In recent years, a large number of on-chain attacks have emerged in the blockchain empowered Web3 ecosystem. In the year of 2023 alone, on-chain attacks have caused losses of over 585 million. Attackers use blockchain transactions to carry out on-chain attacks, for example, exploiting vulnerabilities or business logic flaws in Web3 applications. A wealth of efforts have been devoted to detecting on-chain attack transactions through expert patterns and machine learning techniques. However, in this ever-evolving ecosystem, the performance of current methods is limited in detecting new on-chain attacks, due to the obsoleting of attack recognition patterns or the reliance on on-chain attack samples. In this paper, we propose a universal approach for detecting on-chain attacks even when there are few or even no new on-chain attack samples. Specifically, an in-depth analysis of the transaction characteristics is conducted, and we propose a new insight to train a generic attack transaction detecting model, i.e., transaction reconstruction. Particularly, to overcome the over-fitting in the transaction reconstruction task, we use the web-scale function comments related to transactions as supervision information, rather than expert-confirmed labels. Experimental results demonstrate that the proposed approach surpasses the supervised state-of-the-art by 13% in AUC, with just 30 known on-chain attack samples. Moreover, without any known attack samples, our method can still detect new on-chain attacks in the wild (with a precision of 61.83%). Among attacks detected in the wild, we confirm 1,692 address poisoning attacks, a new type of on-chain attack targeting token holders. Our code is available at: https://github.com/wuzhy1ng/attack_trans_detection_www25.
With the booming development of blockchain technology, smart contracts have been widely used in finance, supply chain, Internet of things and other fields in recent years. However, the security problems of smart contracts become increasingly prominent. Security events caused by smart contracts occur frequently, and the existence of malicious codes may lead to the loss of user assets and system crash. In this paper, a simple study is carried out on malicious code detection of intelligent contracts based on machine learning. The main research work and achievements are as follows: Feature extraction and vectorization of smart contract are the first step to detect malicious code of smart contract by using machine learning method, and feature processing has an important impact on detection results. In this paper, an opcode vectorization method based on smart contract text is adopted. Based on considering the structural characteristics of contract opcodes, the opcodes are classified and simplified. Then, N-Gram (N=2) algorithm and TF-IDF algorithm are used to convert the simplified opcodes into vectors, and then put into the machine learning model for training. In contrast, N-Gram algorithm and TF-IDF algorithm are directly used to quantify opcodes and put into the machine learning model training. Judging which feature extraction method is better according to the training results. Finally, the classifier chain is applied to the intelligent contract malicious code detection.
As Ethereum continues to thrive, the Ethereum Virtual Machine (EVM) has become the cornerstone powering tens of millions of active smart contracts. Intuitively, security issues in EVMs could lead to inconsistent behaviors among smart contracts or even denial-of-service of the entire blockchain network. However, to the best of our knowledge, only a limited number of studies focus on the security of EVMs. Moreover, they suffer from 1) insufficient test input diversity and invalid semantics; and 2) the inability to automatically identify bugs and locate root causes. To bridge this gap, we propose O p D iffer , a differential testing framework for EVM, which takes advantage of LLMs and static analysis methods to address the above two limitations. We conducted the largest-scale evaluation, covering nine EVMs and uncovering 26 previously unknown bugs, 22 of which have been confirmed by developers and three have been assigned CNVD IDs. Compared to state-of-the-art baselines, O p D iffer can improve code coverage by at most 71.06%, 148.40% and 655.56%, respectively. Through an analysis of real-world deployed Ethereum contracts, we estimate that 7.21% of the contracts could trigger our identified EVM bugs under certain environmental settings, potentially resulting in severe negative impact on the Ethereum ecosystem.
Serving as the first touch point for users to the cryptocurrency world, cryptocurrency wallets allow users to manage, receive, and transmit digital assets on blockchain networks and interact with emerging decentralized finance (DeFi) applications. Unfortunately, cryptocurrency wallets have always been the prime targets for attackers, and incidents of wallet breaches have been reported from time to time. Although some recent studies have characterized the vulnerabilities and scams related to wallets, they have generally been characterized in coarse granularity, overlooking potential risks inherent in detailed designs of cryptocurrency wallets, especially from perspectives including user interaction and advanced features. To fill the void, in this paper, we present a fine-grained security analysis on browser-based cryptocurrency wallets. To pinpoint security issues of components in wallets, we design WalletProbe, a mutation-based testing framework based on visual-level oracles. We have identified 13 attack vectors that can be abused by attackers to exploit cryptocurrency wallets and exposed 21 concrete attack strategies. By applying WalletProbe on 39 widely-adopted browser-based wallet extensions, we astonishingly figure out all of them can be abused to steal crypto assets from innocent users. Identified potential attack vectors were reported to wallet developers timely and 26 issues have been patched already. It is, hence, urgent for our community to take action to mitigate threats related to cryptocurrency wallets. We promise to release all code and data to promote the development of the community.
Alexander Plotkin, E. Kuznetsov, K. Starodubov, Yuri Gromov
The paper considers the solution of the problem of ensuring the resistance of key infrastructure in distributed registry systems to some destructive influences with the help of multi-factor authentication. Potentially possible destructive influences depending on defects in authentication systems, in particular on network nodes, are presented. Possible methods of providing resistance against such destructive influences are analyzed.
As a novel decentralized computing paradigm, blockchain is expected to disrupt the existing e-commerce architecture and process. Secure smart contracts are the crucial foundation for e-commerce based on blockchain. However, vulnerabilities in smart contracts occur from time to time and cause significant financial losses in e-commerce. Some static verification methods have been developed to guarantee security for e-commerce smart contracts at design time, but they cannot support complex scenarios at runtime. As a lightweight verification method, runtime verification is a potential method for secure e-commerce smart contracts. The existing runtime verification methods are based on the manual instrument, which leads to additional overheads and gas consumption. To deal with this, we propose a passive learning-based runtime verification framework for e-commerce smart contracts. Firstly, by exploring the Genetic algorithm to evolve state merging and automaton reorganizing in order to simultaneously split time and gas behaviors, we propose a passive learning method to model runtime information for e-commerce smart contracts (PL4ESC). It directly learns P2TA (priced probabilistic timed automaton) from runtime traces without any prior knowledge. Then, we integrate PL4ESC with the open-source PAT (Process Analysis Toolkit) to automatically verify the security of runtime e-commerce smart contracts. The experiments show that PL4ESC is better at accuracy and precision than state-of-the-art passive learning methods. It improves accuracy by 1 to 4 percent compared to TAG and RTI+. As far as we know, it is not only the first learning method that can learn a P2TA from traces, but it is also the first automated runtime verification framework for e-commerce smart contracts. This will provide security guarantees for blockchain-based e-commerce.
As the development of Solidity contracts on Ethereum , more developers are reusing them on other compatible blockchains. However, developers may overlook the differences between the designs of the blockchain system, such as the Gas Mechanism and Consensus Protocol , leading to the same contracts on different blockchains not being able to achieve consistent execution as on Ethereum . This inconsistency reveals design flaws in reused contracts, exposing code smells that hinder code reusability, and we define this inconsistency as EVM-Inequivalent Code Smells . In this paper, we conducted the first empirical study to reveal the causes and characteristics of EVM-Inequivalent Code Smells . To ensure the identified smells reflect real developer concerns, we collected and analyzed 1,379 security audit reports and 326 Stack Overflow posts related to reused contracts on EVM-compatible blockchains, such as Binance Smart Chain (BSC) and Polygon . Using the open card sorting method, we defined six types of EVM-Inequivalent Code Smells . For automated detection, we developed a tool named EquivGuard . It employs static taint analysis to identify key paths from different patterns and uses symbolic execution to verify path reachability. Our analysis of 905,948 contracts across six major blockchains shows that EVM-Inequivalent Code Smells are widespread, with an average prevalence of 17.70%. While contracts with code smells do not necessarily lead to financial loss and attacks, their high prevalence and significant asset management underscore the potential threats of reusing these smelly Ethereum contracts. Thus, developers are advised to abandon Copy-and-Paste programming practices and detect EVM-Inequivalent Code Smells before reusing Ethereum contracts.
Decentralized applications (DApps) face significant security risks due to vulnerabilities in smart contracts, with traditional detection methods struggling to address emerging and machine-unauditable flaws. This paper proposes a novel approach leveraging fine-tuned Large Language Models (LLMs) to enhance smart contract vulnerability detection. We introduce a comprehensive dataset of 215 real-world DApp projects (4,998 contracts), including hard-to-detect logical errors like token price manipulation, addressing the limitations of existing simplified benchmarks. By fine-tuning LLMs (Llama3-8B and Qwen2-7B) with Full-Parameter Fine-Tuning (FFT) and Low-Rank Adaptation (LoRA), our method achieves superior performance, attaining an F1-score of 0.83 with FFT and data augmentation via Random Over Sampling (ROS). Comparative experiments demonstrate significant improvements over prompt-based LLMs and state-of-the-art tools. Notably, the approach excels in detecting non-machine-auditable vulnerabilities, achieving 0.97 precision and 0.68 recall for price manipulation flaws. The results underscore the effectiveness of domain-specific LLM fine-tuning and data augmentation in addressing real-world DApp security challenges, offering a robust solution for blockchain ecosystem protection.
Smart contracts deployed on blockchain platforms are vulnerable to various security vulnerabilities. However, only a small number of Ethereum contracts have released their source code, so vulnerability detection at the bytecode level is crucial. This paper introduces SmartBugBert, a novel approach that combines BERT-based deep learning with control flow graph (CFG) analysis to detect vulnerabilities directly from bytecode. Our method first decompiles smart contract bytecode into optimized opcode sequences, extracts semantic features using TF-IDF, constructs control flow graphs to capture execution logic, and isolates vulnerable CFG fragments for targeted analysis. By integrating both semantic and structural information through a fine-tuned BERT model and LightGBM classifier, our approach effectively identifies four critical vulnerability types: transaction-ordering, access control, self-destruct, and timestamp dependency vulnerabilities. Experimental evaluation on 6,157 Ethereum smart contracts demonstrates that SmartBugBert achieves 90.62% precision, 91.76% recall, and 91.19% F1-score, significantly outperforming existing detection methods. Ablation studies confirm that the combination of semantic features with CFG information substantially enhances detection performance. Furthermore, our approach maintains efficient detection speed (0.14 seconds per contract), making it practical for large-scale vulnerability assessment.
ABSTRACT Ensuring the security and privacy of sensitive health data in Internet of Things (IoT)‐based healthcare systems (HCS) is a critical challenge. This paper proposes a robust security framework by integrating blockchain mechanisms and deep learning (DL) approaches to enhance security and data privacy. The proposed framework leverages the Ethereum blockchain with zero knowledge proof (ZKP) to ensure data integrity and confidentiality, while the interplanetary file system (IPFS) provides secure and efficient data storage. Additionally, a novel At‐GAN‐BiLSTM model is introduced for intrusion detection by combining the attention mechanism, generative adversarial networks (GAN) and bidirectional long short‐term memory (Bi‐LSTM) to improve detection accuracy and also help to enhance model robustness. The proposed model is evaluated by two different benchmark datasets, namely CICIDS‐2018 (D1) and ToN‐IoT (D2), achieving accuracies of 99.9% and 99.1%, respectively. Comparative investigation shows that the proposed approach reduces false alarm rates (FAR) and performs better than current models in identifying impersonation, insider, and man‐in‐the‐middle (MITM) attacks. By integrating blockchain and DL, the proposed framework significantly enhances intrusion detection, data security, and overall system resilience, addressing key vulnerabilities in IoT‐based healthcare security.
Smart contracts are fundamental pillars of the blockchain, playing a crucial role in facilitating various business transactions. However, these smart contracts are vulnerable to exploitable bugs that can lead to substantial monetary losses. A recent study reveals that over 80% of these exploitable bugs, which are primarily functional bugs, can evade the detection of current tools. Automatically identifying functional bugs in smart contracts presents challenges from multiple perspectives. The primary issue is the significant gap between understanding the high-level logic of the business model and checking the low-level implementations in smart contracts. Furthermore, identifying deeply rooted functional bugs in smart contracts requires the automated generation of effective detection oracles based on various bug features.To address these challenges, we design and implement PromFuzz, an automated and scalable system to detect functional bugs in smart contracts. In PromFuzz, we first propose a novel Large Language Model (LLM)-driven analysis framework, which leverages a dual-agent prompt engineering strategy to pinpoint potentially vulnerable functions for further scrutiny. We then implement a dual-stage coupling approach, which focuses on generating invariant checkers that leverage logic information extracted from potentially vulnerable functions. Finally, we design a bug-oriented fuzzing engine, which maps the logical information from the high-level business model to the low-level smart contract implementations, and performs the bug-oriented fuzzing on targeted functions. We evaluate PromFuzz from 4 perspectives on 5 ground-truth datasets and compare it with multiple state-of-the-art methods. The results show that PromFuzz achieves 86.96% recall and 93.02% F1-score in detecting functional bugs, marking at least a 50% improvement in both metrics over state-of-the-art methods. Moreover, we perform an in-depth analysis on 10 real-world DeFi projects and detect 30 zero-day bugs. Our further case studies, the risky first deposit bug and the AMM price oracle manipulation bug on real-world DeFi projects, demonstrate the serious risks of the exploitable functional bugs in smart contracts. Up to now, 24 zero-day bugs have been assigned CVE IDs. Our discoveries have safeguarded assets totaling $18.2 billion from potential monetary losses.
Junhao Wu, Yixin Yang, Chengxiang Jin, Silu Mu · 8 authors
With the widespread adoption of Ethereum, financial frauds such as Ponzi schemes have become increasingly rampant in the blockchain ecosystem, posing significant threats to the security of account assets. Existing Ethereum fraud detection methods typically model account transactions as graphs, but this approach primarily focuses on binary transactional relationships between accounts, failing to adequately capture the complex multi-party interaction patterns inherent in Ethereum. To address this, we propose a hypergraph modeling method for the Ponzi scheme detection method in Ethereum, called HyperDet. Specifically, we treat transaction hashes as hyperedges that connect all the relevant accounts involved in a transaction. Additionally, we design a two-step hypergraph sampling strategy to significantly reduce computational complexity. Furthermore, we introduce a dual-channel detection module, including the hypergraph detection channel and the hyper-homo graph detection channel, to be compatible with existing detection methods. Experimental results show that, compared to traditional homogeneous graph-based methods, the hyper-homo graph detection channel achieves significant performance improvements, demonstrating the superiority of hypergraph in Ponzi scheme detection. This research offers innovations for modeling complex relationships in blockchain data.
Ahmed Mohamed Abdallah, Heba K. Aslan, Mohamed S. Abdallah, Young Im Cho · 5 authors
In recent years, the rapid growth of cryptocurrency markets has highlighted the urgent need for advanced security solutions capable of addressing a spectrum of unique threats, from phishing and wallet hacks to complex blockchain vulnerabilities. This paper presents a comprehensive approach to fortifying cryptocurrency systems by harnessing the structural symmetry inherent in transactional patterns. By leveraging local large language models (LLMs), embeddings, and vector databases, we develop an intelligent and scalable security expert system that exploits symmetry-based anomaly detection to enhance threat identification. Cryptocurrency networks face increasing threats from sophisticated attacks that often exploit asymmetric vulnerabilities. To counteract these risks, we propose a novel security expert system that integrates symmetry-aware analysis through LLMs and advanced embedding techniques. Our system efficiently captures symmetrical transaction patterns, enabling robust detection of anomalies and threats while preserving structural integrity. By integrating a modular framework with LangChain and a vector database (Chroma DB), we achieve improved accuracy, recall, and precision by leveraging the symmetry of transaction distributions and behavioral patterns. This work sets a new benchmark for LLM-driven cybersecurity solutions, offering a scalable and adaptive approach to reinforcing the security symmetry in cryptocurrency systems. The proposed expert system was evaluated using a benchmark dataset of cryptocurrency transactions, including real-world threat scenarios involving phishing, fraudulent transactions, and blockchain anomalies. The system achieved an accuracy of 92%, a precision of 89%, and a recall of 93%, demonstrating a 10% improvement over existing security frameworks. Compared to traditional rule-based and machine learning-based detection methods, our approach significantly enhances real-time threat detection while reducing false positives. The integration of LLMs with embeddings and vector retrieval enables more efficient contextual anomaly detection, setting a new benchmark for AI-driven security solutions in the cryptocurrency domain.
Kyounggon Kim, Seok‐Hee Lee, Sundaresan Ramachandran, Ibrahim Alzahrani
Cybercriminals are employing sophisticated techniques to illegally obtain money from victims, with ransomware, that is the most notorious malware utilized for financial gain. This paper focuses on the Arab world, a prime target region for ransomware gangs. Due to rapid economic growth and digitalization in this region, cybercriminals are increasingly targeting it. However, there is a lack of research on ransomware crime syndication in the Arab region. Data on claimed ransomware victims from 2020 to 2023 was collected from the darknet. Analysis of ransomware gangs in this area revealed significant findings. Based on three years of data collection and analysis, 20 ransomware gangs primarily operating in the Arab region were identified in 2023. Three major ransomware gangs-LockBit, ALPHV/BlackCat, and CL0P-are predominantly targeting the Arab world, with the United Arab Emirates and Saudi Arabia being major targets, along with the manufacturing industry. In addition to identifying the ransomware gangs, the tactics, techniques, and procedures (TTP) used by them were also identified. There was 17 TTPs used by ransomware gangs. This study has also developed a platform to track ransomware gangs and cryptocurrency transactions. Bitcoin’s anonymity and popularity made it the most preferred cryptocurrency by ransomware gangs. This research lays the groundwork for further studies to understand the exact trends and data related to ransomware in the Arab world.
• Agent-based modeling can be used to study the sociotechnical dynamics associated with technology implementation. • Ethereum’s ERC-721protocol can be leveraged to facilitate reducing the prevalence of counterfeit electronic parts. • Widespread adoption of blockchain is required to reduce the flow of counterfeit electronic parts. • Adoption is sensitive to the direct and indirect cost associated with blockchain implementation. • Integerating blockchain with business practice verification can reduces its cost, leading to an increase in adoption. Safety-critical, mission-critical, and infrastructure-critical systems (e.g., aerospace, transportation, defense, and power generation) are forced to source parts over exceptionally long periods of time from a supply chain that they do not control. Such systems are exposed to the dual risks of the impacts of system failure and the exposure to an unauthorized electronics marketplace over decades. Therefore, critical systems operators, manufacturers, and sustainers, must implement policies and technologies to reduce the risk of obtaining counterfeit parts. Blockchain technology, as a distributed ledger platform, has shown promise for resolving the issues associated with a lack of trust, transparency in peer-to-peer transactional networks, and compromised supply chains. There are opportunities to apply blockchain for supply chain concepts to mitigate the risks associated with part authenticity in the electronic part supply chain. This paper introduces a supply-chain blockchain framework resilient to aging (e.g., the loss of involvement of the original component manufacture and its authorized distributors, and loss of part transaction history). An agent-based model is introduced as a novel platform to test the impact of the proposed blockchain framework on supply-chain parties as well as the prevalence of counterfeits in the electronics supply chain. The model can validate the proposed protocol over the entire life cycle of a part (i.e., from active production to discontinuance and beyond) and predict the parties’ adoption rates, and changes in the prevalence of counterfeit parts. Application of the model to a public participation blockchain based on Ethereum ERC- 721 protocols indicates that the participation level of independent distributors directly affects the efficacy of blockchain in the prevention of transactions containing counterfeit parts. A proposed certification-based blockchain participation approach can be effective if certifications require large enough test accuracy limits and high previous owner certification thresholds.
Detecting fraudulent activities such as Ponzi schemes within smart contract transactions is a critical challenge in decentralized finance. Existing methods often fail to capture the heterogeneous, multi-faceted nature of blockchain data, and many graph-based models overlook the contextual patterns that are vital for effective anomaly detection. In this paper, we propose MVCG-SPS, a Multi-View Contrastive Graph Neural Network designed to address these limitations. Our approach incorporates three key innovations: (1) Meta-Path-Based View Construction, which constructs multiple views of the data using meta-paths to capture different semantic relationships; (2) Reinforcement-Learning-Driven Multi-View Aggregation, which adaptively combines features from multiple views by optimizing aggregation weights through reinforcement learning; and (3) Multi-Scale Contrastive Learning, which aligns embeddings both within and across views to enhance representation robustness and improve anomaly detection performance. By leveraging a multi-view strategy, MVCG-SPS effectively integrates diverse perspectives to detect complex fraudulent behaviors in blockchain ecosystems. Extensive experiments on real-world Ethereum datasets demonstrated that MVCG-SPS consistently outperformed state-of-the-art baselines across multiple metrics, including F1 Score, AUPRC, and Rec@K. Our work provides a new direction for multi-view graph-based anomaly detection and offers valuable insights for improving security in decentralized financial systems.
In recent years, the proliferation of malware has reached unprecedented levels, leading to escalating cybercrime costs. Signatures extracted by static analysis of files have been widely adopted for malware detection: vendors maintain databases of known malware signatures that are shared with registered users. The recent literature has proposed the use of private and consortium (thus, permissioned) blockchains for spreading signatures among blockchain users. These approaches require controlled access to enhance trust and accountability but restrict the widespread sharing of up-to-date signatures because users must be registered. In this paper, we present a novel technique that leverages a public blockchain to enable the massive dissemination of malware signatures among any users since a public blockchain is permissionless. On the other hand, the use of a public blockchain introduces new challenges related to security and data privacy, which our solution solves. The main benefit and outcome of our solution is that any users can securely access and verify malware signatures facilitating real-time detection of malicious files. We implemented our solution in Ethereum and exploited a smart contract written in Solidity to demonstrate that our approach is highly cost-effective.
Oshoke Samson Igonor, Muhammad Bilal Amin, Saurabh K. Garg†
Blockchain technology has risen in recent years from its initial application in finance to gain prominence across diverse sectors, including digital forensics. The possible application of blockchain technology to digital forensics is now becoming increasingly explored with many researchers now looking into the unique inherent properties that blockchain possesses to address the inherent challenges in this sector such as evidence tampering, the lack of transparency, and inadmissibility in court. Despite the increasing interest in integrating blockchain technology into the field of digital forensics and its domains, no systematic literature review currently exists to provide a holistic perspective on this integration. It is a challenge to find a comprehensive resource that examines how blockchain is being applied to enhance the digital forensics process. This paper provides a systematic literature review to explore the application of blockchain technology in digital forensics, focusing on its potential to address these challenges and enhance forensic methodologies. Through a rigorous review process, this paper examines selected studies to identify diverse frameworks, methodologies, and blockchain-driven enhancements applied to digital forensic investigations. The discussion highlights how blockchain properties such as immutability, transparency, and automation have been leveraged to improve evidence management and forensic workflows. Furthermore, this paper explores the common applications of blockchain-based forensic solutions across various domains and phases while addressing the associated limitations and challenges. Open issues and future research directions, including unexplored domains and operational gaps, are also discussed. This study provides valuable insights for researchers, investigators, and policymakers by offering a comprehensive overview of the state of the art in blockchain-based digital forensics, summarizing key contributions and limitations, and identifying pathways for advancing the field.
Independent Researcher, San Francisco, CA, USA, Sahaj Tushar Gandhi
Smart contracts, which allow for decentralized, automated transactions on blockchains, have been the source of repeated financial loss from hacking and coding flaws. This article introduces an AI-based deep learning approach to automated detection of vulnerabilities in smart contracts on Ethereum. The architecture integrates code- token embeddings (CodeBERT-style), control- and data-flow graph representations, and a hierarchical graph neural network (HGNN) with attention-based multimodal fusion to allow for comprehensive understanding of human-written programs. We train on labelled datasets from real-world contracts, utilising data augmentation and addressing class imbalance (focal loss + over sampling). For the experimental study, we compare the performance of our framework with existing solely-static and sequence-based transformers approaches apart from other GNN models on public datasets; ScrawlD, SmartBugs and manually curated Github-derived samples. Results The fused HGNN model performs with an average F1-score of 0.91, precision of 0.89, recall of 0.93 and AUC of 0.95 better than transformer- only (F1 = 0.86) and static-tool baselines (F1 = 0.71). The method shows strong generality to a wide range of vulnerability forms (reentrancy, integer overflow, unchecked calls, access control bugs) and enhances the precision for function-level localization. We further develop an interpretation module to map attention weights back to AST/CFG regions for human auditors. The paper also addresses limitations on dataset bias, obfuscation-resilience and adversarial examples and provides ideas for further investigation such as few-shot adaptation with one-class VAEs, integration with continuous deployment pipelines. The contributions: a multimodal deep-learning model for vulnerability detection and localization, an empirical study on state-of-the-art performance in multiple benchmark projects with large amounts of code; and advice how to deploy the AI-assisted contract auditing in development workflows.
Owing to the swift advancement of technology and the unfamiliarity of the execution environment, the development of Solidity smart contracts from scratch often results in significant vulnerabilities.In contrast, automated code generation enhances productivity, minimizes development time, and enables developers to focus on high-level tasks and fundamental logic.In consideration of these two viewpoints, this paper examines the utilization of large language models (LLMs) for the automatic generation of Solidity smart contracts based on specified criteria, while simultaneously ensuring the elimination of vulnerabilities through a novel masking strategy.To achieve this, we propose SolGen, a framework for generating secure Solidity smart contract code using LLMs.We assess the performance of existing LLMs (i.e.ChatGPT and Meta AI) for secure Solidity code generation.Our research indicates that ChatGPT outperforms Meta AI in performance, yielding a greater percentage of syntactically accurate and secure code.Additionally, we examine the impact of temperature adjustment on the security of generated contracts using an open-source LLM, Llama3.Our findings suggest that a temperature setting of 0.7 is optimal for the generation of Solidity code, considerably exceeding the performance of both lower and higher settings (0.1 and 1.2), especially with regard to the compilability of the code.
The popularity of smart contracts has cemented their place in the Blockchain Ecosystem.This is because of the immense number of use cases smart contracts provide.They have become the go-to solution for improving transparency and security for all parties involved in the transaction.Furthermore, a smart contract is immutable after it is deployed.Thus optimization of the smart contract is very important before deployment.Sol-Repairer is a tool that provides the implementation for identifying dead code segments from solidity-written smart contracts and then repairing them.Extensive experiments show that Sol-Repairer optimizes dead code better than the solidity compiler.The study also demonstrates that optimizing dead code reduces gas consumption significantly for smart contracts. CCS Concepts• Software and its engineering → Software testing and debugging.
Abstract Applying Distributed Ledger Technologies to securely manage intercommunicated data between IoT applications has recently been adopted on an enormous scale. They enable data integrity, privacy, and robustness to public, open, permission-less P2P networks. Voting-based consensus algorithms proved high efficiency even with limited computing and less power IoT devices. Moreover, they can identify legitimate information and isolate malicious attackers through repetitive voting queries to adjacent peers asking their opinions about the validity of each transaction. Several lightweight validation models are introduced to enrich IoT networks with better performance and higher security. Nevertheless, the current algorithms struggle to find adequate parameters that balance network security and operability, in addition to balancing fairness in distributed environments. This paper introduces an Autonomous Lightweight Ledger Constructor to resolve common defects and threats. Based on Reinforcement Learning, it can dynamically construct a valid distributed ledger in limited-computing systems under several adversarial conditions. The validity of transactions in this approach is calculated based on their cumulative weights and the issuer’s reputation, which are inferred subjectively by a lightweight Bayesian-like function. A new simulator is developed to evaluate ALLC performance and security. The experimental results demonstrate reasonable performance and high resistance against known compromises targeting Distributed Ledger Technologies.
In smart contract fuzz testing, it is crucial to consider the inter-dependencies between the contract functions. To effectively test the business logic of a contract, its functions must be invoked in a meaningful order. In this paper, we propose techniques that utilize static analysis on Ethereum bytecode to tackle this challenge. When compared with the current state-of-the-art, our approach takes Solidity compiler’s variable packing optimization into account and allows more precise analysis of the data-flows between functions. In addition, we devise a novel test case initialization algorithm for fuzz testing, which minimizes the redundancy in the generated seed set. Our algorithm reduces test cases that share similar function call patterns and leads to more effective testing of the contract code during the fuzz testing. Experimental results show that the proposed techniques improve the effectiveness of smart contract fuzz testing for vulnerability detection. Specifically, our techniques enabled the fuzz testing tool to trigger the target bugs in the benchmark 3.0 times faster on average.
We present the design and implementation of a fourth-year undergraduate computer science elective course on cryptocurrency. The course introduces the basics of cryptocurrencies and blockchains using Bitcoin. Programming distributed applications for blockchains is explored using Ethereum via the Solidity programming language. Advanced theoretical concepts are discussed, using different cryptocurrencies to demonstrate how they are implemented in practice. Cryptocurrency applications are presented, along with a responsible examination of present-day cryptocurrency scams. The assignments build upon each other, with the students implementing a web-based blockchain application by the end of the semester. The course was well received, and student feedback was positive. All of the course materials are available online under public copyright licenses.