Ziwei Li, Jiajing Wu, Zhiying Wu, D. Tan · 9 authors
Smart contracts are self-executing computer programs on blockchains. With the development of blockchain technology, the number of smart contracts has grown rapidly, as has the concern for their security. Regrettably, inconsistencies between the logic implemented in the code and the intentions described in the comments, known as Code–Comment Inconsistencies (CCI), are frequently present in some smart contracts. These inconsistencies can mislead readers in understanding the contract code and, in severe cases, may lead to vulnerabilities and economic losses. Existing learning-based methods are not tailored for smart contract languages, overlook the issue of insufficient context information caused by comment references and nested intentions, and rely on large-scale labeled data; whereas rule-based methods struggle to accommodate the flexibility with which developers express intentions, often resulting in false positives. To tackle the challenges posed by insufficient context information and the scarcity of labeled data, we introduce CCIHunter, a tool designed to detect CCIs in smart contracts. CCIHunter addresses the issue of insufficient context information during data modeling and incorporates a two-stage pre-training process that does not depend on labeled data to enhance its detection capabilities. Specifically, CCIHunter enhances comments based on templates and models code as a heterogeneous graph based on function calls. It utilizes CodeBERT and UniMp to generate embeddings for comments and code, respectively, and then calculates the similarity between these two embeddings. Consistency is judged by combining code embeddings, comment embeddings, and similarity scores. Notably, CCIHunter undergoes a two-stage pre-training that includes contrastive learning and mutation analysis, aiming to improve its ability to bridge the gap between code and comments and to focus on code elements at different granularities. Experimental results demonstrate that CCIHunter achieves a precision of 0.95, a recall of 0.90, and an F1 score of 0.93, outperforming existing tools.
Youwei Huang, Jianwen Li, Bin Hu, Sen Fang · 6 authors
Malicious developer intents in smart contracts constitute significant security threats to decentralized applications, leading to substantial economic losses. Prior work introduced SmartIntentNN, a deep learning model for detecting unsafe developer intents. By combining the Universal Sentence Encoder, a K-means clustering-based intent highlighting mechanism, and a Bidirectional Long Short-Term Memory (BiLSTM) network, the model achieved an F1 score of 0.8633 on an evaluation set of 10,000 real-world smart contracts across ten distinct intent categories. This paper presents SmartIntentV2 (Smart Contract Intent Neural Network Version 2). The primary enhancement is the integration of a BERT-based pre-trained programming language model, which we domain-adaptively pre-train on a dataset of 16,000 real-world smart contracts using a Masked Language Modeling objective. SmartIntentV2 retains the BiLSTM-based multi-label classification network for intent detection. On the same evaluation set of 10,000 smart contracts, it achieves superior performance with an accuracy of 0.9789, precision of 0.9090, recall of 0.9476, and an F1 score of 0.9279, substantially outperforming its predecessor and other baseline models. Notably, SmartIntentV2 also delivers a 65.5% relative improvement in F1 score over GPT-4.1 on this specialized task. These results establish SmartIntentV2 as a new state-of-the-art model for smart contract intent detection.
The Ethereum platform is booming with growing richness and variety in decentralized finance (DeFi) products. However, this progress comes with sophisticated threats, such as sandwich attacks, where attackers exploit the openness and certainty of blockchain technology to manipulate market prices and secure illegal financial rewards through a strategically planned series of transactions. The existing sandwich attack detection methods are ineffective at detecting multi-token transactions and fail to identify multi-token sandwich attacks. To tackle this challenge, this study improves the original detector’s algorithm to identify both traditional single-token and multi-token sandwich attacks. The enhanced system is not only responsive and accurate but also capable of detecting and alerting potential multi-token sandwich attacks. It has been successfully integrated with the go-Ethereum client (Geth). The system is performance-optimized with an average processing time of 0.81 seconds per block and an accuracy rate of 96.17%. The response time for detecting new blocks in real-time is usually no more than 4 seconds, with most between 2 and 3 seconds, which meets practical application requirements. By carefully analyzing the transaction data flow, this system is not only able to identify the traditional front-running attack and sandwich attack, but also extends to multi-currency complex attack strategies. The core innovation lies in the system’s ability to accurately detect and provide early warnings of multi-token sandwich attacks through real-time analysis of in-block transactions, all while maintaining the overall operational efficiency of the node.
Hash functions are fundamental components in both cryptographic and non-cryptographic systems, supporting secure authentication, data integrity, fingerprinting, and indexing. While the Ascon family, selected by the National Institute of Standards and Technology (NIST) in 2023 for lightweight cryptography, has been extensively evaluated in its authenticated encryption mode, its hashing and extendable-output variants, namely Ascon-Hash256, Ascon-XOF128, and Ascon-CXOF128, have not received the same level of empirical attention. This paper presents a structured benchmarking study of these hash variants using both the SMHasher framework and custom Python-based simulation environments. SMHasher is used to evaluate statistical and structural robustness under constrained, patterned, and low-entropy input conditions, while Python-based experiments assess application-specific performance in Bloom filter-based replay detection at the network edge, Merkle tree aggregation for blockchain transaction integrity, lightweight device fingerprinting for IoT identity management, and tamper-evident logging for distributed ledgers. We compare the performance of Ascon hashes with widely used cryptographic functions such as SHA3 and BLAKE2s, as well as high-speed non-cryptographic hashes including MurmurHash3 and xxHash. We assess avalanche behavior, diffusion consistency, output bias, and keyset sensitivity while also examining Ascon-XOF's variable-length output capabilities relative to SHAKE for applications such as domain-separated hashing and lightweight key derivation. Experimental results indicate that Ascon hash functions offer strong diffusion, low statistical bias, and competitive performance across both cryptographic and application-specific domains. These properties make them well suited for deployment in resource-constrained systems, including Internet of Things (IoT) devices, blockchain indexing frameworks, and probabilistic authentication architectures. This study provides the first comprehensive empirical evaluation of Ascon hashing modes and offers new insights into their potential as lightweight, structurally resilient alternatives to established hash functions.
Blockchain address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history, which aims to deceive victims and lure them into mistakenly transferring funds to the attacker. Recent works have shown that millions of Ethereum users were targeted and lost over 100 million US dollars. Ethereum crypto wallets, serving users in browsing transaction history and initiating transactions to transfer funds, play a central role in deploying countermeasures to mitigate the address poisoning attack. However, whether they have done so remains an open question. To fill the research void, in this paper, we design experiments to simulate address poisoning attacks and systematically evaluate the usability and security of 53 popular Ethereum crypto wallets. Our evaluation shows that there exist communication failures between 12 wallets and their transaction activity provider, which renders them unable to download the users' transaction history. Besides, our evaluation also shows that 16 wallets pose a high risk to their users due to displaying fake token phishing transfers. Moreover, our further analysis suggests that most wallets rely on transaction activity providers to filter out phishing transfers. However, their phishing detection capability varies. Finally, we found that only three wallets throw an explicit warning message when users attempt to transfer to the phishing address, implying a significant gap within the broader Ethereum crypto wallet community in protecting users from address poisoning attacks. Overall, our work shows that more efforts are needed by the Ethereum crypto wallet developer community to achieve the highest usability and security standard. Our bug reports have been acknowledged by the developer community, who are currently developing mitigation solutions.
Power industry software, as a core tool for modern power equipment control and management, is facing increasingly severe cybersecurity threats.Distributed ledger technology provides new ideas for power software security detection due to its decentralization, transparency and tamper-proof characteristics.This paper discusses the application of distributed ledger technology in the security detection of software development in the electric power industry, and proposes a trusted traceability and quality access control reinforcement method based on distributed ledger.The research designs the traceability data model and smart contract system to realize the trusted collection, storage and verification of security data; at the same time, it proposes the sensitive data aggregation method based on homomorphic encryption and the tamper-proof technology of RSA asymmetric encryption, and constructs the data communication structure of Overlay structure, which guarantees the complete transmission of electric power software security detection data and traceability tracking.The experimental results show that compared with SHA256 algorithm and DyRH model, the average value of the error localization time of this method is reduced to 9.23ms, which is 8.6ms and 4.1ms less than the control group, respectively; the accuracy rate of the error localization reaches 98.33%, which is improved by 4.77% and 1.79%; and in the test of the anti-attack performance, the average number of tampered data is only 189, which is respectively reduced by 184 and 156.The study proves that distributed ledger technology can effectively enhance data credibility, strengthen traceability, and enhance the strength of system quality access control in software development security detection in the power industry, which provides a new technical path and solution for the information security of the power system.
The robustness and reliability of blockchain applications, critically depend on thorough testing. This study introduces AGTS, an automated framework for generating smart contract test suites on Hyperledger Fabric, significantly reducing manual effort while improving test coverage and security. The framework integrates static and dynamic analysis, leveraging symbolic execution and fuzz testing to detect vulnerabilities. The project is implemented in C#, and uses three test cases: CoCoME, LibraryMS and LoanPS, with their requirements as input, and generates their closely related test cases. We generated 34 test cases for CoCoME, 32 for LibraryMS, and 28 for LoanPS. Combining the test cases, their executable scripts were generated. Finally, we tested all the targeted smart contracts rigorously against the predefined criteria. The generated scripts undergo the quality assurance using ShellCheck, deploying on the continuous integration system, that further enhances the reliability and maintainability of these tests. AGTS automates the entire process of test script creation and verification, drastically reducing the manual effort involved in preparing test cases. It facilitates rapid and thorough testing cycles by generating dedicated scripts that execute specific test scenarios on smart contracts, verifying their behavior and performance. By automating the tedious and error-prone task of writing test cases, AGTS accelerates the development process and fortifies the security framework of blockchain applications. Comprehensive evaluation of AGTS across diverse real world smart contracts demonstrated the effectiveness in defect detection, significantly outperforming existing methods. The contribution of AGTS extends beyond providing a practical testing tool, by offering developers a robust framework for ensuring the reliability and security of their smart contracts. AGTS not only expedites test preparation but also ensures comprehensive test coverage, thus improving the overall quality of blockchain applications.
We argue that the technical foundations of non-fungible tokens (NFTs) remain inadequately understood. Prior research has focused on market dynamics, user behavior, and isolated security incidents, yet systematic analysis of the standards underpinning NFT functionality is largely absent. We present the first study of NFTs through the lens of Ethereum Improvement Proposals (EIPs). We conduct a large-scale empirical analysis of 191 NFT-related EIPs and 10K+ Ethereum Magicians discussions (as of July, 2025). We integrate multi-dimensional analyses including the automated parsing of Solidity interfaces, graph-based modeling of inheritance structures, contributor profiling, and mining of community discussion data. We distinguish foundational from emerging standards, expose poor cross-version interoperability, and show that growing functional complexity heightens security risks.
Cryptocurrencies initially gained prominence by eliminating intermediaries in payment systems and later found applications in various business sectors. The crypto network, pioneered by Bitcoin, has spurred new business forms and organizational structures with diverse motivations. Bitcoin's emergence is technically dated to 2008. However, its ideological and technical roots trace back to the cyberpunk literature of the late 1970s and the cypherpunk movement that began in California in 1992. The cypherpunk manifestos significantly influenced cryptographic work, shaping Bitcoin's technical foundation. This study aims to explore Bitcoin's ideological origins through a qualitative content analysis of cypherpunk manifestos, Nakamoto's posts on the "Bitcointalk" forum, and "Cryptography Mailing List" correspondence. By examining these sources, the study identifies the historical dimensions of Bitcoin's technical structure and highlights the impact of ideological debates on its development. Findings reveal that while cryptographic research influenced Bitcoin's technical evolution, ideological discussions were relatively less significant. Nonetheless, Bitcoin's developers, particularly Nakamoto, incorporated a strong ideological emphasis on "privacy" despite the primary technical focus.
Smart contracts are important for digital finance, yet they are hard to patch once deployed. Prior work has mainly explored LLMs for smart contract vulnerability detection, leaving end-to-end automated exploit generation (AEG) much less understood. We study that gap with \textsc{ReX}, an execution-grounded framework that links LLM-based exploit synthesis to the Foundry stack for end-to-end generation, compilation, execution, and validation. Five recent LLMs are evaluated across eight common vulnerability classes, supported by a curated dataset of 38{+} real incident PoCs and three automation aids: prompt refactoring, a compiler feedback loop, and templated test harnesses. Results indicate that current frontier LLMs can often produce deterministic PoCs for single-contract vulnerabilities, but remain weak on cross-contract attacks; outcomes depend mainly on the model and bug type, while code structure and prompt tuning contribute less in our setting. The study also surfaces important boundary conditions of LLM-driven AEG, including gaps between oracle-validated exploitability and real-world economic attacks, pointing to the need for stronger defenses and more realistic evaluation.
The introduction of smart contract functionality marks the advent of the blockchain 2.0 era, enabling blockchain technology to support digital currency transactions and complex distributed applications. However, many smart contracts have been found to contain vulnerabilities and errors, leading to the loss of assets within the blockchain. Despite a range of tools that have been developed to identify vulnerabilities in smart contracts at the source code or bytecode level, most rely on a single modality, reducing performance, accuracy, and limited generalization capabilities. This paper proposes a multimodal deep learning approach, MultiCFV, which is designed specifically to analyze and detect erroneous control flow vulnerability, as well as identify code clones in smart contracts. Bytecode is generated from source code to construct control flow graphs, with graph embedding techniques extracting graph features. Abstract syntax trees are used to obtain syntax features, while code comments capture key commentary words and comment features. These three feature vectors are fused to create a database for code inspection, which is used to detect similar code and identify contract vulnerabilities. Experimental results demonstrate our method effectively combines structural, syntactic, and semantic information, improving the accuracy of smart contract vulnerability detection and clone detection.
Security issues are becoming increasingly significant with the rapid evolution of Non-fungible Tokens (NFTs). As NFTs are traded as digital assets, they have emerged as prime targets for cyber attackers. In the development of NFT smart contracts, there may exist undiscovered defects that could lead to substantial financial losses if exploited. To tackle this issue, this paper presents a framework called NATLM(NFT Assistant LLM), designed to detect potential defects in NFT smart contracts. The framework effectively identifies four common types of vulnerabilities in NFT smart contracts: ERC-721 Reentrancy, Public Burn, Risky Mutable Proxy, and Unlimited Minting. Relying exclusively on large language models (LLMs) for defect detection can lead to a high false-positive rate. To enhance detection performance, NATLM integrates static analysis with LLMs, specifically Gemini Pro 1.5. Initially, NATLM employs static analysis to extract structural, syntactic, and execution flow information from the code, represented through Abstract Syntax Trees (AST) and Control Flow Graphs (CFG). These extracted features are then combined with vectors of known defect examples to create a matrix for input into the knowledge base. Subsequently, the feature vectors and code vectors of the analyzed contract are compared with the contents of the knowledge base. Finally, the LLM performs deep semantic analysis to enhance detection capabilities, providing a more comprehensive and accurate identification of potential security issues. Experimental results indicate that NATLM analyzed 8,672 collected NFT smart contracts, achieving an overall precision of 87.72%, a recall of 89.58%, and an F1 score of 88.94%. The results outperform other baseline experiments, successfully identifying four common types of defects.
Merkle proof-based airdrops are a widely used mechanism in decentralized finance (DeFi) for distributing tokens securely and efficiently to eligible recipients. By leveraging Merkle trees, these airdrops minimize storage requirements and reduce transaction costs while ensuring the integrity of recipient lists. Unfortunately, their importance also attracts sophisticated attacks. Secondary preimage attacks, in particular, pose a major risk to the security of token distribution, potentially enabling adversaries to exploit vulnerabilities and drain tokens from airdrop contracts. This paper introduces FSA: a F ramework for analyzing S econdary preimage A ttacks on Merkle proof-based airdrops, designed to systematically address such vulnerabilities. The framework operates through four core contributions: (1) a validated quantitative damage assessment model using proof-of-concept experiments, (2) an analysis of attack repetition patterns in binary Merkle trees and Merkle Mountain Ranges, (3) identification of key factors influencing attack success, including token balances, hash values, and variable sizes, and (4) evaluation of mitigation strategies such as using non-64-byte leaf values, asymmetric hashing, and proof length validation. Through extensive analysis using the FSA, our experimental results demonstrate the framework's effectiveness in uncovering vulnerability patterns and developing targeted countermeasures.
In the modern era, the use of blockchain technology has been growing rapidly, where Ethereum smart contracts play an important role in securing decentralized application systems. However, these smart contracts are also susceptible to a large number of vulnerabilities, which pose significant threats to intelligent systems and IoT applications, leading to data breaches and financial losses. Traditional detection techniques, such as manual analysis and static automated tools, suffer from high false positives and undetected security vulnerabilities. To address these problems, this paper proposes an Artificial Intelligence (AI)-based security framework that integrates Generative Adversarial Network (GAN)-based feature selection and deep learning techniques to classify and detect malware attacks on smart contract execution in the blockchain decentralized network. After an exhaustive pre-processing phase yielding a dataset of 40,000 malware and benign samples, the proposed model is evaluated and compared with related studies on the basis of a number of performance metrics including training accuracy, training loss, and classification metrics (accuracy, precision, recall, and F1-score). Our combined approach achieved a remarkable accuracy of 97.6%, demonstrating its effectiveness in detecting malware and protecting blockchain systems.
Smart contract vulnerabilities have led to billions in losses, yet finding actionable exploits remains challenging. Traditional fuzzers rely on rigid heuristics and struggle with complex attacks, while human auditors are thorough but slow and don't scale. Large Language Models offer a promising middle ground, combining human-like reasoning with machine speed. Early studies show that simply prompting LLMs generates unverified vulnerability speculations with high false positive rates. To address this, we present A1, an agentic system that transforms any LLM into an end-to-end exploit generator. A1 provides agents with six domain-specific tools for autonomous vulnerability discovery, from understanding contract behavior to testing strategies on real blockchain states. All outputs are concretely validated through execution, ensuring only profitable proof-of-concept exploits are reported. We evaluate A1 across 36 real-world vulnerable contracts on Ethereum and Binance Smart Chain. A1 achieves a 63% success rate on the VERITE benchmark. Across all successful cases, A1 extracts up to \$8.59 million per exploit and \$9.33 million total. Using Monte Carlo analysis of historical attacks, we demonstrate that immediate vulnerability detection yields 86-89% success probability, dropping to 6-21% with week-long delays. Our economic analysis reveals a troubling asymmetry: attackers achieve profitability at \$6,000 exploit values while defenders require \$60,000 -- raising fundamental questions about whether AI agents inevitably favor exploitation over defense.
The escalating complexity and frequency of malware attacks pose a significant challenge to conventional cybersecurity frameworks, particularly in scenarios demanding high data privacy and cross-organizational threat intelligence sharing. Traditional centralized machine learning models for malware detection often rely on aggregating data in a central server, thereby increasing the risk of data breaches and limiting the deployment of models in privacy-sensitive environments such as healthcare, finance, and critical infrastructure. To address these limitations, this study explores an integrated approach that combines Federated Learning (FL) with Explainable Artificial Intelligence (XAI) for enhancing malware detection while preserving user privacy and system confidentiality. Federated learning enables the collaborative training of robust malware classifiers across multiple decentralized nodes without sharing raw data, thus maintaining local data sovereignty and complying with data protection regulations. The proposed framework incorporates deep learning architectures such as convolutional neural networks (CNNs) trained in a federated environment using feature vectors extracted from malicious binaries and behavior logs. To ensure transparency and trust in model predictions, explainable AI techniques specifically SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) are integrated, providing actionable insights into the model’s decision-making process. This study also presents a comprehensive evaluation using a benchmark malware dataset distributed across simulated client environments, measuring detection accuracy, communication overhead, privacy leakage, and interpretability performance. Results demonstrate that the FL-XAI approach achieves detection rates comparable to centralized models while ensuring data confidentiality and interpretability. The research contributes to the evolving field of privacy-preserving threat intelligence by offering a scalable and explainable framework suitable for real-time cybersecurity applications.
Xing Su, Hanzhong Liang, Hao Wu, Ben Niu · 6 authors
Understanding the Ethereum smart contract bytecode is essential for ensuring cryptoeconomics security. However, existing decompilers primarily convert bytecode into pseudocode, which is not easily comprehensible for general users, potentially leading to misunderstanding of contract behavior and increased vulnerability to scams or exploits. In this paper, we propose DiSCo, the first LLMs-based EVM decompilation pipeline, which aims to enable LLMs to understand the opaque bytecode and lift it into smart contract code. DiSCo introduces three core technologies. First, a logic-invariant intermediate representation is proposed to reproject the low-level bytecode into high-level abstracted units. The second technique involves semantic enhancement based on a novel type-aware graph model to infer stripped variables during compilation, enhancing the lifting effect. The third technology is a flexible method incorporating code specifications to construct LLM-comprehensible prompts for source code generation. Extensive experiments illustrate that our generated code guarantees a high compilability rate at 75%, with differential fuzzing pass rate averaging at 50%. Manual validation results further indicate that the generated solidity contracts significantly outperforms baseline methods in tasks such as code comprehension and attack reproduction.
In smart contract development, practitioners frequently reuse code to reduce development effort and avoid reinventing the wheel. This reused code, whether identical or similar to its original source, is referred to as a code clone. Unintentional code cloning can propagate flaws and vulnerabilities, potentially undermining the reliability and maintainability of software systems. Previous studies have identified a significant prevalence of code clones in Solidity smart contracts on the Ethereum blockchain. To mitigate the risks posed by code clones, clone detection has emerged as an active field of research and practice in software engineering. Recent studies have extended existing techniques or proposed novel techniques tailored to the unique syntactic and semantic features of Solidity. Nonetheless, the evaluations of existing techniques, whether conducted by their original authors or independent researchers, involve codebases in various programming languages and utilize different versions of the corresponding tools. The resulting inconsistency makes direct comparisons of the evaluation results impractical, and hinders the ability to derive meaningful conclusions across the evaluations. There remains a lack of clarity regarding the effectiveness of these techniques in detecting smart contract clones, and whether it is feasible to combine different techniques to achieve scalable yet accurate detection of code clones in smart contracts. To address this gap, we conduct a comprehensive empirical study that evaluates the effectiveness and scalability of five representative clone detection techniques on 33,073 verified Solidity smart contracts, along with a benchmark we curate, in which we manually label 72,010 pairs of Solidity smart contracts with clone tags. Moreover, we explore the potential of combining different techniques to achieve optimal performance of code clone detection for smart contracts, and propose SourceREClone, a framework designed for the refined integration of different techniques, which achieves a 36.9% improvement in F1 score compared to a straightforward combination of the state of the art. Based on our findings, we discuss implications, provide recommendations for practitioners, and outline directions for future research.
Ethereum smart contracts determine state transition results not only by the previous states, but also by a mutable global state consisting of storage variables. This has resulted in state-inconsistency bugs, which grant an attacker the ability to modify contract states either through recursive function calls to a contract (reentrancy), or by exploiting transaction order dependence (TOD). Current studies have determined that identifying data races on global storage variables can capture all state-inconsistency bugs. Nevertheless, eliminating false positives poses a significant challenge, given the extensive number of execution paths that could potentially cause a data race. For simplicity, existing research considers a data race to be vulnerable as long as the variable involved could have inconsistent values under different execution orders . However, such a data race could be benign when the inconsistent value does not affect any critical computation or decision-making process in the program. Besides, the data race could also be infeasible when there is no valid state in the contract that allows the execution of both orders. In this paper, we aim to appreciably reduce these false positives without introducing false negatives. We present DivertScan , a precise framework to detect exploitable state-inconsistency bugs in smart contracts. We first introduce the use of flow divergence to check where the involved variable may flow to. This allows DivertScan to precisely infer the potential effects of a data race and determine whether it can be exploited for inducing unexpected program behaviors. We also propose multiplex symbolic execution to examine different execution orders in one time of solving. This helps DivertScan to determine whether a common starting state could potentially exist. To address the scalability issue in symbolic execution, DivertScan utilizes an overapproximated pre-checking and a selective exploration strategy. As a result, it only needs to explore a limited state space. DivertScan significantly outperformed state-of-the-art tools by improving the precision rate by 20.72% to 74.93% while introducing no false negatives. It also identified five exploitable real-world vulnerabilities that other tools missed. The detected vulnerabilities could potentially lead to a loss of up to $68.2M, based on trading records and rate limits.
Ruichao Liang, Jing Chen, Ruochen Cao, Kun He · 8 authors
Smart contracts, as Turing-complete programs managing billions of assets in decentralized finance, are prime targets for attackers. While fuzz testing seems effective for detecting vulnerabilities in these programs, we identify several significant challenges when targeting smart contracts: (i) the stateful nature of these contracts requires stateful exploration, but current fuzzers rely on transaction sequences to manipulate contract states, making the process inefficient; (ii) contract execution is influenced by the continuously changing blockchain environment, yet current fuzzers are limited to local deployments, failing to test contracts in real-world scenarios. These challenges hinder current fuzzers from uncovering hidden vulnerabilities, i.e., those concealed in deep contract states and specific blockchain environments. In this paper, we present SmartShot, a mutable snapshot-based fuzzer to hunt hidden vulnerabilities within smart contracts. We innovatively formulate contract states and blockchain environments as directly fuzzable elements and design mutable snapshots to quickly restore and mutate these elements. SmartShot features a symbolic taint analysis-based mutation strategy along with double validation to soundly guide the state mutation. SmartShot mutates blockchain environments using contract’s historical on-chain states, providing real-world execution contexts. We propose a snapshot checkpoint mechanism to integrate mutable snapshots into SmartShot’s fuzzing loops. These innovations enable SmartShot to effectively fuzz contract states, test contracts across varied and realistic blockchain environments, and support on-chain fuzzing. Experimental results show that SmartShot is effective to detect hidden vulnerabilities with the highest code coverage and lowest false positive rate. SmartShot is 4.8× to 20.2× faster than state-of-the-art tools, identifying 2,150 vulnerable contracts out of 42,738 real-world contracts which is 2.1× to 13.7× more than other tools. SmartShot has demonstrated its real-world impact by detecting vulnerabilities that are only discoverable on-chain and uncovering 24 0-day vulnerabilities in the latest 10,000 deployed contracts.
Abhishek Bhattarai, Abdulhadi Sahin, Maryna Veksler, Ahmet Kurt · 7 authors
As cryptocurrencies have become increasingly used as an alternative to regular cash and credit card payments, the wallet solutions/apps that facilitate their use have also become increasingly popular. This has also intensified the involvement of these crypto wallet apps in criminal activities such as ransom requests, money laundering, and transactions on dark markets. From a digital forensics point of view, it is crucial to have tools and reliable approaches to detect these wallets on devices and extract their artifacts quickly with greater efficiency. However, with current research and trends, forensic investigators still need to manually extract these file artifacts, which delays the time-sensitive investigation findings. As mobile devices increasingly facilitate cryptocurrency transactions, there emerges a critical gap and need for automated evidence extraction to detect crucial artifacts preventing illicit activities. Therefore, in this paper, we present a comprehensive framework that incorporates various machine learning (ML), image processing, and natural language processing (NLP) approaches to enable fast and automated extraction/triage of crypto-related artifacts from Android and iOS devices. Specifically, our method can automatically detect which crypto wallet exists on the device, their artifacts (i.e., database/log files), along with the crypto-related images, web browsing data, and SMS conversations. For each type of data, we offer a specific ML technique, such as Support Vector Machine, Logistic Regression, and Neural Networks, to detect and classify these files. Our evaluation results show very high accuracy compared to alternative tools: our wallet classification model achieves 91% recall, crypto-related image classification achieves 75% accuracy, browsing data achieves 100% accuracy, and the SMS message model achieves 85% accuracy.
Ahmed Abubakar Aliyu, Mohammed Ibrahim, Sa’adatu Abdulkadir
Traditional Intrusion Detection Systems (IDSs) face significant challenges in keeping pace with the rapidly evolving landscape of cyber threats, primarily due to limitations in continuous learning and the accuracy of data classification and analysis. This often results in delayed detection and leaves networks susceptible to severe attacks. This paper introduces an innovative IDS empowered by blockchain technology to mitigate these shortcomings, leveraging continuous learning and self‑adaptive neural networks. The proposed system adopts a proactive approach by continuously assimilating intrusion logs, utilizing a Long Short‑Term Memory (LSTM) core to discern patterns and enhance its real‑time threat detection capabilities, removing a major bottleneck in traditional IDS models by eliminating the need for manual tagging. To further strengthen the security measures, self‑updating neural networks are embedded in each block of the blockchain, forming a decentralized “brain” that evolves defences against even the most sophisticated adversaries. These networks are securely housed in Trusted Execution Environments (TEEs) to maintain operational integrity, enabling tamper‑proof operation and effective threat detection. Real‑world evaluations conducted on the Binance Smart Chain and Ethereum Classic datasets demonstrate the system’s superior performance. With an impressive accuracy rate of 98.50% and a minimal false positive rate of 1.50%, the model demonstrates a remarkable ability to distinguish legitimate network activity from malicious intrusions.
Amid the surge of Non-Fungible Tokens (NFTs) in blockchain, this study introduces a meticulous methodology focusing on transaction behaviors to unveil rug pulls — a critical issue impacting financial security and trust in the NFT landscape. Using a Graph Isomorphism Network (GIN) model with 6 behavioral patterns obtained from transaction sequences, we create a “Rug Pull Pattern Matcher” model. We provide a comprehensive analysis by applying the model on two datasets — creator’s transactions from 50 reputable NFT projects and 32 reported rug pulls. Our work utilizes automated labeling to categorize addresses and our analysis reveals several interconnected NFT creator activities. We present an in-depth mapping of fund flows and creator interactions exposing suspicious behaviors like artificial inflation and intricate network collaborations among creators. The results of our proposed model demonstrate the efficacy of our methodology with 75.4% accuracy and 85.9% precision on the dataset of reported rug pulls. This work provides comparative analyses of genuine and malicious creator networks to elucidate their structural differences, helping to identify genuine and potentially fraudulent NFT activities.
Zsofia Baruwa, Sanjay Bhattacherjee, Sahil Rey Chandnani, Zhen Zhu
This work is the first study on the perceptions of social media users about cryptocurrency attacks. The double-spending or 51% attack being the most fundamental attack on cryptocurrencies, it is the focus of this study. As a first step, we create a first-of-its-kind comprehensive list of 31 events of 51% attacks on various proof-of-work cryptocurrencies, showing that these events are quite common. This list contradicts the general perception about the security of cryptocurrencies, particularly portrayed in the Executive Order establishing a Strategic Bitcoin Reserve and a Digital Asset Stockpile in the US. We design the methodologies for our new study of user perceptions around these attacks. We create datasets containing tweets from the time of the attack events, and compare them with benchmark data from normal times. We define parameters for profiling these datasets based on user perceptions – sentiments and emotions. We study the variation of these perception profiles, when a cryptocurrency is under attack and the benchmark otherwise, between multiple attack events of the same cryptocurrency, and between different cryptocurrencies. Our results confirm some expected overall behaviour and reactions while providing nuanced insights that may not be obvious or may even be considered surprising. Our code and datasets are publicly accessible.