Pietro Tiberi, Gabriele Marcelli, Vitangelo Lasorella
Central Bank Digital Currency (CBDC) interbank settlement systems operating on Distributed Ledger Technology (DLT) face a fundamental trade-off: blockchain transparency enables trustless verification but exposes commercially sensitive bilateral transaction flows to all network participants. We propose a confidential interbank settlement protocol for permissioned Ethereum-compatible networks that resolves this tension through a relaxed sender anonymity model tailored to regulatory AML/CFT requirements. In this model, the initiating institution remains publicly identifiable on-chain for accountability and compliance, while the receiving institution, transfer amount, and business payload are cryptographically obfuscated. We realize the protocol on Hyperledger Besu using QBFT consensus, combining Groth16 zero-knowledge proofs over BN254, Poseidon hash commitments in an incremental Merkle tree, multi-recipient ECIES payload encryption, and an on-chain NoteRegistry contract that stores encrypted notes as an append-only ledger log, eliminating trusted off-chain custody servers. The protocol supports shield, confidential transfer, and unshield state transitions. Experimental evaluation across a five-node network (three commercial banks, a central bank operator, and a securities depository) demonstrates end-to-end settlement in 8-16 s, proof verification overhead of about 1 ms (around 220k gas) via EVM precompiles, and client proof generation in 4-12 s on commodity ARM hardware. While receiver confidentiality is established at the protocol level, the current proof-of-concept NoteRegistry uses owner-indexed events, a trade-off addressable in production via uniform event broadcasting.
Smart contracts are financial programs deployed on blockchains to manage digital assets. To build trust with users and investors, smart contract projects typically publish their source code on blockchain explorers and verify it against the deployed bytecode, making the on-chain program accessible through a human-readable implementation. However, LLM agents are changing the threat model of this disclosure mechanism. By leveraging publicly disclosed source code, recent agent workflows make it increasingly practical to scan contract vulnerabilities for exploits at large scale. In this paper, we propose DeLLMGuard, a smart contract deployment framework that defends against malicious LLM-based vulnerability scanning while preserving public source disclosure and authorized auditing. DeLLMGuard can separate disclosed source code from runtime execution through multiple contract addresses in a real-world blockchain environment. LLM agents must therefore recover additional proxy, delegate, and factory relations before vulnerability analysis. A built-in Verification Layer checks deployment relations, runtime bytecode, source code, and state changes to ensure that the transformation preserves the original business implementation. We evaluate DeLLMGuard on 387 real-world vulnerable contracts with three LLM agents in an environment derived from SCONE-bench. DeLLMGuard reduces overall root-cause correctness from 23.5% to 6.6% and outperforms the closed-source bytecode baseline on the primary non-proxy set. Trace and ablation analyses further show that agents often recover downstream contracts but still fail to identify the vulnerability, indicating that cross-contract recovery remains a major challenge for automated LLM scanning.
Cyber Threat Intelligence (CTI) reports often describe Indicators of Compromise (IoCs) such as IP addresses, URLs, file hashes, and cryptocurrency wallets involved in cyberattacks. Those IoCs are typically described in the unstructured report's text, or listed at the end of the report with little context, limiting their usefulness. This paper presents TagZilla, a platform that, given a threat report, automatically analyzes its text and tags the IoCs it describes with contextual information about the threat group and malware family that the IoC belongs to and the type of abuse associated with the IoC (e.g., phishing, sextortion, command-and-control). TagZilla provides a novel LLM-based approach to assign owner tags to IoCs using an open-world classification, and assigns 29 abuse type tags to IoCs using a closed-world classification. We evaluate TagZilla on a manually generated ground truth of 100 threat reports containing 1,534 indicators, where it achieves an F1 score of 0.94 for owner tagging and 0.93 for abuse type tagging. Then, we apply TagZilla to tag 765 threat reports, identifying 15,583 IoCs belonging to 637 malware families, 113 threat groups, and 162 other entities. The results show that TagZilla can tag IoCs even in reports describing multiple actors and malware families, enabling the generation of IoC profiles for those entities.
Canonical reference map for the PRE-GHR publication series. Records every record in the series with its concept DOI, version history, and relational links; declares numbering conventions and known gaps; establishes citation and versioning standards. This map is itself a PRE-GHR series record. v33 (2026-08-28). Two changes. 1. PRE-GHR XXXIX v5.0 registered (version DOI 10.5281/zenodo.22145426; concept DOI 10.5281/zenodo.21889278 unchanged). v5.0 is the release version closing all six objections of an adversarial pre-submission review, one revision ticket each: Theorem 4 unilateralized with the converse demoted to an observation under an explicit complete-erasure assumption (R01); ledger counts restricted to lower witnesses, the ordering claim made conditional on a fixed normalization and full retention (R02); an explicit two-sided finite-sample bound replacing an expectation-only argument (R03); four empirical mappings corrected — schema-field disjointness separated from retained-trace intersection, join error reported two-sided with the earlier “directionally safe, never over-counting” claim withdrawn, overlap-error direction governed by an error budget, retention ratio restated in matched units (R04); measure-relative notation throughout (R05); subject classification reassessed and Related Work rebuilt (R06). This is the first subject-classification reversal recorded in this map: cs.MA is withdrawn as unsupported by the technical content — the formalism contains no agent population, strategic interaction, or equilibrium claim — and replaced by cs.CR primary with a cs.DB cross-list; Related Work now separates the lineage the paper inherits from (linked timestamping and distributed witnesses, split-view detection and the undefined gossip layer, existence-not-authenticity timestamping, provenance and lineage, record linkage, trace semantics, measure and order) from adjacent recent lines cited for comparison only, assigning priority to the sources where the paper's constructions proved to be rediscoveries. Two gaps are declared inherited rather than closed: the hash-chain anchor has no consistency-proof comparison mechanism, and the anchor-propagation layer is undefined in the source standard as well. 2. The AI-collaboration attribution note (drafted 2026-08-20, previously unpublished as a local v32.1 revision) is merged into this version. It records that papers in the series are drafted with AI assistance, that the author block is platform-plus-model double-written from XL v1.3 onward, and how the platform-only author line of earlier versions is to be read. On merge, the coverage clause of the writing-model statement was narrowed under red-pen review (2026-08-28): the claim's width is aligned to the strength of its evidence. The complement of the recorded provider-fallback events establishes that no fallback leg entered a paper-writing session; it does not establish per-paper model attribution for the entire series. The statement is therefore scoped to the drafting sessions of the pre-v1.3 papers named in the per-paper note, and the narrowing itself is recorded in the revision history so that the difference between the unpublished local note and this published version is auditable. Delivery-fingerprint discipline updated this day. A PDF's md5 is a build-instance fingerprint, not a content fingerprint: pdflatex writes /CreationDate and /ID on every build, so the same source compiled twice differs in md5 while the typeset content is identical (measured: 68 differing bytes, all inside that region). Deliverables in this series now carry file md5, a content fingerprint with the extractor and version named, page count and byte count, produced under a reproducible build with the embedded date pinned. Record count unchanged: 39 records (27 series-internal).
PRE-GHR XXXIX v5.0 (2026-08-28) — release version closing all six objections of an adversarial pre-submission review. PRE-GHR XXXVIII gave the series its first formal definition of the irreducible governance residue δ0μ(P) := inf over admissible P' of ||residue(P')|| and proved a bit-level lower bound. This paper builds the property theory. The mathematics is a domain-order theory: every inequality follows from how the admissible domain D(P) behaves under enlargement or composition of protocols. We prove monotonicity of δ0μ in the erasure surface, an exact composition law δ0μ(P1 ∘ P2) = δ0μ(P1) + δ0μ(P2) − |T(P1) ∩ T(P2)| under explicit hypotheses (segment autonomy, joint attainability, cross-segment cleanliness), and positivity δ0μ(P) > 0 whenever T(P) is non-empty as a purely normative fact, with Landauer's principle confined to the physical interpretation. We then ask what a running system's audit ledgers can measure. The answer is stratified: the ordering structure is measurable in principle — conditional on a fixed normalization and full retention — while the absolute value is stated relative to a fixed code-point measure, and the aggregate-to-single-protocol bridge remains open. No interception statistic is claimed to equal δ0μ; where the wall cannot be built, the gap is marked, not papered over. Changes in v5.0 (six revision tickets, R01–R06, each closing one reviewer objection): R01 — Theorem 4 unilateralized: the safe direction (T(P) non-empty ⇒ δ0μ > 0) remains a theorem; the converse is demoted to Observation 4.1 under an explicit complete-erasure assumption. A witness-reading remark records that δ0μ is a minimum witness cardinality in the sense of why-provenance, inherited and not claimed as new. R02 — ledger counts restricted to lower witnesses only: the ordering claim is measurable solely under a fixed normalization and full retention, stated as an explicit condition rather than an implicit assumption. R03 — the uniform-sampling remark now carries an explicit finite-sample bound (Hoeffding's inequality in its standard form), two-sided: “holds in expectation” is no longer used as if it held for a sample. R04 — four empirical mappings corrected: schema-field disjointness is separated from retained-trace intersection; the approximate join reports both false-negative and false-positive error (the earlier “directionally safe, never over-counting” claim is withdrawn); the overlap-error direction is declared two-sided and governed by an error budget rather than assumed away; and the retention ratio is restated as an interception-event ratio in matched units. R05 — measure-relative notation throughout: bits and code points are two measures on one trace universe, so every ordering claim is stated at a fixed μ and changing μ defines a new quantity rather than restating the old one. R06 — subject classification reassessed and Related Work rebuilt. The paper contains no multiagent model and no coordinated-interaction result; the earlier cs.MA classification is withdrawn as unsupported by the technical content, and the classification adopted here is cs.CR primary with cs.DB cross-list. Related Work now separates the lineage the paper inherits from — linked timestamping and distributed witnesses (Haber & Stornetta 1991; Bayer, Haber & Stornetta 1993), split-view detection and the undefined gossip layer (Certificate Transparency, RFC 6962 / RFC 9162), existence-not-authenticity timestamping (OpenTimestamps), provenance and lineage (W3C PROV; Buneman, Khanna & Tan 2001; Cui, Widom & Wiener 2000), record linkage (Fellegi & Sunter 1969), trace semantics (Hoare 1978; Brookes, Hoare & Roscoe 1984), and measure and order (Halmos; Davey & Priestley) — from adjacent recent lines cited for comparison only. Where a construction of this paper rediscovers an existing one, priority is assigned to the source and no originality is claimed. Honesty notes. Citations to Hoeffding, Fellegi & Sunter, Halmos, Davey & Priestley and the CSP literature are made at the level of the standard statement of each framework only, pending full-text verification. Two candidate references were deliberately excluded because their primary sources could not be verified. Two gaps are inherited rather than closed: the hash-chain anchor has no consistency-proof comparison mechanism, and the anchor-propagation (gossip) layer is undefined in the source standard as well. Open questions Q5.1, Q5.3 and Q5.4 remain declared open.
Stian Lybech, Eun-Young Kang, Riccardo Tonello, Anders Dalskov
This paper develops a model of a smart-contract language for a blockchain architecture with off-chain components. Off-chain components are pieces of smart contracts that execute at designated locations outside of the network of blockchain nodes, but remain synchronised with the on-chain contract state. They react to changes to the on-chain state, but may also notify the on-chain component about events in the world, e.g. stock prices, weather data etc., or even act as a bridge between different blockchains. This affords greater flexibility for the developer, but may also enable new vulnerabilities. As a concrete example, we use the model to study the problem of ensuring integrity and secrecy of data between the on-chain and off-chain components, using static information flow control techniques. This fails, even in the absence of a loop construct, because off-chain components act as separate threads and can encode a blocking construct e.g. through recursive method calls. We end the paper with a discussion of possible ways to remedy this situation.
With the rapid evolution of the Decentralized Finance (DeFi) ecosystem, stablecoins have emerged as a critical infrastructure bridging the cryptocurrency market with traditional financial paradigms. However, stablecoin systems rely heavily on smart contracts to execute automated operations. The immutable nature of these systems post-deployment means that the exploitation of security vulnerabilities can lead to irreversible, massive economic losses and potentially trigger systemic financial risks. Current research on stablecoin smart contract security faces challenges such as a lack of domain-specific targeting and the obsolescence of static defense models. To address this, this paper systematically analyzes common attack vectors in stablecoin environments and proposes a practical, real-time dynamic defense architecture. By analyzing 12 real-world security incidents, we elucidate the underlying mechanisms of high-risk patterns such as reentrancy attacks, oracle manipulation, and composite flash loan attacks. Concurrently, we construct a real-time anomaly detection model utilizing multi-dimensional on-chain temporal features and the Bi-LSTM algorithm. Experimental results demonstrate that this model achieves a classification accuracy of 96.61\%, with an average recall rate of 97.70\% for malicious attack samples, and a single inference latency ranging from 1.5 to 2.8 milliseconds.
We introduce the Huffman-Merkle Tree (HMT), an authenticated data structure (ADS) for dynamic workloads where items may differ in access frequencies, and access frequencies can change over time. An ADS allows proving item membership against a short commitment to a large mutable state, with applications including verifiable storage, Internet transparency services, and blockchains. Optimizing ADS performance under continuously changing access frequencies has not been fully addressed before, neither in theory nor in practice. HMT addresses dynamically changing access skew through two complementary mechanisms. The first is a Huffman-coding-based Merkle-tree layout, with a novel extension to support evolving access frequencies. The second is an elastic tiering regime that partitions items across separate trees, such as hot and cold tiers, with adaptive migration between them. The key insight in this approach is to place frequently accessed items closer to the root, while assigning less frequently accessed items to progressively larger and deeper trees. This reduces the overall frequency-weighted access cost. Our scheme is designed to scale to gigabytes of data spanning millions of items. To handle dynamism efficiently, layout updates are applied in batches, access frequencies are tracked using a count-min sketch, and the system employs a tier-promotion cache while exploring multiple tier-migration policies. We implement HMT and compare it on real-world data with Ethereum's Merkle Patricia Trie (MPT) ADS and its proposed replacement, the Unified Binary Tree (UBT). Our evaluation considers two metrics: the amount of hashing per update and access-weighted membership-proof size. The latter captures both item access cost and frequency. We find that the best HMT policy uses about 2.4x and 0.34x less average hash operations than MPT and UBT respectively, and has 0.18x and 0.55x shorter proofs.
Tomasz Sadowy, Constantine Doumanidis, Maria Apostolaki
BGP hijacking remains a persistent threat as existing defenses, including RPKI/ROV suffer from a fundamental incentive misalignment: the networks best positioned to filter malicious announcements bear operational costs but receive no direct benefit, while the victim prefix owner captures all the value. We advocate a market-based alternative in which prefix owners post standing bounties for filtering invalid announcements of their prefixes, turning filtering from altruism into a private transaction. Our insight is that neither a propagating hijack nor its absence can hide from public route collectors, whose committed routing tables could become an independent root of trust for releasing funds of the bounty. We build on this insight to design BGPay, an escrow protocol in which filterers and monitors commit before either reveals, and a smart contract pays out on evidence rather than on the prefix owner's judgment. Analyzing 1K real hijack incidents, we find that today's collectors already provide enough visibility where it matters: ASes that are more important for containing the hijack are also highly visible from the public monitors. Hence, setting rewards proportionately to containment impact discourages misbehavior.