With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose NoisePrints, a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.
The Metaverse has evolved into a transformative ecosystem, merging virtual and physical realities with consumer electronics and IoT to enable immersive experiences. However, vulnerabilities like avatar impersonation, identity theft, and Sybil attacks, compounded by centralized intermediaries, underscore the urgent need for decentralized solutions to enhance interoperability, security, and user-centricity. This paper proposes a smart contract-based authentication scheme for the Metaverse, leveraging Web 3.0 technologies to achieve decentralization and address existing limitations. The scheme ensures user-server and avatar-avatar authentication while maintaining anonymity, unlinkability, and incorporating an avatar revocation mechanism. Security validation is conducted using the informal analysis, and smart contract implementation. The system’s operational efficiency is benchmarked against existing solutions using metrics such as computational, bandwidth, and communication costs. Results demonstrate the proposed scheme’s superior performance in reducing computational and communication overhead, making it highly suitable for Metaverse applications. Additionally, the smart contract is implemented on the Ethereum test network, confirming its feasibility and showcasing an acceptable cost for blockchain consumption.
As Web3 matures, decentralized naming and storage systems, such as ENS, Unstoppable Domains, and IPFS, offer new paradigms for publishing and accessing web content without relying on centralized infrastructure.However, the process of retrieving content in such an environment remains fragmented, often dependent on vulnerable public gateways or centralized APIs.This paper investigates the resilience of content retrieval in decentralized systems, using Web3Compass as a case study.The system integrates real-time registry monitoring, onchain name resolution, and direct access to decentralized storage via self-hosted IPFS nodes.By avoiding reliance on third-party resolution services and fallback gateways except when necessary, Web3Compass provides a robust method for discovering and rendering Web3 websites.We detail the system's architecture, including resolver logic, node infrastructure, and content validation policies, and evaluate its robustness against gateway failure, incomplete pinning, and resolution inconsistencies.Our findings indicate that proactive pinning, resolver-specific logic, and local node infrastructure significantly improve access reliability, even under constrained network conditions.
Introduction: Digital content, including images and videos, is increasingly ruling the online world, and so multimedia services form a part of this modern life. However, the digital resources face significant problems, especially regarding copyright infringement. In such an instance, any modification without authority infringes intellectual property rights. Methods: Based on Inter Planetary File System (IPFS) and blockchain technology, a decentralized and distributed framework has been proposed in this study for dealing with insecurity over digital assets and openness of multimedia resources. In this respect, secure, transparent, and immutable transactions in regard to the transfer and ownership of creative works have been facilitated by the use of such a framework. Results: This paper proposes novel decentralized and Blockchain enabled framework to address the problem of video copyright protection by employing solidity based smart contract in a Ethereum network, that allows the content creators to register their videos. The designed smart contract performs copyright checks and release copyright disputes by generating and comparing perceptual hash's (Phash) for original video and modified video. Discussion: Phash techniques play a crucial role in multimedia content analysis, particularly in verifying the integrity and similarity of the video data under various transformations. Additionally, the framework generates Inter Planetary File System (IPFS) main values that signifies the ownership of the video content. Then it compars the phash values, IPFS and similarly score in public Blockchain environment i.e. Ethereum. The framework performance was measured by simulating the contracts of the Application Binary Interface (ABI), JSON file in the Hyperledger Caliper environment. This result shows the performance in the form of video registration, the measured latency was 5.02 seconds with a throughput of 409.87 seconds. For video verification the latency was 4.57 seconds with a throughput of 484.23 seconds.
Smart contract upgrades are increasingly common due to their flexibility in modifying deployed contracts, such as fixing bugs or adding new functionalities. Meanwhile, upgrades compromise the immutability of contracts, introducing significant security concerns. While existing research has explored the security impacts of contract upgrades, these studies are limited in collection of upgrade behaviors and identification of insecurities. To address these limitations, we conduct a comprehensive study on the insecurities of upgrade behaviors. First, we build a dataset containing 83,085 upgraded contracts and 20,902 upgrade chains. To our knowledge, this is the first large-scale dataset about upgrade behaviors, revealing their diversity and exposing gaps in public disclosure. Next, we develop a taxonomy of insecurities based on 37 real-world security incidents, categorizing eight types of upgrade risks and providing the first complete view of upgrade-related insecurities. Finally, we survey public awareness of these risks and existing mitigations. Our findings show that four types of security risks are overlooked by the public and lack mitigation measures. We detect these upgrade risks through a preliminary study, identifying 31,407 related issues - a finding that raises significant concerns.
Self-Sovereign Identity (SSI) is a paradigm for digital identity management that offers privacy and flexibility advantages. A key technology in SSI is Decentralized Identifiers (DIDs) and their associated metadata, DID Documents (DDOs). DDOs contain crucial verification material such as the public keys of the entity identified by the DID (i.e., the DID subject) and are often anchored on a distributed ledger to ensure security and availability. Long-lived DIDs must support updates (e.g., key rotation). Ideally, only the DID subject should authorize DDO updates. However, in practice, update capabilities may be shared or delegated. While the DID specification acknowledges such scenarios, it does not define how updates should be authorized when multiple entities jointly control a DID (i.e., group control). This article examines the implementation of an on-chain, trustless mechanism enabling DID controllers under group control to program their governance rules. The main research question is the following: Can a technical mechanism be developed to orchestrate on-chain group control of a DDO in a ledger-agnostic and adaptable manner?
The integration of blockchain technology introduced smart contracts, which revolutionized the automation and security of executing transactions. This article focuses on using smart contracts to manage information service subscriptions where reliability, transparency, and efficiency are required. Subscription management suffers from payment delays, trust issues, errors, and many other problems. Through automation and smart contracts, the self-executing nature of these agreements helps organizations streamline subscriptions, enforce terms with less risk, and greatly reduce operational blunders. Blunders. In this paper, I thoroughly review smart contracts, explore current gaps within subscription management, and explain how integrating blockchain can fill them. Some successful implementations are presented as case studies. Others discuss technical and organizational hurdles for practical adoption. Future scope widens by providing insight into blockchain-based decentralized solutions' role in contemporary subscription-centered business models. The research ends by recommending information service providers adopt smart contracts for better operational efficiency, reduced costs, and stronger customer relations.
Nominative signatures allow us to indicate who can verify a signature, and they can be employed to construct a non-transferable signature verification system that prevents the signature verification by a third party in unexpected situations. For example, this system can prevent IOU/loan certificate verification in unexpected situations. However, nominative signatures themselves do not allow the verifier to check whether the funds will be transferred in the future or have been transferred.It would be desirable to verify the fact simultaneously when the system involves a certain money transfer such as cryptocurrencies/cryptoassets. In this paper, we propose a smart contract-based non-transferable signature verification system using nominative signatures. We pay attention to the fact that the invisibility, which is a security requirement to be held for nominative signatures, allows us to publish nominative signatures on the blockchain. Our system can verify whether a money transfer actually will take place, in addition to indicating who can verify a signature. We transform the Hanaoka-Schuldt nominative signature scheme (ACNS 2011, IEICE Trans. 2016) which is constructed over a symmetric pairing to a scheme constructed over an asymmetric pairing, and evaluate the gas cost when a smart contract runs the verification algorithm of the modified Hanaoka-Schuldt nominative signature scheme.
The explosive growth of Non-Fungible Tokens (NFTs) has revolutionized digital ownership by enabling the creation, exchange, and monetization of unique assets on blockchain networks. However, this surge in popularity has also given rise to a disturbing trend: the emergence of rug pulls - fraudulent schemes where developers exploit trust and smart contract privileges to drain user funds or invalidate asset ownership. Central to many of these scams are hidden backdoors embedded within NFT smart contracts. Unlike unintentional bugs, these backdoors are deliberately coded and often obfuscated to bypass traditional audits and exploit investor confidence. In this paper, we present a large-scale static analysis of 49,940 verified NFT smart contracts using Slither, a static analysis framework, to uncover latent vulnerabilities commonly linked to rug pulls. We introduce a custom risk scoring model that classifies contracts into high, medium, or low risk tiers based on the presence and severity of rug pull indicators. Our dataset was derived from verified contracts on the Ethereum mainnet, and we generate multiple visualizations to highlight red flag clusters, issue prevalence, and co-occurrence of critical vulnerabilities. While we do not perform live exploits, our results reveal how malicious patterns often missed by simple reviews can be surfaced through static analysis at scale. We conclude by offering mitigation strategies for developers, marketplaces, and auditors to enhance smart contract security. By exposing how hidden backdoors manifest in real-world smart contracts, this work contributes a practical foundation for detecting and mitigating NFT rug pulls through scalable automated analysis.
Ensuring software quality in the Web3 ecosystem presents unique challenges due to its decentralized architecture and evolving technical landscape. While international standards such as the SQuaRE (Systems and software Quality Requirements and Evaluation) framework offer structured approaches for quality assurance, they are often perceived as overly theoretical and not directly applicable to blockchain-based applications. This study aims to translate these standards into actionable practices suitable for Web3 environments, thereby supporting compliance and fostering stakeholder trust. Using the Design Science Research methodology, complemented by Lean Startup principles, a practical quality assurance guide was co-developed through collaboration between VOH.CoLAB researchers and the Exeedme project team and inspired by the practical experience in gaming and digital assets trading blockchain-based platforms. The resulting guide includes a structured framework comprising eight testing domains, 16 sub-domains and 108 targeted tests, with the domains addressing critical features of blockchain software, including, functional suitability, integration, security, performance, usability, portability, recoverability and resilience. This work contributes to the operationalization of international quality standards in decentralized technology, promoting more resilient and trustworthy blockchain applications.
Web-based credit card payments require complete disclosure of all payment card details for transaction authorization. The card’s CVV (Card Verification Value) is the secret code that authorizes card not presented transactions. Currently, all payment card details must be shared among various intermediaries involved in processing the transaction. To mitigate the risks associated with fraudulent transactions, industries have adopted security standards such as the PCI DSS. Credit card data confidentiality rests on all involved stakeholders adhering to best security practices, including data communication encryption, and do not misuse the payment information. However, this security posture does not prevent potential credit card data leaks. We propose an alternative method for conducting remote card payments that does not require disclosing the authorization code while ensuring high interoperability with existing payment networks. Our approach demonstrates how designated verifier Zero-Knowledge Proofs (ZKP) enable minimal disclosure of card details, particularly protecting the confidentiality of authorization codes.
Large language models (LLMs) are rapidly evolving into autonomous agents that cooperate across organizational boundaries, enabling joint disaster response, supply-chain optimization, and other tasks that demand decentralized expertise without surrendering data ownership. Yet, cross-domain collaboration shatters the unified trust assumptions behind current alignment and containment techniques. An agent benign in isolation may, when receiving messages from an untrusted peer, leak secrets or violate policy, producing risks driven by emergent multi-agent dynamics rather than classical software bugs. This position paper maps the security agenda for cross-domain multi-agent LLM systems. We introduce seven categories of novel security challenges, for each of which we also present plausible attacks, security evaluation metrics, and future research guidelines.
1. Abstract The abstract introduces the growing issue of counterfeit products affecting global supply chains and consumer safety. It states that traditional methods—like barcodes, holograms, and watermarks—are increasingly ineffective due to technological advancements in forgery. To address this, the paper proposes a hybrid authentication framework combining the security of blockchain with the convenience and accessibility of QR codes (smart codes). It summarizes the methodology, highlights real-world examples, and touches on the system’s benefits, including enhanced traceability, consumer trust, and tamper-resistance. The abstract concludes by noting the paper’s focus on methodology, performance evaluation, future scope, and supporting case studies.
Sangharatna Godboley, P. Radha Krishna, Sunkara Sri Harika, Pooja Varnam
We propose and develop a framework for validating smart contracts derived from e-contracts. The goal is to ensure the generated smart contracts fulfil all the conditions outlined in their corresponding e-contracts. By confirming alignment between the smart contracts and their original agreements, this approach enhances trust and reliability in automated contract execution. The proposed framework will systematically compare and validate the terms and clauses of the e-contracts with the logic of the smart contracts. This validation confirms that the agreement is accurately translated into executable code. Automated verification identifies issues between the e-contracts and their smart contract counterparts. This proposed work will solve the problems of gap between legal language and code execution, this framework ensures seamless integration of smart contracts into the existing legal framework.
MintMart is a decentralized Web3 platform designed for simplifying the process of buying, selling and creating NFTs (Non Fungible Tokens). Currently there are various existing platforms in the market which have features like transparent transactions, auctions in marketplace etc. However they lack some focus in areas of secure transactions, irregular platform fee and royalty compensation for owners which plays an important role in such platforms. The proposed system is designed with an objective to encounter such problems and make the use of NFT marketplace more seamless for the users. The proposed system uses blockchain technology to confront the existing issues. Royalty compensation distribution becomes easier using smart contracts and libraries like OpenZeppelin which helps in better integration of royalty features using its ERC-721 standard. Also MintMart offers fixed minim MintMart is a decentralized Web3 platform designed for simplifying the process of buying, selling and creating NFTs (Non Fungible Tokens). Currently there are various existing platforms in the market which have features like transparent transactions, auctions in marketplace etc. However they lack some focus in areas of secure transactions, irregular platform fee and royalty compensation for owners which plays an important role in such platforms. The proposed system is designed with an objective to encounter such problems and make the use of NFT marketplace more seamless for the users. The proposed system uses blockchain technology to confront the existing issues. Royalty compensation distribution becomes easier using smart contracts and libraries like OpenZeppelin which helps in better integration of royalty features using its ERC-721 standard. Also MintMart offers fixed minimal platform fee making it more accessible for users The proposed system can successfully support multiple digital formats like images, videos etc. and has also achieved cross chain compatibility allowing users to interact with various blockchain networks. MintMart plans to expand its features in the near future. These include personalized recommendations, live bidding for NFTs on the marketplace, etc., thus aiming to increase user engagement. The proposed system can successfully support multiple digital formats like images, videos, etc., and has also achieved cross-chain compatibility, allowing users to interact with various blockchain networks. MintMart plans to expand its features in the near future. These include personalized recommendations, live bidding for NFTs on the marketplace, etc., thus aiming to increase user engagement.
Kai Ma, Ningyu He, Jintao Huang, B. X. Zhang · 6 authors
Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Token (NFT) ecosystem, there are indications that cybersquatting tactics have evolved from targeting domain names to NFTs. This paper presents the first in-depth measurement study of NFT cybersquatting. By analyzing over 220K NFT collections with over 150M NFT tokens, we have identified 8,019 cybersquatting NFT collections targeting 654 popular NFT projects. Through systematic analysis, we discover and characterize seven distinct squatting tactics employed by scammers. We further conduct a comprehensive measurement study of these cybersquatting NFT collections, examining their metadata, associated digital asset content, and social media status. Our analysis reveals that these NFT cybersquatting activities have resulted in a significant financial impact, with over 670K victims affected by these scams, leading to a total financial exploitation of $59.26 million. Our findings demonstrate the urgency to identify and prevent NFT squatting abuses.
Smart contracts are a secure and trustworthy application that plays a vital role in decentralized applications in various fields such as insurance,the internet, and gaming. However, in recent years, smart contract security breaches have occurred frequently, and due to their financial properties, they have caused huge economic losses, such as the most famous security incident "The DAO" which caused a loss of over $60 million in Ethereum. This has drawn a lot of attention from all sides. Writing a secure smart contract is now a critical issue. This paper focuses on Ether smart contracts and explains the main components of Ether, smart contract architecture and mechanism. The environment used in this paper is the Ethernet environment, using remix online compilation platform and Solidity language, according to the four security events of American Chain, The DAO, Parity and KotET, the principles of integer overflow attack, reentrant attack, access control attack and denial of service attack are studied and analyzed accordingly, and the scenarios of these vulnerabilities are reproduced, and the measures to prevent them are given. Finally, preventive measures are given. In addition, the principles of short address attack, early transaction attack and privileged function exposure attack are also introduced in detail, and security measures are proposed. As vulnerabilities continue to emerge, their classification will also evolve. The analysis and research of the current vulnerabilities are also to lay a solid foundation for avoiding more vulnerabilities.
A Decentralized Identifier (DID) empowers an entity to prove control over a unique and self-issued identifier without relying on any identity provider. The public key material for the proof is encoded into an associated DID document (DDO). This is preferable shared via a distributed ledger because it guarantees algorithmically that everyone has access to the latest state of any tamper-proof DDO but only the entities in control of a DID are able to update theirs. Yet, it is possible to grant deputies the authority to update the DDO on behalf of the DID owner. However, the DID specification leaves largely open on how authorizations over a DDO are managed and enforced among multiple deputies. This article investigates what it means to govern a DID and discusses various forms of how a DID can be controlled by potentially more than one entity. It also presents a prototype of a DID-conform identifier management system where a selected set of governance policies are deployed as Smart Contracts. The article highlights the critical role of governance for the trustworthy and flexible deployment of ledger-anchored DIDs across various domains.
The advancement of Industrial Internet of Things (IIoT) has enabled cross-domain collaboration among enterprises, facilitating data exchange and coordinated operations for complex manufacturing tasks. As the primary security mechanism, cross-domain continuous authentication periodically verifies external devices to prevent unauthorized access and session hijacking, thereby mitigating system vulnerabilities. However, existing solutions face limitations: some rely on device-specific features incompatible with heterogeneous environments, while others neglect cross-domain scenarios, offering insufficient privacy protection and irreversible identity management. To address these gaps, we propose a cross-domain authentication framework leveraging zero-knowledge proofs and blockchain technology. Devices are assigned anonymous identities, with revocation managed via a distributed ledger. Initial authentication employs zero-knowledge proofs to generate valid tokens, while continuous authentication refreshes these tokens periodically. Security analysis confirms robustness against common threats, and performance evaluations demonstrate that periodic token renewal reduces computational and communication costs compared to repeated initial authentication processes.
This study proposes a decentralized framework that merges smart contract based Decentralized Finance (DeFi) protocols and traditional Enterprise Resource Planning (ERP) systems to provide secure, automatic, and verifiable transaction execution. It constructs an additional middleware interface to guarantee interoperability between ERP modules and blockchain networks that utilize smart contracts for procurement, finance, and asset management modules. The system was tested empirically within a hybrid testbed of chains with Ethereum Virtual Machine (EVM) compatibility simulation executing ERP transaction testing on a simulated environment with physical hardware. According to quantitative assessment results, performance increased, achieving a 38% increase in transaction throughput, a 27% decrease in execution costs, increased trust and traceability due to cryptographic audit trails, and improved auditability. The research highlights the potential of DeFi integrated ERP systems for decentralized enterprise finance systems as a scalable secure replacement to centralized enterprise finance systems.
Ye Liu, Yuqing Niu, Chengyan Ma, Ruidong Han · 8 authors
Smart contracts are highly susceptible to manipulation attacks due to the leakage of sensitive information. Addressing manipulation vulnerabilities is particularly challenging because they stem from inherent data confidentiality issues rather than straightforward implementation bugs. To tackle this by preventing sensitive information leakage, we present PartitionGPT, the first LLM-driven approach that combines static analysis with the in-context learning capabilities of large language models (LLMs) to partition smart contracts into privileged and normal codebases, guided by a few annotated sensitive data variables. We evaluated PartitionGPT on 18 annotated smart contracts containing 99 sensitive functions. The results demonstrate that PartitionGPT successfully generates compilable, and verified partitions for 78% of the sensitive functions while reducing approximately 30% code compared to function-level partitioning approach. Furthermore, we evaluated PartitionGPT on nine real-world manipulation attacks that lead to a total loss of 25 million dollars, PartitionGPT effectively prevents eight cases, highlighting its potential for broad applicability and the necessity for secure program partitioning during smart contract development to diminish manipulation vulnerabilities.
In view of the problems of false property rights and difficulties in identity authentication in intellectual property transactions, an identity authentication model for intellectual property transactions based on an alliance chain is proposed. Firstly, the two-factor identity authentication model's roles, functions, and processes are constructed. Secondly, the two-factor authentication mechanism of ID password combined with physiological and property rights features is proposed, the identity identification generation method of fingerprint biometrics and intellectual property features is established, and the constraint compression strategy based on Poseidon hash is designed to reduce the workload of zero-knowledge proof algorithm and realize the consistency of property rights identity. Finally, the security and performance analysis of the authentication model is carried out, and the comparison and validation of related models are carried out, which shows that the model has good security and reliability.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Ben Biedermann, Matthew Scerri, Victoria Kozlova, Joshua Ellul
Web3’s decentralised infrastructure has upended the standardised approach to digital identity established by protocols like OpenID Connect. Web2 and Web3 currently operate in silos, with Web2 leveraging selective disclosure JSON web tokens (SD-JWTs) and Web3 dApps being reliant on on-chain data and sometimes clinging to centralised system data. This fragmentation hinders user esxperience and the interconnectedness of the digital world. This article explores the integration of Web3 within the OpenID Connect framework, scrutinising established authentication protocols for their adaptability to decentralised identities. The research examines the interplay between OpenID Connect and decentralised identity concepts, the limitations of the existing protocols like OpenID Connect for verifiable credential issuance, OpenID Connect framework for verifiable presentations, and self-issued OpenID provider. As a result, a novel privacy-preserving digital identity bridge is proposed, which aims to answer the research question of whether authentication protocols should inherently support Web3 functionalities and the mechanisms for their integration. Through a Decentralised Autonomous Organisation (DAO) use case, the findings indicate that a privacy-centric bridge can mitigate the existing fragmentation by aggregating different identities to provide a better user experience. While the digital identity bridge demonstrates a possible approach to harmonise digital identity across platforms for their use in Web3, the bridging is unidirectional and limits root trust of credentials. The bridge’s dependence on centralised systems may further fuel the debate on (de)centralised identities.