Decompiler is a specialized type of reverse engineering tool extensively employed in program analysis tasks, particularly in program comprehension and vulnerability detection. However, current Solidity smart contract decompilers face significant limitations in reconstructing the original source code. In particular, the bottleneck of SOTA decompilers lies in inaccurate function identification, incorrect variable type recovery, and missing contract attributes. These deficiencies hinder downstream tasks and understanding of the program logic. To address these challenges, we propose SmartHalo, a new framework that enhances decompiler output by combining static analysis (SA) and large language models (LLM). SmartHalo leverages the complementary strengths of SA’s accuracy in control and data flow analysis and LLM’s capability in semantic prediction. More specifically, SmartHalo constructs a new data structure - Dependency Graph (DG), to extract semantic dependencies via static analysis. Then, it takes DG to create prompts for LLM optimization. Finally, the correctness of LLM outputs is validated through symbolic execution and formal verification. Evaluation on a dataset consisting of 465 randomly selected smart contract functions shows that SmartHalo significantly improves the quality of the decompiled code, compared to SOTA decompilers (e.g., Gigahorse). Notably, integrating GPT-4o mini with SmartHalo further enhances its performance, achieving a precision of 91.32% and a recall of 87.38% for function boundaries, a precision of 90.40% and a recall of 88.82% for variable types, and a precision of 80.66% and a recall of 91.78% for contract attributes.
The cross-chain identity authentication method based on relay chains provides a promising solution to the issues brought by the centralized notary mechanism. Nonetheless, it continues to encounter numerous challenges regarding data privacy, security, and issues of heterogeneity. For example, there is a concern regarding the protection of identity information during the cross-chain authentication process, and the incompatibility of cryptographic components across different blockchains during cross-chain transactions. We design and propose a cross-chain identity privacy protection method based on relay chains to address these issues. In this method, the decentralized nature of relay chains ensures that the cross-chain authentication process is not subject to subjective manipulation, guaranteeing the authenticity and reliability of the data. Regarding the compatibility issue, we unify the user keys according to the identity manager organization, storing them on the relay chain and eliminating the need for users to configure identical key systems. Additionally, to comply with General Data Protection Regulation (GDPR) principles, we store the user keys from the relay chain in distributed servers using the InterPlanetary File System (IPFS). To address privacy concerns, we enable pseudonym updates based on the user’s public key during cross-chain transactions. This method ensures full compatibility while protecting user privacy. Moreover, we introduce Zero-Knowledge Proof (ZKP) technology, ensuring that audit nodes cannot trace the user’s identity information with malicious intent. Our method offers compatibility while ensuring unlinkability and anonymity through thorough security analysis. More importantly, comparative analysis and experimental results show that our proposed method achieves lower computational cost, reduced storage cost, lower latency, and higher throughput. Therefore, our method demonstrates superior security and performance in cross-chain privacy protection.
Open access
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Good news for researchers in formal verification: smart contracts regularly suffer exploits such as the DAO bug, which lost the equivalent of 60 million USD on Ethereum. This makes a strong case for applying formal methods to guarantee essential properties.<br/><br/>Which properties would we like to prove? Most previous studies focus on contract-specific properties that do not generalize to a wide class of smart contracts. There is currently no commonly agreed upon list of properties to use as a starting point in writing a formal specification.<br/><br/>We propose three properties that we believe are relevant to all smart contracts: Validity, Liquidity, and Fidelity. Focusing on the concrete case of the Cardano platform, we show how these properties stop exploits similar to the DAO bug, as well as preventing other common issues such as the locking of funds and double satisfaction.<br/><br/>We model an account simulation, a multi-signature wallet, and an order book decentralized exchange, as example smart contract specifications using state transition systems in the Agda proof assistant. We formalize the above properties and prove they hold for the models. The models are then separately proven to be functionally equivalent to a validator implementation in Agda, which is translated to Haskell using agda2hs. The Haskell code can then be compiled and put on the Cardano blockchain directly. We use the Cardano Node Emulator to run property-based tests and confirm that our validator works correctly.
Modern financial technologies (Financial Technologies, FinTech) have improved traditional finance, while concurrently building a fundamentally new financial alternative. The application of FinTech has created digital financial products that are legally regulated but many crypto products still remain outside the law. The cryptocurrency market is a digital decentralized system that operates according to its own rules that users voluntarily accept, using personalized digital transactions. The application of FinTech in banking is a legal activity of banks aimed at strengthening competitive advantages in providing financial services, whereas central banks may require from commercial banks to upgrade or improve part of their digital technologies. In contrast, Blockchain technology has created a digital financial alternative which allows individuals to directly manage their digital wallets via phones and computers, without centralized control and outside of banking systems, by using the Internet and sharing original digital records among networked users worldwide. In the initial period, Blockchain technology generated resistance and was ignored by state regulatory bodies. The process of legal regulation of digital products and markets which were created on the basis of Blockchain and other digital technologies began after several years of actual Blockchain technology application. The subject matter of analysis in this paper is the legal regulation of already developed and widely used digital markets and assets, with specific reference to the legal solutions in the USA, the EU, and Serbia. The challenges of legal regulation of digital assets are numerous, ranging from insufficient knowledge of digital technologies to the unfeasibility of norming the decentralized digital segments. Thus, it is essential for the creators of law and the persons who apply the law to have the basic knowledge of modern digital technologies.
Zaki Rangwala, Stefan Neskovic, Amirhossein Kompanizare
This study examines how well SSL/TLS and blockchain work to secure online transactions, especially purchase orders. Reviewing literature from 2013 to 2024 shows each method's key themes, benefits, and weaknesses. SSL/TLS is known for its strong encryption and solid framework but often has issues like centralization and threats from different attacks, leading to transaction delays and bottlenecks. On the other hand, blockchain technology uses decentralized protocols and features such as zero-knowledge proofs, promising better scalability and security, allowing for smooth and safe transactions without traditional middlemen. This comparison clarifies how effective each method is. It highlights the rise of blockchain as a viable option to the limits of SSL/TLS, deserving more study in e-commerce security.
Domain-specific languages (DSLs) express requirements or designs through visual abstractions.To support complex development tasks such as code generation, testing and analysis, DSLs need semantic foundations.This paper introduces such a semantic framework for DSLs based on graph rewriting.We apply our framework to a DSL for defining multi-party dynamic role-based access control policies for smart contracts.Role-based access control models (RBACMs) express constraints on who can access which resources.Dynamic RBACMs allow a dynamic role membership.Access control policies, in particular for smart contracts, can involve multiple parties such as members of different groups or organisations, combining complex logical and dynamic constraints, and hence are hard to design, understand, validate and test at code level.Our diagrammatic notation supports complex authorisation patterns, including alternatives and multiplicities, to address nuanced access control requirements.Defining the operational semantics for RBACMs by graph rewriting, we let the Groove model checker produce traces for actions where access is granted or denied and generate tests for smart contracts in the Digital Asset Modelling Language (DAML).We validate dynamic access control scenarios generated by ChatGPT for use as test cases or advising users at runtime.Such scenarios represent business workflows interleaved with operations to add or remove role members.They are expressed as Groove control programs and are also verified by its model checker.
Non-Fungible Tokens (NFT) represent a sub form of cryptocurrencies, which allow investments into art, digital rights or any form of unique assets. Our study adds to a young body of research, which tries to analyze the characteristics of these new markets. In our study we present a new methodology to analyze peer-to-peer transactions in Non-Fungible tokens (NFT). We argument that this approach is superior to using prefabricated market data from NFT platform data, because it allows to track transactions to the point 0. Compared to that prefabricated market data could prove to be incomplete, missing peer-to-peer transactions. The difficulty of our approach was to develop a methodology which looks at all available transactions of a NFT on the blockchain, and not just at transactions which take place at specific trading platforms. This research is challenging due to the amount, and complexity of blockchain data which need to be stored and analyzed. For our study we constructed a dataset for the eth blockchain, which represented a complete chain of blockchain transactions, while then comparing our data with platform data on specific NFT’s. We found that our approach provides a more detailed view of the transactions in specific NFT’s. This detailed view allowed us to see specific transaction details. Our approach shall inspire future research to favor complete datasets of NFT transactions, before easily available data from trading platforms.
Die zunehmende Verbreitung verteilter Datenspeicher wie dem InterPlanetary File System erfordert robuste Sicherheitsmechanismen, um den Schutz sensibler Daten in dezentralen Umgebungen zu gewährleisten. Diese Masterarbeit präsentiert ein auf Smart Contracts basierendes Authentifizierungs- und Zugangskontrollsystem, das den Ethereum Attestation Service nutzt, um Rollen und Berechtigungen als nicht übertragbare Attestierungen zu verwalten. Durch die Integration von IPFS und clientseitiger Verschlüsselung wird ein hybrides Modell entwickelt, das öffentliche Datenspeicher durch granular definierte Zugriffskontrollbedingungen absichert. Die Arbeit evaluiert das System in einem praxisnahen Anwendungsfall einer Decentralized Autonomous Organization und demonstriert die Skalierbarkeit durch die Nutzung von Layer-2-Blockchains wie Scroll. Die Analyse der Kosteneffizienz von Smart Contract-Interaktionen zeigt, dass das Framework eine dezentrale, interoperable Verwaltung von Zugriffsrechten ermöglicht und dabei Transaktionskosten durch die Nutzung von Layer-2-Netzwerken signifikant reduziert. Zudem wird die Machbarkeit einer rollenbasierten Zugriffskontrolle ohne zentrale Instanz nachgewiesen, die gleichzeitig die Integrität und Verfügbarkeit der Daten gewährleistet. Die Arbeit leistet einen Beitrag zur Erforschung blockchainbasierter Sicherheitslösungen und bietet eine Blaupause für Organisationen, die dezentrale Speicherlösungen in offenen Ökosystemen einsetzen. Zukünftige Arbeiten könnten die Integration weiterer dezentraler Identitätsmodelle oder die Erweiterung um attributbasierte Zugriffskontrollmechanismen untersuchen, um die Privatsphäre und Flexibilität des Systems weiter zu optimieren.
The rapid expansion of the digital economy heightens the need for privacy and trust in intellectual property transactions. Traditional centralised approaches to identifying legal conflicts in intellectual property contracts are prone to data leakage and fail to balance transparency with confidentiality. This paper proposes a self-identification method for legal conflicts in intellectual property contracts using zero-knowledge proofs. By combining a light gradient boosting machine learning model with the zero-knowledge succinct non-interactive argument of knowledge protocol, our approach allows verifiable detection of potential legal conflicts without revealing sensitive information. Experiments on the US patent and trademark office patent dataset demonstrate that the method achieves high performance in conflict prediction (area under the receiver operating characteristic curve = 0.872) and verification efficiency (<10 ms), providing a novel and practical framework for privacy-aware legal technology.
Андрій Олександрович Гашко, Андрій Петрович Бондарчук, Максим Петрович Трембовецький, Олександр Ілліч Чумак
The article examines an automated method for verifying the correctness of smart contracts in the Solana blockchain network. The relevance of the research is driven by the growing popularity of Web3 applications and the need to ensure their security, as even minor errors in smart contract code can lead to significant financial losses. The primary goal is to develop an automated verification methodology for smart contracts that can detect vulnerabilities such as the absence of founder rights verification, arithmetic operation errors, and missing transaction check signatures. Using static analysis techniques in the Rust programming language, the authors propose an approach that enables rapid analysis-taking less than three minutes per contract-and automatic generation of reports on identified vulnerabilities. The methodology is based on analyzing external data flows through smart contracts, allowing for the early detection of potential threats. To automate the process, Python and Bash scripts are employed, integrating with cloud services such as Amazon Web Services to scale the analysis. Testing results on real Web3 applications demonstrate the effectiveness of the methodology, particularly in reducing analysis time and improving the accuracy of error detection. An important aspect of the research is the continuous updating of knowledge bases and analysis tools, enabling the consideration of new types of attacks and vulnerabilities. The article also highlights the importance of interoperability between different blockchain networks, which remains a challenging task but is a key element for the future development of Web3. The research results show that the proposed methodology is promising for scaling and adapting to new challenges in blockchain ecosystems such as Solana. Thus, the developed approach to automated smart contract verification not only enhances the security of Web3 applications but also contributes to their further development, ensuring stability and reliability in the dynamic evolution of blockchain technologies.
A sharding framework has been proposed by Ethereum 2.0, and researchers have tried to enhance its applicability and scalability to real blockchain networks. Each shard can execute transactions requested by users, so the number of transactions dealt with by the shard-based blockchain grows as the number of shards increases. Dealing with cross-shard transactions, however, is a major hindrance to blockchain performance, because each such transaction requires cooperation among different shard validators in the network. Given this background, this paper proposes a novel cross-shard architecture in which each shard has its own transaction server (TS) and each TS has the role of dealing with transaction requests/results coming from different users or different shards. In this architecture, it is possible for each validator to concentrate on dealing with the transactions in its own shard, so there is no need to multicast transaction information to the other shard validators. We describe the proposed cross-shard framework in detail and demonstrate how a cross-shard transaction can be executed using the hierarchically connected smart contract functions. In the proposed architecture, the interactions among different shard validators can be reduced by having each validator select its neighbors from among members of its own shard after each epoch. This frequent change of neighbors for each validator makes it robust against eclipse attacks. In addition, this architecture speeds up the validation process of transactions/blocks in each shard; we show the effect by measuring the block transmission delays in the proposed architecture in a simulation environment.
The creator economy is valued at over $250 billion and is largely supported by ad revenue, sponsorships, and platform monetization-controlled subscription. Creators face a variety of issues such as earnings cut, face demonetization, and platform policy, which threatens sustainability as a creator. This report introduces TOKN, a hybrid Web2-Web3 monetization strategy that enables creators to tokenize their work and get paid directly for their content on platforms like YouTube, TikTok, and Instagram. By using smart contracts, micropayments, and access tokenization through APIs and browser extensions, TOKN provides creators with greater financial empowerment while maintaining the discoverability and ease of use of Web2 platforms. Through a review of monetization inefficiencies, blockchain integration, and regulatory implications, this research highlights how a hybrid solution can bridge the gap between the usability of Web2 and the financial incentives of Web3-creating a scalable, secure, and platform-agnostic monetization model for digital creators.
The promise of Web3's decentralized, transparent, and user-owned systems offers transformative potential for global commerce. However, Web3 remains largely inaccessible or intentionally avoided due to user experience friction and persistent risk perceptions. Highly publicized failures over the years point to a fundamental weakness in achieving durable trust required for widespread adoption. This paper introduces a normative theory centered on five interdependent principles, spanning enforcement, trust, duty segregation, governance, and adaptability. Together, they define falsifiable conditions for integrity-by-design Web3 commercial infrastructure. These principles are collectively necessary, though not sufficient, to uphold investor protection, maintain efficient and orderly markets, and ensure transparent capital formation. This framework supports regulators, builders, investors, and institutions with a methodical approach for distinguishing legitimate infrastructure innovations from sophisticated regulatory arbitrage. As major infrastructure decisions accumulate daily, path dependencies continue to entrench brittle architectures. This work aims to chart a socio-technical path to achieving sustainable commercial integrity, thereby broadening access to trustworthy, extensible systems for long-term growth in Web3 commerce.
Due to the inherent immutability of blockchain technology, smart contract updates require their deployment at new addresses rather than modifying existing ones, thus fragmenting version histories and creating critical blind spots for analyses. Indeed, for example, this fragmentation severely hinders security researchers ability to track vulnerability lifecycles across contract versions. While platforms like Etherscan provide detailed information about Ethereum smart contracts, they lack crucial functionality to trace predecessor-successor relationships within smart contract lineages, preventing systematic analysis of how vulnerabilities emerge, propagate, and potentially remain unresolved across versions.To address the challenge of tracing smart contract lineages, we adopt a Design Science Research (DSR) approach and introduce ContractTrace, an automated infrastructure that accurately identifies and links versions of smart contracts into coherent lineages. This tool enables the construction of lineageSet, an up-to-date, open-source dataset specifically designed to support security research on vulnerability, defect or any other property evolution patterns in smart contracts. Through a security-focused case study we demonstrate how ContractTrace reveals previously obscured vulnerability life-cycles within smart contract lineages, tracking whether critical security flaws persist or get resolved across versions. This capability is essential for understanding vulnerability propagation patterns and evaluating the effectiveness of security patches in blockchain environments. In the evaluation phase of our DSR approach, we validated our lineage detection methodology against an alternative approach using Locality-Sensitive Hashing (LSH) to cluster contract versions, confirming the security relevance and accuracy of our technique.
Decentralized finance (DeFi) technologies, when integrated with enterprise systems, create an opportunity to fully automate payment processes within ERP systems. This research develops and tests a smart contract-based cryptocurrency payment gateway framework with SAP ERP systems focusing on the FI, MM, and SD modules. Incorporating blockchain wallets, programmable transaction logic, and modular APIs enables SAP systems to independently manage multi-chain and multi-currency crypto payment initiation, confirmation, and reconciliation across multiple chains and currencies. The payment gateway minimizes payment delay, manual processing, and expenses in comparison to traditional fiat gateways utilizing smart contracts for payment validation, tokenization, and invoice reconciliation. Testing under real SAP transactional simulations on Quorum-based testnets showed an about 62% increase in reconciliation speed, 48% decrease in average cost per transaction, and 92% accuracy in volatile token conflict detection—during token volatility periods—resulting in errors. This study contributes to the development of frameworks for decentralized payment systems within ERP infrastructures, advancing the design and ERP enterprises aimed at achieving seamless interoperability, auditability, and comprehensive control over digital assets with SAP ecosystems.
Pranauv Kessavan -, S. Hendry Leo Kanickam, Veeramraju Lakshmi Ajay, Amala Margret -
Digital copyright protection systems aim to secure creators’ rights and ensure they’re fairly compensated, but traditional methods struggle with data verification and tamper-resistance. The proposed solution enhances these protections by integrating proof-of-stake (PoS) algorithms and smart contracts into the blockchain framework. PoS, a consensus mechanism in blockchain, requires participants to stake tokens, ensuring that they have a stake in maintaining the integrity of the system. This approach secures the network and safeguards against tampering. Smart contracts—self-executing, tamper-proof agreements stored on the blockchain—automate copyright enforcement, making it impossible to alter ownership records once added to the blockchain. This automation reduces manipulation risks and improves efficiency. Additionally, the decentralized structure of blockchain distributes data across multiple nodes, preventing any single entity from altering or compromising the information. This guarantees the immutability and transparency of digital content and ownership records. Together, these technologies offer a robust, efficient solution for digital copyright protection. Blockchain’s decentralized, tamper-resistant nature, combined with PoS’s secure verification and smart contracts’ automated enforcement, provides a trustworthy framework that better secures ownership and prevents unauthorized manipulation.
Jing Jiang, Xiaofeng Wang, Qianqian Xing, Jin Tang
Currently, personal information leakage and identity theft have become risks that cannot be ignored. As a robust authentication mechanism, multi-factor authentication (MFA) has gained prominence. However, many existing MFA schemes based on certificate-less public key cryptography amalgamate multiple authentication factors into a single factor for local verification, which fails to achieve independent authentication of each factor and is difficult to resist internal privilege attacks. To address these issues, this paper proposes a certificate-less multi-factor privacy authentication scheme based on elliptic curve cryptography. The proposed scheme divides the full private key into multiple authentication factors and employs the Schnorr zero-knowledge proof technique to independently generate challenge values for each factor, facilitating separate authentication of multiple factors. Notably, this approach eliminates the need to reconstruct the full private key during the authentication process, thereby effectively mitigating the risk of private key leakage.
Open access
Digital Rights Management and Security
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Although smart contracts have emerged as a key innovation for industries, siloed development and deployment of smart contracts pose numerous challenges to mass adoption and interoperability. This paper presents a comprehensive gap analysis of cur- rent standardisation efforts in smart contracts, focusing on common requirements, data formats, schema, and software templates. Through an examination of existing standards, best practices, and identified gaps, this paper proposes contributions to address these challenges. By advocating for cross-platform compatibility, scalability, and maintainability, it aims to advance the standardisation of smart contracts and foster their broader adoption in the industry.
Recently, smart contracts have played a vital role in automatic financial and business transactions. To help end users without programming background to better understand the logic of smart contracts, previous studies have proposed models for automatically translating smart contract source code into their corresponding code summaries. However, in practice, only 13% of smart contracts deployed on the Ethereum blockchain are associated with source code. The practical usage of these existing tools is significantly restricted. Considering that bytecode is always necessary when deploying smart contracts, in this article, we first introduce the task of automatically generating smart contract code summaries from bytecode. We propose a novel approach, named Smart Contract Bytecode Translator ( SmartBT ) for automatically translating smart contract bytecode into fine-grained natural language description directly. Two key challenges are posed for this task: structural code logic hidden in bytecode and the huge semantic gap between bytecode and natural language descriptions. To address the first challenge, we transform bytecode into Control-Flow Graph (CFG) to learn code structural and logic details. Regarding the second challenge, we introduce an information retrieval component to fetch similar comments for filling the semantic gap. Then, the structural input and semantic input are used to build an attentional sequence-to-sequence neural network model. The copy mechanism is employed to copy rare words directly from similar comments, and the coverage mechanism is employed to eliminate repetitive outputs. The automatic evaluation results show that SmartBT outperforms a set of baselines by a large margin, and the human evaluation results show the effectiveness and potential of SmartBT in producing meaningful and accurate comments for smart contract code from bytecode directly.
This paper presents an approach to using decentralized distributed digital (DDD) ledgers like blockchain with multi-level verification. In regular DDD ledgers like Blockchain, only a single level of verification is available, which makes it not useful for those systems where there is a hierarchy and verification is required on each level. In systems where hierarchy emerges naturally, the inclusion of hierarchy in the solution for the problem of the system enables us to come up with a better solution. Introduction to hierarchy means there could be several verification within a level in the hierarchy and more than one level of verification, which implies other challenges induced by an interaction between the various levels of hierarchies that also need to be addressed, like verification of the work of the previous level of hierarchy by given level in the hierarchy. The paper will address all these issues, and provide a road map to trace the state of the system at any given time and probability of failure of the system.
Biagio Boi, Franco Cirillo, Marco De Santis, Christian Esposito
Context: The digitalization of the healthcare sector faces significant challenges due to the diverse representation of data and their distribution across various hospitals. Moreover, security is a key concern as healthcare-related data are subject to the legal obligations of General Data Protection Regulation (GDPR) and similar data protection legislation. Standardization efforts like Health Level Seven (HL7) have been implemented to enhance data interoperability. However, authentication still remains a critical issue with significant challenges. Aim: This research aims to improve and strengthen the authentication process by introducing a novel architecture for decentralized authentication. Additionally, it proposes a new approach to decentralized data management, which is crucial for handling sensitive medical data efficiently. Methodology: The proposed architecture adopts a user-centric approach, utilizing Self-Sovereign Identity (SSI). It introduced a new non-fungible token (NFT) type called soulbound token (SBT) in the medical context, which will facilitate user authentication across different hospitals, effectively creating a federation of interconnected institutions. Results: The implementation of the proposed architecture demonstrated a significant reduction in authentication time across multiple hospitals. The use of SBT ensured secure and seamless user authentication, enhancing overall system interoperability and data security. The decentralized approach also mitigated the risks associated with centralized authentication servers. Conclusion: This study successfully presents a novel decentralized authentication architecture for the healthcare domain, leveraging SSI and SBTs. This approach accelerates the authentication process and enhances data security and interoperability among hospitals. Future research should explore the scalability of this architecture and its application in other sectors requiring stringent data security measures.