Fault tolerance of a blockchain is often characterized by the fraction $f$ of "adversarial power" that it can tolerate in the system. Despite the fast progress in blockchain designs in recent years, existing blockchain systems can still only tolerate $f$ below $0.5$. Can practically usable blockchains tolerate a malicious majority, i.e., $f$ above $0.5$? This work presents a positive answer to this question. We first note that the well-known impossibility of {\em byzantine consensus} for $f$ above $0.5$ does not carry over to blockchains. To tolerate $f$ above $0.5$, we use {\em byzantine broadcast}, instead of byzantine consensus, as the core of the blockchain. A major obstacle in doing so, however, is that the resulting blockchain may have extremely low throughput. To overcome this central technical challenge, we propose a novel byzantine broadcast protocol OverlayBB, that can tolerate $f$ above $0.5$ while achieving good throughput. Using OverlayBB as the core, we present the design, implementation, and evaluation of a novel Proof-of-Stake blockchain called BCube. BCube can tolerate a malicious majority, while achieving practically usable transaction throughput and confirmation latency in our experiments with $10000$ nodes and under $f = 0.7$. To our knowledge, BCube is the first blockchain that can achieve such properties.
Abstract In a decentralized network every user makes use of personal identity details at different places for various services and these details are shared with third-parties without their consent and stored at an unknown location. Organizations like government, banks and social platforms are considered to be the weakest point in the current identity management system as they are vulnerable which leads to compromising billions of user identity data. Block chain based User Identity Management is a solution which provides a decentralized environment that manages the user identity data and their related Know-Your-Customer (KYC) documents in a distributed ledger. All the transactions of the network are stored in the block which is a type of a data structure and these blocks are validated using the powerful consensus algorithms and linked to form a block chain. Smart contracts will act as an interface between the client and the block chain network. User’s information cannot be provided to any third party vendors without the explicit consent of the user. This paper proposes a framework for User Identity Management using Block chain technology in a decentralized Network. The proposed framework ensures a high level privacy and security for the personal identity details and the documents. In addition to that the performance analysis of the framework is presented in terms of Transaction, Mining Resource and Difficulty Variation.
Open access
2 source records
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Blockchain is a method of storing data that makes it extremely difficult, if not impossible, to edit, hack, or update the system. As time passes, blockchain technology becomes more popular, and blockchain-based applications, also known as DApps, which will be used in this article, are becoming more widely recognised. We will construct a chat application based on a decentralised network in this article to eliminate its absolute reliance on centralised players. On a peer-to-peer network like Ethereum, the actual message and data will be kept. To offer decentralised storage and efficient lookup, we will employ a blockchain and distributed hash table (DHT). which will describe what we will do, which is a trendy issue among academics and trades. Except for the fact that DApps are important, we currently have a limited grasp of DApps and nature. To close the data gap, this paper presents a file for the most comprehensive blockchain-based DApps analysis to date, which includes 995 Ethereum DApps data and 29,846,075 dealings logs above them. We usually do a descriptive investigation of Dapp preferences, characterise patterns of how Dapps use good contracts to gain access to fundamental blockchain, and evaluate the results issues with the post and misuse of DApps In support of the findings, we propose a large number of Results for DApp users to choose the best DApps. Dapp developers must work harder in order to create more efficient DApps, and vendors must likewise support them.
Blockchain analysis is essential for understanding how cryptocurrencies like Bitcoin are used in practice, and address clustering is a cornerstone of blockchain analysis. However, current techniques rely on heuristics that have not been rigorously evaluated or optimized. In this paper, we tackle several challenges of change address identification and clustering. First, we build a ground truth set of transactions with known change from the Bitcoin blockchain that can be used to validate the efficacy of individual change address detection heuristics. Equipped with this data set, we develop new techniques to predict change outputs with low false positive rates. After applying our prediction model to the Bitcoin blockchain, we analyze the resulting clustering and develop ways to detect and prevent cluster collapse. Finally, we assess the impact our enhanced clustering has on two exemplary applications.
Chargeback fraud is a fast-growing threat to e-commerce, bringing huge losses to online sellers, but there is still a lack of effective technical counter measures. To combat chargeback fraud, this paper proposes a consortium blockchain based chargeback fraud data sharing mechanism — CFLedger, which includes multi-source reporting, anti-tamper accounting, and post-supervision. This paper also analyzes the efficiency, effectiveness, and practicality of CFLedger, proving that it is an effective and feasible mechanism to prevent chargeback fraud.
The popularity and amazing attractiveness of cryptocurrencies, and especially Bitcoin, absorb countless enthusiasts daily. Although Blockchain technology prevents fraudulent behavior, it cannot detect fraud on its own. There are always unimaginable ways to commit fraud, and the need to use anomaly detection methods to identify abnormal and fraudulent behaviors has become a necessity. The main purpose of this study is to present a new method for detecting anomalies in Bitcoin with more appropriate efficiency. For this purpose, in this study, the diagnosis of the collective anomaly was used, and instead of diagnosing the anomaly of individual addresses and wallets, the anomaly of users was examined, and the anomaly was more visible among users who had multiple wallets. In addition to using the collective anomaly detection method in this study, the Trimmed_Kmeans algorithm was used for clustering and the proposed method succeeded in identifying 14 users who had committed theft, fraud, and hack with 26 addresses in 9 cases. Compared to previous works, which detected a maximum of 7 addresses in 5 cases of fraud, the proposed method has performed well. Therefore, the proposed method, by presenting a new approach, in addition to reducing the processing power to extract features, succeeded in detecting abnormal users and also was able to find more transactions and addresses committed a scam.
Tim Weingärtner, Danielle Alves Batista, Sandro Köchli, Gilles Voutat
Corruption in public procurement is a worldwide appearance that causes immense financial and reputational damages. Especially in developing countries, corruption is a widespread issue due to secrecy and lack of transparency. An important instrument for transparency and accountability assurance is the record which is managed and controlled by recordkeeping systems. Blockchain technology and more precisely blockchain-based smart contracts are emerging technological tools that can be used as recordkeeping systems and a tool to mitigate some of the fraud involving public procurement records. Immutability, transparency, distribution and automation are some of the features of smart contracts already implemented in several applications to avoid malicious human interference. In this paper, we discuss some of the frauds in public procurement, and we propose smart contracts to automatize different stages of the public procurement procedure attempting to fix their biggest current weaknesses. The processes we have focused on include the bidding process, supplier habilitation and delivery verification. In the three subprocesses, common irregularities include human fallibility, improper information disclosure and hidden agreements which concern not only governments but also civil society. To show the feasibility and usability of our proposal, we have implemented a prototype that demonstrates the process using sample data.
One of the requirements for mining cryptocurrency (Crypto) is that the secured ledger of the blockchain must be updated. However, updating the secured ledger requires that the miner develop and solve complex mathematical equations in higher orders hexadecimal 64-digit solution called a hash. In addition to this challenge, the mining processes of cryptocurrency are both resource and cost-intensive. The resources required include, but not limited to mining software, hardware, power (energy usage), CPU or compute cycles, and NP-hard problem. Apart from these numerous challenges that are associated with mining cryptocurrency, the amount of speed that is required to mine a single block is core. Cryptocurrency mining speed requirement is significantly important because only miners that can have the fastest mining device are most likely to get the reward (profit) from competing for a block. In this paper, we designed and implemented a model to speed up mining process which is capable of giving miners an advantage to arrive at a block earlier. The novelty of our architecture is that our design is based on high performance computing paradigm where we achieve processor speed up by parallelizing the number of processors p. We experimented by varying p = 4, 8, 16. Our experimental results where we used the MC6800 simulated on Easy68k emulator demonstrate feasibility of our proposed model and prove that speed was an essential key to cryptocurrency mining. Keywords: Cryptocurrency, Blockchain, Architecture, Mining, Speedup, Bitcoin. CISDI Journal Reference Format Allenotor, D. & Oyemade, D. A. (2021): An Optimized Parallel Hybrid Architecture for Cryptocurrency Mining. Computing, Information Systems, Development Informatics & Allied Research Journal. Vol 12 No 1, Pp 95-104 DOI - https://doi.org/ 10.22624/AIMS/CISDI/V12N1P10. Available online at www.isteams.net/cisdijournal
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Smart Contracts (SCs) in Ethereum can automate tasks and provide different functionalities to a user. Such automation is enabled by the `Turing-complete' nature of the programming language (Solidity) in which SCs are written. This also opens up different vulnerabilities and bugs in SCs that malicious actors exploit to carry out malicious or illegal activities on the cryptocurrency platform. In this work, we study the correlation between malicious activities and the vulnerabilities present in SCs and find that some malicious activities are correlated with certain types of vulnerabilities. We then develop and study the feasibility of a scoring mechanism that corresponds to the severity of the vulnerabilities present in SCs to determine if it is a relevant feature to identify suspicious SCs. We analyze the utility of severity score towards detection of suspicious SCs using unsupervised machine learning (ML) algorithms across different temporal granularities and identify behavioral changes. In our experiments with on-chain SCs, we were able to find a total of 1094 benign SCs across different granularities which behave similar to malicious SCs, with the inclusion of the smart contract vulnerability scores in the feature set.
Rohit Kumar Sachan, Rachit Agarwal, Sandeep K. Shukla
The rise in the adoption of blockchain technology has led to increased illegal activities by cybercriminals costing billions of dollars. Many machine learning algorithms are applied to detect such illegal behavior. These algorithms are often trained on the transaction behavior and, in some cases, trained on the vulnerabilities that exist in the system. In our approach, we study the feasibility of using the Domain Name (DN) associated with the account in the blockchain and identify whether an account should be tagged malicious or not. Here, we leverage the temporal aspects attached to the DN. Our approach achieves 89.53% balanced-accuracy in detecting malicious blockchain DNs. While our results identify 73769 blockchain DNs that show malicious behavior at least once, out of these, 34171 blockchain DNs show persistent malicious behavior, resulting in 2479 malicious blockchain DNs over time. Nonetheless, none of these identified malicious DNs were reported in new officially tagged malicious blockchain DNs.
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Smart Contracts (SCs) in Ethereum can automate tasks and provide different\nfunctionalities to a user. Such automation is enabled by the `Turing-complete'\nnature of the programming language (Solidity) in which SCs are written. This\nalso opens up different vulnerabilities and bugs in SCs that malicious actors\nexploit to carry out malicious or illegal activities on the cryptocurrency\nplatform. In this work, we study the correlation between malicious activities\nand the vulnerabilities present in SCs and find that some malicious activities\nare correlated with certain types of vulnerabilities. We then develop and study\nthe feasibility of a scoring mechanism that corresponds to the severity of the\nvulnerabilities present in SCs to determine if it is a relevant feature to\nidentify suspicious SCs. We analyze the utility of severity score towards\ndetection of suspicious SCs using unsupervised machine learning (ML) algorithms\nacross different temporal granularities and identify behavioral changes. In our\nexperiments with on-chain SCs, we were able to find a total of 1094 benign SCs\nacross different granularities which behave similar to malicious SCs, with the\ninclusion of the smart contract vulnerability scores in the feature set.\n
Android mobile devices are a prime target for a huge number of cyber-criminals as they aim to create malware for disrupting and damaging the servers, clients, or networks. Android malware are in the form of malicious apps, that get downloaded on mobile devices via the Play Store or third-party app markets. Such malicious apps pose serious threats like system damage, information leakage, financial loss to user, etc. Thus, predicting which apps contain malicious behavior will help in preventing malware attacks on mobile devices. Identifying Android malware has become a major challenge because of the ever-increasing number of permissions that applications ask for, to enhance the experience of the users. And most of the times, permissions and other features defined in normal and malicious apps are generally the same. In this paper, we aim to detect Android malware using machine learning, deep learning, and natural language processing techniques. To delve into the problem, we use the Android manifest files which provide us with features like permissions which become the basis for detecting Android malware. We have used the concept of information value for ranking permissions. Further, we have proposed a consensus-based blockchain framework for making more concrete predictions as blockchain have high reliability and low cost. The experimental results demonstrate that the proposed model gives the detection accuracy of 95.44% with the Random Forest classifier. This accuracy is achieved with top 45 permissions ranked according to Information Value.
In recent years, phishing scams have become the crime type with the largest money involved on Ethereum, the second-largest blockchain platform. Meanwhile, graph neural network (GNN) has shown promising performance in various node classification tasks. However, for Ethereum transaction data, which could be naturally abstracted to a real-world complex graph, the scarcity of labels and the huge volume of transaction data make it difficult to take advantage of GNN methods. Here in this paper, to address the two challenges, we propose a Self-supervised Incremental deep Graph learning model (SIEGE), for the phishing scam detection problem on Ethereum. In our model, two pretext tasks designed from spatial and temporal perspectives help us effectively learn useful node embedding from the huge amount of unlabelled transaction data. And the incremental paradigm allows us to efficiently handle large-scale transaction data and help the model maintain good performance when the data distribution is drastically changing. We collect transaction records about half a year from Ethereum and our extensive experiments show that our model consistently outperforms strong baselines in both transductive and inductive settings.
Despite the fact that it is publicly available, collecting and processing the full bitcoin blockchain data is not trivial. Its mere size, history, and other features indeed raise quite specific challenges, that we address in this paper. The strengths of our approach are the following: it relies on very basic and standard tools, which makes the procedure reliable and easily reproducible; it is a purely lossless procedure ensuring that we catch and preserve all existing data; it provides additional indexing that makes it easy to further process the whole data and select appropriate subsets of it. We present our procedure in details and illustrate its added value on large-scale use cases, like address clustering. We provide an implementation online, as well as the obtained dataset.
Abstract Miners in various blockchain-backed cryptocurrency networks compete to maintain the validity of the underlying distributed ledgers to earn the bootstrapped cryptocurrencies. With limited hashing power, each miner needs to decide how to allocate their resource to different cryptocurrencies so as to achieve the best overall payoff. Together all the miners form a hashing power allocation game. We consider two settings of the game, depending on whether each miner can allocate their fund to a risk-free asset or not. We show that this game admits unique pure Nash equilibrium in closed-form for both settings.
The existing supply chain for the pharmaceutical industry is obsolete and lacks clear visibility over the entire system. Moreover, the circulation of counterfeit drugs in the market has increased over the years. According to the WHO report, around 10.5% of the medicinal drugs in lower / middle income countries are fake and such drugs may pose serious threats to public health, sometimes leading to death. Keeping these threats in mind, in this paper, we propose a blockchain-based model to track the movement of drugs from the industry to the patient and to minimize the chances of a drug being counterfeit. The reasons for using blockchain technology in our work include its immutability property and easy tracking of an entity in the blockchain. Through this proposed model, the manufacturer would be able to upload the details corresponding to a drug, after which it will be sent for approval to the Government. Thereafter, hospitals and pharmacies, based upon their requirements, can request the approved drugs. In the future, if a patient wants some medication, then he or she has to request it on the blockchain network. The request will be sent to the nearest hospital/pharmacy and thereafter, the patient can collect the medication. To implement this model, we have used Hyperledger fabric due to the presence of many auto-implemented features in it. Our implementation of the proposed blockchain based model highlights that the model can successfully detect any drug being counterfeit. This will be beneficial for the users getting affected with counterfeit drugs. Moreover, with the proposed model, we can also track the movement of the drug beginning from the manufacturer right up to the patient consuming that drug. Index Terms: Blockchain, Counterfeit Drugs, Drugs Tracking, Fake Medicines, Health Care.
Bütün sektörler dahilinde finans sektöründe de müşterilere ait fikir ve düşüncelerinin belirlenmesi, firma ve kurumların ileriki dönemler için sunacağı hizmetleri etkilemektedir. Kripto para birimlerinin (Bitcoin, Ethereum, Ripple vb.) ekonomik ve sosyal etkileri hızla artmaya devam ettikçe, ilgili haber makalelerinin ve sosyal medya yayınlarının, özellikle de tweetlerin yaygınlığı da artmaktadır. Bu çalışmada, Twitter kullanıcılarının finans sektörü konularından biri olan Bitcoin ile ilgili yorumları derlenerek bir duygu analizi çalışması yapılmıştır. Kullanıcı yorumları, Twitter’ın sunmuş olduğu API hizmeti vasıtasıyla Python Programlama Dili kullanılarak alınmış; yorumlar olumlu, nötr ve olumsuz etiketler ile ayrıştırılmış, etiket bulutunda toplanmıştır. Naïve Bayes ve Lojistik Regresyon algoritmaları kullanılarak oluşturulan modellerde başarı oranları karşılaştırılmıştır. Naïve Bayes uygulamasının tweetlerin duygularını tahmin etmedeki başarı oranı %72,19 olurken, Lojistik Regresyon uygulamasında bu oran %75,53 olmuştur. Çalışmanın ikinci aşamasında ise, duygu analizinden sonra “Bitcoin” anahtar kelimesi içeren günlük pozitif tweet oranı ile Bitcoin günlük açılış değeri beraber kullanılarak Bitcoin kapanış değeri tahminlemesi yapılmıştır. Finans verileri Yahoo Finance web sitesi üzerinden alınmış; Doğrusal Regresyon ve Rastgele Orman Regresyon yöntemleri ile modeller oluşturulmuştur. Doğrusal Regresyon için r² değeri %88,97 çıkarken, Rastgele Orman Regresyonu için ise %94,16 olmuştur.Anahtar Kelimeler: Duygu analizi, Twitter, Bitcoin, Makine öğrenmesi, Veri madenciliği, Finans
One of the most important discoveries and creative developments that is playing a vital role in the professional world today is blockchain technology. A blockchain is a distributed, digitized and consensus-based secure information storage mechanism. Blockchain technology moves in the direction of persistent revolution and change. In the last couple of years, the upsurge in blockchain technology has obliged scholars and specialists to scrutinize new ways to apply blockchain technology with a wide range of domains. The dramatic increase in blockchain technology has provided many new application opportunities, including e-voting application. The present article provides a systematic review of emerging blockchain-based e-voting systems. In this paper, we call attention to the open research matters in this fast-growing field, explaining them in some details. It was concluded that frameworks needed enhancements in order to be used in voting systems due to these reservations. KEYWORDS: blockchain, e-voting, cloud computing, ethereum; ballot
Smart contract is the building block of blockchain systems that enables automated peer-to-peer transactions and decentralized services. With the increasing popularity of smart contracts, blockchain systems, in particular Ethereum, have been the "paradise" of versatile fraud activities in which Ponzi, Honeypot and Phishing are the prominent ones. Formal verification and symbolic analysis have been employed to combat these destructive scams by analyzing the codes and function calls, yet the vulnerability of each \emph{individual} scam should be predefined discreetly. In this work, we present SCSGuard, a novel deep learning scam detection framework that harnesses the automatically extractable bytecodes of smart contracts as their new features. We design a GRU network with attention mechanism to learn from the \emph{N-gram bytecode} patterns, and determines whether a smart contract is fraudulent or not. Our framework is advantageous over the baseline algorithms in three aspects. Firstly, SCSGuard provides a unified solution to different scam genres, thus relieving the need of code analysis skills. Secondly, the inference of SCSGuard is faster than the code analysis by several order of magnitudes. Thirdly, experimental results manifest that SCSGuard achieves high accuracy (0.92$\sim$0.94), precision (0.94$\sim$0.96\%) and recall (0.97$\sim$0.98) for both Ponzi and Honeypot scams under similar settings, and is potentially useful to detect new Phishing smart contracts.
Ethereum Smart Contracts based on Blockchain Technology (BT)enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum smart contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. In this study, we review the existing literature and broadly classify the BT applications. As Ethereum smart contracts find their application mostly in e-commerce applications, we believe these are more commonly vulnerable to attacks. In these smart contracts, we mainly focus on identifying vulnerabilities that programmers and users of smart contracts must avoid. This paper aims at explaining eight vulnerabilities that are specific to the application level of BT by analyzing the past exploitation case scenarios of these security vulnerabilities. We also review some of the available tools and applications that detect these vulnerabilities in terms of their approach and effectiveness. We also investigated the availability of detection tools for identifying these security vulnerabilities and lack thereof to identify some of them
Thousands of new cryptocurrencies have been introduced in recent years. Most are introduced with a so-called "whitepaper" containing a mix of technical documentation, legal boilerplate and marketing material. Notably, many proposed currencies reuse text from previous established cryptocurrencies. We analyze the whitepapers from 1 260 actively traded cryptocurrencies and 2 039 ICOs. We develop two measures of similarity. Moderately similar papers reuse text in a portion of the paper, often the legal disclaimers. By contrast, some highly similar whitepapers appear to copy most of the text. 4% of coin and 19% of ICO whitepapers are highly similar to those of traded coins. The fraction rises to 64% for coins and 67% for ICOs when we consider moderate text reuse.
N. Suganthi, Gokul Sridharan, E Shravanth, K. Veena
Abstract: Democratic rule is based on safe and open electoral systems that can preserve their authenticity. The conventional voting processes are hampered significantly by electoral fraud and security breaches as well as centralized management and inefficiencies in auditability and accessibility. The issues of electoral systems reduce public trust along with lowering the credibility of election results. This paper introduces a new three-tier blockchain-based e-voting system designed to enhance voter privacy alongside system scalability and end-to-end verifiability to restore trust in electoral processes. Voter verification at Layer 1 (Identity Verification) combines Decentralized Identity (DID) with Zero-Knowledge Proofs (ZKP) and multimodal biometric techniques involving fingerprint scanning, facial recognition technology, and voice analysis. The system enables only the participation of valid voters while also protecting their private data and fulfilling different user needs. The system's Layer 2 (Vote Casting & Secure Storage) employs a hybrid consensus algorithm combining Byzantine Fault Tolerance (BFT) and Delegated Proof-of-Stake (dPoS) to store votes securely while reducing energy consumption. The system leverages Triple-Blind Signatures to provide complete voter anonymity by decoupling voter identities from their votes as well as any accompanying metadata. Lattice-based post-quantum cryptography is employed to encrypt votes which are distributed across sharded blockchain subnets for enhanced performance without sacrificing fault tolerance. The system accumulates votes via Merkle roots and verifies them via zk-SNARKs in Layer 3 (Result Processing & Transparency) that allows public observation without compromising voter privacy. A Live Audit Dashboard provides voters with the capability to check their vote in real time which facilitates transparent and accountable voting processes. The suggested system attains a secure and open electronic voting process using sophisticated cryptographic protocols in a decentralized setup compliant with international requirements while enabling digital democratic participation.
Blockchain technology's (BT) Ethereum Smart Contracts allows programmable transactions that involve the transfer of monetary assets among peers on a BT network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This technology enables consumers to make agreements in a transparent and conflict-free environment. However, the security vulnerabilities within these smart contracts are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. In this paper, we propose a framework that combines static and dynamic analysis to detect Denial of Service (DoS) vulnerability due to an unexpected revert in Ethereum Smart Contracts. Our framework, SmartScan, statically scans smart contracts under test (SCUTs) to identify patterns that are potentially vulnerable in these SCUTs and then uses dynamic analysis to precisely confirm their exploitability of the DoS-Unexpected Revert vulnerability, thus achieving increased performance and more precise results. We evaluated SmartScan on a set of 500 smart contracts collected from the Etherscan. Our approach shows an improvement in precision and recall when compared to available state of the art techniques.
Nikolay Ivanov, Jianzhi Lou, Ting Chen, Jin Li · 5 authors
Ethereum holds multiple billions of U.S. dollars in the form of Ether cryptocurrency and ERC-20 tokens, with millions of deployed smart contracts algorithmically operating these funds. Unsurprisingly, the security of Ethereum smart contracts has been under rigorous scrutiny. In recent years, numerous defense tools have been developed to detect different types of smart contract code vulnerabilities. When opportunities for exploiting code vulnerabilities diminish, the attackers start resorting to social engineering attacks, which aim to influence humans -- often the weakest link in the system. The only known class of social engineering attacks in Ethereum are honeypots, which plant hidden traps for attackers attempting to exploit existing vulnerabilities, thereby targeting only a small population of potential victims. In this work, we explore the possibility and existence of new social engineering attacks beyond smart contract honeypots. We present two novel classes of Ethereum social engineering attacks - Address Manipulation and Homograph - and develop six zero-day social engineering attacks. To show how the attacks can be used in popular programming patterns, we conduct a case study of five popular smart contracts with combined market capitalization exceeding $29 billion, and integrate our attack patterns in their source codes without altering their existing functionality. Moreover, we show that these attacks remain dormant during the test phase but activate their malicious logic only at the final production deployment. We further analyze 85,656 open-source smart contracts, and discover that 1,027 of them can be used for the proposed social engineering attacks. We conduct a professional opinion survey with experts from seven smart contract auditing firms, corroborating that the exposed social engineering attacks bring a major threat to the smart contract systems.