January 2024 which covered recent catastrophic events such as Bitcoin Price Crash-2018, COVID-19, Global plummet in Oil Demand-2020, and Russia-Ukraine War. The findings reveal that NFTs and DeFi assets possess weak connectedness with housing market in normal market state, however, connectedness become robust in extreme bearish and bullish market states. Moreover, NFTs and DeFi assets are net transmitters and housing market acts as net receiver of shock in all market states. Investors, portfolio managers, and policymakers should carefully analyze both digital financial assets and housing market especially during extreme events to build well diversified profit-gaining portfolios and to formulate policies.
Although many tools have been developed to detect anomalies in smart contracts, the evaluation of these analysis tools has been hindered by the lack of adequate anomalisticreal-world contracts(i.e., smart contracts with addresses on Ethereum to achieve certain purposes). This problem prevents conducting reliable performance assessments on the analysis tools. An effective way to solve this problem is to inject anomalies intoreal-world contractsand automatically label the locations and types of the injected anomalies.SolidiFI, as the first and only tool in this area, was developed to automatically inject anomalies into Ethereum smart contracts. However,SolidiFIis subject to the limitations from its methodologies (e.g., its injection accuracy and authenticity are low). To address these limitations, we propose an approach calledSCAnoGenerator.SCAnoGeneratorsupports Solidity 0.5.x, 0.6.x, 0.7.x and enables automatic anomaly injection for Ethereum smart contracts via analyzing the contracts’ control and data flows. Based on this approach, we develop an open-source tool, which can inject 20 types of anomalies into smart contracts. The extensive experiments show thatSCAnoGeneratoroutperformsSolidiFIon the number of injected anomaly types, injection accuracy, and injection authenticity. The experimental results also reveal that existing analysis tools can only partially detect the anomalies injected bySCAnoGenerator.
Bianca-Elena Ialangi, Costin Carabaș, Nicolae Ţăpuş, Dinu Țurcanu
Currently, applications called Smart Contracts have taken a considerable leap in blockchain technology. Achieving transaction automation is a huge success that can have many uses. Like any technology in its infancy, there are many vulnerabilities that attackers can exploit. The paper aims to create a modular solution of a security framework for smart contracts in the MultiversX blockchain: a static analyser that can currently identify three vulnerabilities for smart contracts written in the Rust programming language. This tool can be helpful because the development and testing before smart contracts reach the blockchain are done by people, which means that human error can always occur. The objective is to minimize this unfortunate event by automating contract verification in the early stages of development. The encouraging results provide the conviction of an application that will have significant utility, whilst leaving room for improvements in the future.
In decentralized finance, any individual can pool their assets into an automated market maker (AMM) -- herein we focus on the constant product market maker (CPMM) -- in exchange for a claim on a fraction of future pool assets and fees earned from the market making operations. This position is represented by a liquidity token, whose prevailing on-chain price is effectively the initial deposited assets. Though this price is well-defined, we treat the liquidity token as a derivative position in the prices of the underlying assets for the CPMM in order to deduce risk-neutral pricing and hedging formulas, not dissimilar to the Black-Scholes result. Adopting this perspective, in a frictionless environment, hedging the CPMM liquidity token under fair valuation should produce a riskless process, which therefore grows at the risk-free rate, something that is not seen in empirical case studies under the prevailing price. With our novel pricing formula, we construct a method to calibrate a volatility to data which provides an updated (non-market) valuation which is consistent with the (near-continuous) replication strategy out-of-sample. We conclude with a discussion of novel AMM design considerations motivated by this derivative-pricing perspective.
To address the challenges of internal security policy compliance and dynamic threat response in organizations, we present a novel framework that integrates artificial intelligence (AI), blockchain, and smart contracts. We propose a system that automates the enforcement of security policies, reducing manual effort and potential human error. Utilizing AI, we can analyse cyber threat intelligence rapidly, identify non-compliances and automatically adjust cyber defence mechanisms. Blockchain technology provides an immutable ledger for transparent logging of compliance actions, while smart contracts ensure uniform application of security measures. The framework's effectiveness is demonstrated through simulations, showing improvements in compliance enforcement rates and response times compared to traditional methods. Ultimately, our approach provides for a scalable solution for managing complex security policies, reducing costs and enhancing the efficiency while achieving compliance. Finally, we discuss practical implications and propose future research directions to further refine the system and address implementation challenges.
Terrorism is a phenomenon that changes very quickly with time. One of the key factors to survey and evaluate its success is its flexibility and the ease with which it mutates into new forms that adapt its actions depending on their goals and their facility to get funding. International terrorism uses international corporations’ structure and management methods adapted to new technologies to produce a new form of decentralized terrorism that is complicated to fight with only the classical tools of legal enforcement agencie, as at present.
Oladipo Sopitan, Kayode S Adetola, Azeezat Wahab Morenikeji, Joye Ahmed Shonubi · 5 authors
Blockchain combined with smart contracts in banking and business dealings has emerged as an innovative method to enhance financial transparency while reducing potential risks. The earlier decentralized immutable ledger known as blockchain ensures transaction security and verification while minimizing fraudulent activities and operational shortcomings. Smart contracts function as self-expiring agreements withBlockchain and Smart Contracts for Financial Transparency and Risk Mitigation in Banking and Business Transactions https://iaeme.com/Home/journal/IJBC 2
Billions of dollars have been lost due to vulnerabilities in smart contracts. To counteract this, researchers have proposed attack frontrunning protections designed to preempt malicious transactions by inserting "whitehat" transactions ahead of them to protect the assets. In this paper, we demonstrate that existing frontrunning protections have become ineffective in real-world scenarios. Specifically, we collected 158 recent real-world attack transactions and discovered that 141 of them can bypass state-of-the-art frontrunning protections. We systematically analyze these attacks and show how inherent limitations of existing frontrunning techniques hinder them from protecting valuable assets in the real world. We then propose a new approach involving 1) preemptive hijack, and 2) attack backrunning, which circumvent the existing limitations and can help protect assets before and after an attack. Our approach adapts the exploit used in the attack to the same or similar contracts before and after the attack to safeguard the assets. We conceptualize adapting exploits as a program repair problem and apply established techniques to implement our approach into a full-fledged framework, BACKRUNNER. Running on previous attacks in 2023, BACKRUNNER can successfully rescue more than \$410M. In the real world, it has helped rescue over \$11.2M worth of assets in 28 separate incidents within two months.
In the digital asset domain, smart contracts, as an automated execution mechanism, can effectively address many issues in traditional digital asset protection. However, smart contract technology also faces the risk of malicious attacks. The existence of smart contract vulnerabilities primarily stems from two aspects: first, developers may not fully consider potential vulnerabilities when writing the contracts; second, blockchain platforms allow smart contracts to be freely uploaded, but once uploaded, they cannot be modified. This means that if someone discovers a vulnerability, they can exploit it for malicious attacks, causing losses. To address this, this paper proposes and implements a dual-layer smart contract framework aimed at achieving efficient, secure, and flexible digital asset management by combining asset contracts and regulatory contracts. The smart contract factory is used for the batch generation and deployment of asset and regulatory contracts, simplifying the contract creation process and enhancing system scalability. The interaction layer provides user-friendly asset management, while the regulatory layer ensures system security and stability through real-time monitoring and vulnerability detection. Functional testing and performance analysis using Geth and Remix on a local private chain have validated the practicality and reliability of this framework, which has also been successfully applied on a digital asset platform.
The Solidity smart contract language is deterministic by design. Nevertheless, some instances of nondeterminism (ND) in smart contracts stem from unpredictable inputs received during execution, such as inputs from asynchronous callbacks of Oracles or externally called contracts that halt unexpectedly. Such values must be validated to meet prespecified criteria before they reach critical program parts; otherwise, they can lead to nondeterministic state outcomes in smart contracts, which we refer to as ND-issues. To detect ND-issues, we propose an information flow-based analysis that tracks the unpredictable inputs and return values that are not validated before reaching critical program parts. We have implemented our proposal in FONOVA and evaluated it using 326 frequently used Ethereum smart contracts. The evaluation shows that FONOVA detects five times more exploitable instances of ND-issues with 12 times shorter analysis time than leading tools like Ethainter, Securify, and Mythril.
With the widespread adoption of smart contracts in automated financial transactions, the accurate and efficient processing of image data related to financial transactions has become a critical challenge.The successful execution of smart contracts relies on the precise verification of transaction voucher images, yet existing image processing technologies still face limitations in dealing with background complexity, noise interference, and text extraction accuracy.To address these issues, this study proposes a comprehensive image processing approach aimed at enhancing the automation of financial transaction verification.The research focuses on four key areas: separation of table lines and text regions in images, application of Sauvola local adaptive binarization, table detection and reconstruction, and text extraction and fracture restoration techniques.Through these efforts, the study aims to provide more efficient and reliable technical support for financial transaction verification in smart contracts, thereby advancing the development of smart contract technologies.
Blockchain technology and smart contracts are emerging as transformative tools for enhancing transparency and efficiency in supply chain management and vendor relations. Traditional supply chains often face challenges such as inefficiencies, lack of transparency, and susceptibility to fraud (Kouhizadeh & Sarkis, 2018). Blockchain, a decentralized ledger technology, coupled with smart contracts, which are self-executing contracts with the terms directly written into code, offers promising solutions to these challenges (Wang, Han, & Beynon-Davies, 2019). This paper explores the application of blockchain and smart contracts in these domains, examining their potential to provide immutable records, streamline processes, and mitigate risks (Casado-Vara et al., 2018). Through a comprehensive analysis of current literature and case studies, we identify key benefits including improved transparency, enhanced efficiency, and better risk management (Christidis & Devetsikiotis, 2016; Tian, 2016). Our findings suggest that blockchain and smart contracts can significantly improve supply chain transparency and vendor management, though their implementation requires careful consideration of technical, regulatory, and organizational factors (Saberi et al., 2019). Notable case studies, such as Walmart’s blockchain pilot for food safety and De Beers' diamond tracking initiative, illustrate the practical benefits and challenges of adopting these technologies in real-world scenarios (Casino, Dasaklis, & Patsakis, 2019; Kshetri, 2018). Despite the promising outlook, further research is needed to address scalability, interoperability, and regulatory compliance issues to fully realize the potential of blockchain and smart contracts in supply chain management (Hughes et al., 2019).
In the realm of smart contract security, transaction malice detection has been able to leverage properties of transaction traces to identify hacks with high accuracy. However, these methods cannot be applied in real-time to revert malicious transactions. Instead, smart contracts are often instrumented with some safety properties to enhance their security. However, these instrumentable safety properties are limited and fail to block certain types of hacks such as those which exploit read-only re-entrancy. This limitation primarily stems from the Ethereum Virtual Machine's (EVM) inability to allow a smart contract to read transaction traces in real-time. Additionally, these instrumentable safety properties can be gas-intensive, rendering them impractical for on-the-fly validation. To address these challenges, we propose modifications to both the EVM and Ethereum clients, enabling smart contracts to validate these transaction trace properties in real-time without affecting traditional EVM execution. We also use past-time linear temporal logic (PLTL) to formalize transaction trace properties, showcasing that most existing detection metrics can be expressed using PLTL. We also discuss the potential implications of our proposed modifications, emphasizing their capacity to significantly enhance smart contract security.
Reentrancy vulnerability is one of the most serious security issues in smart contracts, resulting in millions of dollars in economic losses and posing a threat to the trust of the blockchain ecosystem. Therefore, researchers are paying more attention to this problem and have proposed various methods to detect and eliminate potential reentrancy vulnerabilities before contract deployment. Compared to symbolic execution and pattern-matching methods, fuzz testing method can achieve higher accuracy and are better suitable for detecting cross-contract vulnerabilities. However, existing fuzz testing tools often spend a long time exploring states with little pruning, and most of them adopt the reentrancy vulnerability oracle used by static analysis tools, which ignores whether the vulnerability can be exploited to compromise the access control, mutex, or time locks. To address these issues, we propose EvoFuzzer, an evolutionary fuzzer that focuses on the detection of reentrancy vulnerabilities. EvoFuzzer first leverages static analysis to exclude branches that have no impact on state transitions, then continuously optimizes test case generation using a genetic algorithm that considers both function sequence and parameter assignment, and Meanwhile, EvoFuzzer confirms whether reentrancy vulnerabilities can be exploited by simulating attacks. Our experiments have performed on 198 annotated contracts and 47 honeypot contracts, and experimental results show that EvoFuzzer can detect 91.7% of reentrancy vulnerabilities with no false positives, achieve the highest F1 score with 95.7%, which is 5.9% higher than the next best approach (Confuzzius), and we also find that it reduces more than 10% of branches when EvoFuzzer adopts a pruning strategy.
Yu Luo, Weifeng Xu, Karl Andersson, Mohammad Shahadat Hossain · 5 authors
The rapid expansion of smart contracts on blockchain platforms has significantly advanced the automation of transactions and agreements. However, the growing reliance on smart contracts increases security risks due to their immutable nature and interactions with digital assets. Existing vulnerability detection methods often fail to adapt to new and complex attack vectors and struggle to accurately predict specific vulnerability types. This paper introduces FELLMVP 1, a novel framework that integrates ensemble learning with Large Language Models (LLMs) to classify vulnerabilities in smart contracts. FELLMVP starts with the parsing of Solidity files to construct call graphs and Contract-External Function-Call (CEC) files for contract analysis. It fine-tunes eight LLMs, each targeted at detecting specific types of vulnerabilities and culminates and deploys an ensemble model that leverages the collective predictive capabilities of these LLMs. FELLMVP was evaluated on 15,637 real-world smart contracts spanning eight types of vulnerabilities, demonstrating superior performance over existing methods with an accuracy of 98.8% and F1 scores of 88%. FELLMVP also outperforms other LLMs such as Llama2-7b, CodeLlama, and Falcon-7b by 5 % -12 % on F1 score. Additionally, a case study using ChatGPT-4 to locate vulnerable code in smart contracts reveals that FELLMVP's prediction of specific vulnerability types enhances the debugging process compared to binary outcomes.
With the rapid development of blockchain technology, smart contracts, as one of its core applications, are gradually becoming a key tool in driving the digital transformation of various industries. Currently, the execution mechanism of smart contracts in most blockchain systems adopts a single-threaded serial execution and synchronous execution during the consensus process. Addressing the efficiency issues of this execution mechanism, this paper compares and analyzes synchronous and asynchronous execution mechanisms, identifying their advantages and challenges in the execution of smart contracts. We design a concurrent execution model for smart contracts based on asynchronous execution, considering the dependencies between contracts. A static analysis method is proposed to ensure that the concurrent execution of smart contracts does not lead to data inconsistency or conflicts. Experiments are designed to simulate the concurrent execution of smart contracts, evaluate the performance metrics of the model, and compare it with the existing synchronous execution model. The performance of these two modes is evaluated by simulation experiments and compared with the existing synchronous execution model. The experimental results show that the proposed concurrent execution model shows significant performance improvement in processing high-concurrency smart contracts, including improved throughput and reduced latency. The superiority of these two modes in high concurrency scenarios is verified, and good scalability is demonstrated.
Combining AI with blockchain smart contracts is possible and can significantly improve smart contracts' functionality, flexibility, and performance. In this paper, concepts of intelligent contracts, advanced through artificial intelligence, are described as potential solutions for increasing the efficiency and security of numerous industries. Some of these are explained by showing the application of the technology in financial services, supply chains, healthcare, and legal processes, as well as the practical enhancements brought about by this technology. Furthermore, the paper explores the prospects for developing the AI smart contract regarding compatibility, expansibility, ethical artificial intelligence, and superior automation. AI and blockchain integration are predicted to have immense impacts on economics and social advancements that will lead to increased automation and decentralization.
This chapter is focused on the specification and development of the i3MWallet, Auditable Accounting, Conflict Resolution, Explicit Consent, and Smart Contract Manager subsystems.
The smart contract manager (SCM) provides a gateway to access the smart contracts and is used by other subsystems to integrate their functionalities (conflict resolution, pricing manager, explicit user consent, and secure data exchanges).
Millions of smart contracts are deployed on various blockchain platforms, involving extensive digital assets. However, vulnerabilities within these smart contracts have resulted in substantial exploitation and asset losses. Traditional methods for detecting smart contract vulnerabilities are limited by their narrow detection range and enormous computational cost. This paper investigates how large language models (LLMs), particularly ChatGPT 4, can be leveraged to detect vulnerabilities in smart contracts. We conduct a comprehensive survey of several existing detection methods for smart contract vulnerabilities. Meanwhile, we design a variety of prompt information, and added contract opcodes and expert rules as auxiliary information. Utilizing ChatGPT, we evaluate the effectiveness of the large language model in identifying vulnerabilities across two datasets. The experimental results demonstrate that ChatGPT, informed by specific prompts, can effectively pinpoint vulnerabilities, highlighting the utility of LLMs in enhancing the security of smart contracts.
Electronic Medical Records (EMRs) offer significant benefits but are vulnerable to security breaches. Blockchain technology, with its inherent security, transparency, and decentralization, presents a promising solution for protecting sensitive patient data. This research proposes a blockchain-based EMR system that employs private keys generated using the SHA256 algorithm for enhanced security. By storing medical records as bytecode, we aim to create an immutable and tamper-proof record-keeping system. This approach has the potential to revolutionize healthcare data management and ensure patient privacy.