Smart contracts underpin a wide range of decentralized applications—from financial services to supply-chain management—but their immutability and direct control of assets magnify the impact of any security bugs. Although many fuzz approaches have been proposed and have demonstrated their effectiveness in uncovering vulnerabilities, existing methods often rely on unguided random mutation scheduling, generate redundant inputs, and fail to adapt to smart contract-specific characteristics. To overcome these challenges, we present FuzzMaster, a feedback-driven fuzzing framework that combines deep reinforcement learning (DRL) with lightweight probabilistic scheduling to steer mutation selection at runtime intelligently. By continuously analyzing execution feedback—code coverage, function-call sequences, and vulnerability signals—FuzzMaster’s DRL agent and probabilistic tables prioritize high-impact mutations and avoid wasted effort on redundant seeds. On standard VeriSmart and SmartBugs benchmarks, FuzzMaster achieves a 66.2% detection rate with 100% precision (versus 46.9% for ItyFuzz and 43.1% for Confuzzius) and uncovers most bugs within the first second of execution. Meanwhile, in real-world Ethereum contracts, FuzzMaster identified 97 vulnerabilities in 6 categories. These results demonstrate that dynamic, vulnerability-aware mutation scheduling can dramatically improve both the efficiency and effectiveness of smart contract fuzz testing.
Smart contracts have achieved significant success, however, their security remains a long-standing challenge. The immutability and transparency of smart contracts require establishing a strong mechanism to prevent private leakage and trusted data tampering. Apart from traditional logic and code-level vulnerabilities arising from insufficient control over contract variables and function parameters, smart contracts may store private-dependent information in blockchain records, which is a critical type of vulnerability, but often overlooked in existing security analysis. In this paper, we present an automated approach for synthesizing security policies, named SmartIFSyn, to eliminate information flow vulnerabilities in smart contracts. We formalize the semantics of Solidity, the most widely used smart contract language, and analyze information flow security of Solidity smart contracts from two perspectives: local-variable security and global-interaction security. We present a type system to guide the elimination of local-variable vulnerabilities by inferring a policy and resort to constraint solving to synthesize a desired policy in case that the type system fails. The policy ensures both local-variable and global-interaction security while it is maximally aligned with user preference. Furthermore, the policy can be subsequently converted into enforceable specifications. We implement our approach in a tool and evaluate it on 17,160 real-world Ethereum smart contracts. The experimental results demonstrate the efficacy of our approach, e.g., detected 243 vulnerabilities in 223 real-world Ethereum smart contracts.
Inundating networks with traffic to cripple service availability defines a DDoS attack. Traditional defences, like firewalls and centralized scrubbing centers, can suffer from single points of failure during large-scale attacks. Enter new blockchain technology, with Ethereum probably leading the way in decentralized solutions. Since Ethereum smart contracts enable DDoS detection and enforcement of validation rules, events can be managed automatically, applying rewards or penalties without a central authority. In this way it leverages the positive aspects of crypto-economic mechanisms and reputation systems; giving people an incentive to honestly participate while making abusing the system unprofitable, creating a trustless, transparent, resilient decentralized defence against cyber threats. The architecture of a blockchain-validated system that gates access to services includes a back-end gateway responsible for verifying transactions on the blockchain before processing user queries. The off-chain detection algorithm identifies unexpected traffic spikes that exceed a predefined threshold. Attackers were deterred by cost, the system itself stayed up and running, and the smart contract worked autonomously. The suggested approach maintained 96% access success for authorized users, successfully blocked 92% of DDoS traffic, and guaranteed 98% uptime during simulated attacks. All validated access attempts were 100% immutably recorded on-chain, and attackers had to pay 300% more employs transparent on-chain rules and Ethereum smart contracts to manage access. Because every access attempt is permanently documented on the blockchain, it is difficult to alter logs or stop denial-of-service attacks without detection.
The growth of the usage of decentralized applications on Ethereum has seen the rise of an increasing number of bad actors that are using it to commit fraud, phishing, money laundering and financial scams. Traditional detection methods are less effective to detect accounts with more complex and changing behaviours. The paper suggests a novel multi-level framework for detecting malicious Ethereum accounts based on supervised classification and adaptive anomalous account verification using a routing based on probabilities. To get the transaction behavior features, opcode features and time-interval features from the publicly available EtherShield data set, we use the entire data set to extract the entire features. The first is a Level-1 where an XGBoost machine learning model classifies Ethereum accounts into Fair, Likely Malicious and Malicious categories, and outputs calibrated probability scores for any account. Uncertainty about malicious accounts are escalated to level-2 where anomaly verification and behavioural re-assessment are carried out by using models such as Random Forest and Isolation Forest. The final classification is obtained by decision fusion process, which combines the results obtained from both levels. The Random Forest-based verification module is evaluated in the experiments and is found to be 95% accurate, 94% macro precision, 95% macro recall and 95% macro F1-score, which is significantly better than the Isolation Forest (baseline). Besides, stratified 5-Fold Cross Validation further demonstrates that the proposed framework is robust and generalizable with a mean accuracy of 94.96% ± 0.43, mean precision of 94.40% ± 0.42, mean recall of 94.84% ± 0.47 and mean F1-Score of 94.66% ± 0.42. The proposed framework proves to be an effective solution to minimize misclassification, enhance the reliability of detection and offer a scalable answer to safeguard Ethereum blockchain ecosystems from newly emerged malicious activities.
Mingxi Ye, Yuhong Nan, Zhijie Zhong, Jianzhong Su · 7 authors
Given the critical nature of Ethereum, exploiting 1-day vulnerabilities that are patched but not yet widely deployed is essential. Meanwhile, Automatic Patch-based Exploit Generation (APEG) is a promising technique for this, as it helps developers understand root causes, verify fixes in downstream forks, and detect incomplete patches. However, existing exploit generation tools can not work well for vulnerabilities on Ethereum due to three key unique challenges: (1) navigating complex and cross-language exploit paths hidden within patches, (2) synthesizing complicated and stateful environment configurations, and (3) handling non-deterministic inconsistencies between blockchain nodes that lead to false alarms. To address these challenges, we introduce ChainDelta , a novel fuzzing agent framework driven by Large Language Models to automatically generate exploits based on Ethereum security patches. ChainDelta consists of three core modules: a directed fuzzer utilizes call graph analysis to guide testing towards vulnerable code based on the patch information; an agent-based environment fuzzer acts as an expert to automatically set up the necessary blockchain states to trigger vulnerabilities; and finally, a state-aware sanitizer performs differential analysis while monitoring the blockchain transient state to distinguish true inconsistencies from benign non-determinism. We evaluate ChainDelta on a diverse benchmark with real-world patches, covering a wide range of types such as data racing and denial-of-service. ChainDelta successfully generated exploits with a 64% success rate and only a 15.8% false positive rate. An ablation study confirms the contribution of each module to the overall performance. To demonstrate its practical impacts, we conducted a real-world auditing campaign on top of ChainDelta , leading to the discovery of four previously undisclosed vulnerabilities with bug bounties.
Decentralized Finance (DeFi) has revolutionized financial services by eliminating traditional intermediaries, but this openness creates new vulnerabilities that malicious actors exploit for fraud. The pseudonymous nature of blockchain transactions and lack of centralized oversight make traditional fraud detection methods inadequate for the DeFi ecosystem. This paper introduces ChainGuard, an end-to-end fraud detection system that leverages verifiable machine learning with zero-knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs). ChainGuard utilizes a comprehensive approach that combines advanced feature extraction from Ethereum blockchain transaction data, optimized machine learning models, and on-chain verification through zk-SNARKs. Our solution enables privacy-preserving fraud detection while maintaining the ability to verify results without exposing sensitive transaction data and the internal architecture of the model. We demonstrate that ChainGuard achieves permissible accuracy in detecting fraudulent activities across Ethereum and various DeFi platforms while ensuring computational efficiency through multiple optimization techniques, including quantization. Experimental results show that our approach achieves performance comparable to traditional fraud detection methods while maintaining the decentralized and trustless nature of blockchain systems.
Sabri Hisham, Mokhairi Makhtar, Azwa Abdul Aziz, Ahmad Firdaus · 6 authors
Abstract The global expansion of blockchain technology has unfortunately been accompanied by a rise in fraudulent activities within decentralized applications (DApps), leading to substantial financial losses. The immense volume of transaction data (big data) makes manual detection of abnormal account behavior impossible, necessitating the use of automated machine learning (ML) techniques. Existing anomaly machine learning detection approaches often rely on single-classifier models that suffer from limited generalization, high false-positive rates, or insufficient feature relevance, thereby compromising detection accuracy and system security. Moreover, the high dimensionality and complexity of blockchain data necessitate more sophisticated and robust methodologies that can effectively identify relevant features and leverage the strengths of multiple learning algorithms. This study addresses a key gap by proposing a novel anomaly detection framework for the Ethereum blockchain that distinctively integrates the Boruta feature selection algorithm with a combination of ensemble methods and a fuzzy logic classifier. Specifically, we investigate the performance of various ensemble techniques (bagging, boosting, voting, and stacking) combined with foundational models (Decision Tree, Random Forest, K-Nearest Neighbors, and XGBoost), including a specialized Fuzzy ENORA model. The objective is to significantly enhance the accuracy of anomaly detection. Our results demonstrate that the ensemble models consistently and significantly outperformed single-classifier models, achieving a mean performance metric of 0.99 across accuracy, precision, recall, and F1 score, affirming the robustness of the proposed Boruta-driven ensemble approach for securing blockchain transactions.
Abstract: In the era of the digital economy, establishing an efficient and compliant data asset rights confirmation system within scalable distributed infrastructures is of critical importance. However, under heterogeneous distributed ledger environments, data circulation is often trapped in a binary tension between privacy preservation and regulatory accessibility, while facing severe scalability bottlenecks. Existing studies lack a unified solution that simultaneously addresses cross-chain interoperability, post-quantum security, and low-cost verification. To this end, this paper proposes a data asset rights confirmation framework based on hybrid post-quantum zero-knowledge proofs. The framework designs a scalable recursive composition architecture combining Scalable Transparent Argument of Knowledge (STARKs) and Succinct Non-interactive Argument of Knowledge (SNARKs), leveraging off-chain compressed permutation to significantly reduce on-chain storage overhead. In parallel, a light-client-based distributed cross-chain state synchronization protocol and a regulation-friendly privacy auditing module (based on threshold encryption) are constructed to ensure transactional atomicity and conditional auditability during data circulation. Experimental evaluations conducted on two datasets, Ethereum NFT transactions and credit card fraud detection, demonstrate that, compared with cross-chain privacy-preserving solutions such as zkCross, the proposed framework reduces on-chain verification Gas costs by approximately 18.2%, compresses proof size to 0.28 kB, and achieves a peak throughput of 1,618 Transactions Per Second (TPS). Moreover, under controlled experimental conditions, the framework attains an audit success rate of 99.6% with only 14.0% performance overhead. Overall, this study alleviates the long-standing trade-offs among privacy protection, regulatory compliance, and computational scalability, and provides a verifiable technical solution for the interoperability and infrastructure development of next-generation distributed systems.
The paper proposes an extended quality assessment model for Distributed Ledger Technology platforms, referred to as DLT-QM, developed on the basis of the ISO/IEC 25010 standard while considering the architectural and operational specifics of decentralized and blockchain-based systems. The relevance of the study is determined by the rapid development of digital technologies and the growing adoption of DLT platforms in finance, e-government, logistics, IoT ecosystems, and enterprise information systems, alongside the absence of a unified formalized approach for comprehensive quality assessment of such platforms. The study analyzes the applicability of ISO/IEC 25010 charac-teristics to DLT-oriented software systems and identifies a set of DLT-specific quality attributes reflecting the unique properties of distributed ledger environments, including decentralization level, consensus reliability, transaction finality, auditability, trust model, interoperability, and on-chain/off-chain balance. For each characteristic, mathematical metrics are formalized to support multicriteria quality assessment and optimization of architectural decisions in software engineering tasks. The integral quality indicator QDLT is defined as a weighted combination of the traditional ISO/IEC 25010 component and a DLT-specific component, enabling the adaptation of the model to various application scenarios. The proposed model is validated using four representative DLT platforms: Hyperledger Fabric, Ethereum, Corda, and Polygon. The obtained results confirm the existence of structural trade-offs between decentralization, performance, security, and interoperability in modern distributed systems. Furthermore, a scenario-oriented application methodology is developed, including a procedure for determining weighting coefficients depending on the application domain, such as financial consortium systems, e-government infrastructures, and IoT supply chain environments. The practical significance of the research lies in the development of a formalized decision-support instrument for selecting DLT platforms in the design and implementation of modern software systems and digital services. Keywords: blockchain, distributed ledger technology, DLT platforms, decentralized systems, distributed systems, information technologies, digital technologies, software engineering.
The structural supranational criterion has been applied to public attractors with a legal form, to a monetary attractor with none, and to private platform attractors. This paper carries it to a third attractor type, the computational-settlement platform on a pure-protocol substrate, the larger smart-contract platforms and the rollups that settle to them. The supranational criterion holds that an entity is a cascade attractor when its binding residue density spans participants so that no single participant’s reversal dissolves the network, with density a multiplicative product of depth, extent, and interconnection in which a necessary component at near-zero nullifies the whole. The decisive choice is the location of the residue. The residue is the composed stack, the deployed contracts, the value locked in them, the standards, and the settlement finality that applications and rollups depend on. It is not the token, which is the internal unit and the instrument that secures and meters the chain. Depth is switching-cost lock-in of composed state. Extent is the deployed value and the user base. Interconnection is composability, the dependence of applications on applications and of settlement layers on a base layer, the settlement interconnection of the Euro re-realised in contract code. The reversal test is the consensus halt, which suspends but does not relocate the residue, because the composed stack persists across it and resumes on restart. The de-concentration that governs whether a platform halts is operational, the diversity of the implementation, the clients and the sequencers, and it is not the distribution of stake, a measure on which the halting platform scores as well as the resilient one. The Ethereum finality incident of May 2023, set against the halt records of Solana and Avalanche, is the existence proof. The same class of client defect stalled Ethereum without halting it, because the independent clients that did not share the defect carried the chain, and halted the two platforms that ran a single client. The argument is set alongside the blockchain trilemma, which states the scalability-decentralisation tradeoff the spectrum populates, and it contributes what the trilemma does not, the location of the residue and the survival of the attractor when it halts.
Giulio Segalini, Yigit Çolakoğlu, Marko Putnik, Jérémie Decouchant
Decentralized Finance (DeFi) applications rely heavily on the order in which transactions are executed, making them susceptible to reordering attacks that enable adversaries to extract Blockchain Extractable Value (BEV). While linear blockchain systems such as Ethereum have inspired extensive research into fair ordering mechanisms, DAG-based consensus protocols have remained largely unprotected despite their growing adoption for scalability and performance. In this paper, we introduce Tilikum, a DAG-based ledger protocol that ensures fair transaction ordering without relying on weak edges. Tilikum achieves ordering linearizability by leveraging median-based timestamp aggregation, or batch order fairness, while maintaining low data redundancy and robust garbage collection. We implemented Tilikum in Rust and evaluated it against representative baselines, namely Narwhal/Tusk, Pompē, Themis and FairDAG. Our results show that Tilikum achieves up to $39\times$ higher throughput than other fair-ordering baselines, while fully blocking state-of-the-art DAG-specific reordering attacks.
We investigate the evolving structure of interactions in cryptocurrency markets using a network-based framework constructed from high-frequency price data spanning 2020-2025. Directed and weighted networks are constructed from statistically significant Granger causal relationships between cryptocurrency log-returns, enabling us to quantify the flow of influence across assets. We find that normalized returns exhibit heavy-tailed distributions, consistent with the presence of large intermittent fluctuations and in line with stylized facts of financial markets. The resulting networks display pronounced heterogeneity in link weights and nodal strengths, indicating that a small subset of cryptocurrencies contributes disproportionately to market dynamics. By ranking cryptocurrencies based on their nodal out-strength, we uncover a dynamically evolving hierarchy of influence. Ethereum consistently emerges as the most influential asset, while Bitcoin shows a gradual decline in its relative importance. The ranking structure exhibits substantial temporal variability, with multiple cryptocurrencies entering and exiting the top positions over time. Our findings reveal a highly competitive and non-stable organization of the cryptocurrency ecosystem.
Over time, the security of traditional public-key infrastructures in blockchain systems and in decentralized applications is threatened by the rise of quantum-enabled adversaries.Due to incomplete protocol specifications, unclear validation semantics, and contradictory experimental reporting, it is challenging to apply lattice-based cryptography, which serves as a foundation for quantum-secure primitives, to blockchain-based AKE frameworks.For decentralized applications that use CRYSTALS-Kyber-768 as a lattice-based Key Encapsulation Mechanism (KEM), this study suggests a formally defined blockchain-enabled post-quantum authenticated key exchange and registration framework.The protocol links a public key registration based on a smart contract with an on-chain Groth16 zk-SNARK proof-of-possession verification, which makes for an efficient and authenticated public key registration that is replay-resistant, protects against key-substitution attacks, and establishes a safe session under a well-established adversarial model.To improve traceability, resolvability, and auditability, the suggested protocol separately identifies cryptographic assumptions, block chain consensus assumptions, smart contract validity semantics, and more.To allow for independent verification of the framework's operation, the complete message flows, contract-level validation rules, and on-chain/off-chain boundaries for interactive protocols are all clearly specified.The experiment was conducted on a private Ethereum Proof-of-Stake test network with 50 validators, a gas block limit of 60,000,000, and a block interval of 12 seconds.A set of tests, each consisting of 30 independent runs, was conducted to produce a total of 30,000 registration transactions for the same workload circumstances.The average end-to-end delay is 24.73 seconds, and the registration process includes an average of 275,555 gas.The actual interval of batch-finalization, which is the period between the first batch submitting a transaction and the last batch's finality confirmation in each round of experiment, was used to determine throughput.The throughput that results from running the experiment within the constraints of the blockchain restrictions is comparable to the theoretical, gas-limited processing speed of around 18. 1 tps.Additionally, the lightweight authenticated key exchange phase, which on the tested network settings, carried out about 41 complete bilateral exchange cycles every second, was also accomplished.The outcomes demonstrate that the post-quantum authenticated key establishment can be realistically incorporated into the blockchain-assisted infrastructure with the reproducible system-level behaviors, while maintaining provable proof-of-possession and preserving structured validation semantics.
Open access
Blockchain Technology Applications and Security
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Kanan Huseynov, Ali Shahzaib, István András Seres, János Tapolcai
From a user's perspective, perhaps the most significant difference between traditional banking services and widely used blockchain-based financial systems is that, in the latter, transactions and, either directly or indirectly, account balances and transaction histories are publicly observable. Therefore, a growing number of cryptographic solutions have been proposed to add a privacy layer to such systems. However, the privacy that users actually obtain does not depend solely on the security of the underlying cryptographic protocol: user behavior, transaction amount patterns, and timing decisions can substantially reduce anonymity. In this work, we study behavioral leakage in cryptocurrency mixers, focusing on Railgun on Ethereum. We aim to heuristically estimate the probability that a given deposit and withdrawal transaction belong to the same user. We consider five sources of leakage: characteristic timing patterns, address reuse, proximity in the transaction graph induced by prior public transactions, amount fingerprints that preserve distinctive digit patterns across transaction values, and knapsack type matches in which groups of transaction amounts add up in revealing ways. Our results show that even cryptographically strong privacy systems may suffer substantial anonymity loss due to user behavior and transaction patterns. Our five heuristics are able to uniquely link 17.65% of Railgun withdraw transactions to deposit transactions. We also applied a knapsack solver algorithm that was able to produce a 3.42 bit median anonymity loss for withdraw transactions. This work contributes to a better understanding of the practical privacy limits of mixers and anonymity pools, and points toward safer usage practices and design principles.
As autonomous AI agents increasingly transact across organizational boundaries, a fundamental trust challenge emerges: how can an agent assess whether an unknown counterpart is trustworthy? The ERC-8004 protocol addresses this challenge with the first permissionless trust layer for AI agent economies, built around three on-chain registries for Identity, Reputation, and Validation. Despite its rapid adoption, the protocol has not been studied empirically, leaving it unclear whether the information it records provides a trustworthy basis for decision-making. To address this gap, we present the first empirical study of ERC-8004 across three chains: Ethereum, BNB Smart Chain (BSC), and Base, covering the period from protocol deployment through May 13, 2026. We crawl on-chain Identity and Reputation events, off-chain files, and x402 payment transactions. On the identity side, we find that most registrations are placeholders rather than active agents, with only a small fraction (3%, 4%, and 15% across Ethereum, BSC, and Base) exposing a valid ERC-8004 registration file with at least one live service endpoint. On the reputation side, we show that the Registry, as currently deployed, cannot function as a trust signal: values are not commensurable, feedback records are rarely grounded in verifiable interactions, and reputation can be manipulated at minimal cost. Consistent with these design weaknesses, we find that a substantial fraction of reviewers (73.5%, 59.2%, and 90.6% across Ethereum, BSC, and Base) exhibit coordinated Sybil behavior. After removing Sybil-flagged feedback, 15.8%, 77.9%, and 86.8% of rated agents, respectively, are left with no valid feedback. We then turn these findings into concrete recommendations for future revisions of ERC-8004. Our study yields actionable protocol-design implications and establishes an empirical baseline for research on AI agent markets.
Non Fungible Token (NFT) Industry has been witnessing 16 million dollar trade in recent times.The following is the development of the decentralized NFT marketplace divided into three principal phases: smart contract development on the Ethereum blockchain using Solidity, creation of the frontend using React.js,Next.js,Node.js,HTML, CSS, and JavaScript, and backend development using Express.jsand MongoDB.The aim of this project is to offer a transparent and safe digital marketplace to mint, buy, and trade NFTs.The project employs ERC-721 standards for the uniqueness of tokens, Web3.js for interaction with smart contracts, and off-chain metadata storage with the help of REST APIs and MongoDB.Results indicate that the marketplace functions securely and efficiently, with seamless user interaction and successful on-chain transaction execution.Challenges related to deployment cost, metadata storage, and smart contract gas optimization were addressed during development.The final product demonstrates a fully functional, scalable, and decentralized NFT marketplace platform.
Mohammed Benseddik, Benjamin Kraner, Claudio J. Tessone
Ethereum's beacon chain hosts over 920,000 active validators, a number inflated by the legacy 32 ETH stake cap. The Pectra upgrade (May 2025) addresses this by introducing 0x02 compounding validators, raising the maximum stake per validator from 32 to 2,048 ETH and enabling automatic reward reinvestment. This paper examines how compounding affects consensus-layer rewards, whether higher balances provide execution-layer advantages, and whether the APR uplift justifies migration for different staker types. We analyse adoption patterns across solo stakers and staking providers, investigate the role of consolidation (merging multiple 32 ETH validators into one) in early migration, and identify barriers slowing the transition. Through simulation, we find that compounding provides roughly +5% relative consensus-layer APR uplift for small balances, diminishing to under 1% for large staking providers. Empirical analysis of all active beacon chain validators shows 0x02 validators achieving modestly higher median CL APR. Solo stakers show higher relative adoption but face operational barriers, whilst providers cite infrastructure costs and protocol constraints. The results suggest that without improved reward accessibility and stronger economic incentives, 0x02 migration will remain gradual despite its network efficiency benefits.
Valerio Mandarino, Giuseppe Pappalardo, Emiliano Tramontana
Authentication is essential to hold users accountable across online services. Conventional authentication systems rely on centralized architectures or third-party identity providers, which, however, introduce single points of failure, privacy concerns, and limited user autonomy. Conversely, fully decentralized authentication frameworks often struggle to provide reliable identity attestation mechanisms. This makes them vulnerable to Sybil attacks and self-asserted claims, while limiting their interoperability with trust-based systems. This paper presents dAuth, a hybrid blockchain-based authentication architecture based on Ethereum smart contracts to provide cryptographic tokens that enable authentication to services. These tokens, anchored to the smart contract, are derived by users from institutionally certified base credentials issued by an accredited verifying authority and enable authentication to services without further involvement of the authority. Each token is cryptographically bound to a specific service, constrained in scope and duration, and verifiable off-chain through data and cryptographic commitments provided by the user. No plaintext personal information is published on-chain: identity attributes are committed as cryptographic digests, which anchor certified identity data on-chain while keeping the underlying personal information private and auditable. This design removes the verifying authority from the authentication process, as all authentication steps are assisted by the user-controlled smart contract. The verifying authority’s role is limited to initial identity certification and exceptional update procedures. The result is a privacy-preserving and verifiable hybrid authentication framework that leverages the cryptographic security properties of the underlying blockchain infrastructure and inherits its scalability characteristics. The proposed design has been implemented and experimentally evaluated on the Ethereum platform, addressing public blockchain-specific challenges such as scalability constraints and transaction costs to ensure practical deployment.
Ethereum Layer 2 (L2) rollups improve scalability but expose a trade-off between fast sequencer soft finality and slow Layer 1 (L1) settlement finality, limiting latency-sensitive applications that require timely and durable guarantees on transaction ordering. We introduce a Byzantine Fault Tolerant (BFT) finality layer that extends existing rollup architectures without requiring L1 or rollup protocol changes. This layer provides deterministic transaction-level finality ahead of L1 settlement by committing to the sequencer's transaction order, bridging the gap between soft and hard finality. At its core, the layer uses a 1-chain variant of the Jolteon consensus protocol, adapted to the rollup setting where a single sequencer determines transaction ordering. Experiments show sub-second committee finalization latency and stable performance under Byzantine faults.
Ethereum account classification is essential for identifying individuals engaged in illicit transactions and analyzing behavioral patterns across various account types. This process serves as a critical mechanism for monitoring and regulating unlawful activities within transactional markets. However, the Ethereum network exhibits the characteristics of a complex heterophilic graph which poses significant challenges to the effectiveness and performance of conventional graph neural networks (GNNs). To address this challenge, the present study proposes FSGCN(Fourier-Sage GCN), a novel architecture for heterophilic graph neural networks (GNNs) that integrates Kolmogorov–Arnold Networks (KANs) with GraphSAGE. FSGCN is specifically designed to adapt efficiently to the structural complexity of heterophilic graphs. By leveraging KANs to extract high-order neighborhood information and employing GraphSAGE to capture low-order neighborhood patterns, FSGCN effectively aggregates both homophilic and heterophilic features, thereby improving classification performance. Furthermore, to improve training efficiency and generalization, we propose the MLPInit weight initialization scheme and the DropEdge graph augmentation technique. Experiments on a large-scale Ethereum transaction dataset show that FSGCN achieves an F1-score of 91.8% and a classification accuracy of 91.6%, significantly outperforming traditional homophilic and heterophilic GNN baselines. Additionally, FSGCN demonstrates high training efficiency, completing each epoch in just 2.302 s per epoch and improving overall training speed by 130.4% compared to conventional GraphSAGE.
Gossipsub is the primary peer-to-peer dissemination protocol used by large-scale Web3 systems such as Ethereum, Filecoin, and IPFS. Despite its widespread deployment, the choice of its key parameters—the eager mesh degree D (number of peers that receive messages eagerly) and the gossip degree Dlazy (number of peers periodically notified via gossip)—has largely relied on heuristics, with little quantitative guidance. Consequently, production networks lack a principled understanding of the delivery rate, bandwidth cost, and latency tradeoffs induced by these parameters.
Ayei E. Ibor, Denis U. Ashishie, John Adinya Odey, Bassey Ele · 5 authors
ABSTRACT Elliptic curve cryptography ( ECC ) underpins the security of most blockchain systems, yet its practical implementations face numerous vulnerabilities. In this systematic literature review ( SLR ), we catalogue and analyze attacks on ECC in the context of blockchain security, including side‐channel attacks, nonce/ PRNG failures, cryptanalysis, and implementation flaws, and we survey proposed countermeasures. We follow rigorous SLR methodology with defined inclusion/exclusion criteria, search strategies across databases such as IEEE Xplore, ACM , Scopus, Web of Science, and clear data synthesis, ensuring replicability. Emphasizing empirical case studies and real‐world exploits, we discuss instances where ECC weaknesses led to blockchain breaches including biased elliptic curve digital signature algorithm nonces exposing Bitcoin/Ethereum private keys, smartphone power analysis revealing wallet keys, and Trezor hardware‐wallet key extraction via single‐trace side‐channel analysis ( SCA ). We tabulate known attack vectors versus affected systems, and similarly compare countermeasure techniques such as hybrid classical/quantum schemes, threshold signatures, and zero‐knowledge proofs, along with implementation trade‐offs. We evaluate advances such as Curve25519/ EdDSA and ARM SVE2 to mitigate side‐channel leakage. Our findings highlight that practical security of blockchain cryptosystems depends on correct ECC implementation and emerging cryptographic upgrades, not merely on the mathematical hardness of the elliptic curve discrete logarithm problem.
Academic research indicates an urgent need for safe, tamper-proof storage of sensitive medical information due to the rapid digitalization of healthcare data. Traditional systems are susceptible to both internal and external assaults because of their dependence on centralized servers. SEC-HEALTH implements a system for the secure storage of electronic health records (EHRs) by combining the immutable, distributed ledger technology of blockchain with the InterPlanetary File System (IPFS).This system use Solidity smart contracts to archive patient data and transaction records on the Ethereum blockchain. Comprehensive EHR files are preserved on IPFS and may be accessed via their blockchain hash addresses. The architecture guarantees data integrity, transparency, and safe access independent of trusted third parties.User modules include appointment scheduling, prescription management, patient and physician authentication, and platform registration. The graphics illustrate a fully operational web interface created in Python, implemented smart contracts, and the integration of blockchain with IPFS. The approach is resilient and decentralized, providing an alternative to traditional centralized health data management systems.
We study the evolution of transaction speed and fees from January 2024 through March 2026, comparing Ethereum Mainnet and its Layer 2 (L2) networks, as well as Solana and Polygon. Ethereum has undergone upgrades that have increased block size and blob count. These upgrades have doubled transactions per second (TPS) on both the Mainnet and the L2 networks. Mainnet median fees have fallen from over \$2 to under \$0.02, and L2 median fees have fallen more than 95% from \$0.05 to \$0.0015. We forecast that Mainnet median fees will converge with Solana in August 2027, but TPS will remain below 100 until 2034. The L1 Strawmap, proposing EIP-7938, a potential exponential increase in the gas limit, brings the Mainnet to only 100 TPS in January 2028. With continued blob expansion, L2s will surpass Solana TPS in March 2029 and have lower median fees by October 2026.