Information and communication technology based inter-organizational systems enable companies to integrate information and conduct business electronically across different parts of the organization. For organizations embracing blockchain, smart contracts provide automation and operational efficiency for inter-organizational systems. Initially utilised for financial transactions, smart contract are extended beyond banking and deployed in wide number of organizations. Smart contracts are regarded as self-executing type of contract consisting of agreement’s terms embedded directly into the code which plays a vital role in operability for inter-organizational systems, however, smart contract vulnerabilities can arise due to programming errors, leading to security issues. The effects of smart contract vulnerabilities can be significant, including loss of funds, unauthorized access to sensitive information, manipulation of data, and loss of trust in the application leading to catastrophic financial losses followed by legal implications for an organization based on blockchain technology. The goal of smart contracts exploiting vulnerabilities is to discover and eliminate potential security vulnerabilities in smart contract code prior to it being deployed. Detecting vulnerabilities in a timely manner helps to prevent financial losses, unauthorized access, and data manipulation. In order to provide a robust solution to detect vulnerabilities in smart contracts, the proposed methodology presents a novel approach for rapid detection of vulnerabilities by integrating genetic algorithm with isolation forest. Furthermore, enhancing smart contract vulnerability identification with higher accuracy and false-positive rate provides a reliable gateway for organizations to adopt blockchain.
Existing research on smart contracts in construction primarily concentrates on their operational stage and the mechanics of their potential operation. The response to the question “Can we do it?” is a resounding yes. The next question to answer is “How do we do it?” The answer to this question involves a consideration of the adoption of smart contracts and their synthesis with the entire construction process, from procurement to the in-use phase. Particular attention is needed for integration into complementary and receptive working practices resulting in optimum conditions for adoption. The current risk is that smart contract adoption may suffer from a lack of clear guidance and occur on a piecemeal and ad hoc basis. This study proposes a principled approach to counter this risk. This approach has been seen before in construction law in the form of the Abrahamson principles, which are a seminal reference point in any discussion of construction law. A framework is proposed, based on five key principles, to guide the automation of contract terms, highlighting the importance of control, codifiability, consideration, efficiency, and data access. The approach uses an interdisciplinary methodology with an applied professional constituency to promote law reform–based research. The inductive/deductive approach aims to share insights with the hope that the resulting principles will aid in the incremental implementation of smart contracts in the industry.
To address the shortcomings of traditional smart contract vulnerability detection methods with low accuracy and the limitations of single-model deep learning approaches, this paper focuses on reentrancy vulnerabilities, one of the most representative vulnerabilities in smart contracts. It introduces an intelligent contract reentrancy vulnerability detection method based on a hybrid CNN and LSTM-Attention model. Initially, the opcode sequences of smart contracts undergo preprocessing and simplification operations. The processed opcode sequences are then trained using the Word2Vec model to obtain word vectors. Subsequently, CNN is employed to extract local features from the opcode sequences, while LSTM is used to extract global features. An attention mechanism is introduced after LSTM to compute attention scores for the output information. Finally, the outputs of CNN and LSTM-Attention are fused for vulnerability detection. Experimental results demonstrate that compared to both deep learning models and traditional tools, this approach significantly improves accuracy, recall, and F1 score, achieving an accuracy of 89.79%and exhibiting effective detection capabilities.
Smart contracts are decentralized applications built atop blockchains like Ethereum. Recent research has shown that large language models (LLMs) have potential in auditing smart contracts, but the state-of-the-art indicates that even GPT-4 can achieve only 30% precision (when both decision and justification are correct). This is likely because off-the-shelf LLMs were primarily pre-trained on a general text/code corpus and not fine-tuned on the specific domain of Solidity smart contract auditing. In this paper, we propose iAudit, a general framework that combines fine-tuning and LLM-based agents for intuitive smart contract auditing with justifications. Specifically, iAudit is inspired by the observation that expert human auditors first perceive what could be wrong and then perform a detailed analysis of the code to identify the cause. As such, iAudit employs a two-stage fine-tuning approach: it first tunes a Detector model to make decisions and then tunes a Reasoner model to generate causes of vulnerabilities. However, fine-tuning alone faces challenges in accurately identifying the optimal cause of a vulnerability. Therefore, we introduce two LLM-based agents, the Ranker and Critic, to iteratively select and debate the most suitable cause of vulnerability based on the output of the fine-tuned Reasoner model. To evaluate iAudit, we collected a balanced dataset with 1,734 positive and 1,810 negative samples to fine-tune iAudit. We then compared it with traditional fine-tuned models (CodeBERT, GraphCodeBERT, CodeT5, and UnixCoder) as well as prompt learning-based LLMs (GPT4, GPT-3.5, and CodeLlama-13b/34b). On a dataset of 263 real smart contract vulnerabilities, iAudit achieves an F1 score of 91.21% and an accuracy of 91.11%. The causes generated by iAudit achieved a consistency of about 38% compared to the ground truth causes.
Jayashree Bhattacharjee, Lata Kumari Pandey, Ranjit Singh, H. Kent Baker
This study explores risk perceptions in cryptocurrency investments among Indian investors. It employs a multistage random sampling survey of 228 investors. Four key factors influence this perception: conceptual clarity, investment education, awareness of investment options, and fear-induced psychological factors. The overall risk perception of crypto investors is high. Based on our findings, we suggest that the Indian government should organize an awareness campaign to create awareness and educate investors about cryptocurrency. Policymakers and investment managers should focus on transforming high-risk investors into lower-risk investors through education and support, fostering a more favorable investment environment.
K. L. Meera, C. Vijai, Rosy Kalia, Harshal Raje · 6 authors
Blockchain is a very useful technique in many areas including finance/insurance /banking services. It does not require any third-party so it is impossible to delete/alter/temper information once loaded on it. It is time-efficient and cost-friendly. It allows smooth and quick KYC update and permits real-time document verification. The encryption in blockchain network make use of cryptography algorithm and hashing for sharing data between participants. Such kind of encrypted transactions later get added in other blocks in the network. Because of immutability nodes in a blockchain system ledger operate in alignment for validation of transactions. Modification of any individual operation can only happen in consensus of other nodes that renders data more secure and reduces any temper attempts. Utilizing blockchain for fintech has given rise to a new type of model for financial usage which is called as decentralized finance DeFi. DeFi means those technical operations that ensure distributed financial exchange missions on blockchain network the combination of Fintech and blockchain in a DeFi has resulted in transparent, temper-proof, convenient, rigid, robust, and customized financial services and completely uprooted the very existence of third-party intermediaries
Fahad Alqahtani, Abdullah Alsharef, Abdullah Bin Dakhel, Hamad Alshaya · 5 authors
Construction contracts are often perceived as complex and lengthy documents, making information extraction significantly challenging. Smart contracts are recently introduced as an alternative to handle the contracts’ provisions, duties, and clauses. However, smart contracts are not yet widely adopted in the construction industry. This study reviewed the literature to understand smart contracts better and how they can benefit the construction industry. After that, the study utilized and designed an analytical approach-based quantitative survey to gather experts’ comments to evaluate the limited adoption of smart contracts in the construction industry. Study findings outlined the benefits and drawbacks of utilizing smart contracts, particularly emphasizing the Saudi Arabian construction industry and the challenges stakeholders must overcome. The study findings assessed the barriers to adopting smart contracts in the construction industry and will benefit the industry which is known for being slow to adopt new technologies.
Reentrancy vulnerability as one of the most notorious vulnerabilities, has been a prominent topic in smart contract security research. Research shows that existing vulnerability detection presents a range of challenges, especially as smart contracts continue to increase in complexity. Existing tools perform poorly in terms of efficiency and successful detection rates for vulnerabilities in complex contracts. To effectively detect reentrancy vulnerabilities in contracts with complex logic, we propose a tool named SliSE. SliSE’s detection process consists of two stages: Warning Search and Symbolic Execution Verification . In Stage I, SliSE utilizes program slicing to analyze the Inter-contract Program Dependency Graph (I-PDG) of the contract, and collects suspicious vulnerability information as warnings. In Stage II, symbolic execution is employed to verify the reachability of these warnings, thereby enhancing vulnerability detection accuracy. SliSE obtained the best performance compared with eight state-of-the-art detection tools. It achieved an F1 score of 78.65%, surpassing the highest score recorded by an existing tool of 9.26%. Additionally, it attained a recall rate exceeding 90% for detection of contracts on Ethereum. Overall, SliSE provides a robust and efficient method for detection of Reentrancy vulnerabilities for complex contracts.
With the continuous development of blockchain technology, smart contracts have found widespread application in various fields of production and daily life. However, as the number of smart contracts increases, so do the economic losses caused by vulnerabilities in these contracts. Consequently, ensuring the security of smart contracts has become a topic of great concern. Unfortunately, existing techniques for detecting smart contract vulnerabilities are insufficient. These detection methods heavily rely on fixed expert rules, leading to low detection accuracy and time-consuming processes as the complexity of smart contracts increases. A smart contract vulnerability detection methodology named SCVD-SA is proposed in this paper to address this issue. This model utilizes a hybrid deep learning approach and incorporates a self-attention mechanism. By combining Word2Vec word embeddings with various deep learning models, the model can extract features effectively. The introduction of a self-attention mechanism further enhances the model's ability to assign greater weights to more important features. Ultimately, these features are utilized for smart contract vulnerability detection. The proposed SCVD-SA method has been extensively evaluated on the public dataset SmartBugs Dataset-Wild, and the results demonstrate its superiority over several of the latest smart contract vulnerability detection methods in terms of detection effectiveness and stability. The detection accuracy for Callstack deep attack vulnerability and timestamp dependency vulnerability reaches 91.65% and 94.68%, respectively. Moreover, the detection accuracy for integer overflow vulnerabilities has also significantly improved, reaching 93.39%. Notably, SCVD-SA surpasses existing state-of-the-art models by 3.65% in detecting the widely studied reentrancy vulnerabilities.
Francesco Salzano, Simone Scalabrino, Rocco Oliveto, Remo Pareschi
Smart Contracts are programs running logic in the Blockchain network by executing operations through immutable transactions. The Blockchain network validates such transactions, storing them into sequential blocks of which integrity is ensured. Smart Contracts deal with value stakes, if a damaging transaction is validated, it may never be reverted, leading to unrecoverable losses. To prevent this, security aspects have been explored in several fields, with research providing catalogs of security defects, secure code recommendations, and possible solutions to fix vulnerabilities. In our study, we refer to vulnerability fixing in the ways found in the literature as guidelines. However, it is not clear to what extent developers adhere to these guidelines, nor whether there are other viable common solutions and what they are. The goal of our research is to fill knowledge gaps related to developers' observance of existing guidelines and to propose new and viable solutions to security vulnerabilities. To reach our goal, we will obtain from Solidity GitHub repositories the commits that fix vulnerabilities included in the DASP TOP 10 and we will conduct a manual analysis of fixing approaches employed by developers. Our analysis aims to determine the extent to which literature-based fixing strategies are followed. Additionally, we will identify and discuss emerging fixing techniques not currently documented in the literature. Through qualitative analysis, we will evaluate the suitability of these new fixing solutions and discriminate between valid approaches and potential mistakes.
Giacomo Ibba, Giuseppe Destefanis, Rumyana Neykova, Marco Ortu · 6 authors
The growing importance of Decentralized Applications (dApps) in areas such as the Internet of Things (IoT), Cybersecurity, and Finance is playing a crucial role in advancing software maintenance, security, and data sharing. Understanding the complex architecture and components of dApps is essential to harness their full benefits. This often involves the challenging task of identifying and retrieving key components during the dApp compilation process, particularly when dealing with multiple external dependencies. A case in point is the variety of versions in the OpenZeppelin libraries, where finding compatible elements can be a laborious process. In response to this challenge, we introduce DAI (Dependency Analyser and Installer), a novel tool that automates the identification of compatible external dependency versions for specific smart contracts. This tool significantly simplifies the compilation process for dApps that incorporate external modules, making it more efficient for developers and researchers. We evaluated DAI on 57 real-world dApps, achieving success in determining the right dependency match for 50 cases. However, the inability to compile the remaining 7 dApps due to missing files and artifacts highlights the ongoing complexities in dApp development.
We surveyed to measure the satisfaction of policyholders in Morocco, and the results clearly show that the majority of customers do not appreciate the current services. They suffer from the ambiguity of contracts, and delays in reimbursement and do not feel the real impact of insurance in society. To solve this problem, we propose an innovative insurance based on blockchain and waqf. We suggest in this paper, to use smart contracts to create an efficient and automatic process in the collection of premiums and reimbursement of policyholders. The goal of this paper is to build insurance that reflects the true meaning of solidarity through Waqf while integrating transparency and speed through Fintech. This insurance model is supposed to be resilient in times of crisis, have a strong social impact, and be attractive to customers. Many advantages of the proposed model are discussed in the paper. In addition, the suggested insurance model will be represented through simulations on the NetLogo platform. We carry out the analysis in normal times and evaluate the behavior of policyholders in choosing a specific type of insurance, depending on some decision-making tools. We also analyze the impact of insurance during a time of crisis, as a particular example, the crisis experienced during the coronavirus pandemic. The simulations aim to evaluate the model in different situations and prove its efficiency.
This study discusses the valuation and asset pricing of non-fungible tokens (NFTs), which are digital assets that represent unique items. The authors put forward a comprehensive framework for pricing NFTs and implementing asset pricing models in the NFT asset class. NFTs present a relatively difficult pricing problem, as the numerous idiosyncrasies of the NFT market have to be taken into account. The difficulties include the unique heterogeneous nature of NFTs, illiquid trading, limited data availability, high dimensionality of features relative to the available data, and the volatile time-varying price dynamics. The framework presented could potentially be expanded to the pricing of other “non-fungible” assets such as art, collectibles, and real estate.
The proliferation of smart contracts has led to a surge in hacking attacks, resulting in substantial financial losses and undermining the healthy growth of the blockchain ecosystem. To mitigate these challenges, this paper introduces a dynamic vulnerability detection approach for smart contracts leveraging machine learning techniques. The proposed method involves the extraction of opcode sequence features through a combination of the N-gram model and a weight penalty mechanism. The core objective is to identify vulnerabilities within deployed smart contracts by analyzing the opcode sequences during their dynamic execution. This approach falls under the category of dynamic detection, aiming to ensure the integrity and security of blockchain-based systems.
Tuan-Dung Tran, Kiet Anh Vo, Phan The Duy, Nguyen Tan Cam · 5 authors
Smart contracts are autonomous programs stored on blockchain networks that self-execute agreed terms in a transparent and accurate manner. Within cross-chain platforms, smart contracts facilitate interaction and exchange of data between diverse blockchains. However, the presence of vulnerabilities in smart contracts renders them susceptible to exploitation, jeopardizing security. Considerable research has focused on identifying and detecting such vulnerabilities, though existing approaches have yet to achieve comprehensive coverage. This paper presents ChainSniper, a sidechain-based framework integrating machine learning to automatically appraise vulnerabilities in cross-chain smart contracts. A comprehensive dataset, denoted "CrossChainSentinel", was compiled comprising 300 manually labeled code snippets. This dataset was leveraged to train machine learning models discerning vulnerable versus secure smart contracts. Experimental findings demonstrate the viability of machine learning methodologies for enhancing smart contract auditing within decentralized applications spanning multiple networks. Notable detection precision was achieved, substantiating ChainSniper’s potential to strengthen security analysis through an automated and expansive evaluation of smart contract code.
Reentrancy is one of the most notorious vulnerabilities in smart contracts, resulting in significant digital asset losses. However, many previous works indicate that current Reentrancy detection tools suffer from high false positive rates. Even worse, recent years have witnessed the emergence of new Reentrancy attack patterns fueled by intricate and diverse vulnerability exploit mechanisms. Unfortunately, current tools face a significant limitation in their capacity to adapt and detect these evolving Reentrancy patterns. Consequently, ensuring precise and highly extensible Reentrancy vulnerability detection remains critical challenges for existing tools. To address this issue, we propose a tool named ReEP, designed to reduce the false positives for Reentrancy vulnerability detection. Additionally, ReEP can integrate multiple tools, expanding its capacity for vulnerability detection. It evaluates results from existing tools to verify vulnerability likelihood and reduce false positives. ReEP also offers excellent extensibility, enabling the integration of different detection tools to enhance precision and cover different vulnerability attack patterns. We perform ReEP to eight existing state-of-the-art Reentrancy detection tools. The average precision of these eight tools increased from the original 0.5% to 73% without sacrificing recall. Furthermore, ReEP exhibits robust extensibility. By integrating multiple tools, the precision further improved to a maximum of 83.6%. These results demonstrate that ReEP effectively unites the strengths of existing works, enhances the precision of Reentrancy vulnerability detection tools.
Purpose This study aims to examine the role of blockchain technology (BCT) in trust in financial reporting (TFR) and the use of smart contracts (USC). It aims to ascertain the mediating role of USC in the relationship between BCT and TFR, thereby contributing to the limited empirical literature in this domain. Design/methodology/approach Based on a sample of the accountants’ familiarity with BCT, a structural equation model was constructed and analyzed using AMOS 24. The model proposes and tests relationships between BCT, USC and TFR. Findings The study highlights BCT’s significant positive influence on TFR, with USC mediating this effect. It provides empirical evidence that supports the transformative potential of BCT and USC in enhancing TFR. Practical implications These findings have significant implications for practitioners, regulatory bodies and policymakers. By highlighting the effectiveness of BCT and USC in fostering TFR, the study makes one aware of strategies to mitigate financial malpractices. It promotes the adoption of BCT in accounting practices. Originality/value This study addresses a gap in the literature by investigating the complex interplay of BCT, USC and TFR. It offers a unique perspective by exploring the mediating role of USC, thereby enhancing our understanding of the mechanisms through which BCT can foster TFR.
Although there is currently no Bitcoin futures trading in Chinese Mainland, there is the possibility of financial innovation in future.The success or failure of the U.S. Bitcoin futures trading was analyzed from an empirical perspective: Regulators replace active review with self-certification, and Bitcoin futures trading violates the law of one price, both of which are prone to financial risks.Bitcoin futures break through previous government barriers that largely separated the virtual currency market from the regulated financial system.Although it has a positive role in integrating the virtual currency market with the broader financial system, it is not recommended for Chinese domestic use in the near future.The futures contract market listed by exchanges should be contracts that are not easily manipulated.In the future, domestic Bitcoin futures trading should emphasize legal regulations and technical support and strengthen the approval process before new products are launched.
Mario Iván Contreras-Valdez, Sonal Sahu, José Antonio Núñez Mora, Roberto J. Santillán‐Salgado
In the broader landscape of cryptocurrency risk management, this study delves into the nuanced estimation of Value-at-Risk (VaR) for a uniformly weighted portfolio of cryptocurrencies, employing the bivariate Normal Inverse Gaussian distribution renowned for its semi-heavy tails. Utilizing high-frequency data spanning between 1 January 2017 and 25 October 2022, with a primary focus on Bitcoin and Ethereum, our research seeks to accentuate the resilience of VaR methodology as a paramount risk assessment tool. The essence of our investigation lies in advancing the comprehension of VaR accuracy by quantitatively comparing the observed returns of both cryptocurrencies with their corresponding estimated values, with a central theme being the endorsement of the Normal Inverse Gaussian distribution as a potent model for risk measurement, particularly in the domain of high-frequency data. To bolster the statistical reliability of our results, we adopt a forward test methodology, showcasing not only a contribution to the evolution of risk assessment techniques in Finance but also underscoring the practicality of sophisticated distributional models in econometrics. Our findings not only contribute to the refinement of risk assessment methods but also highlight the applicability of such models in precisely modeling and forecasting financial risk within the dynamic realm of cryptocurrencies, epitomized by the case study of Bitcoin and Ethereum.
Because of many advanced features, Decentralized Finance (DeFi) has become a hot topic in the past decade. As an application of blockchain technology, DeFi allows people to trade cryptocurrencies and other financial products more efficiently, securely, and privately. Specifically, using smart contracts further improves transaction rate and the quality of user experience (QoE) by defining the business logic via code. However, if smart contracts are not audited before compiling on an immutable blockchain, it may result in losses of millions. Therefore, there is a compelling need for efficient and effective measures to ensure the robustness and genuineness of smart contracts. In this paper, we propose a Homogeneous Graph Machine Learning Algorithm for Reentrancy attacks DEtection using Graph Convolution Networks (HARDEN). Reentrancy attacks are one of the most infamous vulnerabilities in smart contracts. The experimental results are encouraging and validate the feasibility of applying a Deep Learning (DL) approach to detect vulnerabilities in smart contracts. We hope this preliminary study will inspire more interest and discussions in the raising area.
Abstract Financial transaction transparency has gradually become one of the main directions for the development and construction of the financial transaction market. This paper integrates blockchain and smart contracts and proposes a strategy to improve financial transaction transparency in order to protect transaction data privacy and identify and trace transaction anomalies. The proposed DM-IBBE scheme for smart contract transaction privacy involves choosing different interpolation points based on Lagrange interpolation curves and creating encryption modes that meet the requirements for financial transaction privacy. Based on a graph neural network, the propagation probability of abnormal transactions is calculated from the blockchain network topology using the TAGCN model, and the influence of irrelevant noise pairs is eliminated to realize the identification and traceability of abnormal transactions. Taking the financial transaction platform of City A as the research object and carrying out the practice of financial transaction optimization, the evaluation scores of the first-level indexes of comprehensive government transparency, transaction process transparency, operation result transparency, process service transparency, and operation transparency and guarantee are 76.58, 88.93, 95.42, 89.51, and 88.43, and except for the indexes of comprehensive government transparency, the other indexes are all greater than 80 points. The second-level indicators’ evaluation value increases from the 50–70 score range before financial transactions optimization to the 80–100 score range. The financial transaction platform in City A has significantly improved the transparency of financial transactions.