Blockchain Papers

Naufal Ziyaadaturrahman

No abstract is available for this record.

Jitendra Sharma, Jigyasu Dubey

No abstract is available for this record.

Steven Paul Nohr

Proof-of-Stake (PoS) consensus protocols commonly employ epochs as temporal abstractions to simplify validator accounting, reward distribution, and slashing enforcement. These designs assume clean and synchronized state transitions across epoch boundaries. In practice, distributed systems exhibit asynchronous execution, delayed finality, and implementation divergence.This paper introduces and analyzes <b><i>Validator Epoch Reset Collisions</i></b>, a class of temporal desynchronization vulnerabilities in which validator state resets, reward counters, slashing windows, or participation flags become inconsistently applied across epoch boundaries. We demonstrate how such collisions create exploitable enforcement gaps that can be leveraged to evade penalties, duplicate rewards, or bypass participation requirements—without violating protocol rules. We argue that epoch-based accounting introduces structural risks to economic security unless continuity-enforcing safeguards are applied.

Nai‐Wei Lo, Cheng-I Lin, Chih-Chieh Chang, Chi-Yang Chang · 5 authors

The growing frequency of malicious attacks on Internet of Things (IoT) devices has rendered conventional approaches with static label-dependent risk assessment models obsolete, especially when coping with unknown and continuo... | Find, read and cite all the research you need on Tech Science Press

Christopher Schulze

GLYPH is a transparent verification layer for Ethereum for trustless on-chain verification of heterogeneous proof systems. It unifies upstream SNARK and STARK settlement through a single packed arity-8 sumcheck verifier over p = 2^128 - 159, while preserving upstream assumptions. The design centers on a universal adapter surface, UCIR compilation, and a chain-bound artifact interface for stateless verification. Benchmark evidence in the whitepaper reports 29.45k total transaction gas in recorded testnet receipts. This record includes the whitepaper and the formal proof appendix.

Steven Paul Nohr

Airdrops are widely used in blockchain ecosystems as mechanisms for token distribution, user bootstrapping, and governance decentralization. These mechanisms frequently rely on balance or stake snapshots taken at specific blockchain heights or epochs to determine eligibility. However, snapshot-based distribution introduces a critical temporal vulnerability: the assumption that momentary state accurately represents sustained economic participation.This paper defines and analyzes <b><i>Airdrop Snapshot Spoofing</i></b>, a class of temporal state manipulation attacks in which adversaries exploit the gap between snapshot definition, execution, and settlement to illegitimately capture token allocations. We demonstrate that such exploits are not edge cases but structural weaknesses inherent to snapshot-based systems across Proof-of-Stake (PoS) and tokenized networks. We further argue that snapshot spoofing represents a core-layer economic security failure rather than a marketing or distribution flaw, and we outline mitigation strategies based on time-weighted enforcement and validator-level continuity checks.

Steven Paul Nohr

<b><i>Zombie Validator Resurrection</i></b> is a core consensus-layer exploit in Proof-of-Stake (PoS) and alternative Layer-1 networks where inactive, slashed, or economically abandoned validators regain influence without restoring proportional economic security. Through protocol gaps, state resets, or weak liveness enforcement, validators that should be neutralized re?-enter consensus, undermining safety assumptions and enabling stealth attacks. This paper formalizes the structural conditions enabling zombie validators, analyzes common resurrection mechanisms, and examines systemic risks to consensus integrity. We propose mitigation strategies to enforce validator lifecycle accountability and safeguard decentralized networks against stealth reactivation attacks.

Raj Mehta, Prasham Shah, Pimal Khanpara

No abstract is available for this record.

Ningyuan Chen, Chiew Foong Kwong, David Chieng, Pushpendu Kar · 8 authors

This paper addresses the pivotal issue of privacy in traffic condition assessment within Cellular Vehicle-to-Everything (C-V2X) and Intelligent Transportation Systems, specifically targeting applications that do not have stringent low-latency requirements. Despite significant advancements in the field, existing approaches often fail to provide robust privacy protection without compromising network efficiency and data integrity. Our study is motivated by the pressing need to overcome these limitations through solutions that enhance network reliability, data privacy, and node reputation management. At the core of our approach is the implementation of Zero-Knowledge Proofs (ZKPs), which facilitate the secure verification of vehicular data while safeguarding individual privacy. We developed a method for aggregating ZKPs to improve data processing efficiency, thereby substantially reducing network load. Moreover, our application of machine learning techniques for node trustworthiness assessment further strengthens network integrity. The integration of blockchain technology in our framework addresses the traditional centralisation challenges in C-V2X, particularly in the areas of data storage, processing, and verification, thereby enhancing the network's security and resilience. Our framework bridges these gaps, resulting in a 90% reduction in computation and storage costs on-chain compared to a non-aggregated benchmark where each proof is submitted individually. Additionally, the node trustworthiness assessment reduces network delay by up to 31.7%.

Subhasis Thakur, John Breslin

No abstract is available for this record.

Matěj Hůlek

Zero-knowledge důkazy (ZKP) umožňují dokazovateli přesvědčit ověřovatele o správnosti tvrzení, aniž by odhalil podkladový svědek. V posledních letech se ZKP stal klíčovou součástí aplikací chránících soukromí i škálovatelných blockchainových systémů, od stručných rollupů založených na SNARK až po transparentní konstrukce STARK založené na hašovacích funkcích a důkazy vykonání v systémech zkVM/zkEVM. Tato diplomová práce zkoumá hlavní moderní rodiny ZKP, včetně pairing-based zk-SNARKů, Plonkish protokolů, zk-STARKů, Bulletproofs a novějších hash-based přístupů k proximity testingu, jako je WHIR, se zaměřením na jejich kryptografické stavební bloky, bezpečnostní předpoklady a praktické kompromisy. Práce dále mapuje existující benchmarkingové přístupy a identifikuje běžné problémy, které komplikují spravedlivé porovnání, včetně nekonzistentních benchmarkových úloh, heterogenní volby parametrů a nereprodukovatelných běhových \\ prostředí. Na základě této analýzy práce vymezuje klíčové hodnoticí metriky a navrhuje sjednocený benchmarkingový framework typu host-agent s kontejnerizovanými provery, explicitními run manifesty, standardizovanými kontrakty výsledků a podporou jak pro CPU, tak pro GPU výpočetní cesty napříč systémy založenými na obvodech i zkVM. S využitím tohoto frameworku práce hodnotí reprezentativní implementace na sadě sémanticky porovnatelných primárních benchmarkových úloh a sekundárních benchmarkových úloh orientovaných na specializaci. Výsledky ukazují, že neexistuje jeden univerzálně nejlepší proof system: transparentní frameworky založené na obvodech, jako jsou Plonky3 a Winterfell, dosahují u primárních benchmarkových úloh nejlepších výsledků z hlediska doby generování důkazu a paměťových nároků, pairing-based systémy jako Groth16 a ICICLE poskytují nejmenší důkazy a nejrychlejší verifikaci pro scénáře omezené možnostmi ověřovatele nebo pro on-chain nasazení a systémy zkVM, jako jsou RISC Zero a SP1, směňují vyšší spotřebu paměti a větší důkazy za lepší programovatelnost a snazší integraci obecně použitelných výpočtů. Experimenty dále ukazují, že akcelerace pomocí GPU je nejpřínosnější u dostatečně velkých benchmarkových úloh, zatímco inicializační režie a limity VRAM její přínos u menších případů snižují. Celkově práce přispívá jak praktickým jednotným benchmarkingovým frameworkem, tak experimentálně podloženými doporučeními pro volbu ZKP přístupů v různých podmínkách nasazení, hardwaru, důvěryhodnostních modelů a bezpečnostních omezení.

Farhana Javed, Engin Zeydan, J Mangues-Bafalluy, Kapal Dev

Consumer electronics increasingly execute integrated sensing–communication–computing–control (ISCCC) loops locally, making trust, revocation, and audit at the moment of action the bottleneck. We propose an architecture that maintains action-time authorization on the household gateway while synchronizing cross-vendor trust state off-path through a permissioned trust registry. Devices do not write to the ledger; instead, the gateway periodically anchors succinct commitments (Merkle roots and policy/model digests). We implement a proof-of-concept registry on an IOTA DLT and evaluate three aspects. First, for off-path anchoring, we show that under microbursts of size-triggered commit batches the ledger time-to-confirmation remains narrow and milestone-dominated (median around 3.9–4.0 s and 95th percentile around 4.2 s at a ∼10 s coordinator cadence), with no sensitivity to burst size. Second, for registry reaction, we observe that revocation reaction time scales predictably with the snapshot cadence plus a few seconds of confirmation and probing delay: tightening the snapshot period from 60 s to 15 s shifts the empirical reaction-time distributions as expected. Third, for partition tolerance, we show that across normal, impaired, offline, and recovery phases, local decision latency remains in the sub-millisecond range (with only a few milliseconds of conservative extra latency when snapshots age) and anchoring resumes within the same 1–5 s confirmation envelope once connectivity returns. Overall, the results confirm that action-time decisions remain within tens-of-milliseconds budgets, while trust synchronization is predictable and tunable. In this setting, snapshot cadences of approximately 10–15 s for “hot” items (keys and ownership) and at least 60 s for “warm/cold” items (recalls and model checkpoints) provide a practical balance between revocation speed and polling cost. The open-source implementation is available at: https://github.com/ farhanajaved/PDL-Trust.

Alireza Kavousi, Duc V. Le, Philipp Jovanovic, George Danezis

Maximal Extractable Value (MEV) is a crucial challenge in blockchains and cryptocurrencies. A principal countermeasure is using encrypted mempools to hide the transaction payloads until they are committed in a block. However, the existing approaches based on encrypted mempools remain vulnerable to metadata leakage and may not provide sufficient mitigation against block producers due to their sole control in block preparation. In this paper, we propose techniques that utilize randomized permutation on the committed block, offering a multi-layer solution. With a focus on proof-of-stake (PoS) committee-based consensus, we then introduce BlindPerm, a framework that enhances an encrypted mempool with permutation and present various optimizations. Notably, we propose a construction where this enhancement comes at essentially no overhead by piggybacking on the encrypted mempool and without relying on any external entity such as randomness beacon. Further, we illustrate the effectiveness of our solutions by running simulations using historical Ethereum data.

Guesmi, Semia, Piazza, Carla, Gasparetto, Andrea, Rizzo, Matteo · 5 authors

Reentrancy remains one of the most critical vulnerabilities affecting Ethereum smart contracts. While many existing analysis tools focus on detecting classical single-function reentrancy, more complex forms such as cross-function reentrancy are harder to identify because they depend on execution semantics and interactions between multiple functions. In this work, we study reentrancy at the level of Ethereum Virtual Machine (EVM) execution traces. We extend the TxSpector framework with new Datalog-based detection rules designed to capture cross-function reentrancy patterns. To support this analysis, we also modernize the trace extraction component by adapting it to recent versions of the Ethereum client and updated EVM instructions. The proposed approach is evaluated on real Ethereum on-chain transaction traces. The results show that our method is able to detect cross-function reentrancy behaviors that are not captured by the original TxSpector rules, demonstrating the effectiveness of pattern-based logic detection at the EVM execution level.

Supriya Khadka, Sanchari Das

Public distributed ledgers enforce integrity through radical transparency, creating tension with data minimization principles required for regulatory compliance. While Zero-Knowledge Proofs (ZKPs) offer a theoretical privacy solution, existing constructions often overlook adversarial constraints in smart contract environments. Specifically, the asynchronous decoupling of off-chain proof generation from on-chain submission introduces front-running and proof-reuse risks in public mempools. In this work, we formalize Selective Disclosure Authorization Schemes (SDAS), a cryptographic primitive for granular and revocable compliance checks on public ledgers without revealing the underlying witness. We define a security model for SDAS, introducing Ledger-Bound Attribute Unlinkability and Context-Aware Sender Binding to capture how valid proofs remain bound to their intended authorization context. To validate sender binding, we present ZK-Compliance, an Ethereum-based instantiation that operationalizes a user-controlled "Grant, Verify, Revoke" lifecycle. We implement the sender-binding component using a 14-constraint Circom circuit that anchors the zero-knowledge proof to the executing on-chain sender address. Our Sepolia evaluation confirms practical viability: browser-based proof generation executes in under 200 ms, and on-chain verification costs 240,512 gas, neutralizing proof reuse by different callers while preserving strict attribute privacy.

Zhanwen Chen, Yannan Li, Willy Susilo

Long-range attacks pose a significant threat to the integrity of Proof-of-Stake (PoS) blockchains by enabling adversaries to reconstruct an alternative chain history embedded with fraudulent transactions. These attacks can deceive honest participants into accepting a maliciously crafted branch as the canonical chain. While Key Evolving Signature (KES) schemes are widely adopted to mitigate such threats, they typically rely on the assumption that validators behave honestly. In this work, we challenge this assumption by demonstrating how a malicious validator can exploit inherent limitations in existing KES-based mechanisms to mount a successful long-range attack. To address this critical vulnerability, we introduce a novel cryptographic construction that combines one-time signatures with commitment schemes. Our approach imposes constraints on the signing capabilities of validators, thereby significantly reducing the feasibility of long-range attacks. We provide rigorous formal security proofs to substantiate the robustness of our scheme and conduct a comprehensive performance evaluation. The results show that our solution is both computationally and storage efficient, making it a practical and scalable defense mechanism for real-world PoS blockchain deployments.

Steven Paul Nohr

Transaction fees are a core economic mechanism in blockchain systems, intended to price scarce blockspace and align resource consumption with economic cost. However, in Proof-of-Stake (PoS) and decentralized finance (DeFi) environments, fee mechanisms can be exploited to impose asymmetric and persistent economic harm without violating protocol rules. This paper defines <b><i>Gas Fee Drain Loops</i></b>, commonly referred to as <i>grief attacks</i>, as a class of economic exhaustion attacks that weaponize execution costs, transaction ordering, and revert semantics to drain capital from targeted participants. We analyze the structural conditions that enable such attacks, demonstrate why conventional fee market assumptions fail under adversarial strategies, and show how gas griefing degrades security through economic exclusion rather than consensus failure. Finally, we propose a logic-layer mitigation model that bounds execution costs, restores economic symmetry, and preserves open participation under adversarial conditions.

Steven Paul Nohr

Proof-of-Stake (PoS) and stablecoin systems rely on staking and collateralization mechanisms to represent real economic security. However, an increasing number of protocols permit the creation of <i>synthetic stake</i>—derivative, mirrored, or recursively referenced representations of the same underlying capital. This paper defines Synthetic Stake Inflation as a structural vulnerability in which the apparent quantity of staked or collateralized assets exceeds the realizable economic value securing the system. We analyze how liquid staking derivatives, recursive collateral usage, and cross-protocol composability enable stake amplification without proportional risk exposure. Existing safeguards, including slashing, collateral ratios, and audits, are shown to be insufficient due to their inability to detect stake duplication across domains. We propose a logic-layer enforcement model that constrains stake representation through exclusivity rules, provenance verification, and validator-level accounting. This approach restores the correspondence between economic reality and on-chain security metrics, addressing a critical integrity gap in modern PoS and stablecoin architectures.

Steven Paul Nohr

Proof-of-Stake (PoS) networks rely on slashing mechanisms to deter validator misbehavior and preserve consensus security. While early designs emphasized cryptographically verifiable conditions, many contemporary PoS systems increasingly incorporate social, governance, or reputation-based enforcement mechanisms to supplement protocol-level slashing. This paper identifies and formalizes a novel exploit class—<b><i>Social Slashing Exploits</i></b>—where subjective reputation signals, off-chain coordination, or governance influence are weaponized to selectively penalize honest validators or shield malicious actors. We analyze how reputation-driven enforcement undermines determinism, enables cartel behavior, and erodes consensus neutrality without requiring protocol violations. The paper argues that reputation-weighted slashing cannot provide reliable security guarantees in adversarial economic environments and proposes a logic-layer enforcement model based on execution-bound, objective misbehavior proofs. This approach restores deterministic accountability, preserves validator neutrality, and improves long-term system survivability.

Simone Valentini, Sowelu Avanzo, Elvinia Riccobene

No abstract is available for this record.

Marko Vukolić, Orestis Alpos, Jakov Mitrovski, Themis Papameletiou · 6 authors

This paper introduces Bitcoin-IPC, a protocol that scales Bitcoin through a network of permissionless, interconnected, programmable Proof-of-Stake (PoS) Layer-2 chains, called subnets, whose stake is denominated in L1 BTC. These subnets rely on Bitcoin L1 for the communication of critical information, settlement, and security. Subnets can communicate with each other and with Bitcoin: users deposit BTC from Bitcoin to a subnet and withdraw it back, and transfer wBTC directly between subnets. We provide formal definitions of these bridge protocols, incorporating a firewall property that limits the impact of malicious subnets on the security of the broader network. Our design, inspired by SWIFT messaging and embedded within Bitcoin's SegWit mechanism, enables seamless value transfer across L2 subnets. Uniquely, this mechanism reduces the virtual-byte cost per transaction (vB/tx) by up to 23x, compared to transacting natively on Bitcoin L1, effectively increasing monetary-transaction throughput from 7 tps to over 160 tps, without requiring any modifications to Bitcoin L1.

Mojtaba Eshghie, Melissa Mazura, Alexandre Bartel

We frame Ethereum transactions reverted by invariants-require(<invariant>)/ assert(<invariant>)/if (<invariant>) revert statements in the contract implementation-as a positive signal of active on-chain defenses. Despite their value, the defensive patterns in these transactions remain undiscovered and underutilized in security research. We present Raven, a framework that aligns reverted transactions to the invariant causing the reversion in the smart contract source code, embeds these invariants using our BERT-based fine-tuned model, and clusters them by semantic intent to mine defensive invariant categories on Ethereum. Evaluated on a sample of 20,000 reverted transactions, Raven achieves cohesive and meaningful clusters of transaction-reverting invariants. Manual expert review of the mined 19 semantic clusters uncovers six new invariant categories absent from existing invariant catalogs, including feature toggles, replay prevention, proof/signature verification, counters, caller-provided slippage thresholds, and allow/ban/bot lists. To demonstrate the practical utility of this invariant catalog mining pipeline, we conduct a case study using one of the newly discovered invariant categories as a fuzzing oracle to detect vulnerabilities in a real-world attack. Raven thus can map Ethereum's successful defenses. These invariant categories enable security researchers to develop analysis tools based on data-driven security oracles extracted from the smart contracts' working defenses.

Kichang Lee, Sungmin Lee, Jaeho Jin, JeongGil Ko

Modern cloud-based AI training relies on extensive telemetry and logs to ensure accountability. While these audit trails enable retrospective inspection, they struggle to address the inherent non-determinism of deep learning. Stochastic operations, such as dropout, create an ambiguity surface where attackers can mask malicious manipulations as natural random variance, granting them plausible deniability. Consequently, existing logging mechanisms cannot verify whether stochastic values were generated and applied honestly without exposing sensitive training data. To close this integrity gap, we introduce Verifiable Dropout, a privacy-preserving mechanism based on zero-knowledge proofs. We treat stochasticity not as an excuse but as a verifiable claim. Our approach binds dropout masks to a deterministic, cryptographically verifiable seed and proves the correct execution of the dropout operation. This design enables users to audit the integrity of stochastic training steps post-hoc, ensuring that randomness was neither biased nor cherry-picked, while strictly preserving the confidentiality of the model and data.

Jiho Lee, Jieun Lee, Zehua Wang, JaeSeung Song

The proliferation of Internet of Things (IoT) applications in safety-critical domains, such as healthcare, smart transportation, and industrial automation, demands robust solutions for data integrity, traceability, and security that surpass the capabilities of centralized databases. This paper analyzes how blockchain technology can be integrated with core IoT service functions—including data management, security, device management, group coordination, and automated billing—to enhance immutability, trust, and operational efficiency. Our analysis identifies practical use cases such as consensus-driven tamper-proof storage, role-based access control, firmware integrity verification, and automated micropayments. These use cases showcase blockchain’s potential beyond traditional data storage. Building on this, we propose a novel framework that integrates a permissioned distributed ledger with a standardized IoT service layer platform through a Blockchain Interworking Proxy Entity (BlockIPE). This proxy dynamically maps IoT service functions to smart contracts, enabling flexible data routing to conventional databases or blockchains based on the application requirements. We implement a Dockerized prototype that integrates a C-based oneM2M platform with an Ethereum-compatible permissioned ledger (implemented using Hyperledger Besu) via BlockIPE, incorporating security features such as role-based access control. For performance evaluation, we use Ganache to isolate proxy-level overhead and scalability. At the proxy level, the blockchain-integrated path achieves processing latencies (≈86 ms) comparable to, and slightly faster than, the traditional database path. Although the end-to-end latency is inherently governed by on-chain confirmation (≈0.586–1.086 s), the scalability remains high (up to 100,000 TPS). This validates that the architecture secures IoT ecosystems with manageable operational overhead.