Smart contracts manage high-value digital assets, making their security a critical priority. In this work, we present a preliminary ecosystem analysis of how smart contract vulnerabilities are currently classified, disclosed, and managed across academia and industry. Our findings reveal the fragmented nature of Web3 security, characterized by a history of attempted classification schemes and a lack of proper vulnerability disclosure. We propose several hypotheses for this divergence from traditional software standards, including ideological decentralization, reputation management, and misaligned financial incentives. A case study of Uniswap illustrates these challenges, revealing inconsistent reporting and the difficulty of verifying vulnerability data. Ultimately, this work serves as a foundational step toward establishing unified methodologies for the detection, management, and disclosure of smart contract vulnerabilities.
Autonomous AI agents capable of holding digital assets, signing transactions, and executing smart contracts on public blockchain networks have moved from research prototypes to active deployment over the past two years. Despite this pace of adoption, no systematic treatment of their architecture, coordination protocols, and governance structures exists that spans the full design space. This survey addresses that gap through a systematic review of the literature from 2019 to 2026, covering 177 peer-reviewed publications and 14 system documentation sources, identified through a structured search of IEEE Xplore, the ACM Digital Library, Scopus, and arXiv. We classify deployed and proposed systems along four architectural dimensions: on-chain execution, off-chain agents with on-chain settlement, verifiable off-chain computation, and multi-agent on-chain interaction. Then, we examine the coordination mechanisms through which agents reach collective decisions, covering auction-based protocols, cooperative multi-agent reinforcement learning, token-incentive structures, and gossip-based peer-to-peer coordination. Governance is treated as a distinct dimension, analysed through a technical lens, covering on-chain parameter control, dispute resolution, and DAO structures, and an organizational one, covering accountability, incentive alignment, principal–agent dynamics, and regulatory compatibility. We survey applications across decentralized finance, supply chain, IoT, and agent marketplace domains, and identify six open research problems whose resolution is a prerequisite for broader deployment. The convergence of mechanism design and multi-agent reinforcement learning in asynchronous blockchain environments is identified as the direction of greatest near-term research value.
Jin Ah Seo, Kun Hwa Lee, Vijayan Sugumaran, Jo Yeon Park · 5 authors
We build and evaluate a concrete Zero-Knowledge Machine Learning (ZKML)-based pipeline for epidemic diagnosis and show that it can enforce computational integrity without exposing raw medical data in a Web3 setting. In response to security challenges posed by centralized data handling in medical AI applications, particularly during public health crises such as COVID-19, ZKML offers a privacy-preserving alternative by combining machine learning and Zero-Knowledge Proofs (ZKP). We experimentally applied ZKML to a CNN (Convolutional Neural Networks)-based COVID-19 diagnostic model, achieving 87% accuracy and 0.35 loss. All proof generation and verification processes were executed entirely off-chain, with the verified outputs represented as committed public_vals recorded on-chain via smart contracts. To ensure authenticity, the system enforces dual ECDSA signature verification from both the model provider and the data provider. This mechanism prevents unauthorized submissions and confirms the validity of the result before it is stored on-chain. The system was tested under both normal and adversarial conditions, demonstrating robust and reliable operation. By enabling decentralized trust and self-sovereign control over data, this architecture aligns well with Web3 principles. The results indicate that ZKML can support the development of privacy-preserving and verifiable AI systems.
Open access
Adversarial Robustness in Machine Learning
Privacy-Preserving Technologies in Data
Artificial Intelligence in Healthcare and Education
SPECTRA is a static-analysis framework for Solidity contracts that integrates symbolic execution, seven-domain abstract interpretation, semantic vulnerability detection, specification synthesis, SMT validation, and CEGAR refinement. Across 220 contracts, SPECTRA analyzes 216 (98.18%), infers 1,381 function-level specifications (6.39 per successful contract), and reports 673 vulnerability findings in 192 contracts (88.89%), with 0.70 s median runtime. These results indicate that specification-oriented analysis remains practical at benchmark scale.
Flawed funds allocation logic in DeFi contracts can result in disproportionate token distribution, reflecting fundamental errors in how contracts determine and assign user payouts. These issues extend beyond funds allocation logic and affect token distribution mechanisms. Existing defenses such as static analyzers and runtime detectors fail to capture these behaviors because each operation appears valid in isolation. In this work, we present AllocScope, an auditor-centric static analysis framework that identifies allocation manipulation vulnerabilities by modeling allocation-related fund flow semantics and generating vulnerability findings for auditors. AllocScope constructs a funds allocation graph to track the relationship between user contributions and received payouts, and identifies logic that result in unfair outcomes. Evaluated on over 8,000 real-world contracts, AllocScope achieves zero false negatives. A user study with experienced auditors confirms that its findings are accurate, actionable, and easy to integrate into standard auditing workflows.
Purpose This study develops a pricing and contract design framework for cryptocurrency catastrophe (CAT) bonds to transfer extreme crypto-native risks, including protocol exploits, exchange breaches and decentralized finance (DeFi) failures, to capital markets. The paper aims to address arbitrage-free valuation, sponsor-optimal contract design and trustless settlement under the unique informational and operational features of blockchain systems. Design/methodology/approach We propose a multi-trigger crypto CAT bond structure that jointly captures short-term catastrophic shocks and long-term systemic deterioration through oracle-reported loss metrics. An arbitrage-free valuation framework is developed under an incomplete market setting using the minimal martingale measure, while sponsor-optimal contract design is formulated under a dual-measure framework. Empirically, crypto loss dynamics are modeled using generalized extreme value distributions and copula-based dependence structures, whereas financial risk factors are modeled through ARIMA–GARCH and vine copulas. A smart-contract-enabled on-chain settlement architecture is further introduced to automate trigger evaluation and cash-flow execution. Findings Empirical results based on REKT crypto incident data demonstrate strong dependence between monthly extreme and aggregate losses, with heterogeneous dependence structures across blockchain ecosystems. Simulation studies show that trigger and principal repayment designs substantially affect bond price distributions and tail risk exposures. Conservative trigger structures generate more stable bond valuations, whereas aggressive structures exhibit greater downside dispersion. The proposed framework supports economically viable risk transfer while enabling transparent and timely settlement through blockchain-based execution. Originality/value This study develops, to the best of our knowledge, the first integrated framework for crypto native catastrophe bonds that combines arbitrage-free pricing, sponsor optimal contract design and smart contract-based on-chain settlement. Unlike traditional CAT bonds or cyber insurance-linked securities the proposed framework explicitly incorporates oracle-based observability, crypto-specific dependence structures and automated settlement, providing a novel mechanism for transferring systemic digital asset risks to capital markets.
Ilham Qasse, Po-Yu Tseng, Mohammad Hamdaqa, GÃsli Hjálmtýsson
Smart contract security audit reports contain rich information about vulnerabilities and code quality issues in Web3 projects. However, these reports are scattered across different sources and formats, making large-scale analysis difficult. We present SCAR (Smart Contract Audit Repository), an open-source dataset and tool that automatically aggregates these audit reports. SCAR crawls reports from leading security firms (e.g., OpenZeppelin) and community contests (e.g., Code4rena), parses them into a structured JSON schema, and offers a queryable API for accessing the data. Its pipeline includes a crawler, a text-mining module to standardize findings (e.g., vulnerability types, severity, code references), and a web API for retrieving insights. With hundreds of audits covering thousands of issues, SCAR enables empirical studies of smart contract vulnerabilities at scale. The SCAR project repository is available on GitHub, and the screencast demo is available at this link.
Sai Srikanth Madugula, Peplluis Esteva De La Rosa, Daya Shankar
Decentralized Finance (DeFi) lending protocols currently rely on heuristic, utilization-based bonding curves that mandate severe over-collateralization, systematically excluding under-collateralized assets like corporate invoices. This paper introduces a mathematically optimal pricing mechanism for decentralized credit: the Reverse Kelly Automated Market Maker (rkAMM), the core engine of our proposed lending framework. By inverting the Kelly Criterion, traditionally used for optimal bet sizing, we construct a dynamic interest rate discovery protocol that explicitly prices individual loan risk. The rkAMM ingests real-time Probability of Default (PD) streams from an off-chain Explainable AI oracle and dynamically calculates the exact interest rate required to sustain target liquidity provider (LP) yields. We mathematically derive the Reverse Kelly pricing function ($r = \frac{y + PD}{1 - PD}$), proving its strictly convex superiority over Aave and Compound's static utilization curves in managing capital efficiency. Furthermore, we deploy the rkAMM architecture via Solidity smart contracts, optimizing for gas-efficient 1e18 (WAD) floating-point arithmetic. To ensure decentralized transparency, our simulation infrastructure leverages MLflow for tracking yield hyperparameters, Data Version Control (DVC) linked to DagsHub for versioning Real-World Asset (RWA) data arrays, and localized edge-inference via Ollama (Llama-3) and Hugging Face (FinBERT) for zero-cost predictive modeling. Monte Carlo simulations across 10,000 macroeconomic stress scenarios confirm that the rkAMM maintains protocol solvency and stabilizes LP yields at 12-15\% net of expected credit losses. This work provides the foundational financial engineering required to bridge the \$2 trillion global supply chain finance gap using permissionless blockchain infrastructure.
Trusted execution environment (TEE) based confidential smart contract networks promise privacy but remain vulnerable to storage access pattern attacks that can link senders and recipients in token transfers. When contracts update recipient balances during transfers, the unique storage keys accessed reveal transaction relationships even when data is encrypted. This paper introduces two novel data structures to address this vulnerability: the Delayed Write Buffer (DWB) and the Bitwise-Trie of Bucketed Entries (BTBE). The DWB delays recipient balance updates by buffering pending transfers and randomly settling entries, breaking the direct correlation between transfer execution and recipient storage access. The BTBE further enhances privacy by grouping addresses into constant-sized buckets, preventing flooding attacks and creating anonymity sets for balance queries. Additionally, we present a private notification system enabling real-time, privacy-preserving push notifications for confidential contracts. Our domain-specific approach leverages the unique characteristics of token transfers -- asymmetric balance updates and tolerance for delayed settlement -- to achieve practical performance with probabilistic anonymity guarantees.
Modern supply chain management systems increasingly rely on distributed architectures to ensure transparency, integrity, and trust between participants. Blockchain technology provides a promising foundation for such systems; however, traditional consensus mechanisms introduce high computational overhead, energy inefficiency, and privacy risks. These limitations are particularly critical for small and medium-sized enterprises (SMEs) with constrained computational resources, that they are using to expand on their traditional informational systems and not to integrate distributed technologies into the work process, as setup process for blockchain tools is more complex than centralized approach. This paper proposes a private, dockerized blockchain architecture for supply chain management that combines the Proof of Friendship (PoF) consensus mechanism with Zero-Knowledge Proofs (ZKP). By integrating a private, dockerized framework with the Proof of Friendship consensus and Zero-Knowledge Proofs, this architecture enables resource-constrained enterprises to achieve a high-performance decentralized network that simultaneously ensures sub-second transaction validation through social trust metrics, robust protection of competitive business intelligence via cryptographic privacy, and seamless cross-platform deployment through containerization, ultimately overcoming the traditional trade-offs between system transparency, operational cost, and data confidentiality in global trade. PoF extends Proof of Stake by incorporating social trust indicators, including transaction success rate and geographic diversity of validators, enabling resource-efficient and decentralized consensus. ZKP mechanisms are integrated through an off-chain prover module, allowing transaction correctness to be verified without revealing sensitive business data. The proposed approach enhances cybersecurity, data confidentiality, and system scalability while reducing computational costs. Simulation results demonstrate improved resistance to Sybil attacks, reduced validator centralization, and acceptable transaction latency for corporate blockchain deployments.
Tanishka Ahire, Jyotsana Bagul, Dr. Archana Bendale
Abstract: The idea of cryptocurrency is really interesting. It started as a money idea and now it is changing how the world thinks about money and technology. Cryptocurrency began with Bitcoin in 2008. Now it includes ideas like blockchain and special kinds of contracts. There are also kinds of money from central banks and unique digital things called NFTs. This paper looks closely at the technology behind cryptocurrency. How it affects the economy, people and laws. It talks about the things that cryptocurrency can do which will probably help it grow. It also talks about the problems that cryptocurrency is facing which might slow it down. The paper looks at what might happen with cryptocurrency in the future and how it will affect the world and money systems. After looking at a lot of research from 2008 to 2023 it seems that cryptocurrency is a concept that could be really big, in the future. For it to really work some technical and other issues need to be figured out. Cryptocurrency has to deal with these issues to be sustainable. The idea of cryptocurrency is still very promising. It needs to solve some problems.. Keywords: Cryptocurrency, Blockchain Technology, Decentralized Finance (DeFi), Smart Contracts, Consensus Mechanisms
This study examines the transformation of artistic ownership in fine arts through blockchain-based non-fungible tokens (NFTs). It explores how NFTs reshape traditional systems of provenance, authenticity, and value creation by decentralising ownership verification and embedding transaction records within blockchain infrastructure. Using a qualitative research design based on secondary data analysis, the study synthesises findings from academic literature, industry reports, and case studies of NFT marketplaces and institutional adoption. The analysis is grounded in Actor-Network Theory, Institutional Theory, and Cultural Economics, enabling a multidimensional interpretation of technological, institutional, and economic change. Findings indicate that NFTs reconfigure artistic ownership through programmable smart contracts, disrupt traditional intermediary roles in the art world, and introduce new forms of digital scarcity that drive speculative valuation. However, challenges such as regulatory ambiguity, environmental concerns, and market volatility remain significant. The study concludes that NFTs represent not merely a technological innovation but a structural transformation of ownership systems in contemporary fine arts. Keywords: Blockchain, NFTs, Artistic Ownership, Fine Arts, Digital Art Markets, Cultural Economics, Institutional Change
Zhengqing Liu, Alberto Sonnino, Igor Zablotchi, Eleftherios Kokoris-Kogias · 5 authors
Modern blockchains rely on a modular architecture that decouples consensus from execution. Recent advances in consensus algorithms have shifted the bottleneck to the execution layer, which must deterministically follow the consensus order and handle increasingly complex, compute-intensive smart contracts. We identify that single-node validators cannot keep up, motivating the need for a scale-out design. We design Remora, a scale-out smart contract execution engine. Remora adopts an efficient asymmetric architecture with centralized transaction dispatching and distributed execution, and depends on an object versioning scheme with a strict ownership model to guarantee deterministic scale-out execution. Remora achieves up to 3x throughput improvement compared to state-of-the-art deterministic execution schemes, scales up to 250k TPS, matching modern consensus performance, and reduces latency by up to 5ms. We also show that Remora elastically adapts to bursty workloads and dynamic access patterns using real-world traces. Remora's main performance benefits come from a novel stateless-stateful separation during smart contract execution, which overlaps the execution of state-independent tasks with consensus, and a new locality-aware and load-balanced scheduling scheme.
Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted detection rules, while fine-tuning requires massive labeled datasets that are inherently scarce in this domain. We present EvoVuln, an automated framework that reformulates vulnerability detection as a procedural knowledge evolution problem, synthesizing and refining detection logic using only a minimal number of labeled samples. To achieve this, EvoVuln introduces two key mechanisms. First, a Runtime with an Inversion of Control (IoC) architecture compiles detection rules into Executable Policies. This strictly decouples deterministic control flow from LLM semantic reasoning, ensuring faithful logical adherence and producing dense diagnostic telemetry for precise error localization. Second, a two-phase evolution pipeline refines the rule via abductive semantic debugging without any parameter updates: Cold Start bootstraps and stress-tests an initial rule using auto-synthesized corner cases; Few-Shot Evolving then grounds the policy in real-world semantics using only five vulnerable and five safe examples per vulnerability type. Evaluated across five real-world vulnerability types, EvoVuln achieves a 71% macro-average F1-score, outperforming all baselines. The evolved procedural knowledge is portable across models: it enables a lightweight, low-cost model to surpass a much larger zero-shot model by 19 percentage points, and transfers to other LLMs without retraining, at a one-time evolution cost under $50.
ASEGUNLOLUWA E. BABALOLA, DAVID O. ILESANMI, PREYE ADEOLA
Electronic voting can improve the speed of ballot processing and result generation, but conventional systems often depend on centrally controlled infrastructure that may create concerns relating to record alteration, transparency and administrative control. This study presents the development of a blockchain based electronic voting prototype that integrates election creation, candidate management, voter address authorization, ballot submission and result retrieval within a web application. The system adopts an Ethereum based architecture comprising a Next.js user interface, Web3 communication, MetaMask wallet connection, Solidity smart contracts and a local blockchain environment provided by Ganache. A factory smart contract is used to create separate election contracts, enabling each election to maintain its own candidates, authorized voter addresses, election status and vote totals. Before a ballot is accepted, the relevant election contract verifies that the election is active, that the submitting address is authorized and that the address has not previously voted. The developed prototype provides interfaces for election creation, voting and result presentation, demonstrating the integration of the web application with the smart contract and blockchain components. The study provides a basis for the independent management of multiple elections through separate smart contract instances.
This study addresses the persistent challenges of limited transparency and inefficiency in accounting information systems, particularly in the context of financial reporting and auditing. It aims to examine the role of blockchain in enhancing transparency and improving audit processes within accounting systems. The research adopts a systematic literature review approach by analyzing 43 selected academic articles and relevant industry reports published between 2019 and 2026. The analysis focuses on identifying key characteristics, mechanisms, and implications of blockchain adoption in accounting practices. The findings indicate that blockchain has strong potential to improve data transparency, traceability, and reliability through features such as distributed ledgers, immutability, and smart contracts. These characteristics support real-time financial reporting and enable more continuous and efficient audit processes. The study also identifies several implementation challenges, including regulatory uncertainty, high adoption costs, and limited professional expertise. Furthermore, this research proposes a conceptual framework integrating blockchain into accounting information systems to support better governance and decision-making. The study contributes to the growing discourse on digital transformation in accounting, particularly in emerging economies.
The Criminal Evidence Management System using Blockchain is designed to provide a secure, transparent, and tamper-resistant platform for managing digital criminal evidence throughout its lifecycle.Traditional evidence management systems rely on centralized databases, making them vulnerable to unauthorized access, data manipulation, and single points of failure.Such limitations can compromise the integrity of evidence and weaken the chain of custody during legal proceedings.To address these challenges, the proposed system leverages blockchain technology to ensure the authenticity, immutability, and traceability of digital evidence.The system employs Ethereum blockchain and Solidity smart contracts to securely record evidence-related transactions, while Python, Django, and Web3 facilitate seamless interaction between users and the blockchain network.Role-based access control enables administrators and investigating officers to perform authorized operations such as evidence submission, retrieval, and verification.Every transaction is permanently recorded on the blockchain, creating an auditable history that enhances accountability and prevents unauthorized modifications.The proposed solution improves the reliability and efficiency of evidence management by eliminating the risks associated with centralized storage and manual record-keeping.Through secure storage, transparent access, and automated verification, the system strengthens the chain of custody, increases trust among law enforcement agencies, and supports the admissibility of digital evidence in judicial processes, making it a robust solution for modern forensic investigations.
Hai Liang, Xiaoye Lu, Changsong Yang, Yujue Wang · 6 authors
Smart contracts are immutable programs that automatically execute predefined logic. Once deployed, their underlying vulnerabilities are notoriously difficult to patch and highly susceptible to malicious exploitation, often leading to severe financial losses. Although existing vulnerability detection methods have demonstrated certain advantages, they still fail to achieve adequate structural–semantic coverage of vulnerability-relevant behaviors, as they are unable to jointly model opcode semantics, control-flow transitions, and data-dependency relations. To overcome these limitations, this paper proposes a novel smart contract vulnerability detection model named Cross-aligned Penetrative Graph Network (CPGNet). Specifically, CPGNet first constructs control flow graphs and data flow graphs from the abstract syntax tree, and combines them with opcode semantic embeddings to form a multidimensional initial code representation. Based on this representation, a cross-alignment mechanism is introduced to effectively capture and integrate the complex interactions between control-flow transitions and data-flow dependencies. Furthermore, an explicit–implicit feature penetration architecture is designed to inject shallow local opcode patterns into the deep semantic modeling process, enabling multi-source features to dynamically complement each other. By jointly modeling opcode semantics, control-flow structures, and data-dependency relations, CPGNet significantly enhances the representation capability for hidden and complex vulnerability patterns. Experimental results on two datasets show that CPGNet achieves stable performance, with F1-scores of 88.69% and 90.58% on the benchmark Ethereum dataset, and 78.10% and 71.53% on DIVE for reentrancy and timestamp dependency detection, respectively. These results verify the effectiveness of jointly modeling opcode semantics and graph-level structural dependencies.
Nataliya Bilous, Danylo Ostapchenko, Iryna Ahekian, Marcus Frohme
Remote tele-rehabilitation requires objective pain assessment, but existing approaches fail in two distinct ways. Self-report scales such as the Visual Analog Scale and the Numeric Pain Rating Scale are easy to falsify, opening a special case of the Oracle problem in blockchain-based insurance. Cloud-based computer vision handles falsification but transmits raw biometric video off the patient’s device, violating privacy requirements. A decentralized Edge AI-Oracle architecture is proposed that combines MediaPipe Face Mesh landmark extraction with a recurrent classifier mapping Action-Unit feature sequences to a learned pain score aligned with the Prkachin and Solomon Pain Intensity scale. The recurrent cell is selected empirically across short-context (T = 2) and long-context (T = 120 frames at 24 fps) regimes, with a two-layer Long Short-Term Memory (LSTM) network adopted for deployment. Inference and Elliptic Curve Digital Signature Algorithm (ECDSA) signing run inside an ARM TrustZone Trusted Execution Environment (TEE). Biometric logs are stored off-chain on the InterPlanetary File System (IPFS). Smart contracts anchor results on-chain and open a 24 h optimistic verification window for an off-chain Watchtower auditor. On SynPAIN the LSTM reaches F1 = 0.683 on T = 120 video (leave-one-stratum-out), with a directional but non-significant advantage over Gated Recurrent Unit (GRU) (Wilcoxon p = 0.167). Cross-dataset validation on BioVid Heat Pain Database Part A (87 subjects, 174 paired observations, leave-one-subject-out) yields F1 = 0.519 for LSTM and 0.499 for GRU (Wilcoxon p = 0.549). A processor-only TEE surrogate benchmark estimates 1.96 ms (FP32) and 0.45 ms (INT8) inference latency at T = 120 with a 0.34 MB footprint and 707 µs ECDSA signing latency, leaving the INT8 inference latency more than an order of magnitude below the 33 ms per-frame budget. The dual-layer storage reduces gas costs by a factor of 23.4 (160,261 vs. 3,744,872 gas), corresponding to an illustrative mainnet cost of approximately 0.53 USD per submission at 1 gwei, rising to roughly 16 USD at a busier 30 gwei, and falling to approximately 0.005 USD on Arbitrum One (April 2026 reference parameters), so that continuous monitoring is economically practical on Layer-2. An adaptive-adversary analysis of the Watchtower shows that gross score tampering is detected at every usable operating threshold, whereas a rational adversary who inflates by less than the dispute threshold, or who shapes the injected score to fall just inside it, evades detection. Because the false-positive rate reaches zero only for δ≳0.15, the protocol bounds rather than eliminates patient-side fraud and motivates a zero-knowledge proof-of-inference successor. The framework is architecturally and economically feasible as a cryptographically verifiable, privacy-preserving tele-rehabilitation substrate aligned with General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) requirements through the Zero-Video Transmission principle, while remaining economically viable under post-Dencun mainnet and Layer-2 conditions. Recognition accuracy on real-world data and robustness to small-magnitude tampering remain limitations that the interchangeable recognition and audit components must improve before clinical deployment.
Abstract Bitcoin was the breakthrough innovation demonstrating peer-to-peer transfer of value without a central bank and has since expanded to countless innovations such as smart contract applications, decentralized finance protocols and asset tokenization. The EU is moving from scattered state-specific rules governing cryptocurrency activities to a coherent European regulatory regime. This paper review the transition to a harmonized framework in 2024-2025 from a doctrinal-institutional perspective, unpack how to carry out the three main legislative instruments: MiCA, TFR on information accompanying transfers of funds and transfers of certain crypto-assets and amending the EU directive and the EU AML package . Moreover, I look at the implications of DAC8 for the tax treatment of crypto-assets and tokenized assets. In 2025, the market begins institutionalizing, as MiCA requires significant compliance measures in terms of governance, transparency and conduct for CASPs to get licensed. Moreover, in conjunction with the new TFR rules, compliance for CASPs, at least in the business models discussed, effectively transforms into an operational infrastructure issue revolving around data quality, process efficiency and interoperability. By way of comparison, I analyze eight example business models in eight representative EU markets that appear to be impacted. These include: two major exchanges, two broker-dealers offering cryptocurrency on trading platform, a provider of non-custodial software wallets, two DeFi protocol participants and two NFT platform providers. These fall into three general categories depending on their legal status, direct regulatory burden and level of engagement with decentralized technologies. Finally, harmonized regulatory frameworks like the one outlined for the EU increase operational fixed costs and favor consolidation, reduce the benefits for regulatory arbitrage and thereby boost user protection, although part of innovation may pivot towards B2B solutions.
Abstract Smart contracts are the fundamental building block of decentralized applications (DApps) and decentralized finance (DeFi). However, their immutability makes security flaws exceptionally costly. Despite advancements in vulnerability detection, such as static and dynamic analysis, formal verification, and Solidity language improvements, vulnerabilities continue to result in substantial financial losses, exceeding $2 billion in 2024 alone. This paper presents a comprehensive analysis of smart contract vulnerabilities derived from real-world exploits, systematically categorized into seven distinct types. Each category is illustrated with Solidity code examples and insights from notable exploits. An Enhanced test suite is developed by restructuring the existing solidity-defects-and-bugs suite and supplementing it with new smart contract implementations to address underrepresented vulnerabilities, including flash loan and price oracle manipulation. We evaluate three widely used analysis tools (Slither, Mythril, and 4naly3er) on both the original and Enhanced suites, revealing substantial limitations in detection coverage. To address these limitations, we introduce the Solidity Defects and Bugs Analysis (SDABA), which incorporates advanced analyses and detectors to identify 28 vulnerability variations across both suites. Results on the SDB and Enhanced test suites show that SDABA improves overall precision, recall, and F1-score compared with the evaluated tools. Finally, we release the source code, test suite, and vulnerability reports to support future research in smart contract security.
Ethereum sebagai platform smart contract banyak digunakan untuk dApps, namun Ethereum (Layer 1) masih menghadapi kendala skalabilitas ketika aktivitas transaksi meningkat, yang berdampak pada kemacetan jaringan, naiknya latensi, dan biaya transaksi yang tinggi. Makalah ini menyajikan kajian literatur yang berfokus pada rollups sebagai solusi utama Ethereum Layer 2 untuk mengurangi beban pemrosesan transaksi pada Layer 1. Metode yang digunakan adalah literature review terarah dengan sintesis tematik terhadap literatur yang membahas: sumber masalah skalabilitas di Ethereum Layer 1, konsep dan arsitektur rollups, perbedaan Optimistic Rollups dan Zero-Knowledge Rollups, serta tantangan implementasi rollups pada kondisi nyata. Hasil kajian menunjukkan bahwa rollups menjadi pendekatan dominan karena menggabungkan transaksi dalam batch untuk diproses di Layer 2, lalu melaporkan ringkasan/bukti ke Layer 1 sehingga efisiensi biaya dan kapasitas transaksi meningkat. Namun, efektivitas rollups bergantung pada aspek operasional dan keamanan seperti ketersediaan data, mekanisme penarikan dana, serta risiko ketergantungan pada operator/penyedia infrastruktur. Secara keseluruhan, rollups efektif sebagai solusi skalabilitas Ethereum, tetapi memerlukan penguatan desain keamanan dan keandalan operasional agar dapat diadopsi lebih luas.
Ms. Sanskruti Pawaskar, Mr. Harsh Shinde, Mr. Ruturaj Laad, Vaishali Gatty
Decentralized finance has disrupted the lending process by transferring the intermediary role from institutionally-led balance sheets into a public ledger framework of smart contracts, pooled liquidity, and tokenized governance. The relevance of such a change in the lending paradigm is more of a question of different trust mechanisms, where the solvency of actors can be maintained through the imposition of collateral and automated processing [1][3]. A qualitative comparison is made below through a literature-constrained synthesis of five sources on DeFi architecture, flash loan exploits, lending protocol structure, decentralized governance flaws, and extractable value [1]-[5]. The two protocols of Aave and Compound have been selected for being representative DeFi lending cases, as per the allowed literature that points them out to be the top loanable funds protocols, having liquidity pools and variable rates [1][3]. This comparison is made against CeFi as an institution-driven reference point rather than other DeFi lending protocols owing to the asymmetry of the evidence base. Three conclusions are drawn.Second, the risk architecture of DeFi lending is structurally different from other financial institutions in that flash loans, dependence on oracle feeds, smart contract weakness, composable nature, extractable value, and governance capture are not mere flaws in DeFi but inherent aspects of open and highly coupled financial systems [2][4][5]. Third, governance in DeFi is an additional security mechanism, as the governance of protocol control, parameters and responses to emergencies rests on the robustness of token-based decision-making mechanisms [4].