The coming era of autonomous AI agents demands a discovery mechanism capable of navigating millions of tools, yet existing solutions buckle under \( \mathcal{O}(N) \) complexity and centralized governance. Instead of building another fragile overlay, we propose ToolDNS, a radical framework that retrofits semantic tool discovery onto the Internet's most resilient substrate: the Domain Name System (DNS). By embedding functional intent and organizational trust into a hierarchical namespace, ToolDNS transforms an expensive semantic search into a series of lightweight, \( \mathcal{O}(\log N) \) name resolutions. We introduce three protocol-compliant enhancements to enable decentralized governance and semantic pruning: partially unfolded names, EDNS0 intent payloads, and logical subdomains. To rigorously evaluate this approach across the fragmented tooling landscape, we construct and release a large-scale heterogeneous benchmark comprising \( 33,688 \) real-world tools spanning MCP, A2A, RESTful, and Skill protocols. On this dataset, ToolDNS slashes the per-query search space by \( 95.26\% \) while matching state-of-the-art retrieval accuracy. Furthermore, its UDP-native design reduces discovery latency by orders of magnitude compared to HTTP-based registries. Our work demonstrates that scalable AI interoperability requires not more middleware, but a smarter utilization of the infrastructure already beneath our feet.
Memory-enabled large language model (LLM) agents, particularly those deployed in long-horizon, tool-using settings such as Web3-style autonomous workflows, introduce security risks that extend beyond single-prompt injection. By persisting and reusing information across interaction steps and sessions, these agents enable memory poisoning attacks in which adversarial inputs modify persistent agent state and influence future decisions after benign intermediate interactions. Recent work on context manipulation and “fake memories” demonstrates that adversarial content can be injected into an agent’s prompt-visible inputs or persistent memory; however, existing evaluations largely analyze such attacks at isolated interaction steps or static context snapshots, obscuring their temporal dynamics. In this paper, we present the first large-scale, trajectory-level measurement framework for analyzing temporal memory poisoning in memory-enabled LLM agents. We construct a schema-constrained dataset of 2,614 multi-step attack trajectories spanning four attack families,chain poisoning, policy rewriting, backdoor triggering, andslow drift, executed over shared persistent memory. We define temporal risk metrics over multi-step interaction trajectories that capture delayed activation, non-monotonic escalation, and the earliest point at which attacks become distinguishable from benign behavior. Our empirical results show that a substantial fraction of attacks remain indistinguishable from benign behavior until late-stage activation, despite exhibiting low or medium risk at all earlier steps. Slow-drift and backdoor-trigger attacks, in particular, systematically evade step-local evaluation until terminal interactions, while chain poisoning and policy rewriting exhibit non-monotonic risk trajectories. These findings demonstrate that memory poisoning risk is inherently temporal and cannot be reliably assessed using prompt-level or step-isolated evaluation, motivating trajectory-aware benchmarks for agent security.
The investigation of cryptocurrency crimes is still in its infancy with no standardised process or methodology to follow. This paper describes research that forms part of a broader project led by the second author (Botha, et al., 2025). The broader project’s aim is to develop a methodology to follow when conducting cryptocurrency crime investigations. One of the steps in the proposed methodology is web scraping. The authors of this paper present a detailed exploration of web scraping techniques within the broader context of the proposed investigation methodology. In this paper, the focus is on developing a well-structured methodology for scraping social media platforms and online forums to gather data related to fraudulent activities; the goal is to find posts that include references to the wallet address of interest. This exploration uses an iterative approach; for every new cryptocurrency wallet address discovered or revealed through on-chain analysis, a parallel path is followed by scraping the Internet. If a mention of the cryptocurrency address should be discovered it is considered to be a key finding, creating a pivot point in the investigation. From a pivot point, further open-source intelligence (OSINT) techniques will be applied, though this aspect falls beyond the scope of this paper. If no relevant information or link is found, the scraping path will not be pursued, and the investigation proceeds with on-chain analysis to identify additional wallet addresses. Additionally, challenges encountered in web scraping, such as handling platform restrictions, ensuring data accuracy, and managing large volumes of data, are addressed. The goal of the proposed methodology is to enhance data extraction and analysis efficiency contributing to the proposed methodology for investigating cryptocurrency scams.
Che, Zheng, Taoyu Li, Meng Shen, Hanbiao Du · 5 authors
The untraceability of transactions facilitated by Ethereum mixing services like Tornado Cash poses significant challenges to blockchain security and financial regulation. Existing methods for correlating mixing accounts suffer from limited labeled data and vulnerability to noisy annotations, which restrict their practical applicability. In this paper, we propose StealthLink, a novel framework that addresses these limitations through cross-task domain-invariant feature learning. Our key innovation lies in transferring knowledge from the well-studied domain of blockchain anomaly detection to the data-scarce task of mixing transaction tracing. Specifically, we design a MixFusion module that constructs and encodes mixing subgraphs to capture local transactional patterns, while introducing a knowledge transfer mechanism that aligns discriminative features across domains through adversarial discrepancy minimization. This dual approach enables robust feature learning under label scarcity and distribution shifts. Extensive experiments on real-world mixing transaction datasets demonstrate that StealthLink achieves state-of-the-art performance, with 96.98\% F1-score in 10-shot learning scenarios. Notably, our framework shows superior generalization capability in imbalanced data conditions than conventional supervised methods. This work establishes the first systematic approach for cross-domain knowledge transfer in blockchain forensics, providing a practical solution for combating privacy-enhanced financial crimes in decentralized ecosystems.
Ben Biedermann, Matthew Scerri, Victoria Kozlova, Joshua Ellul
Web3’s decentralised infrastructure has upended the standardised approach to digital identity established by protocols like OpenID Connect. Web2 and Web3 currently operate in silos, with Web2 leveraging selective disclosure JSON web tokens (SD-JWTs) and Web3 dApps being reliant on on-chain data and sometimes clinging to centralised system data. This fragmentation hinders user esxperience and the interconnectedness of the digital world. This article explores the integration of Web3 within the OpenID Connect framework, scrutinising established authentication protocols for their adaptability to decentralised identities. The research examines the interplay between OpenID Connect and decentralised identity concepts, the limitations of the existing protocols like OpenID Connect for verifiable credential issuance, OpenID Connect framework for verifiable presentations, and self-issued OpenID provider. As a result, a novel privacy-preserving digital identity bridge is proposed, which aims to answer the research question of whether authentication protocols should inherently support Web3 functionalities and the mechanisms for their integration. Through a Decentralised Autonomous Organisation (DAO) use case, the findings indicate that a privacy-centric bridge can mitigate the existing fragmentation by aggregating different identities to provide a better user experience. While the digital identity bridge demonstrates a possible approach to harmonise digital identity across platforms for their use in Web3, the bridging is unidirectional and limits root trust of credentials. The bridge’s dependence on centralised systems may further fuel the debate on (de)centralised identities.
Jan 1, 2025·Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences
Purpose Advancements in Internet technologies greatly influence digital humanities, yet research investigating web3 (i.e. the blockchain-based, decentralised web) within that domain remains limited. The purpose of this paper is to address that gap, presenting a state-of-the-art synthesis of web3-related technologies for digital humanities infrastructures and exploring associated risks and challenges. Design/methodology/approach Following a review of the literature, the authors scope out ways blockchain technology, peer-to-peer decentralised storage and other web3 technologies could support digital humanities infrastructures, especially in the context of digital cultural heritage. In this discussion, particular cognisance is given to the needs and aims of the UK’s Arts and Humanities Research Council funded Towards a National Collection programme, which seeks to break down the barriers that exist between the UK’s cultural heritage collections. Findings Web3 introduces novel tools and processes that could benefit digital humanities infrastructures, enabling decentralisation and facilitating open access data storage. Yet, significant barriers to adoption remain, such as the requirement for highly specialised technical expertise. Risks and challenges must also be considered prior to any use, including legal, ethical and technical safeguards. Research limitations/implications This study explores opportunities and risks of web3 for digital humanities, through the lens of digital cultural heritage infrastructures and their requirements, including decentralised storage and persistent identification. It does not provide a holistic overview of all web3 technologies. Practical implications The authors identify practical uses of web3 technologies for digital humanities projects, outlining potential applications concerning decentralised storage and persistent identification. Originality/value The authors push forward current knowledge and literature on the intersection of web3 and digital humanities, outlining also practical recommendations for scholars, practitioners and funding organisations.
Konrad Weiss, Christof Ferreira Torres, Florian Wendland
Ethereum smart contracts are executable programs deployed on a blockchain. Once deployed, they cannot be updated due to their inherent immutability. Moreover, they often manage valuable assets that are worth millions of dollars, making them attractive targets for attackers. The introduction of vulnerabilities in programs due to the reuse of vulnerable code posted on Q&A websites such as Stack Overflow is not a new issue. However, little effort has been made to analyze the extent of this issue on deployed smart contracts. In this paper, we conduct a study on the impact of vulnerable code reuse from Q&A websites during the development of smart contracts and provide tools uniquely fit to detect vulnerable code patterns in complete and incomplete Smart Contract code. This paper proposes a pattern-based vulnerability detection tool that is able to analyze code snippets (i.e., incomplete code) as well as full smart contracts based on the concept of code property graphs. We also propose a methodology that leverages fuzzy hashing to quickly detect code clones of vulnerable snippets among deployed smart contracts. Our results show that our vulnerability search, as well as our code clone detection, are comparable to state-of-the-art while being applicable to code snippets. Our large-scale study on 18,660 code snippets reveals that 4,596 of them are vulnerable, out of which 616 can be found in 7,852 deployed smart contracts. These results highlight that the reuse of vulnerable code snippets is indeed an issue in currently deployed smart contracts.
Amir M. Ebrahimi, Bram Adams, Gustavo A. Oliva, Ahmed E. Hassan
The proxy pattern is a well-known design pattern with numerous use cases in several sectors of the software industry. As such, the use of the proxy pattern is also a common approach in the development of complex decentralized applications (DApps) on the Ethereum blockchain. Despite the importance of proxy contracts, little is known about (i) how their prevalence changed over time, (ii) the ways in which developers integrate proxies in the design of DApps, and (iii) what proxy types are being most commonly leveraged by developers. This study bridges these gaps through a comprehensive analysis of Ethereum smart contracts, utilizing a dataset of 50 million contracts and 1.6 billion transactions as of September 2022. Our findings reveal that 14.2% of all deployed smart contracts are proxy contracts. We show that proxy contracts are being more actively used than non-proxy contracts. Also, the usage of proxy contracts in various contexts, transactions involving proxy contracts, and adoption of proxy contracts by users have shown an upward trend over time, peaking at the end of our study period. They are either deployed through off-chain scripts or on-chain factory contracts, with the former and latter being employed in 39.1% and 60.9% of identified usage contexts in turn. We found that while the majority (67.8%) of proxies act as an interceptor, 32.2% enables upgradeability. Proxy contracts are typically (79%) implemented based on known reference implementations with 29.4% being of type ERC-1167, a class of proxies that aims to cheaply reuse and clone contracts' functionality. Our evaluation shows that our proposed behavioral proxy detection method has a precision and recall of 100% in detecting active proxies. Finally, we derive a set of practical recommendations for developers and introduce open research questions to guide future research on the topic.
The greatest advantage that Web3 applications offer over Web 2.0 is the evolution of the data access layer. Opaque, centralized services that compelled trust from users are replaced by trustless, decentralized systems of smart contracts. However, the public nature of blockchain-based databases, on which smart contracts transact, has typically presented a challenge for applications that depend on data privacy or that rely on participants having incomplete information. This has changed with the introduction of confidential smart contract networks that encrypt the memory state of active contracts as well as their databases stored on-chain. With confidentiality, contracts can more readily implement novel interaction mechanisms that were previously infeasible. Meanwhile, in both Web 2.0 and Web3 applications the user interface continues to play a crucial role in translating user intent into actionable requests. In many cases, developers have shifted intelligence and autonomy into the client-side, leveraging Web technologies for compute, graphics, and networking. Web3's reliance on such frontends has revealed a pain point though, namely that decentralized applications are not accessible to end users without a persistent host serving the application. Here we introduce the Non-Fungible Program (NFP) model for developing self-contained frontend applications that are distributed via blockchain, powered by Web technology, and backed by private databases persisted in encrypted smart contracts. Access to frontend code, as well as backend services, is controlled and guaranteed by smart contracts according to the NFT ownership model, eliminating the need for a separate host. By extension, NFP applications bring interactivity to token owners and enable new functionalities, such as authorization mechanisms for oracles, supplementary Web services, and overlay networks in a secure manner. In addition...
Web3, the next generation of the Internet, represents a decentralized and democratized web. Although it has garnered significant public interest and found numerous real-world applications, there is a limited understanding of people's perceptions and experiences with Web3. In this study, we conducted an empirical study to investigate the categories of Web3 application and their popularity, as well as the potential challenges and opportunities within this emerging landscape. Our research was carried out in two phases. In the first phase, we analyzed 200 popular Web3 projects associated with 10 leading Web3 venture capital firms. In the second phase, we collected and examined code-related data from GitHub and market-related data from blockchain browsers (e.g., Etherscan) for these projects. Our analysis revealed that the Web3 ecosystem can be categorized into two groups, i.e., Web3 infrastructure and Web3 applications, with each consisting of several subcategories or subdomains. We also gained insights into the popularity of these Web3 projects at both the code and market levels and pointed out the challenges in the Web3 ecosystem at the system, developer, and user levels, as well as the opportunities it presents. Our findings contribute to a better understanding of Web3 for researchers and developers, promoting further exploration and advancement in this innovative field.
Wensheng Gan, Zhenqiang Ye, Shicheng Wan, Philip S. Yu
With the rapid growth of the Internet, human daily life has become deeply bound to the Internet. To take advantage of massive amounts of data and information on the internet, the Web architecture is continuously being reinvented and upgraded. From the static informative characteristics of Web 1.0 to the dynamic interactive features of Web 2.0, scholars and engineers have worked hard to make the internet world more open, inclusive, and equal. Indeed, the next generation of Web evolution (i.e., Web 3.0) is already coming and shaping our lives. Web 3.0 is a decentralized Web architecture that is more intelligent and safer than before. The risks and ruin posed by monopolists or criminals will be greatly reduced by a complete reconstruction of the Internet and IT infrastructure. In a word, Web 3.0 is capable of addressing web data ownership according to distributed technology. It will optimize the internet world from the perspectives of economy, culture, and technology. Then it promotes novel content production methods, organizational structures, and economic forms. However, Web 3.0 is not mature and is now being disputed. Herein, this paper presents a comprehensive survey of Web 3.0, with a focus on current technologies, challenges, opportunities, and outlook. This article first introduces a brief overview of the history of World Wide Web as well as several differences among Web 1.0, Web 2.0, Web 3.0, and Web3. Then, some technical implementations of Web 3.0 are illustrated in detail. We discuss the revolution and benefits that Web 3.0 brings. Finally, we explore several challenges and issues in this promising area.
Yusra Mohammed AlRoshdi, Mohammed Al-Badawi, Abdullah Al-Hamdani, Mohamed Sarrab
Decentralized Web (Web3) and Finance (DeFi) have become the main discussion topic in research and industry fields.Cryptocurrencies, as an essential part of DeFi, enjoyed the interest of many stakeholders such as companies, professionals, researchers, and even common citizens eager to benefit from the proposed ecosystems.Although previous research studies focused on establishing price prediction systems using Sentiment Analysis (SA) techniques, the main focus of these studies was the performance of the predictive system rather than the accuracy and efficiency of the used models.In our work, we address two research questions; the predictability of cryptocurrency price based on past social and technical information, and the effect of social features on cryptocurrency price fluctuations using an SA and a Time Series approach.A combination of selected social and technical features was processed and reframed as a prediction problem, then studied to assess the ability of our model to predict the desired price.We noted that there is both an explicit correlation for some considered features and implicit for others, also social features including overall positive and neutral sentiment, and community engagement improved the performance of our model.
This paper presents an architectural overview and detailed design of the Krypton network, the first decentralized search engine built on Web3 principles. Krypton leverages blockchain technology, token-driven incentives, and privacy-focused features to revolutionize internet search. The proposed solution incorporates distributed storage, decentralized web crawling and indexing, a consensus mechanism, open-source search algorithms, and a privacy-focused search experience. Krypton introduces the novel concept of Proof of Learning, a machine learning protocol embedded in the search engine to facilitate the discovery of decentralized platforms and enable direct peer-to-peer networking. The system also employs decentralized cloud technologies (validators in the PoS blockchain) to promote enhanced decentralization and encryption, paving the way for a more secure and equitable internet.
The search for smart contract source codes has drawn research attention to fulfill developers’ and researchers’ needs. Yet, the existing studies are not mature enough to address smart contracts’ technical properties and functionalities. This paper proposes a system to improve the naive search for smart contract codes; for example, Etherscan has one keyword search feature without regard to the contract structure. We consider clustering smart contracts based on developers’ preferences, which increases the probability that the resulting source codes match developers’ needs. Our experimental results show a significant improvement in the complexity of the retrieved source codes of smart contracts compared with the baseline scenario using blockchain search engines (e.g., Etherscan). Our solution reduces the number of retrieved smart contract codes the developer has to check if the codes match her/his needs by 94%, 88%, 82%, or 98%, depending on the user’s search preferences.
Abstract Event studies in general rely on having a high-quality curated database of events. In this paper we introduce CryptoGDelt2022, a news event dataset extracted from the Global Database of Events, Language and Tone (GDELT) containing more than 243 thousands cryptocurrency related news events between the 31st of March 2021 and 30th of April 2022. The dataset is enriched with supervised machine learning scores for Relevance, Sentiment and Strength. Supervised Relevance Score measures how related to Cryptocurrency the topic is using news web scrapped from Yahoo in general and from the Cryptocurrency part of the site, after a comparison of approaches; Latent Dirichlet Allocation (LDA), BERT and Naive Bayes, Naive Bayes was chosen and the hyper-parameter tuned model reached accuracy: 97.84 % in the train set and 91.70% in the test set. Supervised Sentiment Score measures the negative, neutral or positive tone of the news, after hyper-parameter tuning, the retrained FinBERT model achieved accuracy of 92.63% in the train set and 86.11% in the test set. Supervised Strength Score measures how strong the news by using the abnormal return using Fama French 3-factor model as target output variable, after hyper-parameter tuning, the trained Naive Bayes model reached accuracy of 63.34%. The work concludes that GDELT is more reliable source of event when compared to news selected from cryptocurrency specialized websites as it presents a more balanced positive and negative number of news. All data sets and Python Jupyter Notebooks are available in the project's GitHub.
Md. Amir Hossain Fahad, Redoyan Chowdhury, Hasan-Al– Shabbir
Web development has greatly advanced from basic static web pages to dynamic, datadriven applications utilizing modern technology. Specifically, this article looks at the past, present, and future of web development, focusing on the importance of artificial intelligence (AI), progressive web apps (PWAs), security measures, and performance improvement. The adoption of contemporary frontend and backend technologies has improved user experience, scalability, and security, while nascent trends like Web3, blockchain integration, and decentralized apps (DApps) are poised to transform the digital environment. Even with these advances, there are still problems, such as cybersecurity risks, accessibility issues, and the need to keep improving online performance. This evaluation shows how important it is to welcome new technologies while also addressing important problems in order to create a safe, effective, and welcoming digital world. Future research must concentrate on enhancing cybersecurity frameworks, refining AI-driven web development, and investigating decentralized computing paradigms. Utilizing advanced technology, web developers may design more intelligent, responsive, and user-centric online apps that satisfy the increasing expectations of the digital age.
This paper examines the effects of inherent risks in the emerging technology of non-fungible tokens and proposes an actionable set of solutions for stakeholders in this ecosystem and observers. Web3 and NFTs are a fast-growing 300 billion dollar economy with some clear, highly publicized harms that came to light recently. We set out to explore the risks to understand their nature and scope, and if we could find ways to mitigate them. In due course of investigation, we recap the background of the evolution of the web from a client-server model to the rise of Web2.0 tech giants in the early 2000s. We contrast how the Web3 movement is trying to re-establish the independent style of the early web. In our research we discover a primary set of risks and harms relevant to the ecosystem, and classify them into a simple taxonomy while addressing their mitigations with solutions. We arrive at a set of solutions that are a combination of processes to be adopted, and technological changes or improvements to be incorporated into the ecosystem, to implement risk mitigations. By linking mitigations to individual risks, we are confident our recommendations will improve the security maturity of the growing Web3 ecosystem. We are not endorsing, or recommending specifically any particular product or service in our solution set. Nor are we compensated or influenced in any way by these companies to list these products in our research. The evaluations of products in our research have to simply be viewed as suggested improvements.
Understanding the semantic of a collection of texts is a challenging task. Topic models are probabilistic models that aims at extracting "topics" from a corpus of documents. This task is particularly difficult when the corpus is composed of short texts, such as posts on social networks. Following several previous research papers, we explore in this paper a set of collected tweets about bitcoin. In this work, we train three topic models and evaluate their output with several scores. We also propose a concrete application of the extracted topics.
A group of researchers, builders and activists came together to discuss platform cooperativism and the intersection with the web3 movement. We touched on some of the key takeaways from the history of cooperatives that can be applied to developing new internet platforms and protocols, as well as the challenges platform cooperatives face scaling alternative models of ownership and control. Consequently, we investigated how developers and emerging internet companies might learn from the shared history of cooperatives and how, in practice, they can construct systems that respect cooperative ideals.
Smart Contracts are computer programs which implement and execute transactions and manage business logic on a decentralized public ledger. Smart Contracts can be written in different programming languages and for different Blockchains. Currently the most used language for Smart Contracts is Solidity and the most used platform is the Ethereum Blockchain. Assessing the quality of Smart Contract programs is an important task required to professional programmers, especially when a programming language has so powerful economic implications. It is therefore crucial to provide professional programmers with tools for the evaluation of Smart Contracts. In software engineering, software metrics has been defined and used to measure software quality and, more in general, to qualify software under the principle “You Can't Manage What You Don't Measure”. For the Solidity programming language there are only a few Standalone Applications to analyse the Smart Contract metrics. The aim of this paper is first to build a tool for the practical computation of a specific set of Solidity source code metrics, so that the set will be extensible in the future according also to Solidity compiler evolution, second to fully enable a web-based usage of the tool to access the metrics of the Solidity programming language. The tool, PASO, differently from the existing application, is able to give software metrics values for Smart Contracts written in Solidity programming language just using a web browser.