This preprint introduces Risk Oracle, an exploit-intelligence–driven SBOM attestation framework designed to support practical risk gating in CI/CD. The system combines signals from Known Exploited Vulnerabilities (KEV) and Exploit Prediction Scoring System (EPSS) with SBOM-to-vulnerability matching to produce a policy-backed gate decision (e.g., pass / warn / block) while keeping the workflow interpretable and reproducible. A core design goal is bounded disclosure: the producer can commit to full findings and then disclose only a limited subset (e.g., top-K highest-risk issues) suitable for downstream verification, reducing disclosure risk while preserving auditability. The paper details the end-to-end pipeline (producer/verifier roles), a typed attestation schema, a scoring and decision procedure, and an evaluation that studies (i) signal behavior under pinned KEV/EPSS snapshots and (ii) operational overhead under synthetic SBOM scaling intended to approximate CI workloads. Key contributions A practical SBOM attestation pipeline that integrates exploit-intelligence signals for operational decision-making in CI/CD. A typed attestation schema and verifier procedure supporting bounded disclosure. A policy-driven scoring and gating framework (pass/warn/block) grounded in vulnerability-management practice. Evaluation focused on interpretability and operational cost (runtime/payload scaling) under reproducible, pinned snapshots. Artifacts / Reproducibility Code, scripts, and pinned snapshot references: [GitHub link] Suggested citationSudhir, S. (2026). Risk Oracle: Exploit-Intelligence–Driven SBOM Attestations with Bounded Disclosure (preprint). Zenodo. DOI: [10.5281/zenodo.18153487] Keywords: SBOM, software supply chain security, vulnerability management, KEV, EPSS, OSV, attestation, CI/CD, bounded disclosure, reproducibility
Md Al Amin, Indrajit Ray, Indrakshi Ray, Yashwant K. Malaiya · 5 authors
Access to electronic health records (EHRs) is heavily regulated by various policies, including federal-level policies, state-level statutes, international data protection laws, and local and organizational-level policies. These policies may include procedures to ensure compliance with other organizational-level regulations. In addition, individual patients can establish agreements, formally known as patient-provider agreements (PPA), with their healthcare providers to express their consent to access or share their protected health information (PHI). When such policies are adequately specified and implemented, they go a long way toward protecting EHR data. However, research has shown that significant policy compliance problems or gaps often go undetected until after a breach or security incident. Further, a recent study shows that subcultures within a healthcare organization influence whether employees violate policies, perhaps unintentionally. These observations motivate us to revisit the compliance and provenance aspects of policies. This dissertation proposes a blockchain-powered, smart contract-based policy-compliance assurance framework to enforce patient-provider agreements and other applicable policies and attributes, ensuring policy compliance and provenance in the healthcare sector. This work proposes a novel compliance review mechanism, Proof of Compliance (PoC), that conducts reviews through a set of independent, distributed, decentralized auditor nodes from various stakeholders, such as healthcare organizations, insurance companies, federal and other government agencies, regulatory agencies, and others mandated by the business requirements. Blockchain smart contracts appear to be a promising new technology for enforcing policies. In addition, blockchains' immutable storage properties and strong integrity guarantees provide hope that an adequate trail of policy compliance (or non-compliance) can be maintained, thereby facilitating provenance.
Smart contract security research has historically emphasized exploit-driven threat models developed for open, permissionless blockchain environments. While effective for identifying adversarial attacks and loss-of-funds scenarios, these models are insufficient for institutional blockchain systems supporting Real-World Assets (RWAs). In regulated and asset-backed deployments, threats frequently arise from non-adversarial actors, design assumptions, operational dependencies, and compliance enforcement failures rather than from direct malicious exploitation.This paper presents a structured threat taxonomy tailored to institutional RWA smart contract systems. The taxonomy classifies threats according to origin, intent, capability, and impact, explicitly incorporating adversarial, non-adversarial, and systemic threat sources. By decoupling threat analysis from exploit-centric assumptions, the taxonomy enables correctness-oriented risk assessment, formal specification of threat boundaries, and alignment with institutional audit and compliance requirements. The proposed framework provides a foundation for secure system design, verification, and operational governance in regulated blockchain environments.
Graph neural networks (GNNs) have shown notable success in identifying security vulnerabilities within Ethereum smart contracts by capturing structural relationships encoded in control- and data-flow graphs. Despite their eff... | Find, read and cite all the research you need on Tech Science Press
The adoption of decentralized technologies in healthcare introduces new opportunities for secure, patient-centered data management but also brings significant privacy and security challenges. This paper presents a threat modeling approach applied to a Web3-based healthcare platform that integrates blockchain for access logging, a FHIR-compliant server for clinical data, and a backend for identity and access management. Using the LINDDUN privacy threat modeling framework and OWASP Threat Dragon, we identified and prioritized privacy risks based on system architecture and data flows. The results show that threat modeling can provide early insights into regulatory compliance, data exposure, and user privacy concerns. This process can be viewed as a foundational step in the development of digital health systems. While the analysis was focused on a specific use case, the methodology is adaptable to a wide range of applications handling sensitive personal data.
We frame Ethereum transactions reverted by invariants-require(<invariant>)/ assert(<invariant>)/if (<invariant>) revert statements in the contract implementation-as a positive signal of active on-chain defenses. Despite their value, the defensive patterns in these transactions remain undiscovered and underutilized in security research. We present Raven, a framework that aligns reverted transactions to the invariant causing the reversion in the smart contract source code, embeds these invariants using our BERT-based fine-tuned model, and clusters them by semantic intent to mine defensive invariant categories on Ethereum. Evaluated on a sample of 20,000 reverted transactions, Raven achieves cohesive and meaningful clusters of transaction-reverting invariants. Manual expert review of the mined 19 semantic clusters uncovers six new invariant categories absent from existing invariant catalogs, including feature toggles, replay prevention, proof/signature verification, counters, caller-provided slippage thresholds, and allow/ban/bot lists. To demonstrate the practical utility of this invariant catalog mining pipeline, we conduct a case study using one of the newly discovered invariant categories as a fuzzing oracle to detect vulnerabilities in a real-world attack. Raven thus can map Ethereum's successful defenses. These invariant categories enable security researchers to develop analysis tools based on data-driven security oracles extracted from the smart contracts' working defenses.
Cryptocurrency exchanges are integral to the digital asset economy; however, their rapid growth has been accompanied by recurrent high-impact cyberattacks that erode trust and inflict substantial losses. Guided by the PRISMA-ScR framework, this review systematically screened peer-reviewed and industry sources to construct a validated dataset of 220 major incidents (2009–2024) across centralized (CEX) and decentralized (DEX) exchanges. We classify attack vectors, analyze repeated high-impact patterns, and identify systemic vulnerabilities spanning cryptographic mechanisms and exchange infrastructure. Across CEX platforms, four of ten identified attack types accounted for 62 of the 80 incidents and approximately $1.764 billion in losses (42.1% of the $4.191 billion CEX total). Across DEX platforms, five of eighteen attack types were responsible for 120 of 140 incidents, totaling $3.755 billion (87.3% of the $4.303 billion DEX total). The overall losses sum to $8.494 billion across 220 incidents (80 CEX; 140 DEX). Repeated vectors comprised 182/220 incidents and $5.519 billion (65.0%) of losses, dominated by wallet/key compromise (78 incidents; $2.394 billion) and DEX system/server/protocol exploits (56 incidents; $1.939 billion); these two classes account for 134/182 repeated incidents (79.1%) and $4.333 billion (78.5%) of repeated losses. We examine the susceptibility of cryptographic defenses to emerging quantum adversaries and assess the exchange readiness for post-quantum threats. This study is the first to systematically compile and quantitatively analyze cybercrime incidents affecting both centralized and decentralized cryptocurrency exchanges in a unified dataset, enabling unprecedented comparability of systemic risks with actionable insights for cybersecurity researchers, regulators, and exchange operators seeking quantum-safe infrastructure evolution.
Decentralized Finance (DeFi) staking is one of the most prominent applications within the DeFi ecosystem, where DeFi projects enable users to stake tokens on the platform and reward participants with additional tokens. However, logical defects in DeFi staking could enable attackers to claim unwarranted rewards by manipulating reward amounts, repeatedly claiming rewards, or engaging in other malicious actions. To mitigate these threats, we conducted the first study focused on defining and detecting logical defects in DeFi staking. Through the analysis of 64 security incidents and 144 audit reports, we identified six distinct types of logical defects, each accompanied by detailed descriptions and code examples. Building on this empirical research, we developed SSR (Safeguarding Staking Reward), a static analysis tool designed to detect logical defects in DeFi staking contracts. SSR utilizes a large language model (LLM) to extract fundamental information about staking logic and constructs a DeFi staking model. It then identifies logical defects by analyzing the model and the associated semantic features. We constructed a ground truth dataset based on known security incidents and audit reports to evaluate the effectiveness of SSR. The results indicate that SSR achieves an overall precision of 92.31%, a recall of 87.92%, and an F1-score of 88.85%. Additionally, to assess the prevalence of logical defects in real-world smart contracts, we compiled a large-scale dataset of 15,992 DeFi staking contracts. SSR detected that 3,557 (22.24%) of these contracts contained at least one logical defect.
Marilyne Ordekian, Ingolf Becker, Tyler Moore, Marie Vasek
Centralized cryptocurrency exchanges have quickly become internal components of the digital finance ecosystem, mirroring traditional institutions by offering custody, investments, and transactional services. Despite their increasing prominence, the regulatory oversight has historically been fragmented and inadequate, leaving them largely relying on self-regulation. The resulting environment has been marked by exchange collapses, connections to criminal activities, cyber attacks, and poor operational security. High-profile failures, such as Mt. Gox and FTX, highlight the systemic risks and failure of internal governance models to properly mitigate or protect user funds from cascading risks or security breaches. In response, the European Union introduced the Markets in Crypto-Assets (MiCA) regulation and the Digital Operational Resilience Act (DORA), intending to standardize regulatory oversight and enhance user protection. This paper presents the first comprehensive interdisciplinary analysis of centralized exchanges under the MiCA and DORA frameworks. Drawing on methods from both law and computer science, we systematically translate regulatory requirements into measurable compliance standards, and develop a novel doctrinal and empirical methodology to evaluate current self-regulatory practices of 75 centralized exchanges operating in Europe. Through a detailed analysis of 143 exchange legal documents, we identify major compliance gaps and regulatory uncertainties. Our findings indicate significant shortcomings in exchange practices relating to asset custody, cybersecurity, and liability. This suggests that serious efforts are needed to change these practices and ensure their alignment with regulatory requirements. Our framework enables a systemic comparison between regulation and practice, and establishes a baseline for evaluating the effectiveness of regulatory measures. This approach can be replicated to study other self-regulating emerging sectors. • We conduct a doctrinal analysis on recent EU regulations, the Markets in Crypto-Assets Regulation (MiCA) and Digital Operational Resilience Act (DORA). We identify requirements for centralized cryptocurrency exchanges and systematically extract them and create a standard framework comprising 53 criteria. • We conduct the first comprehensive empirical study of self-regulation practices among all 75 fiat-dealing exchanges in Europe, analyzing 143 documents, including terms and conditions (T&Cs) and security policies. We compile a dataset of 371 hand-coded variables across 14 themes describing exchange practices. • We use the extracted legal standards to evaluate exchange practices, assessing their compliance posture with recent regulations. This study provides a baseline to gauge the effectiveness of MiCA/DORA in the long term and track changes compared to the pre-regulation era. Additionally, it provides a tool to understand the areas currently lacking or that need more attention in industry practices. • We show that many exchanges face challenges in effectively self-regulating, fulfill their custodial duties, maintaining robust security measures, and (may) use T&Cs to shift liability. By documenting these practices and shortcomings, we provide regulators and the industry actionable and tailored recommendations for improvements. We also provide a replicable methodology to investigate the self-regulation and governance of service providers in other emerging self-regulating technologies. • An earlier draft of this research was communicated with the EU’s European Securities and Markets Authority (ESMA) and European Banking Authority (EBA) in a closed meeting. We were recommended to expand the scope of the study to include DORA provisions in addition to MiCa. It was also suggested that this study could act as the ground truth baseline for pre-MiCA industry practices. A final version has been requested by said authorities. Additionally, findings from this paper have been submitted as evidence for consultation calls in the, UK. For intance, the FCA and HM Treasury. One of the authors recently presented the high-level implications of this study in an invited and closed conference organized by the FCA.
This paper introduces a methodology for software vulnerability detection that combines structural and semantic analysis through software metrics and topic modelling. We evaluate the approach using smart contracts as a case study, focusing on their structural properties and the presence of known security vulnerabilities. We identify the most relevant metrics for vulnerability detection, evaluate multiple machine learning classifiers for both binary and multi-label classification, and improve classification performance by integrating topic modelling techniques. Our analysis shows that metrics such as cyclomatic complexity, nesting depth, and function calls are strongly associated with vulnerability presence. Using these metrics, the Random Forest classifier achieved strong performance in binary classification (AUC: 0.982, accuracy: 0.977, F1-score: 0.808) and multi-label classification (AUC: 0.951, accuracy: 0.729, F1-score: 0.839). The addition of topic modelling using Non-Negative Matrix Factorization further improved results, increasing the F1-score to 0.881. The evaluation is conducted on Ethereum smart contracts written in Solidity.
Proposer anonymity in Proof-of-Stake (PoS) blockchains is a critical concern due to the risk of targeted attacks such as malicious denial-of-service (DoS) and censorship attacks. While several Secret Single Leader Election (SSLE) mechanisms have been proposed to address these threats, their practical impact and trade-offs remain insufficiently explored. In this work, we present a unified experimental framework for evaluating SSLE mechanisms under adversarial conditions, grounded in a simplified yet representative model of Ethereum's PoS consensus layer. The framework includes configurable adversaries capable of launching targeted DoS and censorship attacks, including coordinated strategies that simultaneously compromise groups of validators. We simulate and compare key protection mechanisms - Whisk, and homomorphic sortition. To the best of our knowledge, this is the first comparative study to examine adversarial DoS scenarios involving multiple attackers under diverse protection mechanisms. Our results show that while both designs offer strong protection against targeted DoS attacks on the leader, neither defends effectively against coordinated attacks on validator groups. Moreover, Whisk simplifies a DoS attack by narrowing the target set from all validators to a smaller list of known candidates. Homomorphic sortition, despite its theoretical strength, remains impractical due to the complexity of cryptographic operations over large validator sets.
This paper introduces a pioneering multi-layered cybersecurity framework for Decentralized Finance (DeFi) platforms, fundamentally transforming traditional financial infrastructure by operating without centralized intermediaries through blockchain-based smart contracts, creating unprecedented accessibility while simultaneously introducing complex security challenges requiring specialized defense mechanisms. The immutable nature of blockchain technology necessitates comprehensive proactive security measures, as deployed smart contracts cannot be easily modified to address discovered vulnerabilities. Multi-layered security frameworks encompass pre-deployment foundations, including rigorous smart contract auditing by multiple independent firms, formal verification processes that mathematically prove contract behavior alignment with intended specifications, and transparent code documentation enabling thorough community security reviews. Runtime protection mechanisms incorporate time-locks enforcing mandatory delays before implementing critical protocol changes, circuit breakers serving as emergency stops when suspicious activity is detected, and rate limiting controls preventing flash loan attacks through transaction volume restrictions. Access control systems utilize multi-signature wallets requiring multiple authorized parties for transaction approval, while progressive decentralization strategies enable structured transitions from centralized development teams to distributed community governance. Financial protection frameworks integrate insurance protocols providing coverage against successful exploits, treasury management systems maintaining reserve funds through secure multi-signature mechanisms, and comprehensive risk management frameworks enabling continuous monitoring and threat identification. Community-driven security initiatives leverage distributed expertise through bug bounty programs offering competitive rewards for responsible vulnerability disclosure, collaborative security reviews identifying issues missed by formal auditing, and educational programs enhancing user awareness of security best practices and threat recognition capabilities.
European cybersecurity is rapidly evolving to address complex and emerging threats fueled by advancements in technology. AI-powered threat analysis has become a cornerstone, enabling faster detection of anomalies, predictive threat modeling, and real-time incident response. As Europe enters the quantum age, cybersecurity strategies are increasingly focused on quantum-resistant encryption to protect critical infrastructure and sensitive data from future quantum attacks. Simultaneously, the rise of blockchain technologies and cryptocurrencies introduces new vulnerabilities, such as smart contract exploits and decentralized finance (DeFi) fraud, requiring targeted regulatory oversight. In response, the EU is strengthening its regulatory frameworks, such as the NIS2 Directive and the Digital Operational Resilience Act (DORA), to ensure a harmonized, proactive approach to cybersecurity governance, resilience, and accountability across sectors. This multifaceted strategy reflects Europe’s commitment to safeguarding digital sovereignty and fostering trust in its digital ecosystem. The study deals with the transformation of the European cyber security ecosystem within the framework of artificial intelligence (AI) supported threat analysis. The paper discusses the security risks that arise in the quantum and post-quantum era, the possibility of blockchain/crypto systems being broken by quantum computers, the limitations of the existing data set, and the need for human-like thinking skills. In addition, the European Union's (EU) cybersecurity policies, data privacy principles, ethical standards, transparency, accountability, and human-centered AI design approaches are examined within the scope of the EU's global norm-setting role. This article also aims to shed light on the strategic steps that will shape the future of AI-powered cyber defense. Study shows that Europe should develop artificial intelligence (AI)-powered cybersecurity solutions in its preparations for the post-quantum era, it also should invest in AI models that transcend current data set limits and have humanoid thinking capacities.
Blockchain address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history, which aims to deceive victims and lure them into mistakenly transferring funds to the attacker. Recent works have shown that millions of Ethereum users were targeted and lost over 100 million US dollars. Ethereum crypto wallets, serving users in browsing transaction history and initiating transactions to transfer funds, play a central role in deploying countermeasures to mitigate the address poisoning attack. However, whether they have done so remains an open question. To fill the research void, in this paper, we design experiments to simulate address poisoning attacks and systematically evaluate the usability and security of 53 popular Ethereum crypto wallets. Our evaluation shows that there exist communication failures between 12 wallets and their transaction activity provider, which renders them unable to download the users' transaction history. Besides, our evaluation also shows that 16 wallets pose a high risk to their users due to displaying fake token phishing transfers. Moreover, our further analysis suggests that most wallets rely on transaction activity providers to filter out phishing transfers. However, their phishing detection capability varies. Finally, we found that only three wallets throw an explicit warning message when users attempt to transfer to the phishing address, implying a significant gap within the broader Ethereum crypto wallet community in protecting users from address poisoning attacks. Overall, our work shows that more efforts are needed by the Ethereum crypto wallet developer community to achieve the highest usability and security standard. Our bug reports have been acknowledged by the developer community, who are currently developing mitigation solutions.
In an era marked by increasingly sophisticated cyber threats and growing vulnerabilities in national critical infrastructure, this study explores the transformative role of confidential computing in defending against emerging cryptographic attacks and enabling secure threat intelligence sharing. Traditional cybersecurity measures, while effective for protecting data at rest and in transit, fall short in securing data during active processingan area exploited by advanced persistent threats, quantum computing, and side-channel attacks. This research investigates how hardware-based trusted execution environments (TEEs), homomorphic encryption, and zero-knowledge proofs embedded in confidential-computing platforms can preserve the confidentiality of sensitive operations even within potentially compromised environments. Through detailed case studies of major U.S. institutionsincluding PGandE, Exelon, JPMorgan Chase, Wells Fargo, and Kaiser Permanentethe paper demonstrates significant improvements in detection speed, false positive reduction, and operational efficiency. Furthermore, it proposes a scalable, privacy-preserving framework for collaborative cyber defense across critical sectors such as energy, finance, and healthcare. The findings underscore that integrating confidential computing with decentralized intelligence sharing networks not only enhances cybersecurity resilience but also yields substantial economic and regulatory benefits. This work advocates for a national, and eventually global, shift toward confidential-computing-enabled infrastructures to achieve robust, cooperative, and future-proof cyber defense ecosystems.
The results of this study highlight the effectiveness of the proposed semantic security detection framework, SSB, in identifying a wide range of vulnerabilities in smart contracts tailored for industrial control scenarios. Compared to existing tools like ZEUS, Securify, and VULTRON, SSB demonstrates superior logical coverage across various vulnerability types, as evidenced by its performance on smart contract samples. This suggests that semantic-based approaches, which integrate domain-specific invariants and runtime monitoring, can address the unique challenges of ICS, such as real-time constraints and semantic consistency between code and physical control logic. The framework's ability to model industrial invariants-covering security, functionality, consistency, time-related, and resource consumption aspects-provides a robust mechanism to prevent critical errors like unauthorized access or premature equipment operation. However, the lack of real-world ICS validation due to confidentiality constraints limits the generalizability of these findings. Future research should focus on adapting SSB for real industrial deployments, exploring scalability across diverse ICS architectures, and integrating advanced AI techniques for dynamic invariant adjustment. Additionally, addressing cross-chain interoperability and privacy concerns could further enhance the framework's applicability in complex industrial ecosystems.
The healthcare sector increasingly explores Distributed Ledger Technology (DLT) and Health Web 3.0 Decentralized Applications (DApps) as promising solutions for patient-centric data management, data sovereignty, and privacy-preserving systems. Despite significant research at the intersection of blockchain and healthcare, current efforts predominantly address isolated technical challenges—focusing narrowly on specific mechanisms such as confidentiality, privacy, or individual smart contract vulnerabilities. Even cybersecurity assessments typically examine discrete attack vectors rather than comprehensive threat landscapes. This fragmented approach limits our ability to build trustworthy systems and delays real-world adoption, as stakeholders lack frameworks to holistically evaluate security posture. This study addresses this gap by conducting a comprehensive threat modeling analysis of Health Web 3.0 DApps, taking into account the complex and interconnected security challenges inherent in blockchain-based healthcare systems. We employ a multi-framework approach integrating LINDDUN threat modeling methodology, OWASP Top 10 Smart Contract Vulnerabilities catalog, and Threat Dragon analytical tool to systematically identify, categorize, and evaluate security risks across the entire application stack. Our analysis maps threats spanning smart contract design flaws, cross-chain interaction vulnerabilities, decentralized identity management weaknesses, unauthorized data access risks, and denial-of-service attack vectors. The primary contribution of this work is demonstrating the critical importance and practical value of holistic threat modeling in blockchain healthcare systems. Our findings reveal interdependencies between seemingly isolated vulnerabilities and show how comprehensive security assessment enhances data privacy protection, smart contract integrity, and overall application resilience. This research provides stakeholders with a systematic methodology for deriving trust in blockchain healthcare solutions, advancing both regulatory compliance and user confidence in decentralized medical data management systems.
Cloud identity management has evolved from a purely technical concern into a fundamental pillar of digital society, creating profound impacts that extend far beyond organizational boundaries. Modern cloud-based identity and access management systems serve as critical infrastructure enabling access to essential services including healthcare, education, government benefits, and financial services. These systems incorporate advanced technical mechanisms such as multi-factor authentication, single sign-on, zero trust architecture, and artificial intelligence-driven fraud detection to establish secure and inclusive digital environments. The transformation to cloud-based architectures addresses traditional limitations of on-premises systems while introducing new capabilities for digital inclusion through device-agnostic authentication, accessibility-first design, and multilingual support. However, this evolution presents significant challenges including privacy concerns arising from data aggregation, potential government surveillance, and algorithmic bias in automated decision-making systems. Strategic implementation through public-private partnerships, investment in open source components, and adoption of emerging technologies such as quantum-resistant cryptography and distributed ledger integration shapes the societal impact of these systems. The technical decisions made in designing and implementing cloud identity infrastructure have far-reaching implications for social equity, democratic participation, and economic opportunity in an increasingly digital world.