Follow blockchain research across journals, conferences, and preprint repositories.
1,082 results · page 1 of 46
Santosh S Doifode, Anand Singh Rajawat
No abstract is available for this record.
Zhe Chen, Xiaohan Zhang, Ning Zhang, Guihua Gu · 7 authors
Cyber–physical systems (CPSs) increasingly rely on complex software components whose vulnerabilities may affect both digital services and physical processes. Fuzzing is a practical technique for discovering such vulnerabilities in CPS-facing parsers, protocol handlers, and edge services. Distributed fuzzing improves throughput, but outsourcing fuzzing tasks to multiple untrusted nodes introduces privacy risks: valuable seeds, especially crash-triggering samples, may reveal vulnerability information before affected users are protected. In this paper, we propose PrivFuzz, a privacy-preserving collaborative fuzzing framework. PrivFuzz allows organizations and individuals to collaborate and receive rewards while keeping fuzzing seeds confidential and enabling controlled encrypted seed reuse among untrusted fuzzing nodes. The key idea is to combine trusted execution environments (TEEs) with blockchain-based smart contracts to support confidentiality and fair reward settlement. We give game-based definitions and reduction-style arguments for seed confidentiality, worker soundness, outsourcer atomicity, and duplicate-claim resistance under an attested execution model. We implement a PrivFuzz prototype and evaluate it on four open-source parsing targets. Separately, native AFL++ sanity checks suggest that CPS-facing industrial protocol parsers such as Modbus and OPC UA fall within the same fuzzable target domain. Demonstrating end-to-end PrivFuzz on CPS control programs is left as future work. Using PrivFuzz, we discovered nine bugs and reported them to the developers.
Nguyen Dinh Dai, Lai Minh Tuan
With the transparency of the Ethereum platform, deployed smart contracts remain permanently public, exposing their virtual machine code to risks such as reverse engineering, control-flow analysis and malicious behavior identification. Although several obfuscation approaches for the EVM have been proposed, existing solutions often suffer from limited resistance against advanced analysis techniques, insufficient structural transformation capability or excessive execution overhead. In this work, we propose a novel obfuscation framework for EVM bytecode that enhances security by combining semantic-aware transformations with control-flow perturbation techniques. The proposed framework significantly increases structural complexity, hinders Control Flow Graph (CFG) recovery and alters discriminative virtual machine code characteristics while preserving the semantic correctness of smart contracts. Experimental results demonstrate that the proposed framework achieves a 100% obfuscation success rate with an average cyclomatic complexity of 90.80. Across all 15 evaluated transformation combinations, the framework introduces an overall mean virtual machine code size increase of 15.99% and a mean gas overhead of 7.04%. Notably, the complete multi-layer pipeline (T1+T2+T3+T4) exhibits overheads of 29.73% for virtual machine code size and 12.58% for gas, which remain acceptable considering the achieved robust resistance against reverse engineering and automated static analysis.
Staley Ian
Pipelines that pair a large language model with a static analyzer, feeding findings back as repair instructions, appear throughout recent smart contract repair research. They rest on a rarely examined assumption: that the analyzer output serving as the oracle faithfully records what the analyzer found. I report three ways that assumption fails, identified during a four-contract instrument-validation exercise preceding a planned repair study. First, Mythril v0.24.8 can exit without reaching the analysis phase while returning exit status zero, empty standard error, and a findings array byte-identical to that of a genuinely clean scan; the failure is reported in a sibling JSON field that finding-extraction code has no reason to read. Second, 12 of 23 Slither findings in my validation set fell outside the high, medium, and low impact bands, so an unfiltered count measures a composite whose components may not behave alike under repair. Third, keying finding identity on source location breaks across repair rounds. On the one contract carried through three rounds, location-based keying inflated resolved findings from 7 to 12 and introduced findings from 2 to 7. The underlying instability is established in the warning-tracking literature; my contribution is its consequence for repair metrics, where it biases both transition counts upward and can confound comparison between methods producing differently sized .patches. I separately report an executed exploit showing a specification-level authorization defect that produced no high or medium impact finding. I propose calibration procedures for each hazard and release the harness, contracts, and raw analyzer output at doi:10.5281/zenodo.21586404.
Aman Sharma, Vishvesh Revoori
Over the past few years, Wireless Sensor Networks (WSNs) have been increasingly deployed for numerous sensing and monitoring purposes in environmental monitoring, industrial automation, health monitoring, military surveillance, smart agriculture and disaster management among others. The inherent limitations in terms of processing power, memory, communication bandwidth and energy of sensor nodes make WSNs highly susceptible to malware attacks. A wide variety of malware such as sensor network worms, Trojans, viruses, botnets and ransomware can easily propagate in a network through inter node communication. Such malware can cause serious damage to communication, compromise sensitive data, consume energy of the infected nodes thereby reducing the lifetime of network among others. In the last decade, numerous approaches have been proposed for the detection of malware infecting sensor nodes. These approaches range from traditional signature-based detection and behavior-based detection to more advanced approaches such as machine learning (ML)-based, deep learning (DL) -based, blockchain-based, trust management-based and federated learning-based detection. Most of the existing approaches for malware detection in WSNs have been designed to work on WSNs and have not been tested on real scenarios. Most of the approaches have their own strengths and weaknesses and the most suitable approach for a given application depends on various factors. In this paper, we present a comprehensive review of approaches for the detection of malware infecting sensor nodes in WSNs. We present a taxonomy of reviewed approaches for detection of malware. We also present a discussion on approaches for modeling malware propagation in a WSN as well as review on various categories of malware that have been designed to attack sensor nodes in WSNs along with detection frameworks for different categories of malware. We also present a comparative study of approaches used for the detection of malware in WSNs on the basis of various parameters such as detection accuracy, computational complexity, energy efficiency, scalability, detection latency and deployability. The review and taxonomy presented in this paper will be highly beneficial for researchers and practitioners designing approaches and systems for the detection of malware in WSNs. Various open research challenges in this area have also been discussed in this paper including detection of zero-day malware, designing of intelligent models to be light enough to be deployed on sensor nodes, use of explainable artificial intelligence for detection of malware in WSNs, designing approaches for privacy-preserving collaborative learning in WSNs and designing adaptive security approaches for WSNs.
Zhifan Ye, Jiachi Chen, Zhongxin Liu, Chong Chen · 8 authors
Solidity has undergone 116 version iterations between August 2015 and February 2026, during which compiler updates have introduced behavioral changes, including issues later fixed in subsequent releases. Contracts compiled under specific versions may exhibit version-dependent execution behaviors, particularly in low-level code. These differences are often difficult for developers and users to recognize, creating opportunities for adversaries to exploit legacy compiler behaviors and deploy contracts with potentially deceptive outcomes. We define this issue as the Compiler Version Discrepancy (CVD) risk , where attackers leverage compiler-version-dependent behaviors to produce misleading or unfair outcomes while contracts appear functionally benign. We summarize five representative CVD risk patterns from real compiler inconsistencies. To mitigate this risk, we develop the CompileGuard detection tool. It combines Abstract Syntax Tree (AST) analysis, taint analysis, and symbolic execution with Control Flow Graph (CFG) analysis to identify version-sensitive code patterns. Evaluation on 227 smart contracts shows CompileGuard achieves an overall F1 score of 95.22%. A user study with 21 blockchain practitioners shows contracts exploiting CVD risks can mislead users, while detection reports enable all participants to correctly identify risk-inducing behaviors. These results highlight the practical exploitability of CVD risks and the effectiveness of automated detection in preventing such deception.
Yongming Fan
Cryptographic software forms a critical foundation of modern computing systems, but the security guarantees of cryptographic protocols do not automatically extend to their implementations. Errors in arithmetic operations, validation logic, data conversion, constraint generation, or component integration can cause deployed software to deviate from the intended protocol while still producing plausible outputs. Such risks are difficult to detect in compiled binaries and become even more challenging in modern cryptographic systems such as zero-knowledge proofs, where implementations combine finite-field arithmetic, constraint systems, witness generation, proving procedures, verification logic, and serialization formats.Securing cryptographic implementations requires analysis techniques that can reason about both low-level program behavior and high-level cryptographic intent. To address this need, cryptographic function identification in binaries is first examined. It categorizes existing detection techniques, develops a unified benchmarking framework, and evaluates current tools through reproduction and replication studies across different compilers, optimization levels, obfuscation strategies, and algorithm variants. The second part introduces an automated security analysis framework for zkSNARK implementations that combines constraint checking with fuzzing-based testing to detect and locate cryptographic logic errors. This approach helps determine whether an implemented zkSNARK system correctly enforces the intended computation and security design. The third part develops a grey-box differential fuzzing approach for zero-knowledge proof binary applications. It uses structured input generation, coverage monitoring, control-dependency-aware taint tracking, and error localization to guide testing toward security-relevant code and expose inconsistencies in circuit construction, witness conversion, proof generation, and verification logic.Together, these contributions connect binary analysis, automated checking, and protocol-aware fuzzing to improve the practical security of cryptographic software. They provide methods for identifying implementation-level weaknesses that may remain hidden during ordinary testing, especially when programs produce valid-looking outputs despite incorrect cryptographic behavior. By combining systematic evaluation, zkSNARK-specific analysis, and binary-level testing, the resulting methodologies advance the development of more reliable techniques for analyzing, testing, and securing real-world cryptographic systems.
Ezeibeanu Ozioma Stephanie
The rising use of the Internet of Things (IoT) has changed the communication and automation landscape in various industries. However, the growing number of interconnected and vulnerable IoT devices has created several cybersecurity challenges, and the conventional intrusion detection system is not designed to handle the dynamicity of sophisticated cyber-attacks and secure information management. This study presents a blockchain-based security framework for intrusion detection in an IoT environment that uses a Gated Recurrent Unit (GRU) to achieve high-level detection accuracy and blockchain technology to guarantee information security. Edge-IIoTset benchmark data containing about 2.2 million traffic instances and 61 traffic features were collected, preprocessed, and split into training, validation, and testing datasets at a ratio of 70:15:15 for model development and evaluation. The GRU network was trained to capture sequential patterns in network traffic with high accuracy, while the blockchain layer was leveraged to ensure secure detection record storage and information sharing. The model attained 99.12% accuracy, 99.08% precision, 98.97% recall, 99.02% F1-score, and 0.9987 ROC-AUC. Additionally, the blockchain layer achieved an average of 850 transactions per second with a 2.3-second block confirmation time, while the framework recorded an average of 3.2 millisecond traffic detection time. Thus, the proposed framework was efficient and effective in detecting and responding to cyber-attacks in an IoT network.
Jean Chrysostome NDAYISABYE
Abstract Cryptocurrency rug pulls, in which token developers withdraw liquidity or otherwise abandon a project after attracting investment, remain a persistent and costly form of decentralized finance (DeFi) fraud. Prior detection approaches, whether feature-engineered supervised classifiers or temporal graph learning models, are typically trained and periodically retrained on labeled data, without an explicit, continuously operating mechanism to detect when the underlying decision boundary has drifted between retraining cycles. Malware threat intelligence has separately developed and validated concept-drift-aware incremental clustering specifically to address this class of problem for evolving malware families. This paper adapts that methodology to the cryptocurrency rug-pull domain and evaluates it empirically against a periodically retrained supervised baseline on a real, temporally-hygienic dataset of 633 labeled Ethereum token projects. Using a strict chronological warm-start, validation, and held-out test split explicitly designed to avoid the hyperparameter-tuning leakage identified and corrected during this study we find that the periodic-retrain baseline achieves marginally higher F1-score (mean 0.891, std 0.008) than the drift-aware clustering approach (mean 0.873, std 0.014) across five independent chronological splits, and is substantially more stable, exhibiting far lower variance in precision across time periods (std 0.015 versus 0.064 for clustering). The clustering approach's principal advantage is a markedly lower false-positive rate in several splits, at the cost of reduced and less stable recall. These findings offer a specific, mechanistically grounded, and negative-leaning result for the transfer of drift-aware clustering from malware detection to on-chain fraud detection under this feature set, and motivate concrete directions richer behavioral features, principled hyperparameter search, and comparison against temporal graph learning baselines for future work.
Michał Bartnicki, Jarosław A. Chudziak
Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.
Arman Kolozyan, Tom Sorger, Alexander Hicks, Stefanos Chaliasos
Zero-knowledge proofs (ZKPs) have become a core technology for privacy and verifiable computing. They are used to secure blockchains that handle billions of dollars and identity applications dealing with sensitive personal data. However, ZKP systems are complex, and subtle implementation errors can completely break their guarantees, letting attackers forge money or false proofs of identity. Researchers and practitioners have therefore developed a growing set of bug detection and formal verification methods to secure these systems. Yet their real-world effectiveness and adoption remain unclear. In this paper, we aim to shed light on the state of ZKP security tooling. We first systematize the landscape of these tools and observe that most target Circom, leaving newer DSLs and zkVMs with limited support. We then evaluate six tools across 70 real-world vulnerabilities and find that while the tools detect 45.7% of bugs on isolated targets, their effectiveness drops to 19.6% on full codebases, with important vulnerability classes left unaddressed. We also present the first systematic analysis of formal verification efforts, revealing that current work focuses primarily on constraint correctness and identifying key gaps and risks. Finally, we survey 48 practitioners, showing that development and security remain human-led, LLMs are widely used, and practitioners prioritize tools with clearer guarantees and lower integration effort. Overall, our results highlight the need for better integration of security tooling with the development and auditing process, and we provide actionable insights for researchers and practitioners.
Muhammad Wahid, Shahzaib Khan, Mashhood Ali, Muhammad Hassan · 6 authors
The immutable nature of smart contracts makes it challenging to fix and patch bugs once they are deployed to a blockchain. This implies that security vulnerabilities may be exposed to possible exploitation for a longer period, necessitating comprehensive pre-deployment testing. Property-based testing combined with fuzzing has proven itself as a promising technique for uncovering vulnerabilities. Traditionally, system properties are written by human experts, which is time-consuming and consequently expensive.With the recent advancement in Large Language Models (LLMs) and their ability to 'understand' natural language and code semantics, it may be possible to generate effective properties. This study, leverages state-of-the-art LLMs to generate high-quality properties for Soliditybased smart contracts. We measure the quality of the generated properties using mutation testing. Our results show that LLMs have the potential to generate high-quality properties that are close to those written by human experts. We extensively evaluate LLMs using various prompting techniques (e.g., zero shot, few shot, and prompt chaining). Overall, we find that Gemini Pro 1.5, when combined with prompt chaining, achieves the highest average mutation score of 25.99% among all studied configurations, closely approaching the human written benchmark of 31.75%. However, our per contract analysis reveals notable variance, particularly for the LibBit contract, where Gemini Pro 1.5 under prompt chaining achieves a mutation score of 74.34%, which is on par with human written properties (74.83%). This highlights that while average performance is informative, individual contract level results demonstrate that LLMs can, in some cases, match expert level property generation.
Rui Cao, Shaojing Fan, Zhimei Sui, Liming Fang · 7 authors
Blockchain and its killer applications, particularly decentralized finance (DeFi), are gaining widespread adoption, with over 5,200 DeFi projects deployed on mainstream blockchains as of January 2026. At the same time, security risks in DeFi are becoming increasingly serious. However, existing DeFi detection tools usually cover only specific attack types, exhibiting severely limited detection coverage. In this paper, we argue that an effective way to address this gap is to pre-screen vulnerable instances from large volumes of smart contract functions and call sequences. This is motivated by a key phenomenon we term "perilous temporal asymmetry". Inspired by this, we propose DeFiScreener, the first automated pre-screening framework for DeFi attacks that uses historical exploit cases to identify potentially vulnerable functions and call sequences. Given the full source code of a target project, DeFiScreener builds Function Call Trees (FCTs) and generates semantic embeddings for each function using a large language model (LLM), allowing both program structure and function intent to be analyzed together. It then applies a dual-level screening process. At the function level, function embeddings are matched against an Attack Pattern Library of historically exploited functions. At the sequence level, the proposed Attack Pattern Oriented Monte Carlo Tree Search (APO-MCTS) efficiently explores the FCTs and screens vulnerable call sequences. The identified candidates are ultimately passed to an LLM for further interpretive and security analysis. We empirically evaluate the DeFiScreener over datasets comprising 207 real-world DeFi attack incidents. Experimental results demonstrate that DeFiScreener achieves a remarkable 98.55% recall and 84.30% precision in attack pre-screening.
Deyu Yang, Rundong Wei, Xiaoqi Li
Ethereum non-fungible tokens (NFTs) implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with application-specific logic, whereas unconstrained large language model analysis may be distracted by irrelevant code or produce inconsistent outputs. We present a vulnerability-detection method that combines vulnerability-focused code slicing, an ERC-721-oriented knowledge base, and constrained DeepSeek analysis. Regular-expression patterns locate candidate statements for reentrancy, integer overflow or underflow, and timestamp dependence. A structure-aware context-window algorithm then extracts line-numbered code slices. DeepSeek analyzes each slice using explicit decision rules and a fixed output schema, and the resulting records support automated batch processing. On 450 NFT contract samples, the full configuration produced 437 positive labels, corresponding to a reported positive-label rate of 97.1%. Removing the external knowledge base reduced this rate to 87.11%, while analyzing complete contracts without the knowledge base reduced it to 73.78%. These results indicate that focused code context and domain constraints materially affect the detector's reported output.
Bofeng Pan, Andrei Natadze, Enrico Branca, Jadyn Kimber · 5 authors
Similar to all other cryptocurrency platforms, Ethereum is constantly confronted with malicious activities. In recent years, research efforts have targeted the detection and mitigation of malicious activities and the associated accounts within the Ethereum ecosystem. Yet, the malicious accounts represent only a small visible part of the substantial collaborative network enabling these activities. In this work, we offer the first analysis of this collaborative network and the corresponding affiliate accounts that often remain hidden from detection. We present enEtherShield, an enhanced framework for detecting affiliate accounts that assist malicious accounts in the related Ethereum scams. Our research findings lay the foundation for the detection of the collaborative network enabling Ethereum scams.
Xianhao Zhang, J F Sun, Zijian Zhang, Ye Liu · 7 authors
Smart contract vulnerabilities pose severe financial risks, yet existing security tools largely stop at vulnerability detection, offering limited support for explaining whether reported flaws are exploitable, how attacks unfold, and what concrete damage they cause. To bridge this gap, we propose KASS (Knowledge-Augmented Attack Synthesis and Simulation), a multi-agent framework for executable smart contract exploit verification. KASS decomposes automated exploit generation into planning, generation, and testing stages, and integrates three complementary mechanisms: retrieval-augmented planning over real-world audit knowledge, formal generation and validation constraints that bind attack plans to executable proof-of-concept tests, and a hierarchical dual-loop refinement process that repairs code-level errors while triggering strategy-level replanning when attack assumptions fail. We evaluate KASS on 104 SmartBugs-Curated contracts across four vulnerability categories. Experimental results show that KASS successfully generates executable exploits for 94.23% of tested contracts; this rate is higher than previously reported results for REX and AdvSCanner on comparable SmartBugs-Curated subsets, and higher than our reproduced Claude Code baseline under the same evaluation protocol. On 11 real-world CVE-tagged contracts, KASS successfully validates 9 cases. Beyond exploit generation, KASS produces structured attack plans that document exploitation flows, quantify potential asset losses, and serve as semantic false positive filters for static analysis tools.
Mao Guanghui
Project Name: PR-DataShield Summary: This technical disclosure introduces PR-DataShield, a lightweight, zero-trust, event-driven security gateway architecture designed to secure distributed source code supply chains at the boundary of version control integration. By decoupling repository-level change requests from localized security operations, the framework utilizes asynchronous webhooks, serverless relational data persistence, and tokenized downstream feedback mechanisms to construct a deterministic code-gate keeper. Key Architectural Features: Event-Driven Ingestion: Utilizes structured cryptographic JSON payloads for secure PR event interception. Multi-Route Gateway: Implements redundant endpoint mapping to ensure operational continuity and resilient webhook delivery. Immutable Audit Ledger: Enforces transactional persistence via a serverless PostgreSQL cluster, guaranteeing non-repudiation of security logs. Asynchronous Feedback Loop: Automatically updates the host repository with an isolated markdown audit badge, providing immediate and immutable visual proof of security logging. Experimental Validation: Empirical verification conducted on July 11, 2026, demonstrated a sub-second response latency (0.27s) for the complete end-to-end security audit loop. This architecture establishes an immutable audit trail, effectively mitigating unauthorized code injection and supply chain tampering risks in modern CI/CD pipelines. Repository: https://github.com/apps/pr-datashield-bot
Jinlong Bai, Lifeng Cao, Xingchen Li, Hengyi Lv · 5 authors
Abstract A smart contract fundamentally consists of code deployed on the blockchain, noted for its transparent and unchangeable execution. These characteristics, however, also expose it to attackers once any weaknesses are present. In recent years, attacks targeting smart contracts have caused substantial financial losses, highlighting the importance of robust vulnerability detection approaches. Conventional detection techniques, which rely on contextual semantics or symbolic execution, often face limitations in efficiency. Although neural network-based approaches have enhanced detection speed, they frequently compromise accuracy. This study introduces a framework for identifying and repairing vulnerabilities in smart contracts by utilizing multi-relational graphs combined with a pre-trained model. Initially, a Multi-Relational Graph (MRG) is constructed to represent the multi-dimensional aspects of execution logic and data dependencies by integrating multiple program feature graphs. To reduce interference from extraneous code, contract slices are then generated according to node and edge types defined within the MRG. These vectorized slices are subsequently processed by a pre-trained model called SCCodeBERT for both detection and repair of potential vulnerabilities. Experiments show that SCCodeBERT achieves an average accuracy of 96.06% and an F1-score of 90.90% on mainstream vulnerability datasets. Moreover, it reaches an average repair effectiveness of 86.42%, significantly outperforming current baseline approaches. This work presents a highly effective automated solution for enhancing smart contract security, offering notable theoretical and practical contributions.
Tianjun Ma, Xialei Zhang, Lifeng Guo
Numerous reports and studies indicate that the lack of effective regulation in cryptocurrencies has not only led to substantial financial losses but also eroded the traditional ”central bank-commercial bank” framework, thereby destabilizing financial systems. To address these issues, a growing body of research has focused on developing regulatory mechanisms for cryptocurrencies. However, existing regulatory proposals face a persistent trilemma: they fail to simultaneously achieve three critical properties—(i) one‑time registration with self‑updating addresses, (ii) completeness (including a lost‑coin retrieval mechanism), and (iii) fine‑grained access control that respects the ”central bank‑commercial bank” framework. This study bridges this gap by proposing TCoin, the first regulatory cryptocurrency that fulfills all three requirements. We first introduce TSFG, a traceable scheme built on SkyEye, which employs cryptographic techniques to achieve one‑time registration with self‑updating addresses and fine‑grained access control for tracing. By integrating TSFG into the RSCoin framework, we construct TCoin—a regulatory cryptocurrency that achieves one‑time registration with self‑updating addresses, ensures completeness through a novel coin recovery mechanism, and enforces fine‑grained access control. Compared to prior work (CB, DAP, PDC, RSCoin, e‑CNY, and RECoin), TCoin is the first to resolve the regulatory trilemma, offering a comprehensive solution that reconciles the disruptive potential of cryptocurrencies with the stability requirements of the traditional monetary system.
Jiashuo Zhang, Jiachi Chen, Ting Zhang, Yue Li · 9 authors
Smart contracts have attracted rapid development and widespread application. Due to the complexity of real-world smart contracts, it is error-prone to correctly enforce all intended functionalities in code implementations, resulting in unintended functional behaviors and security issues in practice. Code-comment inconsistency detection has emerged as an important solution to these issues, which leverages the redundant functional specifications in comments to detect code implementations that violate developers' intentions. However, existing inconsistency detection solutions are typically pattern-based and limited to fixed types of inconsistencies, which prevents them from detecting the diverse inconsistencies between real-world code implementations and casually written comments. To bridge the gap, this paper presents SmartComment, the first technique that combines LLMs with program analysis techniques for detecting code-comment inconsistencies in smart contracts. SmartComment introduces an LLM-driven workflow which simulates real-world interactions between code reviewers and developers to identify inconsistencies. It incorporates various program analysis techniques into the workflow, including comment propagation and code context extraction for generating input context for inconsistency detection, as well as program variant generation and differential analysis for inconsistency confirmation. Our evaluation results show that SmartComment detects 203 valid inconsistencies from a dataset of 1,000 real-world contracts with a precision of 79.9%, highlighting its effectiveness in detecting prevalent and diverse real-world inconsistencies. Compared to previous work, SmartComment achieves both higher precision and recall, detecting over 90% of inconsistencies that existing methods fail to identify. Furthermore, an ablation experiment demonstrates the effectiveness of incorporating program analysis techniques into SmartComment, improving the F1-score from 58.7% to 81.3%.
Jianzhong Su, Mingxi Ye, Jiachi Chen, Yuhong Nan · 7 authors
With the rapid development of decentralized applications, many malicious actors exploit smart contract vulnerabilities for launching attacks. Moreover, as smart contracts utilize more state variables to support complex functionalities, some vulnerabilities require specific states to trigger (marked as vulnerable states), bringing new challenges to the vulnerability detection task. Although many smart contract fuzzers have been proposed for this task, they face limitations due to their inability to efficiently explore smart contract states. To address this challenge, we propose a novel fuzzer, Odyssey, with fine-grained state modeling and exploration, which increases the probability of reaching vulnerable states. We improve the efficacy of the fuzzer with two key mechanisms: (1) modeling an essential state space consisting of the variables related to sensitive operations to compress the exploration scope; (2) designing state-aware exploration strategies to identify test seeds that cover new state scope or cause new state transitions, to improve the efficiency of exploration. To evaluate the performance in vulnerability detection, we adopt Odyssey to a labeled benchmark consisting of 130 vulnerable contracts. Odyssey detects at least 70% more vulnerabilities than other fuzzers. Moreover, we evaluate Odyssey on a dataset that consists of 143 DApps (involving 437 contracts) from real-world security incidents. The experimental results demonstrate that state-aware feedback enhances the ability of Odyssey in state exploration by achieving 19% higher state coverage. Meanwhile, Odyssey totally finds 15 exploits of vulnerabilities from real-world attacks, showing its advantage in detecting real-world vulnerabilities.
Qianqian Pang, Xin Yin, Tingting Bi, Lingfeng Bao · 6 authors
Smart contracts underpin a wide range of decentralized applications—from financial services to supply-chain management—but their immutability and direct control of assets magnify the impact of any security bugs. Although many fuzz approaches have been proposed and have demonstrated their effectiveness in uncovering vulnerabilities, existing methods often rely on unguided random mutation scheduling, generate redundant inputs, and fail to adapt to smart contract-specific characteristics. To overcome these challenges, we present FuzzMaster, a feedback-driven fuzzing framework that combines deep reinforcement learning (DRL) with lightweight probabilistic scheduling to steer mutation selection at runtime intelligently. By continuously analyzing execution feedback—code coverage, function-call sequences, and vulnerability signals—FuzzMaster’s DRL agent and probabilistic tables prioritize high-impact mutations and avoid wasted effort on redundant seeds. On standard VeriSmart and SmartBugs benchmarks, FuzzMaster achieves a 66.2% detection rate with 100% precision (versus 46.9% for ItyFuzz and 43.1% for Confuzzius) and uncovers most bugs within the first second of execution. Meanwhile, in real-world Ethereum contracts, FuzzMaster identified 97 vulnerabilities in 6 categories. These results demonstrate that dynamic, vulnerability-aware mutation scheduling can dramatically improve both the efficiency and effectiveness of smart contract fuzz testing.
Hyegeun Song, Jiseong Han, Sunbeom So
We present SmarTrim, a new symbolic execution technique for detecting vulnerabilities in smart contracts. Smart contracts require rigorous safety validation since flaws in them can cause significant financial loss. Numerous symbolic execution techniques, which generate vulnerable transaction sequences to trigger and help understand vulnerabilities, have been extensively studied to enhance the security and safety of smart contracts. However, their performance remains unsatisfactory due to the extremely large search space for transaction sequences. To mitigate this issue, SmarTrim introduces a novel technique that safely reduces the search space by detecting and pruning redundant transaction sequences. Experimental results show that SmarTrim greatly outperforms eleven state-of-the-art analyzers in detecting critical vulnerabilities in real-world smart contracts.
Mingxi Ye, Yuhong Nan, Zhijie Zhong, Jianzhong Su · 7 authors
Given the critical nature of Ethereum, exploiting 1-day vulnerabilities that are patched but not yet widely deployed is essential. Meanwhile, Automatic Patch-based Exploit Generation (APEG) is a promising technique for this, as it helps developers understand root causes, verify fixes in downstream forks, and detect incomplete patches. However, existing exploit generation tools can not work well for vulnerabilities on Ethereum due to three key unique challenges: (1) navigating complex and cross-language exploit paths hidden within patches, (2) synthesizing complicated and stateful environment configurations, and (3) handling non-deterministic inconsistencies between blockchain nodes that lead to false alarms. To address these challenges, we introduce ChainDelta , a novel fuzzing agent framework driven by Large Language Models to automatically generate exploits based on Ethereum security patches. ChainDelta consists of three core modules: a directed fuzzer utilizes call graph analysis to guide testing towards vulnerable code based on the patch information; an agent-based environment fuzzer acts as an expert to automatically set up the necessary blockchain states to trigger vulnerabilities; and finally, a state-aware sanitizer performs differential analysis while monitoring the blockchain transient state to distinguish true inconsistencies from benign non-determinism. We evaluate ChainDelta on a diverse benchmark with real-world patches, covering a wide range of types such as data racing and denial-of-service. ChainDelta successfully generated exploits with a 64% success rate and only a 15.8% false positive rate. An ablation study confirms the contribution of each module to the overall performance. To demonstrate its practical impacts, we conducted a real-world auditing campaign on top of ChainDelta , leading to the discovery of four previously undisclosed vulnerabilities with bug bounties.