This paper explores the critical role of Public Key Infrastructure (PKI) in ensuring the security of electronic transactions, particularly in validating the authenticity of websites in online environments. Traditional Centralised PKIs (CPKIs) relying on Certificate Authorities (CAs) face a significant drawback due to their susceptibility to a single point of failure. To address this concern, Decentralised PKIs (DPKIs) have emerged as an alternative. However, both centralised and decentralised approaches encounter specific challenges. Researchers have made several attempts using blockchain-based PKI, which implements a reward and punishment mechanism to enhance the security of traditional PKI. Most of the attempts are focused on CA-based PKI, which still suffers from the risk of a single point of failure. Inspired by ETHERST, which is a blockchain-based PKI that implements Web of Trust (WoT) with reward and punishment, we introduce ETHERST version 3.0, with improvements in its secure level algorithm that enhances trustworthiness measurement. Comparative simulations between ETHERST version 2.0 and ETHERST version 3.0 reveal the superior performance of the latter in trustworthiness measurement and ensure the higher security of a virtual community. The new simulation algorithm with different node type definitions and assumptions presents results through tables and graphs, showing that ETHERST version 3.0 outperforms ETHERST version 2.0. This research contributes to advancing the field by introducing an innovative PKI solution with enhanced trustworthiness and security features. • Comparison of blockchain-based PKIs which implement reward and punishment mechanism. • Reward and punishment with blockchain-based PKI with an improved new algorithm. • Definition of bad( B ), normal( N ) and good( G ) nodes to improve simulations algorithm.
Smart contracts are essential for managing digital assets in blockchain networks, highlighting the need for effective security measures. This paper introduces SmartLLMSentry, a novel framework that leverages large language models (LLMs), specifically ChatGPT with in-context training, to advance smart contract vulnerability detection. Traditional rule-based frameworks have limitations in integrating new detection rules efficiently. In contrast, SmartLLMSentry utilizes LLMs to streamline this process. We created a specialized dataset of five randomly selected vulnerabilities for model training and evaluation. Our results show an exact match accuracy of 91.1% with sufficient data, although GPT-4 demonstrated reduced performance compared to GPT-3 in rule generation. This study illustrates that SmartLLMSentry significantly enhances the speed and accuracy of vulnerability detection through LLM-driven rule integration, offering a new approach to improving Blockchain security and addressing previously underexplored vulnerabilities in smart contracts.
Zheng Che, Meng Shen, Zhehui Tan, Hanbiao Du · 9 authors
With the rapid evolution of Web3.0, cryptocurrency has become a cornerstone of decentralized finance. While these digital assets enable efficient and borderless financial transactions, their pseudonymous nature has also attracted malicious activities such as money laundering, fraud, and other financial crimes. Effective detection of malicious transactions is crucial to maintaining the security and integrity of the Web 3.0 ecosystem. Existing malicious transaction detection methods rely on large amounts of labeled data and suffer from low generalization. Label-efficient and generalizable malicious transaction detection remains a challenging task. In this paper, we propose ShadowEyes, a novel malicious transaction detection method. Specifically, we first propose a generalized graph structure named TxGraph as a representation of malicious transaction, which captures the interaction features of each malicious account and its neighbors. Then we carefully design a data augmentation method tailored to simulate the evolution of malicious transactions to generate positive pairs. To alleviate account label scarcity, we further design a graph contrastive mechanism, which enables ShadowEyes to learn discriminative features effectively from unlabeled data, thereby enhancing its detection capabilities in real-world scenarios. We conduct extensive experiments using public datasets to evaluate the performance of ShadowEyes. The results demonstrate that it outperforms state-of-the-art (SOTA) methods in four typical scenarios. Specifically, in the zero-shot learning scenario, it can achieve an F1 score of 76.98% for identifying gambling transactions, surpassing the SOTA method by12.05%. In the scenario of across-platform malicious transaction detection, ShadowEyes maintains an F1 score of around 90%, which is 10% higher than the SOTA method.
The web3 applications have recently been growing, especially on the Ethereum platform, starting to become the target of scammers. The web3 scams, imitating the services provided by legitimate platforms, mimic regular activity to deceive users. The current phishing account detection tools utilize graph learning or sampling algorithms to obtain graph features. However, large-scale transaction networks with temporal attributes conform to a power-law distribution, posing challenges in detecting web3 scams. In this paper, we present ScamSweeper, a novel framework to identify web3 scams on Ethereum. Furthermore, we collect a large-scale transaction dataset consisting of web3 scams, phishing, and normal accounts. Our experiments indicate that ScamSweeper exceeds the state-of-the-art in detecting web3 scams.
Abstract Smart contracts have significant losses due to various types of vulnerabilities. However, traditional vulnerability detection methods rely extensively on expert rules, resulting in low detection accuracy and poor adaptability to novel attacks. To address these problems, in this paper, deep learning methods are combined with smart contract vulnerability code detection approaches. Abstract syntax trees (ASTs), which are special isomorphic graph structures, are an important bridge between source code and graph neural networks. By learning the AST, the model can understand the semantics of the source code. Moreover, graph neural networks have an increasing ability to address complex heterogeneous graphs. Therefore, control flow graphs are fused with data flow graphs on the basis of the ASTs to build heterogeneous graphs with richer code semantics. Furthermore, multigranularity analysis of the vulnerability detection results is performed, including coarse-grained contract-level vulnerability detection and fine-grained line-level vulnerability detection. Through this multigranularity detection approach, vulnerabilities in contracts can be identified and analysed more comprehensively, providing a richer perspective and more solutions for vulnerability detection. The experimental results show that the proposed multigranularity vulnerability detection method based on heterogeneous graphs (MVD-HG) improves both the accuracy and range of the detected vulnerability types in contract-level vulnerability detection tasks; moreover, in the line-level vulnerability detection task, the MVD-HG model achieves significant results and addresses the shortcomings of existing methods. In addition, based on code generation methods used in related fields, a data enhancement method based on the source code is developed, which effectively expands the experimental dataset to address the reduced credibility of the results due to insufficient amounts of data.
Francesco Zola, Jon Elduayen, Igor Pallin, Raúl Orduna-Urrutia
Abstract Despite being backed by blockchain technology that promises security, immutability, and full transparency, some cryptocurrencies such as Bitcoin have been used as enablers for many licit and illicit activities such as money laundering, terrorism financing, and ransomware payments. In this scenario, the analysis of the transactions, as well as the entities that have generated them, became a crucial step for law enforcement officer (LEO) investigations. However, the (pseudo) anonymity of the network, the lack of regulatory authority, the employment of anonymizer mechanisms, the evolution of entities’ behavior, and the emergence of new dynamics are just five of the main elements that make this task challenging. At the same time, the huge amount of information to be analyzed can result in a waste of time and resources, slowing the investigations. For this reason, in this work, we present Kriptosare, a tool able to classify entity behaviors belonging to Bitcoin, Bitcoin Cash, and Litecoin. On the one hand, the tool makes use of state-of-the-art machine learning techniques to reduce anonymity in the considered cryptocurrencies. This model extracts behaviors from interactions and dynamics of different known entities involved in the transactions and then predicts the behaviors of new unseen entities. On the other hand, Kriptosare includes a crypto simulator able to create and control a private Bitcoin, Bitcoin Cash, or Litecoin network. This unit allows the simulation of crypto transactions in a controlled way for evaluating hypotheses and/or enriching the input data. The presented tool can be used by LEOs to search and highlight the most important red flag indicators that could suggest criminal behavior, and to support their analysis by optimizing their investigation resources.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Konrad Weiss, Christof Ferreira Torres, Florian Wendland
Ethereum smart contracts are executable programs deployed on a blockchain. Once deployed, they cannot be updated due to their inherent immutability. Moreover, they often manage valuable assets that are worth millions of dollars, making them attractive targets for attackers. The introduction of vulnerabilities in programs due to the reuse of vulnerable code posted on Q&A websites such as Stack Overflow is not a new issue. However, little effort has been made to analyze the extent of this issue on deployed smart contracts. In this paper, we conduct a study on the impact of vulnerable code reuse from Q&A websites during the development of smart contracts and provide tools uniquely fit to detect vulnerable code patterns in complete and incomplete Smart Contract code. This paper proposes a pattern-based vulnerability detection tool that is able to analyze code snippets (i.e., incomplete code) as well as full smart contracts based on the concept of code property graphs. We also propose a methodology that leverages fuzzy hashing to quickly detect code clones of vulnerable snippets among deployed smart contracts. Our results show that our vulnerability search, as well as our code clone detection, are comparable to state-of-the-art while being applicable to code snippets. Our large-scale study on 18,660 code snippets reveals that 4,596 of them are vulnerable, out of which 616 can be found in 7,852 deployed smart contracts. These results highlight that the reuse of vulnerable code snippets is indeed an issue in currently deployed smart contracts.
Ethereum faces growing fraud threats. Current fraud detection methods, whether employing graph neural networks or sequence models, fail to consider the semantic information and similarity patterns within transactions. Moreover, these approaches do not leverage the potential synergistic benefits of combining both types of models. To address these challenges, we propose TLMG4Eth that combines a transaction language model with graph-based methods to capture semantic, similarity, and structural features of transaction data in Ethereum. We first propose a transaction language model that converts numerical transaction data into meaningful transaction sentences, enabling the model to learn explicit transaction semantics. Then, we propose a transaction attribute similarity graph to learn transaction similarity information, enabling us to capture intuitive insights into transaction anomalies. Additionally, we construct an account interaction graph to capture the structural information of the account transaction network. We employ a deep multi-head attention network to fuse transaction semantic and similarity embeddings, and ultimately propose a joint training approach for the multi-head attention network and the account interaction graph to obtain the synergistic benefits of both.
In recent years, a more advanced form of phishing has arisen on Ethereum, surpassing early-stage, simple transaction phishing.This new form, which we refer to as payload-based transaction phishing (PTXPHISH), manipulates smart contract interactions through the execution of malicious payloads to deceive users.PTXPHISH has rapidly emerged as a significant threat, leading to incidents that caused losses exceeding $70 million in 2023 reports.Despite its substantial impact, no previous studies have systematically explored PTXPHISH.In this paper, we present the first comprehensive study of the PTXPHISH on Ethereum.Firstly, we conduct a long-term data collection and put considerable effort into establishing the first ground-truth PTXPHISH dataset, consisting of 5,000 phishing transactions.Based on the dataset, we dissect PTXPHISH, categorizing phishing tactics into four primary categories and eleven sub-categories.Secondly, we propose a rule-based multidimensional detection approach to identify PTXPHISH, achieving an F1-score of over 99% and processing each block in an average of 390 ms.Finally, we conduct a large-scale detection spanning 300 days and discover a total of 130,637 phishing transactions on Ethereum, resulting in losses exceeding $341.9 million.Our in-depth analysis of these phishing transactions yielded valuable and insightful findings.Scammers consume approximately 13.4 ETH daily, which accounts for 12.5% of the total Ethereum gas, to propagate address poisoning scams.Additionally, our analysis reveals patterns in the cash-out process employed by phishing scammers, and we find that the top five phishing organizations are responsible for 40.7% of all losses.Furthermore, our work has made significant contributions to mitigating real-world threats.We have reported 1,726 phishing addresses to the community, accounting for 42.7% of total community contributions during the same period.Additionally, we have sent 2,539 on-chain alert messages, assisting 1,980 victims.This research serves as a valuable reference in combating the emerging PTXPHISH and safeguarding users' assets.
Consumers and brands are at serious risk due to the growth of counterfeit goods, especially in regions like Nigeria. Conventional techniques, such border inspections and market raids by the Standards Organization of Nigeria (SON), are inadequate for detecting counterfeit goods. To ensure traceability, transparency, and immutability in the supply chain, this article suggests utilizing blockchain technology. The decentralized and encrypted characteristics of blockchain, when bolstered by smart contracts, enable efficient product tracking from producers to end users, hence impeding the infiltration of fake goods. Using a permissioned blockchain network, this system attempts to confirm the legitimacy of products at every point along the supply chain—manufacturers, distributors, retailers, and end users. The Remix IDE is used to deploy and test Ethereum-based smart contracts that were created in Solidity for the proposed system. This blockchain-based strategy aims to decrease the spread of counterfeit goods, protect consumer confidence, and preserve brand reputation. To offer a user-friendly interface for wider accessibility, future advancements will link this system with decentralized apps (DApps).
Kai Wang, Michael Wen Tong, Jun Pang, Jitao Wang · 5 authors
Recently, there is a surge in ransomware activities that encrypt users’ sensitive data and demand bitcoins for ransom payments to conceal the criminal’s identity. It is crucial for regulatory agencies to identify as many ransomware addresses as possible to accurately estimate the impact of these ransomware activities. However, existing methods for detecting ransomware addresses rely primarily on time-consuming data collection and clustering heuristics, and they face two major issues: (1) The features of an address itself are insufficient to accurately represent its activity characteristics, and (2) the number of disclosed ransomware addresses is extremely less than the number of unlabeled addresses. These issues lead to a significant number of ransomware addresses being undetected, resulting in a substantial underestimation of the impact of ransomware activities. To solve the above two issues, we propose an optimized ransomware address detection method based on Bitcoin transaction relationships, named XRAD , to detect more ransomware addresses with high performance. To address the first one, we present a cascade feature extraction method for Bitcoin transactions to aggregate features of related addresses after exploring transaction relationships. To address the second one, we build a classification model based on Positive-unlabeled learning to detect ransomware addresses with high performance. Extensive experiments demonstrate that XRAD significantly improves average accuracy, recall, and F1 score by 15.07%, 19.71%, and 34.83%, respectively, compared to state-of-the-art methods. In total, XRAD detects 120,335 ransomware activities from 2009 to 2023, revealing a development trend and average ransom payment per year that aligns with three reports by FinCEN, Chainalysis, and Coveware.
El-hacen Diallo, Rouwaida Abdallah, Mohammad Dib, Omar Dib
This paper introduces an innovative response to the pressing challenge of rapid and effective incident detection and management in urban settings. The proposed solution is a decentralized incident reporting system (IRS) harnessing blockchain technology and decentralized data storage systems. By empowering residents to report incidents, the proposed IRS enables seamless real-time monitoring and intervention by relevant departments. Built on a blockchain foundation, the proposed solution ensures immutability, transparency, security, and auditability, enhancing data resilience and comprehensive applicability. The proposed system leverages the InterPlanetary File System (IPFS) for the storage of incident proofs to manage the blockchain size effectively. Through the proposed IRS, transparency is upheld, enabling complete auditability of incident details and required interventions by citizens, societal bodies, and governmental bodies. Moreover, an incentive model is introduced to encourage active participation in incident reporting, thereby enhancing the system’s overall effectiveness and long-term sustainability. The proposed IRS integrates mobile technology to facilitate user engagement and data submission, essential for urban emergency management. Empirical validation using the Quorum–Raft blockchain demonstrates the feasibility of the proposed approach in terms of system throughput, incident reporting delay, blockchain size, and deployment cost. Specifically, the system maintains a latency of under 15 s even at high transaction rates, can handle up to 200 incidents per second, and is cost-effective, with deployment estimates for 16 organizations over five years being under 1.99 million USD. The method involves extensive testing with simulated incidents and user interactions to ensure robustness and scalability, showcasing the system’s potential for effective emergency management in urban environments.
Blockchain fuelled the innovation of numerous application fields. In particular, Web3 applications benefit the most because blockchain can be used to implement a rewarding system for users that contribute the most, thus increasing the overall social good provided by these platforms. One of the sectors that has benefited most from blockchain technology is the gaming sector through the so-called Play-to-Earn (P2E) model. The P2E Blockchain Video Games allow players to earn rewards in the form of tokens or NFTs, by having an impact on the social good. Unfortunately, bot accounts could exploit these platforms, which defeats the purpose of having a reward system because they invalidate the social good introduced by the rewards. In this paper, we provide an analysis geared towards detecting suspicious behaviour in P2E blockchain-based games by exploiting Gods Unchained as a case study. Using the game’s official APIs, we download 12 months’ worth of players’ activity. Analysing the data, we detect two groups of players with abnormal activity. Additionally, analysing the players’ graph, we find communities made of the best players with similar activity. Lastly, we observe that users with suspicious behaviour belong to these communities.
This paper explores the vulnerability of machine learning models, specifically Random Forest, Decision Tree, and K-Nearest Neighbors, to very simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics, such as accuracy, precision, recall, and F1-score. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness.
The rampant fraudulent activities on Ethereum hinder the healthy development of the blockchain ecosystem, necessitating the reinforcement of regulations. However, multiple imbalances involving account interaction frequencies and interaction types in the Ethereum transaction environment pose significant challenges to data mining-based fraud detection research. To address this, we first propose the concept of meta-interactions to refine interaction behaviors in Ethereum, and based on this, we present a dual self-supervision enhanced Ethereum fraud detection framework, named Meta-IFD. This framework initially introduces a generative self-supervision mechanism to augment the interaction features of accounts, followed by a contrastive self-supervision mechanism to differentiate various behavior patterns, and ultimately characterizes the behavioral representations of accounts and mines potential fraud risks through multi-view interaction feature learning. Extensive experiments on real Ethereum datasets demonstrate the effectiveness and superiority of our framework in detecting common Ethereum fraud behaviors such as Ponzi schemes and phishing scams. Additionally, the generative module can effectively alleviate the interaction distribution imbalance in Ethereum data, while the contrastive module significantly enhances the framework's ability to distinguish different behavior patterns. The source code will be available in https://github.com/GISec-Team/Meta-IFD.
Authentication is a crucial security service on the Internet. In real-world applications, multiple independent trust domains often exist, with each recognizing only certain identities within their own systems. During cross-domain access, users cannot directly use their original certificates, which presents a cross-domain authentication problem. Traditional centralized schemes typically employ a trusted third party (TTP) to facilitate the transfer of identity trust across domains. These schemes inevitably inherit the vulnerabilities associated with single points of failure. In contrast, blockchain-based decentralized schemes effectively eliminate the potential threats posed by TTPs. However, the openness and transparency of the blockchain also bring new security issues, such as privacy leakage. In this paper, we propose a zk-SNARK-based anonymous scheme on the blockchain for cross-domain authentication. Specifically, our scheme adopts an authorization-then-proof structure, which strikes a delicate balance between anonymity and revocability. We provide theoretical proofs for the security of our scheme and explain how it achieves proactive revocability. Experimental evaluation results demonstrated that our scheme is both secure and efficient, and the revocation could be accomplished by introducing only 64 bytes of on-chain storage with one hash comparison.
A. Bendada, Mouhamed Amine Bouchiha, Mourad Rabah, Yacine Ghamri-Doudane
Current blockchain-based reputation solutions for crowdsourcing fail to tackle the challenge of ensuring both efficiency and privacy without compromising the scalability of the block chain. Developing an effective, transparent, and privacy-preserving reputation model necessitates on-chain implementation using smart contracts. However, managing task evaluation and reputation updates alongside crowdsourcing transactions on-chain substantially strains system scalability and performance. This paper introduces RollupTheCrowd, a novel blockchain-powered crowdsourcing framework that leverages zkRollups to enhance system scalability while protecting user privacy. Our framework includes an effective and privacy-preserving reputation model that gauges workers' trustworthiness by assessing their crowdsourcing interactions. To alleviate the load on our blockchain, we employ an off-chain storage scheme, optimizing RollupTheCrowd's performance. Utilizing smart contracts and zero-knowledge proofs, our Rollup layer achieves a significant 20x reduction in gas consumption. To prove the feasibility of the proposed framework, we developed a proof-of-concept implementation using cutting-edge tools. The experimental results presented in this paper demonstrate the effectiveness and scalability of RollupTheCrowd, validating its potential for real-world application scenarios.
A giveaway scam is a type of fraud leveraging social media platforms and phishing campaigns. These scams have become increasingly common and are now also prevalent in the crypto community where attackers attempt to gain crypto-enthusiasts’ trust with the promise of high-yield giveaways. Giveaway scams target individuals who lack technical familiarity with the blockchain. They take on various forms, often presenting as genuine cryptocurrency giveaways endorsed by prominent figures or organizations within the blockchain community. Scammers entice victims by promising substantial returns on a nominal investment. Victims are manipulated into sending cryptocurrency under the pretext of paying for "verification" or "processing fees." However, once the funds have been sent, the scammers disappear and leave victims empty-handed. This study employs essential blockchain tools and techniques to explore the mechanics of giveaway scams. A crucial aspect of an investigation is to meticulously trace the movement of funds within the blockchain so that illicit gains resulting from these scams can be tracked. At some point a scammer wants to “cash-out” by transferring the funds to an off-ramp, for example, an exchange. If the investigator can establish a link to such an exchange, the identity of the owner of cryptocurrency address could be revealed. However, in organised scams, criminals make use of mules and do not use their own identities. The authors of this paper select a use case and then illustrate a comprehensive approach to investigate the selected scam. This paper contributes to the understanding and mitigation of giveaway scams in the cryptocurrency realm. By leveraging the mechanics of blockchain technology, dissecting scammer tactics, and utilizing investigative techniques and tools, the paper aims to contribute to the protection of investors, the industry, and the overall integrity of the blockchain ecosystem. This research sheds light on the intricate workings of giveaway scams and proposes effective strategies to counteract them.
The rapid advancement of blockchain technology has fueled the prosperity of the cryptocurrency market. Unfortunately, it has also facilitated certain criminal activities, particularly the increasing issue of phishing scams on blockchain platforms such as Ethereum. Consequently, developing an efficient phishing detection system is critical for ensuring the security and reliability of cryptocurrency transactions. However, existing methods have shortcomings in dealing with sample imbalance and effective feature extraction. To address these issues, this study proposes an Ethereum phishing scam detection method based on DA-HGNN (Data Augmentation Method and Hybrid Graph Neural Network Model), validated by real Ethereum datasets to prove its effectiveness. Initially, basic node features consisting of 11 attributes were designed. This study applied a sliding window sampling method based on node transactions for data augmentation. Since phishing nodes often initiate numerous transactions, the augmented samples tended to balance. Subsequently, the Temporal Features Extraction Module employed Conv1D (One-Dimensional Convolutional neural network) and GRU-MHA (GRU-Multi-Head Attention) models to uncover intrinsic relationships between features from the time sequences and to mine adequate local features, culminating in the extraction of temporal features. The GAE (Graph Autoencoder) concept was then leveraged, with SAGEConv (Graph SAGE Convolution) as the encoder. In the SAGEConv reconstruction module, by reconstructing the relationships between transaction graph nodes, the structural features of the nodes were learned, obtaining reconstructed node embedding representations. Ultimately, phishing fraud nodes were further identified by integrating temporal features, basic features, and embedding representations. A real Ethereum dataset was collected for evaluation, and the DA-HGNN model achieved an AUC-ROC (Area Under the Receiver Operating Characteristic Curve) of 0.994, a Recall of 0.995, and an F1-score of 0.994, outperforming existing methods and baseline models.
Lukas Ingmarsson, Karl Duckert Karlsson, Niklas Carlsson
Bitcoin and the Dark Web present an interesting synergy that enables both legitimate anonymity and illicit activities, making it an important landscape to understand, especially as the Dark Web, with its hidden services, relies heavily on Bitcoin as a pseudonymous currency for transactions. However, a lack of scalable tools and timely datasets has limited systematic analysis of this ecosystem. To address this gap, we introduce Venom, a scalable framework for mapping Bitcoin activity on the Dark Web. Venom integrates multithreaded crawling, data extraction, and dataset generation, resulting in a comprehensive resource that allows us to easily collect snapshots of over 177,000 onion sites in roughly 24 hours. With the paper, we share both the tool and an example snapshot containing both per-site metadata and Bitcoin transaction data. Preliminary analysis reveals concentrated activity among key players and widespread content mirroring, offering new insights into the Dark Web's economic structure. Venom provides a critical resource for advancing research and monitoring in this domain.
Chuyi Yan, Xueying Han, Yan Zhu, Dan Du · 6 authors
Abstract Despite the growing attention on blockchain, phishing activities have surged, particularly on newly established chains. Acknowledging the challenge of limited intelligence in the early stages of new chains, we propose ADA-Spear-an automatic phishing detection model utilizing a dversarial d omain a daptive learning which symbolizes the method’s ability to penetrate various heterogeneous blockchains for phishing detection. The model effectively identifies phishing behavior in new chains with limited reliable labels, addressing challenges such as significant distribution drift, low attribute overlap, and limited inter-chain connections. Our approach includes a subgraph construction strategy to align heterogeneous chains, a layered deep learning encoder capturing both temporal and spatial information, and integrated adversarial domain adaptive learning in end-to-end model training. Validation in Ethereum, Bitcoin, and EOSIO environments demonstrates ADA-Spear’s effectiveness, achieving an average F1 score of 77.41 on new chains after knowledge transfer, surpassing existing detection methods.
Amir M. Ebrahimi, Bram Adams, Gustavo A. Oliva, Ahmed E. Hassan
The proxy pattern is a well-known design pattern with numerous use cases in several sectors of the software industry. As such, the use of the proxy pattern is also a common approach in the development of complex decentralized applications (DApps) on the Ethereum blockchain. Despite the importance of proxy contracts, little is known about (i) how their prevalence changed over time, (ii) the ways in which developers integrate proxies in the design of DApps, and (iii) what proxy types are being most commonly leveraged by developers. This study bridges these gaps through a comprehensive analysis of Ethereum smart contracts, utilizing a dataset of 50 million contracts and 1.6 billion transactions as of September 2022. Our findings reveal that 14.2% of all deployed smart contracts are proxy contracts. We show that proxy contracts are being more actively used than non-proxy contracts. Also, the usage of proxy contracts in various contexts, transactions involving proxy contracts, and adoption of proxy contracts by users have shown an upward trend over time, peaking at the end of our study period. They are either deployed through off-chain scripts or on-chain factory contracts, with the former and latter being employed in 39.1% and 60.9% of identified usage contexts in turn. We found that while the majority (67.8%) of proxies act as an interceptor, 32.2% enables upgradeability. Proxy contracts are typically (79%) implemented based on known reference implementations with 29.4% being of type ERC-1167, a class of proxies that aims to cheaply reuse and clone contracts' functionality. Our evaluation shows that our proposed behavioral proxy detection method has a precision and recall of 100% in detecting active proxies. Finally, we derive a set of practical recommendations for developers and introduce open research questions to guide future research on the topic.
Ruichao Liang, Jing Chen, Cong Wu, Kun He · 9 authors
Ponzi schemes, a form of scam, have been discovered in Ethereum smart contracts in recent years, causing massive financial losses. Existing detection methods primarily focus on rule-based approaches and machine learning techniques that utilize static information as features. However, these methods have significant limitations. Rule-based approaches rely on pre-defined rules with limited capabilities and domain knowledge dependency. Using static information like opcodes for machine learning fails to effectively characterize Ponzi contracts, resulting in poor reliability and interpretability. Our research shows no significant difference between Ponzi and non-Ponzi contracts at the opcode level. Moreover, relying on static information like transactions for machine learning requires a certain number of transactions to achieve detection, which limits the scalability of detection and hinders the identification of 0-day Ponzi schemes. In this article, we propose PonziGuard , an efficient Ponzi scheme detection approach based on contract runtime behavior. Inspired by the observation that a contract’s runtime behavior is more effective in disguising Ponzi contracts from the innocent contracts, PonziGuard establishes a comprehensive graph representation called contract runtime behavior graph (CRBG), to accurately depict the behavior of Ponzi contracts. Furthermore, it formulates the detection process as a graph classification task on CRBG, enhancing its overall effectiveness. The experiment results show that PonziGuard surpasses the current state-of-the-art approaches in the ground-truth dataset, achieving a precision of 96.9%, recall of 98.2%, and F1-score of 97.5%. It also exhibits the highest level of interpretability among the current tools. We applied PonziGuard to Ethereum Mainnet and demonstrated its effectiveness in real-world scenarios. Using PonziGuard , we identified 805 Ponzi contracts on Ethereum Mainnet, which have resulted in an estimated economic loss of 281,700 Ether or approximately \($\) 500 million USD. We also found 0-day Ponzi schemes in the recently deployed 10,000 smart contracts.
Adnan Ramzan, Hina Amir, Muhammad Atif Ur Rehman, Muhammad Ikram Ashraf
The findings of our extensive review of the cryptocurrency literature from 2010 to 2022 are presented in this report. We cover the definitions, history, uses, and distinctive activities of the cryptocurrency business in our overview. We initially conducted a bibliometric analysis on articles acquired from the Scopus database using the VOSviewer bibliometric and R package tool in order to identify the two main streams of cryptocurrency literature. Then, we conducted content analyses on pertinent publications from reputable sources. We also found gaps in the literature and suggested seven research areas that should be addressed in follow-up studies to improve understanding of the cryptocurrency sector. Researchers researching at the numerous sides of cryptocurrencies to increase our understanding of this industry may find the findings of this paper to be a helpful resource.