Once deployed in blockchain, smart contracts become immutable: Attackers can exploit bugs and vulnerabilities in their code that cannot be replaced with a bug-free version. For this reason, the verification of smart contracts before they are deployed in blockchain is important. However, the development of verification tools is not easy, especially if one wants to obtain guarantees by using formal methods. This article describes the development, from scratch, of a static analyzer based on abstract interpretation for the verification of real-world Tezos smart contracts. The analyzer is generic with respect to the property under analysis. This article shows taint analysis as a concrete instantiation of the analyzer, at different levels of precision, to detect untrusted cross-contract invocations.
Joyce Quintino, Carina Oliveira, Rossana M. C. Andrade
The growth of devices in the Internet of Things (IoT) has brought an increase in the amount of data flowing through the network. As a consequence of that, a reliable environment has became essential to avoid security vulnerabilities. In this scenario, Blockchain emerges as a promising technology to enhance IoT security, enabling decentralized, encrypted, and immutable data registration with the consensus of network participants. Smart contracts are self-executing programs distributed in a Blockchain. In IoT applications that use Blockchain, smart contracts can eliminate the need for intermediaries, allowing for more secure and transparent data transfers between involved parties in a decentralized manner. However, smart contracts are subject to security flaws, mainly caused by programming errors and vulnerabilities in the source code, which can result in financial losses or compromise data integrity, posing risks to users’ privacy and security. Therefore, performing tests with different approaches before deployment can expose errors in the smart contract code and reduce security risks. This work then proposes a process, called PERCI, that defines a set of verification steps for smart contracts in IoT applications to detect known vulnerabilities, using a combination of static and dynamic analysis tools before the contract deployment. The combination of static and dynamic analyses is proposed to improve vulnerability detection, providing a more robust solution. For this, the process uses two static analysis tools, Slither and Mythril, and one dynamic analysis tool, Manticore. PERCI is evaluated, firstly, by demosntrating that the combination of the analyses of each tool resulted in more efficient vulnerability detection, providing a more comprehensive and precise verification of the smart contract code. Additionally, this work integrated a smart contract to register and authenticate devices on the Blockchain with an IoT application that shows weather conditions through colors with a smart lamp. The process evaluation demonstrated the feasibility of using combined static and dynamic analyses for more efficient vulnerability detection. Finally, this dissertation is expected to contribute to improving the security and the reliability of IoT applications that use Blockchain.
Mutlu Tahsin Üstündağ, Gizem Yıldız, Mustafa TANRIVERDİ, Togay Seçkin BİRBUDAK
In this study, it is aimed to analyze the articles on Web3 and present the general situation about Web3 to researchers. Within the scope of this purpose, the trends of the studies published on Web3 according to years, the trends of the journals in which they were published, the institutions and countries that contributed the most, the keywords used in the studies, the topics and themes based on the studies, and the distribution of research areas were revealed. The research is based on bibliometric analysis. A total of 280 articles published in WoS and SCOPUS databases were analyzed. WoSViewer and Bibliometrix programs were used in data analysis. The findings were analyzed and interpreted separately in WoS and SCOPUS. As a result of the research, there was a significant increase in studies on Web3 in 2022, and the journals with the highest number of publications in WoS and SCOPUS differ. The countries that contributed the most to Web3 were China, The USA, India, England, Germany. The most cited countries are China, the USA, India, England, Iran and Canada. In general, it can be said that countries and institutions have conducted studies on Web3 by addressing many issues related to Web3. Within the scope of the results, Web3 studies address many different disciplines with many topics. However, there is a need to deepen the studies. The policies, practices and even the laws created by countries on Web3 are important for studies on Web3. Blockchain is one of the most studied topics, but it is understood that there are some hesitations about blockchain security. For this reason, Web3 studies can be conducted to increase blockchain security.
Solana has quickly emerged as a popular platform for building decentralized applications (DApps), such as marketplaces for non-fungible tokens (NFTs). A key reason for its success are Solana's low transaction fees and high performance, which is achieved in part due to its stateless programming model. Although the literature features extensive tooling support for smart contract security, current solutions are largely tailored for the Ethereum Virtual Machine. Unfortunately, the very stateless nature of Solana's execution environment introduces novel attack patterns specific to Solana requiring a rethinking for building vulnerability analysis methods. In this paper, we address this gap and propose FuzzDelSol, the first binary-only coverage-guided fuzzing architecture for Solana smart contracts. FuzzDelSol faithfully models runtime specifics such as smart contract interactions. Moreover, since source code is not available for the large majority of Solana contracts, FuzzDelSol operates on the contract's binary code. Hence, due to the lack of semantic information, we carefully extracted low-level program and state information to develop a diverse set of bug oracles covering all major bug classes in Solana. Our extensive evaluation on 6049 smart contracts shows that FuzzDelSol's bug oracles find bugs with a high precision and recall. To the best of our knowledge, this is the largest evaluation of the security landscape on the Solana mainnet.
Context:Smart contracts are prone to numerous security threats due to undisclosed vulnerabilities and code weaknesses. In Ethereum smart contracts, the challenges of timely addressing these code weaknesses highlight the critical need for automated early prediction and prioritization during the code review process. Efficient prioritization is crucial for smart contract security. Objective:Toward this end, our research aims to provide an automated approach, PrAIoritize, for prioritizing and predicting critical code weaknesses in Ethereum smart contracts during the code review process. Method: To do so, we collected smart contract code reviews sourced from Open Source Software (OSS) on GitHub and the Common Vulnerabilities and Exposures (CVE) database. Subsequently, we developed PrAIoritize, an innovative automated prioritization approach. PrAIoritize integrates advanced Large Language Models (LLMs) with sophisticated natural language processing (NLP) techniques. PrAIoritize automates code review labeling by employing a domain-specific lexicon of smart contract weaknesses and their impacts. Following this, feature engineering is conducted for code reviews, and a pre-trained DistilBERT model is utilized for priority classification. Finally, the model is trained and evaluated using code reviews of smart contracts. Results: Our evaluation demonstrates significant improvement over state-of-the-art baselines and commonly used pre-trained models (e.g. T5) for similar classification tasks, with 4.82\%-27.94\% increase in F-measure, precision, and recall. Conclusion: By leveraging PrAIoritize, practitioners can efficiently prioritize smart contract code weaknesses, addressing critical code weaknesses promptly and reducing the time and effort required for manual triage.
Nowadays, Learning Management Systems (LMS) have become increasingly popular, particularly due to the COVID-19 pandemic, offering enhanced effectiveness and efficiency. Online exams have emerged as a critical feature within LMS, serving as a means to evaluate students’ performance and assess their understanding of the course material. These exams play a crucial role in determining students’ eligibility for progression to the next grade or level of study. It is imperative that online exam results meet the standards of reliability and transparency. Any lack of reliability, such as the vulnerability to hacking, can have detrimental effects on students’ overall grades. Traditional online exam systems typically store data in centralized locations like MySQL databases, leaving them susceptible to unauthorized access by malicious individuals who may alter students’ exam results. This paper aims to propose a blockchain-based framework that facilitates the secure and peer-to-peer conduct and evaluation of academic exams. The framework employs hashing techniques to ensure the integrity of the data and utilizes proof of stake mechanisms to enhance security. Blockchain technology has proven to be effective in safeguarding data integrity by virtue of its decentralized data storage approach and the use of cryptographic hashing for every block within the chain. This paper demonstrates how online exams can be developed using blockchain technology, with each question asked and answered being directly stored on the blockchain. To achieve this, we have developed a module that integrates with the Moodle learning management system. Through a comparative analysis of the default centralized storage approach in Moodle, our module modifies the exam results’ storage method, ensuring secure and tamper-proof data storage on the blockchain network. By leveraging the blockchain network, the data associated with exam results is reliably secured, ensuring its integrity, and making it immune to manipulation. Our results indicate that the data stored through the blockchain achieved complete accuracy, with no discrepancies observed when compared to the standard approach employed by the Moodle LMS for storing results. The blockchain network provides a reliable and immutable platform that prevents unauthorized alterations or manipulations of student data. In conclusion, our blockchain-based framework offers a robust solution for enhancing the security and reliability of online exam results. By leveraging the decentralized and tamper-proof nature of blockchain technology, we can ensure the integrity and transparency of student data, ultimately providing a more trustworthy and accurate assessment of their academic performance.
Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu · 8 authors
Smart contracts are prone to various vulnerabilities, leading to substantial financial losses over time. Current analysis tools mainly target vulnerabilities with fixed control or data-flow patterns, such as re-entrancy and integer overflow. However, a recent study on Web3 security bugs revealed that about 80% of these bugs cannot be audited by existing tools due to the lack of domain-specific property description and checking. Given recent advances in Large Language Models (LLMs), it is worth exploring how Generative Pre-training Transformer (GPT) could aid in detecting logicc vulnerabilities. In this paper, we propose GPTScan, the first tool combining GPT with static analysis for smart contract logic vulnerability detection. Instead of relying solely on GPT to identify vulnerabilities, which can lead to high false positives and is limited by GPT's pre-trained knowledge, we utilize GPT as a versatile code understanding tool. By breaking down each logic vulnerability type into scenarios and properties, GPTScan matches candidate vulnerabilities with GPT. To enhance accuracy, GPTScan further instructs GPT to intelligently recognize key variables and statements, which are then validated by static confirmation. Evaluation on diverse datasets with around 400 contract projects and 3K Solidity files shows that GPTScan achieves high precision (over 90%) for token contracts and acceptable precision (57.14%) for large projects like Web3Bugs. It effectively detects ground-truth logic vulnerabilities with a recall of over 70%, including 9 new vulnerabilities missed by human auditors. GPTScan is fast and cost-effective, taking an average of 14.39 seconds and 0.01 USD to scan per thousand lines of Solidity code. Moreover, static confirmation helps GPTScan reduce two-thirds of false positives.
Smart contracts play a vital role in the Ethereum ecosystem. Due to the prevalence of kinds of security issues in smart contracts, the smart contract verification is urgently needed, which is the process of matching a smart contract's source code to its on-chain bytecode for gaining mutual trust between smart contract developers and users. Although smart contract verification services are embedded in both popular Ethereum browsers (e.g., Etherscan and Blockscout) and official platforms (i.e., Sourcify), and gain great popularity in the ecosystem, their security and trustworthiness remain unclear. To fill the void, we present the first comprehensive security analysis of smart contract verification services in the wild. By diving into the detailed workflow of existing verifiers, we have summarized the key security properties that should be met, and observed eight types of vulnerabilities that can break the verification. Further, we propose a series of detection and exploitation methods to reveal the presence of vulnerabilities in the most popular services, and uncover 19 exploitable vulnerabilities in total. All the studied smart contract verification services can be abused to help spread malicious smart contracts, and we have already observed the presence of using this kind of tricks for scamming by attackers. It is hence urgent for our community to take actions to detect and mitigate security issues related to smart contract verification, a key component of the Ethereum smart contract ecosystem.
Sebastian Holler, Sebastian Biewer, Clara Schneidewind
The cryptocurrency Ethereum is the most widely used execution platform for smart contracts. Smart contracts are distributed applications, which govern financial assets and, hence, can implement advanced financial instruments, such as decentralized exchanges or autonomous organizations (DAOs). Their financial nature makes smart contracts an attractive attack target, as demonstrated by numerous exploits on popular contracts resulting in financial damage of millions of dollars. This omnipresent attack hazard motivates the need for sound static analysis tools, which assist smart contract developers in eliminating contract vulnerabilities a priori to deployment. Vulnerability assessment that is sound and insightful for EVM contracts is a formidable challenge because contracts execute low-level bytecode in a largely unknown and potentially hostile execution environment. So far, there exists no provably sound automated analyzer that allows for the verification of security properties based on program dependencies, even though prevalent attack classes fall into this category. In this work, we present HoRStify, the first automated analyzer for dependency properties of Ethereum smart contracts based on sound static analysis. HoRStify grounds its soundness proof on a formal proof framework for static program slicing that we instantiate to the semantics of EVM bytecode. We demonstrate that HoRStify is flexible enough to soundly verify the absence of famous attack classes such as timestamp dependency and, at the same time, performant enough to analyze real-world smart contracts.
Blockchain is really trendy these days. A distributed ledger on a peer-to-peer network that is completely open to everyone was the block chain. It is composed of blocks that include hash values and data. Before a new transaction can be added to the block chain, researchers must validate it; this process is called mining. Mining is expensive and requires a lot of processing power. Since the block chain is a peer-to-peer network, the data is maintained in every node. The block chain network has increased to 190GB thanks to the increasing number of transactions that are processed through it. It is a problem because a cheap laptop can only hold so much data. This study developed a revolutionary, less expensive system than the block chain method. We choose web applications as our use case since they are increasingly overtaking all other methods of accessing internet services in popularity. The immutability, data security, and data dissemination features of the block chain were all taken into account. The Merle tree concept provides immutability, hashing was used to achieve security, and an open source data distribution tool is used to spread the data. This paper provides innovative methods for preventing malicious data upload using MIME, cross-site programming, and cross-site request manipulation.
Smart contract vulnerability detection draws extensive attention in recent years due to the substantial losses caused by hacker attacks. Existing efforts for contract security analysis heavily rely on rigid rules defined by experts, which are labor-intensive and non-scalable. More importantly, expert-defined rules tend to be error-prone and suffer the inherent risk of being cheated by crafty attackers. Recent researches focus on the symbolic execution and formal analysis of smart contracts for vulnerability detection, yet to achieve a precise and scalable solution. Although several methods have been proposed to detect vulnerabilities in smart contracts, there is still a lack of effort that considers combining expert-defined security patterns with deep neural networks. In this paper, we explore using graph neural networks and expert knowledge for smart contract vulnerability detection. Specifically, we cast the rich control- and data- flow semantics of the source code into a contract graph. To highlight the critical nodes in the graph, we further design a node elimination phase to normalize the graph. Then, we propose a novel temporal message propagation network to extract the graph feature from the normalized graph, and combine the graph feature with designed expert patterns to yield a final detection system. Extensive experiments are conducted on all the smart contracts that have source code in Ethereum and VNT Chain platforms. Empirical results show significant accuracy improvements over the state-of-the-art methods on three types of vulnerabilities, where the detection accuracy of our method reaches 89.15%, 89.02%, and 83.21% for reentrancy, timestamp dependence, and infinite loop vulnerabilities, respectively.
Michael Coblenz, Jonathan Aldrich, Brad A. Myers, Joshua Sunshine
Some blockchain programs (smart contracts) have included serious security vulnerabilities. Obsidian is a new typestate-oriented programming language that uses a strong type system to rule out some of these vulnerabilities. Although Obsidian was designed to promote usability to make it as easy as possible to write programs, strong type systems can cause a language to be difficult to use. In particular, ownership, typestate, and assets, which Obsidian uses to provide safety guarantees, have not seen broad adoption together in popular languages and result in significant usability challenges. We performed an empirical study with 20 participants comparing Obsidian to Solidity, which is the language most commonly used for writing smart contracts today. We observed that Obsidian participants were able to successfully complete more of the programming tasks than the Solidity participants. We also found that the Solidity participants commonly inserted asset-related bugs, which Obsidian detects at compile time.
Amin Kharraz, Zane Ma, Paul Murley, Charles Lever · 9 authors
In-browser cryptojacking is a form of resource abuse that leverages end-users' machines to mine cryptocurrency without obtaining the users' consent. In this paper, we design, implement, and evaluate Outguard, an automated cryptojacking detection system. We construct a large ground-truth dataset, extract several features using an instrumented web browser, and ultimately select seven distinctive features that are used to build an SVM classification model. Outguardachieves a 97.9% TPR and 1.1% FPR and is reasonably tolerant to adversarial evasions. We utilized Outguardin the wild by deploying it across the Alexa Top 1M websites and found 6,302 cryptojacking sites, of which 3,600 are new detections that were absent from the training data. These cryptojacking sites paint a broad picture of the cryptojacking ecosystem, with particular emphasis on the prevalence of cryptojacking websites and the shared infrastructure that provides clues to the operators behind the cryptojacking phenomenon.
Among the zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARK), the simulation-extractable zk-SNARK (SE-SNARK) introduces a security notion of non-malleability. The existing pairing-based zk-SNARKs designed from linear encoding are known to be vulnerable to algebraic manipulation of the proof. The latest SE-SNARKs check the proof consistency by increasing the proof size and the verification cost. In particular, the number of pairings increases almost doubles due to further verification. In this article, we propose two novel SE-SNARK constructions with a single verification. The consistency check is subsumed in a single verification through employing a hash function. The proof size and verification time of the proposed SE-SNARK schemes are minimal in that it is the same as the state-of-the-art zk-SNARK without non-malleability. The proof in our SE-SNARK constructions comprises only three group elements (type III) in the QAP-based scheme and two group elements (type I) in the SAP-based scheme. The verification time in both requires only 3 pairings. The soundness of the proposed schemes is proven under the hash-algebraic knowledge (HAK) assumption and the (linear) collision-resistant hash assumption.
Paulo Matias, Pedro Barbosa, Thiago N.C. Cardoso, Diego M. Campos · 5 authors
Capture-the-flag (CTF) competitions are increasingly important for the Brazilian cybersecurity community as educational and professional tools. Unfortunately, CTF platforms may suffer from security issues, giving an unfair advantage to competitors. To mitigate this, we propose NIZKCTF, the first open-audit CTF platform based on noninteractive zero-knowledge proofs.
Roman Matzutt, Oliver Hohlfeld, Martin Henze, Robin Rawiel · 6 authors
As transaction fees skyrocket today, blockchains become increasingly expensive, hurting their adoption in broader applications. This work tackles the saving of transaction fees for economic blockchain applications. The key insight is that other than the existing "default'' mode to execute application logic fully on-chain, i.e., in smart contracts, and in fine granularity, i.e., user request per transaction, there are alternative execution modes with advantages in cost-effectiveness. On Ethereum, we propose a holistic middleware platform supporting flexible and secure transaction executions, including off-chain states and batching of user requests. Furthermore, we propose control-plane schemes to adapt the execution mode to the current workload for optimal runtime cost. We present a case study on the institutional accounts (e.g., coinbase.com) intensively sending Ether on Ethereum blockchains. By collecting real-life transactions, we construct workload benchmarks and show that our work saves 18%\sim 47%18%-47% per invocation than the default baseline while introducing 1.81%\sim 16.59%1.81%-16.59% blocks delay.