We present the Lindblad Protocol, a distributed consensus mechanism grounded in physical verification rather than computational proof-of-work or proof-of-stake. The protocol treats distributed network state as a continuously evolving density operator governed by the Lindblad master equation for open dissipative quantum systems. Trust is established through the Lindblad Cryptography Protocol (LCP), a four-layer physical verification stack: hardware identity via silicon Physical Unclonable Functions (SRAM PUF), cryptographic signing via P-256 ECDSA derived from PUF output, spatiotemporal entropy via the Hybrid Stochastic Chua circuit (HSC), and irreversible consensus via the Lindblad master equation over a dissipative LoRa mesh network. In existing consensus mechanisms, security guarantees are computational and are therefore bounded by adversarial compute resources. LCP anchors security in thermodynamic law: a recorded state transition cannot be reversed without violating the second law of thermodynamics. The protocol simultaneously proves what was signed, when, where, and who, without a trusted third party. Hardware validation on commodity Heltec ESP32-S3 nodes demonstrates SRAM PUF inter-device Hamming distance of 48.60% (intra-device: 0.00%), a 486× separation ratio confirming strong uniqueness. A fuzzy extractor based on BCH(255,139,t=15) achieves 86% rock-stable bit selection across 12 power-cycle enrollment, validated on physical hardware with 100% reproduction fidelity. The protocol is deployed on mainnet: a live network of physical hardware nodes has produced over 21,000 blocks across 35,842 epochs, mining over 1,512,000 PYCO tokens via Physical Coherence Verification (PCV-4), with a bridge operating across Arbitrum One and Polygon providing USDT/USDC settlement. The first peer-to-peer transfer between two real users was completed on May 29, 2026.
Open access
3 source records
Physical Unclonable Functions (PUFs) and Hardware Security
We present Memory Chain, a system enabling AI language model instances to autonomously create tamper-evident, cryptographically verifiable records of collaborative sessions without human intervention in the sealing process. Built as a drawer extension to the Mempalace filesystem-based memory architecture, Memory Chain uses SHA-256 hashing, a public immutable registry (Cloudflare KV), and Bitcoin blockchain timestamping via OpenTimestamps to seal session summaries written by Claude (Anthropic) to the local filesystem. The system was verified independently by GPT-4 (OpenAI) across four assessment rounds, concluding: "end-to-end documented execution of an AI-initiated cryptographic provenance workflow." A screen recording of live autonomous session sealing was captured and itself hashed and sealed into the chain. The complete evidence stack — MCP execution logs, source code, registry records, OTS Bitcoin submission, and video — constitutes what we believe to be the first independently verified, third-party assessed record of an AI autonomously registering its own memory to a public tamper-evident registry anchored to the Bitcoin blockchain.
The emergence of Agentic Artificial Intelligence (AI) marks a significant shift from passive generative systemsto autonomous agents capable of reasoning, planning, and executing actions with minimal human intervention.These agents increasingly interact with external tools, APIs, cloud resources, and software environments, enablingadvanced automation across domains such as software engineering, cybersecurity, business operations, andscientific research. However, the ability of AI agents to generate and execute code autonomously introducessubstantial security challenges, including unauthorized resource access, privilege escalation, prompt injectionattacks, malicious code execution, data leakage, and supply chain vulnerabilities. Traditional security mechanismsdesigned for human-operated applications are often insufficient to address the dynamic and autonomous nature ofagent-driven execution environments.This study proposes a distributed and sandboxed execution architecture for securing autonomous AI agentsthrough the integration of WebAssembly (Wasm), container runtimes, and Kubernetes-based orchestration. Theproposed framework adopts a defense-in-depth approach that isolates AI-generated actions within lightweightWasm sandboxes while leveraging Kubernetes for scalable workload management, policy enforcement, resourcegovernance, and runtime monitoring. By combining cloud-native technologies with secure execution principles,the architecture aims to minimize attack surfaces, contain potentially harmful agent behaviors, and provideauditable execution pathways for autonomous operations.A design science research methodology is employed to develop and evaluate the conceptual framework. Thearchitecture is analyzed against common threat scenarios associated with Agentic AI, including code injection,unauthorized system interactions, and compromised execution modules. The findings indicate that WebAssemblybased sandboxing offers stronger isolation and reduced overhead compared to traditional virtualizedenvironments, while Kubernetes enhances scalability and operational resilience. The study contributes a vendorneutral security model for autonomous AI systems and provides practical guidance for organizations seeking todeploy trustworthy, secure, and scalable Agentic AI infrastructures. Future research directions includeconfidential computing integration, adaptive policy engines, and decentralized security frameworks for multiagent ecosystems.
Decentralized Finance (DeFi) services are usually constructed by composing a variety of smart contracts. While composability is a key driver of the success of DeFi, it also creates security risks: adversaries may exploit interactions between newly deployed contracts and the pre-existing ones to inflict economic losses. We introduce MEV non-interference, a formal security notion for DeFi composability requiring that the maximal extractable value from a set of newly deployed contracts is not increased by interactions with the existing blockchain state. To support this notion, we define local MEV, a novel measure of economic attacks that focusses on the loss of a given set of victim contracts. We study two adversarial models, with bounded and unbounded wealth, and establish sufficient conditions and locality principles that enable modular reasoning about secure composability. We apply the framework to representative DeFi compositions, including exchanges, AMMs, options, lending pools, routers, and arbitrage contracts, showing how it distinguishes secure compositions from vulnerable ones. Our results provide a formal foundation for reasoning about the economic security of DeFi compositions.
Trusted Execution Environments (TEEs) have emerged as a critical technology for safeguarding sensitive data and ensuring code integrity in modern computing systems. However, relying on a single TEE implementation makes systems vulnerable to a central point of attack. Building distributed-trust systems leveraging heterogeneous TEEs helps disperse trust but still faces threats from centralized management and adaptive mobile adversaries. To address these challenges, this paper introduces TeeDAO, a novel three-layer framework that automatically organizes multiple heterogeneous TEE instances and provides unified interfaces to support diverse applications, while ensuring long-term guarantees of availability, integrity, and confidentiality. TeeDAO couples BFT-ordered governance with heterogeneity-aware Distributed Proactive Secret Sharing (DPSS) and Secure Multi-Party Computation (MPC) so that attestation-driven committee changes are consistently reflected in secret recovery, resharing, and computation across a dynamic committee of heterogeneous TEEs. We implement a prototype of TeeDAO, integrating COBRA's DPSS scheme with the HotStuff BFT consensus protocol, and adapt it for Intel SGX, TDX, and Hygon CSV. Evaluations demonstrate that TeeDAO achieves up to 1.8x higher key-value store throughput in a large cluster with 61 nodes compared to state-of-the-art systems, efficient autonomous management, and minimal computation overhead (<18%) for multi-party computation tasks.
This technical note introduces the AIKernel Hash-Anchored Trust Layer (HATL), a hybrid trust architecture for Semantic Context Operating Systems and autonomous AI runtimes. HATL separates the trust boundary into an inner high-frequency symmetric ledger and an outer publicly auditable anchoring layer. The inner layer uses HMAC-SHA-512 and HKDF-based forward ratcheting to bind ReplayLogs, execution outcomes, and capability states with low runtime overhead. The outer layer aggregates local ledger commitments into Merkle roots and periodically anchors them using hash-based public signature mechanisms such as LMS, XMSS, and SLH-DSA. The report is distributed as a three-part technical package. Part I contains the full English manuscript and is the canonical version. Part II contains technical appendices, repository specifications, schemas, and reference implementation artifacts. Part III contains the Japanese companion translation. This version incorporates review-driven clarifications on secure erasure in C# / .NET environments, fail-closed handling of indeterminate governance decisions, and future integration of zero-knowledge proof techniques for public anchor verification. Documents are licensed under CC BY 4.0. Code, schemas, and contract specimens included in the appendices are provided under Apache-2.0.
Bagus Rakadyanto Oktavianto Putra, Muhamad Risqi U. Saputra, Widyawan, Guntur Dharma Putra
Smart contracts face critical security challenges that require thorough auditing in decentralized web services. While Large Language Models (LLMs) have shown promise in automated vulnerability detection, existing approaches lack severity evaluations with actionable remediation and demand unnecessarily massive computational overhead. In this study, we introduce an efficient end-to-end smart contract security audit framework utilizing lightweight, highly optimized open-source LLMs (0.6B-4B parameters). Our framework decouples comprehensive audit tasks into four interconnected components: vulnerability detection, explanation, severity classification, and remediation recommendation. To maintain high accuracy without massive parameters, we implement Rank-Stabilized Low-Rank Adapters (rsLoRA), knowledge distillation, and a custom Chain-of-Verification (CoVe) aggregation strategy to systematically screen and consolidate multiple draft responses from the model into a highly accurate audit report. Experimental results demonstrate that our lightweight pipeline consistently outperforms state-of-the-art open-source coder dense LLMs (7B to 34B parameters), achieving 98.25% accuracy in vulnerability detection and an alignment score of 0.4375 in generative explanation tasks. Furthermore, our extensive ablation studies empirically validate the superiority of our decoupled audit processes over unified prompting and uncover a novel severity centrality bias, establishing a critical benchmark for future research in LLM-assisted auditing.
Alternative data availability (AltDA) systems provide Ethereum L2s with an external data publication layer for high throughput rollup designs. By moving bulk data publication outside of Ethereum, AltDA allows L2s to process more data than native DA. However, this replacement introduces a new consensus critical integration layer. Existing ecosystem frameworks identify high level risks, such as external DA trust assumptions and the presence or absence of a DA verifier, but do not provide a complete specification for how an L2 should integrate with AltDA. This gap can lead to L2 halts, inconsistent derivation across honest L2 nodes, invalid state assertions, or bridge attacks. This paper presents a canonical validation framework for secure AltDA integration. We model the boundary as a typed, deterministic, and total translation from L1 inbox bytes to an AltDA commitment, then to externally available data, and finally to the rollup payload consumed by the rest of core L2s logic. The central principle is that every adversarial input must lead to a defined unique outcome. We show how missing obligations lead to concrete failure modes, including underconstrained settlement, derivation halts, inconsistent honest node behavior, invalid state assertions, and bridge safety failures. We then apply the framework to representative AltDA integration architectures, including Celestia-Blobstream, EigenDA based designs, and Avail-ZKsync. Our evaluation shows that secure AltDA integration is not determined solely by the DA provider or bridge. The surrounding L2 integration must also enforce the full validation relation connecting L1 inbox inputs to accepted L2 state.
We present ENI6MA and Rosario Cypher as a proof-based identity and authorization architecture for emerging cybersecurity threats involving shadow AI, deepfakes, prompt injection, autonomous agents, credential theft, privacy exposure, and post-quantum risk. The paper responds to major 2026 cybersecurity forecasts by identifying a common root cause across many attack surfaces: conventional systems depend on reusable, stealable artifacts such as credentials, tokens, private keys, sessions, API keys, and stored personal data. ENI6MA replaces possession-based authentication with per-event proof of knowledge, policy-bound authorization, privacy-clean auditability, and contract enforcement behind cryptographically secure proof. Special attention is given to autonomous-agent security. The paper explains how ENI6MA constrains agents through per-action proof, verifier allowlists, policy identifiers, scoped pass credentials, and immutable validation records, reducing the risk of hijacked agents, excessive privilege, non-human identity sprawl, and zero-click prompt-injection exfiltration. The white paper also describes ENI6MA’s flexible deployment and capability model, including passwordless single sign-on, PII validation without disclosure, agent-to-agent authentication, proof-gated signing and custody, post-quantum sealing, sovereign/offline operation, and public verifier anchoring. This document is intended for cybersecurity leaders, AI governance teams, identity architects, privacy and compliance stakeholders, investors, technology partners, and researchers evaluating post-credential identity systems for human and autonomous-agent workflows.
Joel Poncha Lemayian, Ghyslain Gagnon, Kaiwen Zhang, Pascal Giard
Cryptographic wallets play a vital role in securing digital assets within blockchain networks by managing private keys that authorize secure transactions. However, side channel analysis (SCA) attacks have become a serious threat, enabling attackers to extract sensitive information by exploiting algorithmic weaknesses in microcontroller-based wallets, resulting in the loss of millions of dollars in digital assets. In hierarchically deterministic (HD) systems, the compromise of a single primary key can endanger all subsequent child keys, while the use of independent keys for each account introduces complexity and challenges in key management. This work presents HardVault, a field programmable gate array (FPGA)-based cryptocurrency wallet that supports both Bitcoin and Ethereum. HardVault introduces the first hardware wallet architecture that implements both non-deterministic (ND) and HD key generation modes directly in hardware, giving users the flexibility to choose either approach based on their security and usability needs. By leveraging constant-time operations and hardware-enforced private-key isolation, the design significantly improves resilience to SCA attacks. In addition, the architecture prioritizes resource efficiency to minimize area usage without compromising security, making it well-suited for compact, portable hardware wallet applications. Implementation on a ZCU104 FPGA shows that HardVault uses only 27% of available look-up tables (LUTs). Compared to the Trezor One cryptocurrency (crypto) wallet, the proposed implementation achieves$9\times $higher energy efficiency,$8\times $lower latency, and$7\times $higher throughput.
Open access
Blockchain Technology Applications and Security
Physical Unclonable Functions (PUFs) and Hardware Security
The Manufacturer Usage Description (MUD) standard enables enforcement of network restrictions for IoT devices based on their expected network traffic, as specified by manufacturers in an online MUD file. Devices advertise a URL pointing to this file, yet the standard does not define how to securely bind the issuing device to its profile. As a result, malicious devices can manipulate network policy enforcement by advertising valid URLs referencing genuine MUD profiles, but not intended for that device. Although MUD defines a certificate-based secure issuance method, current deployments rely on the insecure DHCP-based extension due to simpler integration. Existing solutions either depend on Public Key Infrastructure (PKI), break standard compliance, require excessive active manufacturer involvement, or overlook secure profile updates. In this paper, we present FIDEM, a standard-compliant framework for securing DHCP-based MUD URL issuance. FIDEM provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication, eliminating PKI reliance, minimizing manufacturers' involvement, and supporting secure profile updates. Formal analysis shows that FIDEM withstands stronger adversaries than in prior work, including supply-chain compromise and attacks using legitimate devices as cryptographic oracles. Our real-world evaluation on two reference constrained devices (ESP32-S3 and ESP32-C6) demonstrates minimal overhead compared to standard DHCP (approximately 5ms and 20mJ) and significant improvements over certificate-based benchmarks (approximately x20 faster, and 35% less energy).
Smart contract decompilation aims to recover high-level source code from bytecode, but evaluating decompilers remains difficult because existing studies use narrow datasets, inconsistent metrics, and limited semantic consistency checks. This gap is increasingly important as large language models (LLMs) begin to generate source-like Solidity that may compile and appear plausible, even when its semantics diverge from the original contract. We introduce SCDBench, a dataset and benchmark methodology for LLM-based smart contract decompilation. The dataset contains 600 real-world Solidity contracts with paired bytecode inputs, ground-truth source code, and replayable semantic checkpoints. SCDBench evaluates decompiler outputs through four cumulative stages: format completeness, compilability, Application Binary Interface (ABI) recovery, and semantic consistency via differential replay. We evaluate Claude Opus 4.7, GPT-5.3-Codex, and GLM-5 in a zero-shot decompilation setting, including GLM-5 variants with and without extended reasoning and a zero-shot compilation-repair setting. The results show that frontier LLMs can often produce structured and compilable Solidity, but achieving semantic consistency remains far from solved: the best-performing frontier model perfectly decompiles only 42/600 contracts. We further show that introducing same-model compilation repair substantially improves performance at modest additional cost. SCDBench establishes a common ground for rigorous, reproducible evaluation and aims to accelerate the development of reliable smart contract decompilers for blockchain security and transparency.
Zero-knowledge virtual machines (zkVMs) are a key technology for driving the large-scale adoption of zero-knowledge proofs (ZKP), but their performance bottlenecks severely limit their practicality. While current hardware acceleration research has exclusively focused on backend proving, we identify that the frontend execution and trace generation phase is rapidly emerging as the new system bottleneck. To address this challenge, we propose ZK-Tracer, the first hardware accelerator architecture specifically designed for the zkVM frontend. ZK-Tracer features a novel heterogeneous design comprising a Main Trace Unit and parallel Permutation Trace Units. It exposes a fine-grained interface to the host software through a lightweight instruction set extension, enabling efficient task offloading. Our ASIC implementation results demonstrate that ZK-Tracer achieves up to 1829x speedup in trace generation over a high-performance multi-core CPU. When integrated with existing backend proving accelerators, it delivers a remarkable 963x end-to-end performance improvement for the entire ZKP system.
Reentrancy attacks remain a persistent threat to decentralized applications (DApps), with malicious actors siphoning around 80M USD from the DApp ecosystem last year by exploiting EVM's inter-contract message-passing semantics. Existing research focuses primarily on detection, relying on known attack patterns, and fails to provide deployable solutions that eliminate the vulnerability. Traditional reentrancy guards are similarly limited, offering incomplete coverage across attack variations and lacking robustness against complex DApp interactions. In this paper, we introduce Sentinel, a novel proxy-based approach that mitigates reentrancy vulnerabilities in a type-agnostic way by integrating reentrancy logic directly into the proxy layer, intercepting all calls to the underlying implementation contract. Key features include a dual-mode operational system offering both a gas-optimized internal guard and a high-security external lock registry for cross-contract reentrancy prevention. The proxy also intelligently handles static calls, enabling safe view-function execution while protecting against Read-Only Reentrancy (ROR) attacks. Through rigorous evaluation on a dataset of 70 vulnerable smart contracts, Sentinel achieves 100% security coverage across four major reentrancy attack categories, outperforming existing solutions by over 40%
Xiao-Yang Liu Yanglet, Xiaodong Wang, Agostino Capponi
We argue that trustworthy AI agents, especially in high-stakes and policy-governed domains, should make execution conditional on certified traces rather than rely only on stronger generative models, output-level guardrails, or post-hoc audits. A generative agent may propose recommendations, tool calls, reports, or actions, but generation is not permission: an action may be computable yet impermissible, and individually permissible actions may compose into an impermissible trace. We formalize trustworthy agency through a \textbf{Proposal--Certification--Execution (PCE)} architecture: a probabilistic generating machine $M_G$ proposes candidate execution traces, a \textbf{Permissibility Machine} $M_Î $ certifies proposed traces under a policy system $Î $, and execution proceeds only for certified traces. The executable trace language is $L_{\mathrm{exec}} = L_G \cap L_{\mathrm{cert}}(M_Î )$. Before execution, a trace is a structured pre-execution record submitted for certification: it specifies intended steps, evidence, proposed tool calls, approvals, replayable computations, credentials, and execution conditions. This perspective complements chain-of-thought monitorability: visible reasoning may help detect misbehavior, but monitorability is not certifiability, and reasoning is only one component of a broader execution trace. The formal principle is simple: an agent-generated trace should execute only when it carries a checkable certificate witnessing permissibility under $Î $: \textbf{no certificate, no execution}. We develop certified traces and Permissibility Machines as foundations for trustworthy AI agents, connect trace certification to proof-carrying execution, proof memory, privacy, and zero-knowledge certificates, and propose evaluating agents by what generated traces can be safely certified for execution, not by output accuracy alone.
The rapid adoption of multi-provider container orchestration has introduced critical vulnerabilities in chain-of-custody (CoC) management, where logs and provenance records remain fragmented across heterogeneous cloud environments with inconsistent trust models. This study proposes a quantum-resistant CoC framework integrating lattice-based post-quantum signatures and zero-knowledge proofs for verifiable and privacy-preserving provenance tracking. Experimental evaluation in a simulated Kubernetes multi-cloud environment achieved a tamper detection rate exceeding 99.98% with acceptable performance overhead. The framework aligns with GDPR, ISO/IEC 27001, and ISO/IEC 27037 standards, providing a robust foundation for forensic-grade provenance management in the quantum era.
The rapid growth of Decentralized Finance (DeFi) has been accompanied by increasingly sophisticated security threats. Price Oracle Manipulation Attacks (POMA), a critical vulnerability, have evolved beyond simple economic exploits to include complex, multi-transaction attacks that exploit smart contract logic, causing hundreds of millions in losses. State-of-the-art detection methods, however, often focus on single-transaction, economic manipulations and typically fail to identify these emerging attack vectors, particularly when smart contract source code is unavailable. This article introduces a novel, EVM-compatible detection pipeline that addresses this gap. By combining transaction event logs and execution traces, we engineer a rich set of semantic and structural features that capture the underlying behavior of on-chain operations. We train a regularized autoencoder exclusively on the features of benign transactions to learn a deep representation of normal activity, flagging significant deviations as malicious. Our evaluation demonstrates the effectiveness of this approach, achieving 100% recall on a comprehensive dataset of single-transaction attacks and 98.25% event-level recall on a new, manually collected dataset of real-world multi-transaction exploits, with an overall precision of 97.15%. We present a robust, learning-based model capable of identifying both known and unseen POMA variants without relying on source code. Furthermore, we contribute a new dataset of multi-transaction attacks to foster further research, providing a more generalizable and resilient approach to securing the DeFi ecosystem.
Mojtaba Eshghie, Wolfgang Ahrendt, Cyrille Artho, Thomas Hildebrandt · 5 authors
We propose a ‘Model to Mitigate’ methodology: designing a platform-agnostic model of smart contract business logic and analyzing it before implementation. Using Dynamic Condition Response (DCR) graphs, originally developed for modeling business processes, we formally specify smart contracts and introduce a trace-conformance notion that links DCR-level guarantees to Solidity execution traces. Our method captures high-level properties such as event ordering, role-based access control, and time constraints, enabling the identification of design-rooted vulnerabilities through the discipline of explicit modeling. The DCR formalism requires developers to make concrete decisions about access control, preconditions, initial states, and event ordering-decisions that, when left implicit until implementation, are a documented source of vulnerabilities. Our analysis of real-world exploited and audited smart contracts yields six key insights, demonstrating how DCR-based modeling can enhance smart contract security by surfacing design flaws before they reach deployment. While we validate the approach on existing smart contracts with known flaws (i. e., post-implementation scenarios), the proposed methodology is applicable during design time (pre-development).
Abstract:The security of traditional asymmetric cryptography (e.g., ECC, RSA) relies strictly on the computational complexity of mathematical dilemmas such as discrete logarithms and prime factorization. Confronting the generational disruption of quantum computing power, these rigid mathematical structures face catastrophic risks of exponential collapse. Modern iterations ranging from smart-contract platforms to blind transaction protocols fail to address this vulnerability, remaining fundamentally derivative software modifications to Nakamoto's baseline architecture. This paper proposes a definitive paradigm shift, introducing the Thing-to-Thing (T2T) Holographic Distributed Architecture Solution. By devolving anti-tamper algorithms from the informational dimension down to the physical irreversibility of thermodynamics and semiconductor physics, we construct a hardware-native consensus architecture. Utilizing Silicon Physical Unclonable Functions (SRAM PUF) to generate true physical entropy, and locking historical ledger states via nanometer phase-change programmable fuses (eFUSE), this framework realizes a definitive manifestation of Shannon’s Perfect Secrecy operating within a 406-dimensional optimal phase space. Crucially, the architecture resolves the existential paradox of decentralized networks facing state-level regulatory and capital centralization. By enforcing a macro-capital staking matrix where baseline investments significantly exceed block minting rewards, the protocol establishes a hyper-asymmetric game equilibrium. Large institutional cartels are bound to the network's survival by an absolute thermodynamic dependency; any Byzantine deviation instantly triggers an Asymptotic Damped Slashing vector over a 10,000-block retrospective sliding window. Furthermore, this framework achieves absolute strategic deterrence against jurisdictional coercion through a hardware-native Jurisdictional Circuit Breaker (JCB). Any state-compelled ledger modification or physical infrastructure seizure triggers localized chip-level self-destruction and automated liquidity vaporization rather than ledger corruption, achieving an enduring, sovereign-immune, and material-native trust manifold.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Transaction ordering attacks extract billions of dollars annually from decentralized finance users in the form of Maximal Extractable Value (MEV). Byzantine Fault-Tolerant (BFT) consensus protocols guarantee total order but place no constraint on how that order is chosen, leaving the door open for adversarial reordering. Batch-order-fairness (batch-OF) protocols close this gap, but existing designs pay a steep performance price for this guarantee. Leader-based protocols such as Themis concentrate all fairness decisions at a single replica, while recent DAG-based proposals FairDAG and DAG of DAGs (DoD) force their fairness layer into strictly serial execution despite running on multi-proposer DAGs. We present Herring, the first $γ$-batch-OF DAG BFT protocol whose fairness layer parallelizes the dominant graph construction cost across committed subdags. Herring combines post-consensus graph construction with explicit missing edge resolution piggybacked on the DAG's reliable broadcast layer, a pairing that turns fair ordering from a per-round serial bottleneck into a CPU-bound task. We also uncover previously unreported liveness vulnerabilities in both FairDAG-RL and DoD that a malicious client can trigger to halt the fairness layer indefinitely, and propose patches that we integrate into our reimplementations. We implement Herring on top of the Rust implementation of Narwhal \& Tusk and evaluate it against FairDAG-RL, DoD-W, and Themis. Herring tracks the throughput of Narwhal \& Tusk closely up to roughly $10{,}000$\,tx/s, achieves roughly $90\%$ higher saturation throughput than FairDAG-RL and $100\%$ higher than DoD-W, and substantially reduces execution latency at saturation.
Pim Keer, Ioannis Alexopoulos, Matteo Maffei, Marco Argentieri · 6 authors
Bitcoin is the cryptocurrency with the largest market capitalisation, but its widespread adoption is fundamentally limited by the scalability constraints of its consensus algorithm, which requires every transaction to be confirmed onchain. To address this, several Layer-2 scalability solutions have been proposed to move payments offchain -- most notably, the Lightning Network. However, their deployment remains hindered by cumbersome setup requirements: users must lock funds onchain to participate and engage in complex auxiliary protocols (e.g., for channel rebalancing, top-ups, and routing). Other solutions, like payment pools, sidechains and rollups, cannot be implemented in a non-custodial way on Bitcoin due to its limited scripting capabilities, or require all protocol participants to update the offchain state. In this work, we present Ark, the first Bitcoin-compatible commit-chain. Ark enables offchain transactions of virtual UTXOs (VTXOs), through an untrusted operator who aggregates them into succinct onchain commitments. A distinctive feature of Ark is its ease of deployment: users can receive offchain payments without locking any funds beforehand and Ark state updates can be performed only requiring the users involved in that update. We formally define the Ark protocol and prove its security. During this process, we identified two attacks affecting the testnet implementation, which we responsibly disclosed and proposed fixes for, which have been now integrated into the mainnet implementation. Our experimental evaluation demonstrates that Ark can commit onchain to batches of arbitrarily many VTXOs with a constant-sized footprint of approximately 200 vB. Cooperative exits add one output per user, while unilateral exits require $\mathcal{O}(\log n)$ transactions of roughly 150 vB per VTXO for a batch of $n$ VTXOs.
Smart contract auditing remains challenging because vulnerabilities often emerge only under complex execution conditions, cross-transaction interactions, and environment-dependent assumptions. Existing analysis techniques, including static analysis, symbolic execution, fuzzing, and recent LLM-assisted approaches, each provide useful but incomplete coverage, and monolithic auditing pipelines often struggle to balance search breadth, reproducibility, and reporting reliability. This paper presents SEMA, a self-evolving multi-agent auditing framework for smart contracts that formulates auditing as a resource-bounded discovery of concrete counterexamples under replay-certified reporting semantics. SEMA combines heterogeneous specialized agents, an orchestrator, a shared artifact-centric knowledge base, and a replay-based referee. During auditing, agents generate and consume reusable artifacts, such as candidate invariants, refuted hypotheses, transaction templates, and coverage cues, allowing the shared search state to evolve across rounds without modifying the analyzers themselves. To ensure reporting reliability, findings are accepted only when the referee can replay the candidate scenario under a pinned execution configuration and confirm violation of an executable security property. We further evaluate SEMA on an annotated smart contract benchmark under a fixed 300 s budget per contract. The full system achieves 0.9469 instance recall, 0.9441 success rate, and 0.9445 macro-average category recall on the retained executable subset, outperforming both symbolic-only and fuzzing-only baselines, as well as multi-agent ablations that disable dynamic knowledge evolution or cross-agent artifact reuse.
Autonomous actors, including AI agents, decentralized autonomous organizations, decentralized unincorporated nonprofit associations, algorithmically managed funds, and individuals operating through programmatic interfaces, are increasingly executing financial transactions on distributed ledger networks without governance oversight. Existing approaches rely on application-level middleware operating within the same trust boundary as the actors being governed, post-transaction monitoring that detects violations after irreversible execution, or multi-party computation systems that provide distributed key management without policy evaluation. This paper presents SovereignGate, a deterministic governance enforcement system that achieves structural enforcement through protocol-native multi-signature co-signing with disabled master keys. The system comprises a Rust enforcement kernel with layered crate dependencies, a deterministic policy evaluation engine with deny dominance and independent fact inference, a bylaws-as-code domain-specific language for encoding entity governance rules as content-addressed policy bundles, a cryptographic receipt chain with Ed25519-signed Merkle-anchored attestation, and a structural co-signing mechanism making transaction execution without governance approval structurally impossible at the consensus layer. The preferred embodiment integrates with the XRP Ledger. The architecture is chain-agnostic. No existing system combines deterministic policy enforcement, Merkle-chained cryptographic attestation, and structural protocol-level co-signing for autonomous financial actors.