Matteo Vaccargiu, Sabrina Aufiero, Silvia Bartolucci, Ronnie de Souza Santos · 6 authors
Labels on platforms such as GitHub support triage and coordination, yet little is known about how well they align with code modifications or how such alignment affects collaboration across contributor experience levels. We present a case study of the Kubernetes project, introducing label-diff congruence - the alignment between pull request labels and modified files - and examining its prevalence, stability, behavioral validation, and relationship to collaboration outcomes across contributor tiers. We analyse 18,020 pull requests (2014--2025) with area labels and complete file diffs, validate alignment through analysis of over one million review comments and label corrections, and test associations with time-to-merge and discussion characteristics using quantile regression and negative binomial models stratified by contributor experience. Congruence is prevalent (46.6\% perfect alignment), stable over years, and routinely maintained (9.2\% of PRs corrected during review). It does not predict merge speed but shapes discussion: among core developers (81\% of the sample), higher congruence predicts quieter reviews (18\% fewer participants), whereas among one-time contributors it predicts more engagement (28\% more participants). Label-diff congruence influences how collaboration unfolds during review, supporting efficiency for experienced developers and visibility for newcomers. For projects with similar labeling conventions, monitoring alignment can help detect coordination friction and provide guidance when labels and code diverge.
Smart contracts (SCs) cannot be modified once deployed on the blockchain, making pre-deployment vulnerability identification essential. Although numerous SC vulnerability (SCVul) detection tools (SCTs) have been developed, prior evaluations have examined only limited vulnerability types, leaving it uncertain whether SCTs can comprehensively detect vulnerabilities and what characteristics their detectable vulnerabilities exhibit. Because each SCT employs distinct analysis methods and detection strategies, using multiple SCTs can be advantageous; however, the detection accuracy of such combinations has not yet been systematically evaluated. In this study, we comprehensively investigate the types and characteristics of SCVuls targeted by eight SCTs whose execution environments were successfully established and verified.
Smart contract vulnerability benchmarking lacks standardized, reproducible datasets that enable fair and consistent evaluation of static analysis tools. This paper presents SARMF-Bench, a compact, deterministic, and fully reproducible benchmark dataset comprising five SWC-aligned Solidity smart contracts (SC01–SC05) covering reentrancy (SWC-107), integer overflow/underflow (SWC-101), access-control weakness (SWC-105), unchecked external calls (SWC-104), and denial-of-service via unbounded loops (SWC-113). Each contract is intentionally minimal to isolate a single structural vulnerability pattern and is paired with machine-readable JSON outputs generated using Slither v0.11.5 in a version-locked environment, preserving detector identifiers, impact levels, and confidence metadata. SARMF-Bench is archived across multiple open repositories with permanent DOIs to enable fully reproducible smart contract security tool evaluation experiments. Baseline static analysis results are reported for each vulnerability class. All artifacts are publicly released under open licenses.
Solana is rapidly gaining traction among smart contract developers and users. However, its growing adoption has been accompanied by a series of major security incidents, which have spurred research into automated analysis techniques for Solana smart contracts. Unfortunately, existing approaches do not address the unique and complex account model of Solana. In this paper, we propose SseRex, the first symbolic execution vulnerability detection approach for finding Solana-specific bugs such as missing owner checks, missing signer checks, and missing key checks, as well as arbitrary cross-program invocations. Our evaluation of 8,714 bytecode-only contracts shows that our approach outperforms existing approaches and identifies potential bugs in 467 different contracts. Additionally, we analyzed 120 open-source Solana projects and conducted in-depth case studies on four of them. Our findings reveal that subtle, easily overlooked issues often serve as the root cause of severe exploits, further highlighting the need for specialized analysis tools like SseRex.
Shikah J. Alsunaidi, Hamoud Aljamaan, Mohammad Hammoudeh
Smart Contract (SC) vulnerabilities are programming errors or design flaws that can lead to financial loss or functional failure, making accurate detection essential. Although Machine Learning (ML) is widely applied to SC vulnerability detection, existing datasets are often small, imbalanced, inconsistently labeled, or nonstandardized, and frequently rely on limited feature representations that do not account for different contract lifecycle stages, restricting generalization and degrading benchmark reliability. This study introduces DIVE, a multi-label dataset that addresses these structural and feature-level limitations. DIVE includes 22,330 real-world SCs deployed between 2016 and 2024, and spanning major Solidity compiler versions, annotated for eight vulnerability types aligned with the Decentralized Application Security Project (DASP) Top 10 taxonomy. It provides 221 pre-deployment and 176 post-deployment features and employs a standardized multi-tool labeling pipeline based on Power-based voting and post-hoc filtering, which corrected 14.3% false positives in DoS and 24.9% in Time Manipulation. Unlike prior datasets, DIVE offers two lifecycle-specific feature sets and an open-source framework enabling reproducible benchmarking and periodic reconstruction aligned with evolving vulnerability patterns.
Description of the Invention The present invention relates to the field of cybersecurity and artificial intelligence, and more particularly to a method and system for local autonomous internal penetration testing using artificial intelligence agents augmented by retrieval-based knowledge mechanisms. The invention discloses a technical solution in which one or more autonomous artificial intelligence agents operate within an internal enterprise environment to continuously assess the security posture of information systems, networks, services, and configurations. Unlike conventional penetration testing approaches that rely on manual effort, predefined scripts, or static rule-based scanners, the proposed system dynamically adapts its behavior based on observed system states, retrieved security knowledge, and learned experience. The system employs reinforcement learning to model penetration testing as a sequential decision-making problem, wherein an agent observes an environment state, selects an action from a defined action space, receives a reward based on the outcome, and updates its policy to maximize an expected cumulative reward associated with discovering security weaknesses, misconfigurations, or policy violations. The environment may include hosts, network topology, authentication mechanisms, access control rules, and security monitoring components. To overcome the limitations of fixed context windows and static knowledge in machine learning models, the invention integrates retrieval-augmented mechanisms. At each decision step, the agent retrieves relevant contextual information from a locally stored vector database containing embeddings of security documentation, vulnerability descriptions, configuration policies, compliance requirements, historical findings, and system metadata. The retrieval process is performed using approximate nearest neighbor search, enabling low-latency access to relevant knowledge at scale. The retrieved contextual data is used to augment the agent’s internal state representation and, in some embodiments, to construct augmented prompts for a local large language model responsible for high-level planning, reasoning, or task decomposition. This combination enables the agent to make informed decisions grounded in both learned behavior and up-to-date domain-specific knowledge. In certain embodiments, the system supports multiple cooperating agents, each specializing in a subset of penetration testing activities, such as reconnaissance, vulnerability identification, exploitation simulation, lateral movement analysis, or compliance auditing. Coordination between agents is achieved through a centralized planner or critic during training, while execution may occur in a decentralized manner. A key feature of the invention is that all data processing, retrieval, learning, and inference are performed locally within the organization’s infrastructure, without transmitting sensitive information to external systems. This design preserves confidentiality, complies with regulatory and organizational privacy requirements, and enables deployment in restricted or high-security environments. The disclosed method and system provide continuous, adaptive, and knowledge-informed internal security assessment, improving the detection of security weaknesses while reducing reliance on manual testing and static tools.
We introduce TorusDB, the first database engine supporting practical SQL query processing over ciphertexts using a fully homomorphic encryption scheme derived entirely from elliptic curve cryptography. Unlike prior approaches based on lattice FHE or zero-knowledge proofs, TorusDB preserves the elliptic curve group structure and extends additive homomorphism via a formal multiplicative construction and rational extension, enabling full homomorphic evaluation without decryption. We formalize the underlying EC-based FHE scheme, prove its security under standard elliptic curve assumptions (ECDLP, DDH, BDH), and present a query execution model supporting selection, projection, aggregation, and grouping. Our implementation demonstrates that encrypted query execution incurs only 77% overhead relative to plaintext execution, marking a substantial improvement over existing homomorphic database systems which typically exhibit 10-100× overhead.
Jiaqi Gao, Zijian Zhang, Yuqiang Sun, Ye Liu · 8 authors
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or arithmetic errors, these vulnerabilities arise from missing or incorrectly enforced business invariants and are tightly coupled with protocol semantics. Existing static analysis techniques struggle to capture such high-level logic, while recent large language model based approaches often suffer from unstable outputs and low accuracy due to hallucination and limited verification. In this paper, we propose LogicScan, an automated contrastive auditing framework for detecting business logic vulnerabilities in smart contracts. The key insight behind LogicScan is that mature, widely deployed on-chain protocols implicitly encode well-tested and consensus-driven business invariants. LogicScan systematically mines these invariants from large-scale on-chain contracts and reuses them as reference constraints to audit target contracts. To achieve this, LogicScan introduces a Business Specification Language (BSL) to normalize diverse implementation patterns into structured, verifiable logic representations. It further combines noise-aware logic aggregation with contrastive auditing to identify missing or weakly enforced invariants while mitigating LLM-induced false positives. We evaluate LogicScan on three real-world datasets, including DeFiHacks, Web3Bugs, and a set of top-200 audited contracts. The results show that LogicScan achieves an F1 score of 85.2%, significantly outperforming state-of-the-art tools while maintaining a low false-positive rate on production-grade contracts. Additional experiments demonstrate that LogicScan maintains consistent performance across different LLMs and is cost-effective, and that its false-positive suppression mechanisms substantially improve robustness.
Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem · 5 authors
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures and provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.
Jinghan Liu, Hui Zhao, Chenyang Lin, Dan Wang · 5 authors
The current security problem of smart contracts is becoming a common concern for researchers and developers. Existing smart contract vulnerability detection methods rely heavily on fixed expert rules, resulting in low detection accuracy. In order to cope with complex and changing smart contract application scenarios, we chose to use graph neural networks to detect vulnerabilities. In this paper, we proposed a vulnerability detection model called ESA based on the enhanced sequential algorithm. During the coding process, the contract function source code is described as a contract graph, which increases the model’s global insight into node features during the learning process and reduces the number of noise nodes unrelated to vulnerabilities while retaining sufficient contextual semantic features. Compared to the cutting-edge methods, our model has significantly improved the accuracy of reentrant and timestamp dependency vulnerabilities, with detection accuracies of 89.09% and 88.49%, respectively.
Smart contract technology facilitates self-executing agreements on the blockchain, eliminating dependency on an external trusted authority. However, smart contracts may expose vulnerabilities that can lead to financial losses and disruptions in decentralized applications. In this work, we evaluate deep learning-based approaches for vulnerability scanning of Ethereum smart contracts. We propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, which performs sequential analysis of Ethereum Virtual Machine (EVM) bytecode and incorporates a sliding window mechanism to overcome input length constraints. To assess VASCOT's detection efficacy, we construct a dataset of 16,469 verified Ethereum contracts deployed in 2022, and annotate it using trace analysis with concrete validation to mitigate false positives. VASCOT's performance is then compared against a state-of-the-art LSTM-based vulnerability detection model on both our dataset and an older public dataset. Our findings highlight the strengths and limitations of each model, providing insights into their detection capabilities and generalizability.
Smart contracts are a core component of blockchain-based decentralized systems, but their immutability and financial exposure make software defects particularly costly. Existing analysis tools have improved vulnerability detection, yet most lack integrated remediation capabilities. This paper presents SARMF, a hybrid framework combining static analysis, pattern detection, lightweight machine learning classification, and template-based remediation. The framework is evaluated using SARMF-Bench, a curated dataset designed to support reproducible assessment of detection and first-pass remediation across common vulnerability classes. Results indicate detection performance in the high-80s to low-90s range with balanced precision and recall, while remediation templates reduce manual correction effort by approximately 30–40%. The contribution is a practical research prototype, a benchmark protocol, and an extensible evaluation framework for smart contract security.
Elvira Albert, Emanuele De Angelis, Marco Di Ianni, Fabio Fioravanti · 5 authors
Testing has become an integral part of the software development process in order to ensure the correct and safe execution of programs. A powerful approach to testing is property-based testing that aims at generating unit tests that verify that a certain property of interest holds. However, smart contracts are also characterized by important non-functional aspects, such as the gas consumption required to execute their functions. Static gas analyzers are able to obtain parametric gas bounds - that soundly over-approximate - the gas consumption of executing each of the public functions within a smart contract. This paper discusses our ideas towards combining both formal methods, property-based testing and gas analysis, in order to generate gas-aware unit tests that can ensure the gas requirements provided by the programmers.
This registration documents the creation, structure, and validation workflow of SARMF-Bench, a minimal reproducible benchmark dataset for smart contract vulnerability analysis. SARMF-Bench consists of five intentionally engineered Solidity contracts representing canonical vulnerability classes: Reentrancy, Arithmetic Overflow Behavior, Access Control Weakness, Unchecked External Call, and Denial-of-Service Pattern. Each contract is paired with machine-readable static analysis outputs generated using Slither v0.11.5. The objective of this dataset is to provide a controlled experimental baseline for evaluating static analyzers, symbolic execution engines, fuzzers, and AI-assisted smart contract security tools. All artifacts were created in a controlled Linux environment and validated for reproducibility through consistent detector metadata (impact and confidence levels). No synthetic mutation frameworks or automated vulnerability generators were used. This registration serves as a timestamped, immutable research record documenting dataset structure, methodology, and reproducibility protocol.
Smart contracts are high-stakes software: their immutable, publicly accessible, code may govern assets worth millions, meaning that even minor defects can have severe consequences. The most used techniques to ensure smart contract correctness are testing and formal verification. Testing is almost always employed but is often restricted to unit tests (which often miss edge cases) and has limited coverage, while formal verification can provide strong guarantees but is often costly and complex to apply, demanding substantial time and expertise. Property-based testing bridges this gap by exploring large input spaces and shrinking failures to minimal counterexamples, helping uncover defects early in development. Formal verification can be left to critical features once testing has filtered out common issues. To add to the challenges smart contract developers face, most languages used were not designed with safety and security guarantees built-in. Daml is a smart contract language designed with correctness in mind, featuring a strong static type system, functional programming paradigms, and built-in abstractions for common smart contract patterns. However, Daml currently lacks support for property-based testing, limiting developers' ability to systematically explore input spaces and verify contract properties. This paper introduces Hypothesis2Daml, an open-source library that brings property-based testing to the Daml ecosystem by connecting the Hypothesis testing framework with the Daml JSON API. Hypothesis2Daml enables developers to specify invariants, preconditions, and stateful workflows over realistic ledger interactions, while providing automatic input generation, shrinking, and isolation of ledger state between test cases. The approach is evaluated using a benchmark consisting of eight contracts, three Daml templates, and twenty-eight property-based tests covering happy paths, negative cases, and alternative interaction orders. The results show that property-based testing is feasible for Daml smart contracts, can systematically expose violated properties with minimal counterexamples, and supports effective debugging of realistic, stateful workflows.
haojia hong, Duan Jia, Wei Ren, Xi Liu · 5 authors
Proxy contracts support logic upgradeability and deployment reuse in decentralized application (DApp). However, the use of proxy mechanisms also introduces new security risks. Although prior work has explored the security of proxy contracts, most prior approaches either depend on source code or fail to handle complex proxy storage layouts at the bytecode level, reducing their applicability to real-world closed-source contracts. In this paper, we propose ProxyLens, a bytecode-level vulnerability detection framework tailored for Ethereum proxy contracts. Without requiring source code, ProxyLens integrates storage structure modeling, proxy pattern recognition, and vulnerability detection. It features (1) a slot recovery mechanism based on symbolic execution and taint analysis for precise variable layout inference, (2) a proxy identification and delegate slot tracing module for accurate proxy architecture recognition, and (3) a semantic-driven vulnerability detection engine that works independently of function names. Experiments show that ProxyLens significantly outperforms existing tools in storage slot recovery (F1 = 96.4%), variable type inference (accuracy = 63.0%), proxy pattern recognition (accuracy > 90% across multiple patterns), and vulnerability detection (e.g., function selector collision F1 = 98.77%, storage collision F1 = 79.50%). As a supplementary contribution, we have publicly released the prototype of ProxyLens.
The internet was architected on a 128-character encoding that systematically excluded billions of speakers of Arabic, Chinese, Persian, Turkish, Hindi, and every other non-Latin script. Two interlocking standards broke that constraint: Unicode — the universal map of every human character to a unique codepoint — and Punycode (RFC 3492), which translates Unicode into ASCII-compatible encodings the legacy Domain Name System can process. The emergence of Handshake (HNS), a decentralised proof-of-work naming blockchain, extends this capability into Web3 without any central gatekeeper. Handshake allows any individual to auction, own, and resolve top-level domains in any script — including emoji — through sovereign cryptographic ownership.
Tato práce se zabývá integrací protokolu zkLogin do aplikace Web3, aby se uživatel mohl přihlásit pomocí účtu OpenID Connect místo správy seed phrase. Práce vysvětluje princip zkLogin, porovnává jej s jinými přístupy k autentizaci ve Web3 a implementuje prototyp pro Sui a Ethereum. Větev pro Sui používá nativní podporu zkLogin, zatímco větev pro Ethereum používá Groth16 důkaz, chytrý účet, registr JWK a ERC-4337. Jednoduchý lending scénář ověřuje opakované změny on-chain stavu po přihlášení. Výsledky ukazují, že zkLogin může zjednodušit onboarding a omezit přímé zveřejnění vazby mezi účtem Web2 a on-chain adresou, ale prototyp stále závisí na poskytovateli identity, salt service, proving infrastruktuře a správě veřejných klíčů.
Nadia van Niekerk, Brink van der Merwe, Louwrens Labuschagne
In the rapidly evolving realm of blockchain technology, the pursuit of enhanced privacy, security, and scalability has propelled the exploration of cryptographic innovations. Zero-Knowledge Proofs (ZKPs) have emerged as a pivotal solution, addressing diverse challenges across decentralized applications and cryptographic systems. However, the intricate mathematical foundations of ZKPs can pose a barrier to widespread adoption. To bridge this gap, a spectrum of ZKP tools has been developed, abstracting mathematical complexities and enabling developers with varying levels of expertise to incorporate ZKPs into their projects. The exploration of the 5 W’s – Who, What, When, Where, and Why – guides developers in selecting ZKP tools aligned with their specific needs and understanding. This paper serves as a vital resource for developers entering the dynamic landscape of ZKP development. By answering crucial questions and providing nuanced insights into ZKP tools, it empowers developers to navigate this intricate domain effectively. As ZKP technology continues to evolve, our findings contribute to the ongoing dialogue surrounding its implementation, utilization and the ever-adapting toolkit shaping the future of cryptographic innovation. This paper employs a Mining Software Repositories (MSR) approach to unravel insights from the expansive landscape of ZKP development. By delving into GitHub repositories, we categorize author archetypes, discuss ZKP proof constructions, identify phases of tool development, explore the level of understanding required and examine the correlation between tool types and application purposes. Through a metrics-driven analysis, we unveil patterns in tool popularity, development trends, and historical perspectives, offering a comprehensive understanding of the ZKP tooling ecosystem.
Abstract This paper revisits Virgo, a well-known transparent zero-knowledge proof system that has been used in many subsequent studies. Through our analysis, we uncover previously overlooked limitations and several exploitable security vulnerabilities within Virgo’s zkVPD protocol design and implementation. We subsequently address these issues and improve Virgo’s zkVPD protocol. Our improvements feature simplified but more efficient VPD and zkVPD algorithms, offering enhanced support for computations over binary fields and their extension fields.
In the case of upgrading smart contracts on blockchain systems, it is essential to consider the continuity of upgrades and subsequent maintenance. In practice, upgrade operations often introduce new vulnerabilities. Existing static analysis tools usually only scan a single version and are unable to capture the correlation between code changes and emerging risks. To address this, we propose an Upgradeable Smart Contract Security Analyzer, USCSA, which uses Abstract Syntax Tree (AST) difference analysis to assess risks associated with the upgrade process and utilizes large language models (LLMs) for assisted reasoning to achieve high-confidence vulnerability attribution. We collected and analyzed 3,546 cases of vulnerabilities in upgradeable contracts, covering common vulnerability categories such as reentrancy, access control flaws, and integer overflow. Experimental results show that USCSA achieves a precision of 92.26%, a recall of 89.67%, and an F1-score of 90.95% in detecting upgrade-induced vulnerabilities. As a result, USCSA provides a significant advantage to improve the security and integrity of upgradeable smart contracts, offering a novel and efficient solution for security auditing on blockchain applications.
This paper presents LLMBugScanner, a large language model (LLM) based framework for smart contract vulnerability detection using fine-tuning and ensemble learning. Smart contract auditing presents several challenges for LLMs: different pretrained models exhibit varying reasoning abilities, and no single model performs consistently well across all vulnerability types or contract structures. These limitations persist even after fine-tuning individual LLMs. To address these challenges, LLMBugScanner combines domain knowledge adaptation with ensemble reasoning to improve robustness and generalization. Through domain knowledge adaptation, we fine-tune LLMs on complementary datasets to capture both general code semantics and instruction-guided vulnerability reasoning, using parameter-efficient tuning to reduce computational cost. Through ensemble reasoning, we leverage the complementary strengths of multiple LLMs and apply a consensus-based conflict resolution strategy to produce more reliable vulnerability assessments. We conduct extensive experiments across multiple popular LLMs and compare LLMBugScanner with both pretrained and fine-tuned individual models. Results show that LLMBugScanner achieves consistent accuracy improvements and stronger generalization, demonstrating that it provides a principled, cost-effective, and extensible framework for smart contract auditing.
T J E N N I N G, Kalokhe Omkar Nanabhau, Takale Ram Arjun, Borge Akash Sandip
The proliferation of digital documents and academic credentials in today's interconnected world has created both opportunities and vulnerabilities. Traditional certificate issuance and storage mechanisms are highly susceptible to forgery, duplication, and unauthorized manipulation, undermining the trustworthiness of academic and professional qualifications. To address these challenges, this research proposes a blockchain-based certificate generation and verification system that ensures transparency, immutability, and trust across stakeholders. Leveraging distributed ledger technology, the system securely records certificate metadata and unique identifiers, enabling real-time, tamper-proof validation without reliance on intermediaries. The architecture integrates modern web technologies such as Next.js for frontend and backend services, MongoDB for scalable storage, JWT for authentication, and cryptographic techniques including bcrypt for enhanced security. Additionally, smart contracts deployed on Ethereum/Ganache enable decentralized storage and validation, while certificate data is simultaneously linked with non-fungible tokens (NFTs) to provide verifiable ownership and authenticity. This integration not only eliminates certificate fraud but also facilitates seamless verification across institutions, employers, and regulatory authorities. By combining blockchain's decentralized security with user-friendly web applications, the proposed approach aims to create a globally interoperable, cost-effective, and future-ready framework for academic and professional certification systems.