models based on assessments from the global data and business intelligence platform and official statistical reports. We have established a fairly strong positive correlation between fraud in cryptocurrency crime and digital development, e-commerce market size, and the level of mass adoption of cryptocurrency; a fairly strong negative correlation between the level of fraud in cryptocurrency crime and the level of cybersecurity in a specific country; a fairly strong positive correlation between the level of mass adoption of cryptocurrency and the level of cybersecurity. The proposed models give decision-makers a clear understanding of the key factors in cryptocurrency that pose a high risk of related crime.

Ferda Özdemir Sönmez, William J. Knottenbelt

This paper presents an ongoing study of a novel attack surface generator tool for smart contracts developed in Solidity. The tool leverages a rule-based engine and ChatGPT API for security analysis. The rule-based engine provides numerical values and key variables and functions for further analysis, while ChatGPT handles complex queries. However, ChatGPT may generate similar responses for more general questions, irrespective of the given contract code. The tool combines both approaches to identify and mitigate potential security vulnerabilities in Solidity-based smart contracts. The effectiveness of the tool is evaluated on real-world smart contracts, and its potential for detecting and preventing common attack vectors is demonstrated.

Sayyed Usman Ahmed, Abutalha Danish, Nesar Ahmad, Tameem Ahmad

The rise in legislation and the need for task automation systems has resulted in an amplified requirement for software development. This is aimed at improving the accuracy and efficiency of reading and interpreting laws in legal activities, allowing for enhanced precision and swiftness. Currently, there is a need for analysts to interpret written legislation and then encode it into computer programs, which often leads to errors. As cryptocurrencies gain popularity, there is growing interest in utilizing Blockchain technology in the legal field. Specifically, smart contracts can be used to integrate business rules into laws and automate blockchain management. However, the process of writing fast and high-quality code can be improved by leveraging artificial intelligence based techniques such as natural language processing (NLP) to help practitioners. Despite reviewing the current state-of-the-art, there is a lack of existing work that combines smart contracts and NLP in the context of legislation analysis. This study work generates intelligent code from legislation analysis, utilizing NLP and Blockchain for this purpose. In this research work a pilot prototype for smart contract generation is developed and initial code samples are presented. This work demonstrates a promising results with 96% accuracy in Name Entity Recognition (NER) and also highlights the importance of smart contract generation through NLP.

Zulfiqar Ali Khan, Akbar Siami Namin

Ethereum Blockchain technology introduced a competitive environment in the financial sector. Consequently, new technologies emerged, such as Smart Contracts (SCs), which preclude code corrections due to their immutable nature. But the incorrect and faulty uploaded SCs led to uninvited penetrations into SCs’ accounts, resulting in considerable customer losses. This SC’s drawback requires tools to test the SCs and paves the way for research on vulnerability detection techniques. Our survey paper comprehensively reviews 41 SC tools and presents the vulnerability detection techniques (VDTs) of the several previously discussed tools by dividing them into general and specific classes. Finally, we also perform a classification of detection techniques to standardize the approaches. Thus, our study will help SC developers and security analysts to streamline the security of SCs and reduce the chances of malicious monetary transfers.

Hao Sui, Jiale Zhang, Bing Chen, Di Wu · 6 authors

No abstract is available for this record.

Hao Ding, Yizhou Liu, Xuefeng Piao, Huihui Song · 5 authors

No abstract is available for this record.

Shaoyan CHEN, Fei Li

Abstract Blockchain smart contracts are codes that can execute and enforce rules for blockchain digital transactions. However, smart contracts may contain numerous subtle vulnerabilities, among which Ponzi vulnerabilities are notable. Existing Ponzi scheme contract detection approaches often rely on machine learning models trained on manually extracted features to achieve satisfactory classification results. Nonetheless, the code of a smart contract potentially harbours elusive semantics and characteristics, which compromises the precision and accuracy of vulnerability detection. Therefore, this paper proposes a method of converting operation codes into sequences to process data to avoid losing unnecessary important information, and uses a one‐dimensional convolutional neural network combined with formal verification. This method is named PZ‐C1DZ3(Ponzi‐Conv1D‐Z3) and is used for Ponzi scheme detection. Four types of machine learning models, namely Conv1D, Conv1D‐LSTM, Conv1D‐MLP, and Conv1D‐transformer, are employed for improvement and comparative validation experiments. Additionally, formal verification tool Z3 solver is utilized to conduct formal security verification on the final model, ensuring its safety. Experimental results demonstrate that the improved Conv1D model outperforms other existing models in terms of detection efficiency and accuracy while also meeting the requirements of formal security verification.

Norta Alex, Makrygiannis Sotiris

With the rapid diffusion of social networks in combination with mobile phones, a new social threat of sextortion has emerged, in which vulnerable young women are essentially blackmailed with their explicit shared multimedia content. The phenomenon of sextortion is now widely studied by psychologists, sociologists, criminologists, etc. The findings have been translated into scattered help from NGOs, specialized law enforcement units, and therapists, who usually do not coordinate their efforts among each other. This paper addresses the gap of lacking coordination systems to effectively and efficiently use modern information technologies that align the efforts of scattered and non-aligned sextortion help organizations. Consequently, this paper not only investigates the goals, incentives, and disincentives for a system design and development that not only governs effectively and efficiently diverse cases of sextortion victims, but also leverages artificial intelligence in a targeted manner. It explores how AI and, in particular, autonomous cognitive entities can improve victim profiles analysis, streamline support mechanisms, and provide intelligent insight into sextortion cases. Furthermore, the paper conceptually studies the extent to which such efforts can be monetized in a sustainable way. Following a novel design methodology for the design of trusted blockchain decentralized applications, the paper presents a set of conceptual requirements and system models based on which it is possible to deduce a best-practice technology stack for rapid implementation deployment.

Zhiju Yang, Gaoyuan Man, Songqing Yue

As decentralized finance (DeFi) built on blockchain grows rapidly, the security of smart contracts underpinning DeFi has become a major concern due to exploits leading to billions in damages. Although tools exist for automated vulnerability detection in smart contracts, studies show that most vulnerabilities remain undetected. In this work, we propose using fine-tuned large language models (LLMs) for enhanced automated detection of vulnerabilities in smart contracts. We collected over 26,727 labeled smart contract vulnerabilities and fine-tuned the 13B parameter Llama-2 model. Evaluation of 1,000 unseen functions shows promising precision of 31-36% in predicting vulnerability categories. The fine-tuned LLM demonstrates potential as an auxiliary tool to identify vulnerable code and assist auditors. Future work is outlined for improving performance via larger models, higher-quality data, and specialized binary detection models. We present promising preliminary results on integrating LLMs into smart contract analysis and motivate further research at the intersection of LLMs and blockchain security.

Zekun Hou, Changtong Dong, Ying Shang

Abstract. Due to the transparent nature of blockchain, all transaction information and smart contract code is recorded on the public blockchain. It is easy for existing static analysis tools to analyze and exploit vulnerabilities in smart contract code. To mitigate this risk, we propose HermHD, an automated security enhancement tool that protects smart contracts on the Ethereum network. HermHD employs six obfuscation patterns that can rewrite the bytecode of a smart contract without affecting its functionality. By applying these obfuscation techniques, we aim to prevent reverse static analysis tools from cracking the contract and thereby enhance the security of smart contracts. To validate the effectiveness of HermHD, we conducted experiments on 121 smart contracts from a public dataset. 54The evaluation results demonstrate that all the protected smart contracts are resistant to two popular reverse engineering tools, and the additional gas cost incurred is minimal.

Kai Ma, Jintao Huang, Ningyu He, Zhuo Wang · 5 authors

Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem. To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.

Subhadeep Mandal, Arpan Kumar Kar, Shivam Gupta

No abstract is available for this record.

Anatolii Movchan, Oleksandr Shliakhovskyi, Vasyl Kozii, Ihor Fedchak

The article is devoted to the study of the problems of investigating crimes of financing terrorism and armed aggression with cryptocurrency, which is relevant considering the attack on Ukraine by the Russian Federation, as well as in connection with the significant spread and use of cryptocurrency for financing both terrorism and armed aggression. The purpose of the article is to study the problems of investigating crimes of cryptocurrency financing of terrorism and armed aggression and finding ways and means of solving problematic issues, because cryptocurrency financing of terrorism and armed aggression is an encroachment on national security. The methods of system analysis and technical- legal analysis, as well as the formal-logical method, were used in the research process. Thanks to this, approaches to understanding the way of committing crimes of the researched category have been determined. The shortcomings in the legal regulation of the circulation and use of cryptocurrency in Ukraine, as well as in the legal regulation of the investigation of crimes related to the illegal acquisition and use of cryptocurrency for criminal purposes, including for the financing of terrorism and armed aggression, are highlighted. Jurisdictional problems of criminal prosecution of persons who committed crimes of this category, their high latency due to the lack of proper legal procedures and methods of investigation, have been determined. The need to create specialized units in law enforcement agencies, whose competence will include the detection and investigation of the specified crimes, their active interaction with the Cyber Police, is substantiated. The attention and necessity of introducing a system of constant monitoring of social networks, the Internet, and media and conducting OSINT-intelligence from open sources with the aim of detecting and stopping such criminal activities, tracking and arresting and eventually seizing cryptocurrency, if such an opportunity is available, was emphasized. Practical recommendations for the investigation of crimes of cryptocurrency financing of terrorism and armed aggression have been formulated. The need for international legal cooperation in this area was emphasized; the need to involve specialists in the field of information technologies, programming, and blockchain engineering in the investigation process in general and in specific investigative actions. The requirements for the recording of evidence in the protocols of investigative (search) actions during the investigation of crimes of this category are formulated, in particular, the need for hashing of files is specified. The practical significance of the study is that the obtained results can be used during the investigation of crimes of the studied category

B. Hong, Thắng Lê Đức, Doan Minh Trung, Tuan-Dung Tran · 6 authors

The proliferation of smart contracts on blockchain technology has led to several security vulnerabilities, causing significant financial losses and instability in the contract layer. Existing machine learning-based static analysis tools have limited detection accuracy, even for known vulnerabilities. In this study, we propose a novel deep learning-based model combined with attention mechanisms for identifying security vulnerabilities in smart contracts. Our experiments on two large datasets (SmartBugs Wild and Slither Audited Smart Contracts) demonstrate that our approach successfully achieves a 90% detection accuracy in identifying smart contract reentrancy attacks (e.g. performing better than other existing state-of-the-art deep learning-based approaches). In addition, this work also establishes the practical application of deep learning-based technology in smart contract reentrancy vulnerability detection, which can promote future research in this domain.

Feng Ding, Rupert Hitsch, Kaihua Qin, Arthur Gervais · 7 authors

No abstract is available for this record.

Sharad Agarwal, Gilberto Atondo Siu, Marilyne Ordekian, Alice Hutchings · 6 authors

No abstract is available for this record.

Dimitris Kafteranis, Hüseyin Ünözkan, Umut Türkşen

Non-Fungible Tokens (NFTs) is a new virtual asset phenomenon the trade of which has spread quickly without any regulationas no legislation has been adopted in the EU, USA or the UK where the majority of NFT trading takes place. Concerns have been raised about NFTs and their relation to fraud and money launderingasanonymity and price volatility of NFTs create a unique and profitable asset for criminals. This paper addressestwomain issues: (1) trading statistics on NFTs,their analysis,and if and to what extent NFTs are used for financial crimes purposes; and (2) the legal challenges posed by the misuse of NFTs for fraud and other economic crimes. The final section of this paper provides feasible regulatory and business solutions that can help businesses to mitigate risks emanating from NFTs. It is argued that legal scholars, businesses and/or regulators cannot solve the challenges and risks posed by NFTs on their own, requiringmultidisciplinary research from academia and knowledge exchange between private and public stakeholders to close this gap.

Jinggang Li, Gehao Lu, Yulian Gao, Feng Gao

With the proliferation of blockchain technology in decentralized applications like decentralized finance and supply chain and identity management, smart contracts operating on a blockchain frequently encounter security issues such as reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and integer overflow vulnerabilities. These security concerns pose a significant risk of causing substantial losses to user accounts. Consequently, the detection of vulnerabilities in smart contracts has become a prominent area of research. Existing research exhibits limitations, including low detection accuracy in traditional smart contract vulnerability detection approaches and the tendency of deep learning-based solutions to focus on a single type of vulnerability. To address these constraints, this paper introduces a smart contract vulnerability detection method founded on multimodal feature fusion. This method adopts a multimodal perspective to extract three modal features from the lifecycle of smart contracts, leveraging both static and dynamic features comprehensively. Through deep learning models like Graph Convolutional Networks (GCNs) and bidirectional Long Short-Term Memory networks (bi-LSTMs), effective detection of vulnerabilities in smart contracts is achieved. Experimental results demonstrate that the proposed method attains detection accuracies of 85.73% for reentrancy vulnerabilities, 85.41% for timestamp dependency vulnerabilities, 83.58% for tx.origin vulnerabilities, and 90.96% for integer Overflow vulnerabilities. Furthermore, ablation experiments confirm the efficacy of the newly introduced modal features, highlighting the significance of fusing dynamic and static features in enhancing detection accuracy.

Yevgeniy A. Ignatenko

The article discusses certain features of the legal regulation of cryptocurrency, taking into account the specifics of building a model for the functioning of blockchain networks, which consists in combining various tools, technologies and principles that form a logical and secure structure for distributed data storage. The problems of criminal law protection of digital currency are highlighted and the most common scientific approaches are identified, on the basis of which the author indicates that the use of the concepts of “digital currency” and “cryptocurrency” as synonyms does not correspond to the legislative definition of digital currency, since the concept of cryptocurrency is wider in content than the concept of digital currency. As a result of a comprehensive analysis of the norms of the Federal Law of July 31, 2020 No. 259-FZ On Digital Financial Assets, Digital Currency and Amendments to Certain Legislative Acts of the Russian Federation, the author comes to the conclusion that digital currency is exclusively a “domestic” currency. Based on the study of judicial practice, it is shown that the broadest possible interpretation of the concept of “other property”, which includes digital currency and cryptocurrency, is allowed. It indicates the presence of judicial acts in criminal cases, in which the subject of a crime are such cryptocurrencies as, for example, bitcoin. Attention is focused on the importance of civil law regulation of cryptocurrencies for their criminal law protection and the range of social relations that develop regarding cryptocurrencies subject to protection by means of criminal law is determined.

Bowen He, Yuan Chen, Zhuo Chen, Xiaohui Hu · 9 authors

The prosperity of Ethereum attracts many users to send transactions and trade crypto assets. However, this has also given rise to a new form of transaction-based phishing scam, named TxPhish. Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets. The past year has witnessed 11 large-scale TxPhish incidents causing a total loss of more than 70 million.

Andrew Childs

Cryptomarkets are increasingly requiring users to purchase products with Monero (a ‘privacy coin’) to further obfuscate the digital trail of money compared to conventional cryptocurrencies (e.g. Bitcoin). This is the first study to explore how cryptomarket communities are used to facilitate norms and behaviours to expedite these emerging cryptocurrency practices. Through a qualitative analysis of Monero threads in a Reddit cryptomarket community (3451 total posts), this research illustrates how online communities often underpin the adoption of new technologies in cryptomarkets. The findings reveal: how the online community functions, adapts, and fails to support cryptocurrency transitions; the appraisal and contestation of cryptocurrency risks; and the ideological drivers and symbolic resources used to align community practices to adopt Monero. This research contributes to an understanding of the processes that underpin the constant evolution of online illicit markets as human and non-human elements are constantly re-assembled.

Et al. Laxmi Poonia

Computer networks and internet services are increasingly threatened by attacks like Distributed Denial-of-Service (DDoS). DDoS attack mitigation techniques now in use are ineffective due to a lack of resources and a lack of adaptability. Using blockchains like Ethereum, DDoS attacks can be thwarted in innovative ways. With smart contracts, it is possible to track down the IP addresses of attackers without additional hardware. This study examines blockchain-based solutions to combat DDoS attacks for feasibility, effectiveness, as well as cost and performance. The cost model delves into economic aspects like gas, gas price, and Ether value. In it, the evaluation of various smart contracts for the signalization of DDoS attacks is documented and compared to assess three system variants, analyzing gas costs, deployment, speed, and accuracy. It also details Ethereum's ecosystem and how that affects smart contract design and it also acknowledges scalability challenges and suggests outsourcing data for a more scalable solution, advocating for specialized blockchains for DDoS signaling applications. The analysis provides insights into the gas costs associated with different variants, considering various scenarios and highlighting the trade-offs and efficiencies of each approach.