Wansen Wang, Pu Zhang, Renjie Ji, Wenchao Huang · 6 authors
Some smart contracts violate decentralization principles by defining privileged accounts that manage other users' assets without permission, introducing centralization risks that have caused financial losses. Existing methods, however, face challenges in accurately detecting diverse centralization risks due to their dependence on predefined behavior patterns. In this paper, we propose JANUS, an automated analyzer for Solidity smart contracts that detects financial centralization risks independently of their specific behaviors. JANUS identifies differences between states reached by privileged and ordinary accounts, and analyzes whether these differences are finance-related. Focusing on the impact of risks rather than behaviors, JANUS achieves improved accuracy compared to existing tools and can uncover centralization risks with unknown patterns. To evaluate JANUS's performance, we compare it with other tools using a dataset of 540 contracts. Our evaluation demonstrates that JANUS outperforms representative tools in terms of detection accuracy for financial centralization risks . Additionally, we evaluate JANUS on a real-world dataset of 33,151 contracts, successfully identifying two types of risks that other tools fail to detect. We also prove that the state traversal method and variable summaries, which are used in JANUS to reduce the number of states to be compared, do not introduce false alarms or omissions in detection.
Smart contracts are self-executing programs on blockchain platforms like Ethereum, which have revolutionized decentralized finance by enabling trustless transactions and the operation of decentralized applications. Despite their potential, the security of smart contracts remains a critical concern due to their immutability and transparency, which expose them to malicious actors. Numerous solutions for vulnerability detection have been proposed, but it is still unclear which one is the most effective. This paper presents a systematic literature review that explores vulnerabilities in Ethereum smart contracts, focusing on automated detection tools and benchmark evaluation. We reviewed 3,380 studies from five digital libraries and five major software engineering conferences, applying a structured selection process that resulted in 222 high-quality studies. The key results include a hierarchical taxonomy of 192 vulnerabilities grouped into 13 categories, a comprehensive list of 219 detection tools with corresponding functionalities, methods, and code transformation techniques, a mapping between our taxonomy and the list of tools, and a collection of 133 benchmarks used for tool evaluation. We conclude with a discussion about the insights into the current state of Ethereum smart contract security and directions for future research.
Tamim Hossain, Faisal Haque Bappy, Tarannum Shaila Zaman, Tariqul Islam
This work addresses the critical challenges of upgrading smart contracts, which are vital for trust in automated transactions but difficult to modify once deployed. To address this issue, we propose SEAM, a novel framework that automates the conversion of standard Solidity contracts into upgradable versions using the diamond pattern. SEAM simplifies the upgrade process and addresses two key vulnerabilities: function selector clashes and storage slot collisions. Additionally, the framework provides tools for efficiently deploying, modifying, and managing smart contract lifecycles. By enhancing contract security and reducing the learning curve for developers, SEAM lays a robust foundation for more flexible and maintainable blockchain applications.
Smart contracts form the core of Web3 applications. Contracts mediate the transfer of cryptocurrency, making them irresistible targets for hackers. We introduce ASP, a system aimed at easing the construction of provably secure contracts. The Asp system consists of three closely-linked components: a programming language, a defensive compiler, and a proof checker. The language semantics guarantee that Asp contracts are free of commonly exploited vulnerabilities such as arithmetic overflow and reentrancy. The defensive compiler enforces the semantics and translates Asp to Solidity, the most popular contract language. Deductive proofs establish functional correctness and freedom from critical vulnerabilities such as unauthorized access.
Abstract Conditional risk measures and their associated risk contribution measures are commonly employed in finance and actuarial science for evaluating systemic risk and quantifying the effects of risk interactions. This paper introduces various types of contribution ratio measures based on the multivariate conditional value-at-risk (MCoVaR), multivariate conditional expected shortfall (MCoES), and multivariate marginal mean excess (MMME) studied in [34] (Ortega-Jiménez, P., Sordo, M., & Suárez-Llorens, A. (2021). Stochastic orders and multivariate measures of risk contagion. Insurance: Mathematics and Economics , vol. 96, 199–207) and [11] (Das, B., & Fasen-Hartmann, V. (2018). Risk contagion under regular variation and asymptotic tail independence. Journal of Multivariate Analysis 165 (1), 194–215) to assess the relative effects of a single risk when other risks in a group are in distress. The properties of these contribution risk measures are examined, and sufficient conditions for comparing these measures between two sets of random vectors are established using univariate and multivariate stochastic orders and statistically dependent notions. Numerical examples are presented to validate these conditions. Finally, a real dataset from the cryptocurrency market is used to analyze the spillover effects through our proposed contribution measures.
In recent years, security incidents stemming from centralization defects in smart contracts have led to substantial financial losses. A centralization defect refers to any error, flaw, or fault in a smart contract's design or development stage that introduces a single point of failure. Such defects allow a specific account or user to disrupt the normal operations of smart contracts, potentially causing malfunctions or even complete project shutdowns. Despite the significance of this issue, most current smart contract analyses overlook centralization defects, focusing primarily on other types of defects. To address this gap, our paper introduces six types of centralization defects in smart contracts by manually analyzing 597 Stack Exchange posts and 117 audit reports. For each defect, we provide a detailed description and code examples to illustrate its characteristics and potential impacts. Additionally, we introduce a tool named CDRipper (Centralization Defects Ripper) designed to identify the defined centralization defects. Specifically, CDRipper constructs a permission dependency graph (PDG) and extracts the permission dependencies of functions from the source code of smart contracts. It then detects the sensitive operations in functions and identifies centralization defects based on predefined patterns. We conduct a large-scale experiment using CDRipper on 244,424 real-world smart contracts and evaluate the results based on a manually labeled dataset. Our findings reveal that 82,446 contracts contain at least one of the six centralization defects, with our tool achieving an overall precision of 93.7%.
We introduce a novel class of systemic risk measures, the Vulnerability Conditional risk measures, which try to capture the "tail risk" of a risky position in scenarios where one or more market participants is experiencing financial distress. Various theoretical properties of Vulnerability Conditional risk measures, along with a series of related contribution measures, have been considered in this paper. We further introduce the backtesting procedures of VCoES and MCoES. Through numerical examples, we validate our theoretical insights and further apply our newly proposed risk measures to the empirical analysis of cryptocurrencies, demonstrating their practical relevance and utility in capturing systemic risk.
Mojtaba Eshghie, Viktor Åryd, Cyrille Artho, Martin Monperrus
Structured code differencing is the act of comparing the hierarchical structure of code via its abstract syntax tree (AST) to capture modifications. AST-based source code differencing enables tasks such as vulnerability detection and automated repair where traditional line-based differencing falls short. We introduce SoliDiffy, the first AST differencing tool for Solidity smart contracts with the ability to generate an edit script that soundly shows the structural differences between two smart-contracts using insert, delete, update, move operations. In our evaluation on 353,262 contract pairs, SoliDiffy achieved a 96.1% diffing success rate, surpassing the state-of-the-art, and produced significantly shorter edit scripts. Additional experiments on 925 real-world commits further confirmed its superiority compared to Git line-based differencing. SoliDiffy provides accurate representations of smart contract evolution even in the existence of multiple complex modifications to the source code. SoliDiffy is made publicly available at https://github.com/mojtaba-eshghie/SoliDiffy.
Lei Yu, Shiqi Chen, Hang Yuan, Peng Wang · 10 authors
With the rapid development of blockchain technology, smart contract security has become a critical challenge. Existing smart contract vulnerability detection methods face three main issues: (1) Insufficient quality of datasets, lacking detailed explanations and precise vulnerability locations. (2) Limited adaptability of large language models (LLMs) to the smart contract domain, as most LLMs are pre-trained on general text data but minimal smart contract-specific data. (3) Lack of high-quality explanations for detected vulnerabilities, as existing methods focus solely on detection without clear explanations. These limitations hinder detection performance and make it harder for developers to understand and fix vulnerabilities quickly, potentially leading to severe financial losses. To address these problems, we propose Smart-LLaMA, an advanced detection method based on the LLaMA language model. First, we construct a comprehensive dataset covering four vulnerability types with labels, detailed explanations, and precise vulnerability locations. Second, we introduce Smart Contract-Specific Continual Pre-Training, using raw smart contract data to enable the LLM to learn smart contract syntax and semantics, enhancing their domain adaptability. Furthermore, we propose Explanation-Guided Fine-Tuning, which fine-tunes the LLM using paired vulnerable code and explanations, enabling both vulnerability detection and reasoned explanations. We evaluate explanation quality through LLM and human evaluation, focusing on Correctness, Completeness, and Conciseness. Experimental results show that Smart-LLaMA outperforms state-of-the-art baselines, with average improvements of 6.49% in F1 score and 3.78% in accuracy, while providing reliable explanations.
Smart contracts are self-executing digital contracts that run on a blockchain network. They enable the automation and decentralization of various operations and have become increasingly popular in recent years. However, smart contracts are susceptible to vulnerabilities, and their deployment without proper security testing can result in severe consequences, such as financial losses and reputational damage. In this article, we explore the use of deep learning techniques, particularly Convolutional Neural Networks (CNNs), for detecting and classifying vulnerabilities in smart contracts deployed on the Ethereum main net. We compare different kinds of neural architectures, i.e., a baseline LSTM, multiple 1D CNNs working on the smart contracts’ bytecode, a Vision Transformer (Swin v2 Tiny), and various 2D CNNs that work on RGB images obtained from the bytecode (i.e., ResNet-50, ResNeXt-50, Inception v3, and EfficientNetv2 Small). We provide an in-depth analysis of these techniques to classify a dataset of smart contracts we have collected. Our study shows that the use of deep neural networks can represent a promising technique to automatically assess smart contracts’ correctness and classify potential vulnerabilities. According to our experiments, the ResNet 1D CNN working directly on the smart contract bytecode offers the best results in terms of classification capabilities. Moreover, due to the unbalanced sizes of the different classes, the classification resulted in more effectiveness for the unchecked calls and reentrancy vulnerability classes while still providing good results for others.
Daniel E. Martínez, Lena Magdalena, Agnes Novalita Savitri
The integration of Artificial Intelligence (AI) and Blockchain is revolutionizing the financial sector, targeting crucial challenges like security and transparency. This paper explores the synergistic effects of AI and Blockchain on enhancing the security of financial transactions through advanced real-time fraud detection, anomaly identification, and decentralized transaction verification. Employing a comprehensive review of existing literature and case studies, the research investigates how AI’s capabilities in processing vast data volumes can be leveraged alongside Blockchain’s robust, immutable ledger system to mitigate risks in financial operations effectively. The findings reveal that integrating AI with Blockchain not only significantly improves the security by enabling the real-time detection of anomalies but also upholds the integrity and transparency of transactions across distributed ledgers. The results underscore the potential of AI-Blockchain technology to enhance financial transaction frameworks and highlight its capacity to support the achievement of the United Nations Sustainable Development Goals (SDGs), particularly SDG 8 (Decent Work and Economic Growth), SDG 9 (Industry, Innovation, and Infrastructure), and SDG 16 (Peace, Justice, and Strong Institutions) by fostering more transparent and secure economic environments. The conclusion of the study suggests further research on the scalability of AI-Blockchain integrations and their broader application across various industries, pointing towards a transformative impact on global financial practices.
Smart contracts are essential for managing digital assets in blockchain networks, highlighting the need for effective security measures. This paper introduces SmartLLMSentry, a novel framework that leverages large language models (LLMs), specifically ChatGPT with in-context training, to advance smart contract vulnerability detection. Traditional rule-based frameworks have limitations in integrating new detection rules efficiently. In contrast, SmartLLMSentry utilizes LLMs to streamline this process. We created a specialized dataset of five randomly selected vulnerabilities for model training and evaluation. Our results show an exact match accuracy of 91.1% with sufficient data, although GPT-4 demonstrated reduced performance compared to GPT-3 in rule generation. This study illustrates that SmartLLMSentry significantly enhances the speed and accuracy of vulnerability detection through LLM-driven rule integration, offering a new approach to improving Blockchain security and addressing previously underexplored vulnerabilities in smart contracts.
Dat Tien Nguyen, Dung Cam Huynh, Tran Bao Anh Nguyen
The Industrial Revolution 4.0 and modern technology have had a significant impact on Vietnam’s economy. One of the most notable developments is the emergence of blockchain technology. “Smart contracts” or “virtual contracts” have become an important term on the Blockchain platform, offering many advantages and being widely deployed in areas such as finance, business, trade, and insurance. Although smart contracts have potential benefits, businesses are still hesitant to establish them. The article employs analytical methods and synthesizes data to provide evaluative insights. Additionally, this article analyzes the concept and characteristics of smart contracts, the trend of applying smart contracts in some countries worldwide, and provides suggestions for Vietnamese businesses on how to apply smart contracts, along with notes and recommendations.
While smart contracts are foundational elements of blockchain applications, their inherent susceptibility to security vulnerabilities poses a significant challenge. Existing training datasets employed for vulnerability detection tools may be limited, potentially compromising their efficacy. This paper presents a method for improving the quantity and quality of smart contract vulnerability datasets and evaluates current detection methods. The approach centers around semantic-preserving code transformation, a technique that modifies the source code structure without altering its semantic meaning. The transformed code snippets are inserted into all potential locations within benign smart contract code, creating new vulnerable contract versions. This method aims to generate a wider variety of vulnerable codes, including those that can bypass detection by current analysis tools. The paper experiments evaluate the method's effectiveness using tools like Slither, Mythril, and CrossFuzz, focusing on metrics like the number of generated vulnerable samples and the false negative rate in detecting these vulnerabilities. The improved results show that many newly created vulnerabilities can bypass tools and the false reporting rate goes up to 100% and increases dataset size minimum by 2.5X.
Smart contracts, self-executing agreements directly encoded in code, are fundamental to blockchain technology, especially in decentralized finance (DeFi) and Web3. However, the rise of Ponzi schemes in smart contracts poses significant risks, leading to substantial financial losses and eroding trust in blockchain systems. Existing detection methods, such as PonziGuard, depend on large amounts of labeled data and struggle to identify unseen Ponzi schemes, limiting their reliability and generalizability. In contrast, we introduce PonziSleuth, the first LLM-driven approach for detecting Ponzi smart contracts, which requires no labeled training data. PonziSleuth utilizes advanced language understanding capabilities of LLMs to analyze smart contract source code through a novel two-step zero-shot chain-of-thought prompting technique. Our extensive evaluation on benchmark datasets and real-world contracts demonstrates that PonziSleuth delivers comparable, and often superior, performance without the extensive data requirements, achieving a balanced detection accuracy of 96.06% with GPT-3.5-turbo, 93.91% with LLAMA3, and 94.27% with Mistral. In real-world detection, PonziSleuth successfully identified 15 new Ponzi schemes from 4,597 contracts verified by Etherscan in March 2024, with a false negative rate of 0% and a false positive rate of 0.29%. These results highlight PonziSleuth's capability to detect diverse and novel Ponzi schemes, marking a significant advancement in leveraging LLMs for enhancing blockchain security and mitigating financial scams.
The development of smart contracts remains in its early stages, with significant differences in underlying programming languages and application platforms resulting in a lack of standardization. This lack of standardization increases the susceptibility to vulnerabilities and associated financial losses. To address security vulnerabilities in smart contracts on the Ethereum blockchain platform, this paper proposes a security audit method based on formal verification. The method integrates an input module, static analysis module, formal verification module, analog execution module, and report and recommendation module, which can accurately discover the security vulnerabilities and logical flaws of smart contracts through formal verification and other analysis techniques, thus realizing correctness detection. During the experiment, the method detects 8 types of common vulnerabilities in 148 smart contracts and marks 21 smart contracts with vulnerabilities. After manual review and analysis, it is found that 17 of these 21 marked smart contracts do have security vulnerabilities. The experimental results show that the proposed method can accurately detect security vulnerabilities and logic flaws in smart contracts through formal verification and other analysis techniques before smart contracts are deployed, thus significantly improving the security of smart contracts and reducing the economic losses that may be caused by code defects.
The cryptocurrency market offers attractive but risky investment opportunities, characterized by rapid growth, extreme volatility, and uncertainty. Traditional risk management models, which rely on probabilistic assumptions and historical data, often fail to capture the market’s unique dynamics and unpredictability. In response to these challenges, this paper introduces a novel portfolio optimization model tailored for the cryptocurrency market, leveraging a credibilistic CVaR framework. CVaR was chosen as the primary risk measure because it is a downside risk measure that focuses on extreme losses, making it particularly effective in managing the heightened risk of significant downturns in volatile markets like cryptocurrencies. The model employs credibility theory and trapezoidal fuzzy variables to more accurately capture the high levels of uncertainty and volatility that characterize digital assets. Unlike traditional probabilistic approaches, this model provides a more adaptive and precise risk management strategy. The proposed approach also incorporates practical constraints, including cardinality and floor and ceiling constraints, ensuring that the portfolio remains diversified, balanced, and aligned with real-world considerations such as transaction costs and regulatory requirements. Empirical analysis demonstrates the model’s effectiveness in constructing well-diversified portfolios that balance risk and return, offering significant advantages for investors in the rapidly evolving cryptocurrency market. This research contributes to the field of investment management by advancing the application of sophisticated portfolio optimization techniques to digital assets, providing a robust framework for managing risk in an increasingly complex financial landscape.
There is a huge demand to ensure the compliance of smart contracts listed on blockchain platforms to safety and economic standards described in natural languages. Today, manual efforts in the form of auditing are commonly used to achieve this goal. ML-based automated techniques have the promise to alleviate human efforts and the resulting monetary costs. However, unlike other domains where ML techniques have had huge successes, no systematic ML techniques have been proposed or applied to smart contract auditing. We present SC-Bench, the first dataset for automated smart-contract auditing research. SC-Bench consists of 5,377 real-world smart contracts running on Ethereum, a widely used blockchain platform, and 15,975 violations of standards on Ehereum called ERCs. Out of these violations, 139 are real violations programmers made. The remaining are errors systematically injected by us to reflect the violations of different ERC rules. We evaluate SC-Bench using GPT-4 by prompting it with both the contracts and ERC rules. In addition, we manually identify each violated rule and the corresponding code site (i.e., oracle) and prompt GPT-4 with the information asking for a True-or-False question. Our results show that without the oracle, GPT-4 can only detect 0.9% violations, and with the oracle, it detects 22.9% violations. These results show the potential room for improvement in ML-based techniques for smart-contract auditing.
The substantial value held by smart contracts (SCs) makes them an enticing target for malicious attacks. The process of fixing vulnerabilities in SCs is intricate, primarily due to the immutability of blockchain technology. This research paper introduces a systematic literature review (SLR) that evaluates rectification systems designed to patch vulnerabilities in SCs. Following the guidelines set forth by the PRISMA statement, this SLR meticulously reviews a total of 31 papers. In this context, we classify recently published SC automated repair frameworks based on their methodologies for automatic program repair (APR), rewriting strategies, and tools for vulnerability detection. We argue that automated patching enhances the reliability and adoption of SCs, thereby allowing developers to promptly address identified vulnerabilities. Furthermore, existing automated repair tools are capable of addressing only a restricted range of vulnerabilities, and in some cases, patches may not be effective in preventing the targeted vulnerabilities. Another key point that should be taken into account is the simplicity of the patch and the gas consumption of the modified program. Alternatively, large language models (LLMs) have opened new avenues for automatic patch generation, and their performance can be improved by innovative methodologies.
January 2024 which covered recent catastrophic events such as Bitcoin Price Crash-2018, COVID-19, Global plummet in Oil Demand-2020, and Russia-Ukraine War. The findings reveal that NFTs and DeFi assets possess weak connectedness with housing market in normal market state, however, connectedness become robust in extreme bearish and bullish market states. Moreover, NFTs and DeFi assets are net transmitters and housing market acts as net receiver of shock in all market states. Investors, portfolio managers, and policymakers should carefully analyze both digital financial assets and housing market especially during extreme events to build well diversified profit-gaining portfolios and to formulate policies.
Bianca-Elena Ialangi, Costin Carabaș, Nicolae Ţăpuş, Dinu Țurcanu
Currently, applications called Smart Contracts have taken a considerable leap in blockchain technology. Achieving transaction automation is a huge success that can have many uses. Like any technology in its infancy, there are many vulnerabilities that attackers can exploit. The paper aims to create a modular solution of a security framework for smart contracts in the MultiversX blockchain: a static analyser that can currently identify three vulnerabilities for smart contracts written in the Rust programming language. This tool can be helpful because the development and testing before smart contracts reach the blockchain are done by people, which means that human error can always occur. The objective is to minimize this unfortunate event by automating contract verification in the early stages of development. The encouraging results provide the conviction of an application that will have significant utility, whilst leaving room for improvements in the future.
In decentralized finance, any individual can pool their assets into an automated market maker (AMM) -- herein we focus on the constant product market maker (CPMM) -- in exchange for a claim on a fraction of future pool assets and fees earned from the market making operations. This position is represented by a liquidity token, whose prevailing on-chain price is effectively the initial deposited assets. Though this price is well-defined, we treat the liquidity token as a derivative position in the prices of the underlying assets for the CPMM in order to deduce risk-neutral pricing and hedging formulas, not dissimilar to the Black-Scholes result. Adopting this perspective, in a frictionless environment, hedging the CPMM liquidity token under fair valuation should produce a riskless process, which therefore grows at the risk-free rate, something that is not seen in empirical case studies under the prevailing price. With our novel pricing formula, we construct a method to calibrate a volatility to data which provides an updated (non-market) valuation which is consistent with the (near-continuous) replication strategy out-of-sample. We conclude with a discussion of novel AMM design considerations motivated by this derivative-pricing perspective.