Aaron Chan, Alex Ding, Frank Sicong Chen, Alan Wu · 6 authors
The rapid integration of Large Language Models (LLMs) into decentralized physical infrastructure networks (DePIN) is currently bottlenecked by the Verifiability Trilemma, which posits that a decentralized inference system cannot simultaneously achieve high computational integrity, low latency, and low cost. Existing cryptographic solutions, such as Zero-Knowledge Machine Learning (ZKML), suffer from superlinear proving overheads (O(k NlogN)) that render them infeasible for billionparameter models. Conversely, optimistic approaches (opML) impose prohibitive dispute windows, preventing real-time interactivity, while recent "Proof of Quality" (PoQ) paradigms sacrifice cryptographic integrity for subjective semantic evaluation, leaving networks vulnerable to model downgrade attacks and reward hacking. In this paper, we introduce Optimistic TEE-Rollups (OTR), a hybrid verification protocol that harmonizes these constraints. OTR leverages NVIDIA H100 Confidential Computing Trusted Execution Environments (TEEs) to provide sub-second Provisional Finality, underpinned by an optimistic fraud-proof mechanism and stochastic Zero-Knowledge spot-checks to mitigate hardware side-channel risks. We formally define Proof of Efficient Attribution (PoEA), a consensus mechanism that cryptographically binds execution traces to hardware attestations, thereby guaranteeing model authenticity. Extensive simulations demonstrate that OTR achieves 99% of the throughput of centralized baselines with a marginal cost overhead of $0.07 per query, maintaining Byzantine fault tolerance against rational adversaries even in the presence of transient hardware vulnerabilities.
The Proof of Stake(PoS) consensus procedure has become a largely embraced option to the energy-demanding Proof of Work (PoW) contract, guaranteeing the integrity, reliability, and decentralization in the latest Blockchain programme. In a PoS system, staking procedures, validator and delegation functions, reward distribution processes, and governance control operations must be implemented accurately to maintain the system's security. This paper represents the formal verification and validation of Stake Manager key features, as verification of validators and delegators, setting staking tokens, reward evaluation and distribution, and authentication of the owner. This formal model is evolved using the Communicating Sequential Processes (CSP#), and this model is verified concerning critical safety and liveness properties defined in Linear Temporal Logic formula (LTL). The Process Analysis Toolkit (PAT) model checker is used to check these properties, containing accurate reward distribution and exclusion of deadlocks. This verification mechanism ensures that all processes work properly in all feasible execution states. The results ensure the reliability and security of the Stake Manager Contract and emphasize the efficacy of formal verification in securing the PoS blockchain structure.
Gazi Maliha Raisa Noor, Md Ashikul Islam, Saha Reno, S. Mahin
Managing intellectual property (IP) in the digital age presents significant challenges, including unauthorized duplication, unclear ownership, and insufficient verification mechanisms. This paper proposes a blockchain-based framework that integrates Hyperledger Fabric, Interplanetary File System (IPFS), and Non-Fungible Tokens (NFTs) to ensure secure, transparent, and tamper-proof IP management. Hyperledger Fabric serves as the permissioned blockchain platform, using the RAFT (Replicated And Fault-Tolerant) consensus protocol to achieve fast, fault-tolerant agreement with low latency and moderate resource consumption. IP assets are stored off-chain using IPFS, with their metadata encapsulated in NFTs for unique identification, traceability, and automated licensing via smart contracts. The system enables decentralized IP registration, verification, and transfer while preserving content integrity. Performance analysis shows that RAFT consistently outperforms PoW, PoS, and Clique in throughput, latency, and CPU usage, making it well-suited for high-performance enterprise applications. A cost breakdown also confirms the system's affordability and scalability. Finally, command-line validation demonstrates correct ledger operations and smart contract functionality. The proposed solution offers a practical and efficient alternative to traditional IP systems, with future improvements targeting enhanced access control and support for large-scale IP ecosystems.
Blockchain Technology Applications and Security
Physical Unclonable Functions (PUFs) and Hardware Security
How users adapt after being sandwiched remains unclear; this paper provides an empirical quantification. Using transaction level data from November 2024 to February 2025, enriched with mempool visibility and ZeroMEV labels, we track user outcomes after their n-th public sandwich: (i) reactivation, i.e., the resumption of on-chain activity within a 60-day window, and (ii) first-time adoption of private routing. We refer to users who do not reactivate within this window as churned, and to users experiencing multiple attacks (n>1) as undergoing repeated exposure. Our analysis reveals measurable behavioral adaptation: around 40% of victims migrate to private routing within 60 days, rising to 54% with repeated exposures. Churn peaks at 7.5% after the first sandwich but declines to 1-2%, consistent with survivor bias. In Nov-Dec 2024 we confirm 2,932 private sandwich attacks affecting 3,126 private victim transactions, producing \$409,236 in losses and \$293,786 in attacker profits. A single bot accounts for nearly two-thirds of private frontruns, and private sandwich activity is heavily concentrated on a small set of DEX pools. These results highlight that private routing does not guarantee protection from MEV extraction: while execution failures push users toward private channels, these remain exploitable and highly concentrated, demanding continuous monitoring and protocol-level defenses.
Abstract This paper revisits Virgo, a well-known transparent zero-knowledge proof system that has been used in many subsequent studies. Through our analysis, we uncover previously overlooked limitations and several exploitable security vulnerabilities within Virgo’s zkVPD protocol design and implementation. We subsequently address these issues and improve Virgo’s zkVPD protocol. Our improvements feature simplified but more efficient VPD and zkVPD algorithms, offering enhanced support for computations over binary fields and their extension fields.
The rapid growth of IoT devices in smart home environments has introduced significant challenges in ensuring secure, scalable, and efficient communication among heterogeneous devices. Centralized architectures suffer from a single point of failure, while blockchain-only solutions face high latency, limiting their use in real-time control. To address these issues, we propose a multi-layered decentralized framework that combines a consortium blockchain, a trusted off-chain coordinator, group-based zero-knowledge proofs (ZKPs), and a two-tiered access control policy (ACP) architecture. The consortium blockchain provides an immutable ledger for device identities and foundational, coarse-grained ACP enforcement through smart contracts, ensuring tamper-proof trust. For privacy-preserving mutual authentication, a group-based ZKP protocol enables collective device authorization without revealing sensitive keys. The off-chain coordinator complements this by enforcing dynamic security mechanisms, including fine-grained ACPv2 checks—such as rate limits, time-of-day restrictions, and device telemetry—in addition to anomaly detection for behavioral risk assessment. This proposed hybrid structure achieves both immutability and high efficiency over traditional methods. A performance evaluation highlighted the framework’s efficiency by demonstrating that the core ZKP verification for a 500-device group can be completed in just 190 ms. The framework drastically reduces on-chain costs, with critical access control policy transactions consuming only 82,748 gas—a reduction of over 90% compared to benchmarked on-chain systems. The complete end-to-end workflow, from user request to secure session establishment, has a latency bound of approximately 3s. Formal security verification with the BAN and AVISPA tools validates resilience against common attacks, including man-in-the-middle, replay, and impersonation, while static analysis using the Slither framework confirms the absence of critical vulnerabilities in the smart contract code. By combining an immutable on-chain foundation with intelligent, dynamic off-chain enforcement, our proposed framework provides a uniquely resilient, scalable, and adaptive security solution for modern smart home systems.
Dhanush K, Tamilvelan S, Hari L, R. Roopa Chandrika
The growing adoption of lightweight, scalable, and resistant to tampering security mechanisms in the face of broad use of Internet-of-Things (IoT) and edge computing devices requires such mechanisms to be not based on centralized trust or bulky cryptography. The promising answer to this is the concept of Physical Unclonable Functions (PUFs) which relies on naturally existing manufacturing differences to produce device-specific, unclonable responses. Nevertheless, existing PUF-based authentication systems have significant flaws, such as centralized Challenge-Response Pair (CRP) storage vulnerable to attacks, vulnerability to machine learning, and no support of secure data recovery and sharing in distributed settings. This paper suggests a distributed authentication and recoverable data sharing framework that reduces these drawbacks, PUF-as-a-Service (PUFaaS). PUFaaS presents a multi-dimensional space of CRP, spreading the domain of challenges with respect to various operational parameters to maximize security against modeling attacks. Helper data of fuzzy extractors are secured with Shamir's secret sharing over distributed nodes and without having single points of weakness. A mechanism based on fuzzy vaults provides recoverable data binding, whereby encryption keys or sensitive data can be re-assembled successfully on successful verification of stable PUF responses. Authentication is carried out by way of lightweight commitment protocol, message authentication protocol and optional zero-knowledge proof guarantees privacy. Experimental analysis shows that PUFaaS can be evaluated as having low false acceptance and rejection, high modeling attack resistance, and scale efficiently (appropriate to large-scale IoT and cloud-edge). PUFaaS will offer an effective, privacy-resilient, and scalable solution to distributed authentication and secure information exchange in a non-trusted environment by converting PUFs into a service-oriented architecture.
Physical Unclonable Functions (PUFs) and Hardware Security
Ghassan Samara, Ibrahim Obeidat, Mais Haj Qasem, Raed Alazaidah · 9 authors
Vehicular networks must authenticate high-rate safety messages under tight latency while preserving privacy and remaining secure against post-quantum adversaries. We present$P Q$-Rate, a post-quantum, privacy-preserving, rate-limited credential system for C-V2X. PQ-Rate replaces per-message signatures with a one-round-trip (1-RTT) KEM handshake to derive an AEAD session key, keeping the fast path lightweight. Vehicles obtain unlinkable Rate-Limited Anonymous Tokens (RLATs) from edge issuers (RSU/MEC) via a threshold VOPRF; each token is spent once using a zero-knowledge proof that binds a unique nullifier, enforcing per-epoch budgets without revealing identity. Revocation scales via compact, signed Bloom-filter digests broadcast by RSUs, with optional online disambiguation to handle rare false positives, and accountability is provided by threshold opening of verifiably encrypted token metadata. We prototype PQ-Rate in NS-3 with SUMO-driven mobility and compare against pseudonym-based PKI and verifier-local-revocation group signatures. Metrics include 1-RTT authentication latency, beacon delivery ratio (PDR), channel busy ratio (CBR), verifier throughput, revocation-wire overhead, and realized Sybil capacity. Results show that PQ-Rate maintains sub- 20 ms session setup, improves PDR under high density by reducing airtime overhead, increases verifier throughput via batching and inexpensive decapsulation, and bounds attacker identities to the product of enrolled hardware modules and budget. Revocation digests remain small (on the order of 9-12 KB for thousands of inserts at$10^{-3}-10^{-4}$false-positive targets), supporting frequent broadcast without inflating CBR. PQ-Rate demonstrates that post-quantum security, strong privacy, Sybil resistance, and rapid revocation can be achieved simultaneously within V2X timing constraints.
Cryptographic Implementations and Security
Physical Unclonable Functions (PUFs) and Hardware Security
Smart contracts rely on blockchain oracles to access off-chain data, yet existing oracle designs often face challenges such as untrustworthy data sources, weak temporal guarantees, and limited verifiability. This work presents Ivy Oracle, a robust and time-trustworthy data feed framework that enhances the reliability and auditability of off-chain information for smart contracts. Ivy Oracle integrates trusted execution environments (TEEs) for secure data acquisition, an external time server for authenticated timestamps, and a PageRank-based trust model to evaluate source credibility. We implement and evaluate Ivy Oracle on the Ethereum Sepolia testnet, demonstrating that it achieves up to 63.6% lower on-chain gas consumption than Chainlink for signature verification while maintaining only a slight increase in communication overhead due to its dual-attestation mechanism. These results confirm that Ivy Oracle provides strong time trustworthiness and data reliability with minimal performance cost, making it suitable for latency-sensitive blockchain applications.
As vehicular ad hoc networks (VANETs) increase in size and complexity, ensuring secure, flexible, and privacy-preserving vehicle-to-infrastructure (V2I) authentication remains a major challenge. Existing protocols often focus solely on identity verification, overlooking the need for access control based on vehicle attributes. Furthermore, vehicles must obtain authentication credentials from various trusted entities, including automakers, regulators, and government agencies. However, the absence of a unified credential issuance mechanism introduces fragmentation and inconsistencies during the registration process. To address these issues, we propose a V2I authentication protocol, called PriV2I, that integrates distributed credential issuance, attribute-based access control, and strong anonymity guarantees. During vehicle registration, our approach uses Shamir’s Secret Sharing with a threshold t of n across multiple certification authorities (CAs) to consolidate credentials. A vehicle credential can only be issued by a predefined threshold number of CAs, enhancing security and flexibility. Within the authentication protocol, Pointcheval-Sanders (PS) signatures enable fine-grained access control based on vehicle attributes such as type and role. Meanwhile, noninteractive zero-knowledge proofs protect identity privacy by allowing vehicles to prove credential possession and policy compliance without revealing sensitive information. The proposed scheme also supports batch authentication at Roadside Units (RSUs) to efficiently handle high-density environments and includes a comprehensive revocation mechanism to trace and revoke malicious vehicles promptly and securely. In our implementation, the computation cost during the authentication phase is 75.58 ms. The communication overhead per authentication exchange is 992 bytes across two messages. Overall, the protocol provides a secure, scalable, and privacy-preserving solution tailored to modern VANET environments.
Vikash Singh, Little, Barrett, Phil Hayes, Fang, Max · 7 authors
Verifying the private liquidity state of Lightning Network (LN) channels is desirable for auditors, service providers, and network participants who need assurance of financial capacity. Current methods often lack robustness against a malicious or compromised node operator. This paper introduces a methodology for the verification of LN channel balances. The core contribution is a framework that combines Trusted Execution Environments (TEEs) with Zero-Knowledge Transport Layer Security (zkTLS) to provide strong, hardware-backed guarantees. In our proposed method, the node's balance-reporting software runs within a TEE, which generates a remote attestation quote proving the software's integrity. This attestation is then served via an Application Programming Interface (API), and zkTLS is used to prove the authenticity of its delivery. We also analyze an alternative variant where the TEE signs the report directly without zkTLS, discussing the trade-offs between transport-layer verification and direct enclave signing. We further refine this by distinguishing between "Hot Proofs" (verifiable claims via TEEs) and "Cold Proofs" (on-chain settlement), and discuss critical security considerations including hardware vulnerabilities, privacy leakage to third-party APIs, and the performance overhead of enclaved operations.
Love Allen Chijioke Ahakonye, Hamza Ibrahim, Jae-Min Lee, Dong‐Seong Kim
Smart contract environments are increasingly targeted by stealthy, adaptive attacks that evade conventional rule-based or static anomaly detection systems. Inspired by the anglerfish’s bioluminescent filament, which perceives and lures activity in dark, dynamic environments, this research introduces a Bioluminescent Filament-Inspired Artificial Intelligence Perception framework for smart contract intrusion detection. The proposed model emulates biological sensory adaptation through multi-modal attention layers that dynamically illuminate anomalous behaviors in contract execution flows. By integrating self-supervised temporal perception with context-driven feedback, the framework continuously refines its detection sensitivity while maintaining low computational overhead. We evaluate the framework using fuzz-tested smart contract vulnerability datasets that simulate diverse malicious execution behaviors observed in Ethereum environments, demonstrating over 98% detection accuracy with a 40% reduction in latency compared to traditional deep learning-based IDS models. This biologically inspired perception paradigm offers a scalable, energy-efficient solution for securing blockchain-based decentralized systems against evolving threat vectors.
Zero-knowledge proofs (ZKPs) are central to secure and privacy-preserving computation, with zk-SNARKs and zk-STARKs emerging as leading frameworks offering distinct trade-offs in efficiency, scalability, and trust assumptions. While their theoretical foundations are well studied, practical performance under real-world conditions remains less understood. In this work, we present a systematic, implementation-level comparison of zk-SNARKs (Groth16) and zk-STARKs using publicly available reference implementations on a consumer-grade ARM platform. Our empirical evaluation covers proof generation time, verification latency, proof size, and CPU profiling. Results show that zk-SNARKs generate proofs 68x faster with 123x smaller proof size, but verify slower and require trusted setup, whereas zk-STARKs, despite larger proofs and slower generation, verify faster and remain transparent and post-quantum secure. Profiling further identifies distinct computational bottlenecks across the two systems, underscoring how execution models and implementation details significantly affect real-world performance. These findings provide actionable insights for developers, protocol designers, and researchers in selecting and optimizing proof systems for applications such as privacy-preserving transactions, verifiable computation, and scalable rollups.
Habib, Kyle, Vladislav Kapitsyn, Giovanni Mazzeo, Faisal Mehrban
Current blockchain consensus protocols -- notably, Proof of Work (PoW) and Proof of Stake (PoS) -- deliver global agreement but exhibit structural constraints. PoW anchors security in heavy computation, inflating energy use and imposing high confirmation latency. PoS improves efficiency but introduces stake concentration, long-range and "nothing-at-stake" vulnerabilities, and a hard performance ceiling shaped by slot times and multi-round committee voting. In this paper, we propose Proof of Trusted Execution (PoTE), a consensus paradigm where agreement emerges from verifiable execution rather than replicated re-execution. Validators operate inside heterogeneous VM-based TEEs, each running the same canonical program whose measurement is publicly recorded, and each producing vendor-backed attestations that bind the enclave code hash to the block contents. Because the execution is deterministic and the proposer is uniquely derived from public randomness, PoTE avoids forks, eliminates slot.time bottlenecks, and commits blocks in a single round of verification. We present the design of a PoTE consensus client, describe our reference implementation, and evaluate its performance against the stringent throughput requirements of the Trillion decentralized exchange.
Blockchain systems, such as Bitcoin and Ethereum 2.0, face vulnerabilities under bandwidth-constrained partitions, where throughput collapses and latency increases. In addition, adversaries can exploit inconsistencies to launch double-spending attacks. This study presents a lightweight dual-layer countermeasure that integrates a robust freezing threshold ( ) with multi-signal disconnection proofs to enhance performance and security without altering consensus rules. Controlled simulation experiments on Bitcoin (PoW) and Ethereum 2.0 (PoS) show throughput gains exceeding 1000% in Ethereum and over 100% in Bitcoin, with inconsistency reduced by up to 64% and latency bounded within 5-6 blocks/s. These results confirm that attacker-aware thresholds and multi-signal validation substantially improve blockchain resilience under partitioned network conditions.
André Augusto, Rafael Belchior, Jonas Pfannschmidt, André Vasconcelos · 5 authors
Cross-chain bridges are a blockchain interoperability middleware that supports the transfer of assets and data across blockchains. However, several of these bridges have vulnerabilities that have caused 3.2 billion dollars in losses since May 2021. Some studies have revealed the existence of these vulnerabilities, but there is little quantitative research available, and there are no safeguard mechanisms to protect bridges from such attacks. Furthermore, no studies are available on the practices of cross-chain bridges that can cause financial losses. We propose XChainWatcher (Cross-Chain Watcher), a modular and extensible logic-driven anomaly detector for cross-chain bridges. It operates in three main phases: (1) decoding events and transactions from multiple blockchains, (2) building logic relations from the extracted data, and (3) evaluating these relations against a set of detection rules. Using XChainWatcher, we analyze data from two previously attacked bridges: the Ronin and Nomad bridges. XChainWatcher successfully identified the transactions that led to losses of $611M and $190M (USD) and surpassed the results obtained by a reputable security firm in the latter. We not only uncover successful attacks, but also reveal other anomalies, such as 37 cross-chain transactions (cctx) that should not have accepted, failed attempts to exploit Nomad, over $7.8M worth of tokens locked on one chain but never released on Ethereum, and $200K lost by users due to inadequate interaction with bridges. We provide the first open dataset of 81,000 cctxs across three blockchains, capturing more than $4.2B in token transfers.
This paper develops semantic typing in a smart-contract setting to ensure type safety of code that uses statically untypable language constructs, such as the fallback function. The idea is that the creator of a contract on the blockchain equips code containing such constructs with a formal proof of its type safety, given in terms of the semantics of types. Then, a user of the contract only needs to check the validity of the provided 'proof certificate' of type safety. This is a form of proof-carrying code, which naturally fits with the immutable nature of the blockchain environment. As a concrete application of our approach, we focus on ensuring information flow control and non-interference for TinySol, a distilled version of the Solidity language, through security types. We provide the semantics of types in terms of a typed operational semantics of TinySol and we express the proofs of safety as coinductively-defined typing interpretations, which can be represented compactly via up-to techniques, similar to those used for bisimilarity. We also show how our machinery can be used to type the typical pointer-to-implementation pattern based on the fallback function and to reject a distilled version of the infamous Parity Multisig Wallet Attack.
Classical ledger systems, including proof-of-work (PoW) and proof-of-stake (PoS) blockchains;derive their security from the assumption that irreversible computation incurs a thermodynamic cost. This assumption, rooted in Landauer’s principle, implies that reversing orre-writing global state requires expenditure of significant physical energy, and therefore canbe made economically infeasible.In this paper, we introduce the RHEA–Λ Gate Family: a reversible multi–radix (2–3–5)logic primitive with a triangular, measure-preserving topology that embeds directly intoHamiltonian phase-space flows. Each gate includes an intrinsic symbolic (glyph/entropy)register enabling perfect, lossless history retention without information erasure. Whencomposed into circuits, Λ–gates form fully reversible, entropy-preserving state-transitionoperators capable of implementing arbitrary classical computations at asymptotically zeroenergy in adiabatic regimes.We show that any ledger whose security relies on computational irreversibility becomesvulnerable in a computational substrate that supports (i) strictly reversible evolution, (ii)zero–entropy symbolic memory, and (iii) multi-radix reversible hashing. In such substrates,the economic barrier that protects ledger history vanishes: all PoW functions become ther-modynamically free, PoS penalties become reversible, and Merkle-tree hashing no longerprovides unidirectional security. We formalize this result as an impossibility theorem forirreversible-cost security models, and we construct a reversible ledger architecture whose cor-rectness is maintained through Hamiltonian invariants rather than dissipative computationalcost.The Λ framework thereby provides both (a) a constructive alternative to irreversible ledgermechanisms and (b) the first proof that classical reversible computation, when extendedto higher radices with symbolic memory, nullifies the energy-based assumptions underlyingmodern blockchain security.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
An important cryptographic mechanism that guarantees confidentiality (the zero-disclosure property) and ensures that it is impossible to prove a false statement to the verifier is zero-disclosure proofs. A popular implementation of zero-disclosure proofs is short, noninteractive proofs that can be quickly verified and that do not require interaction between the parties after the initial setup. The main direction in the development of modern proof systems is interactive proof, which is built in two steps. The first is sending a confirmation of the polynomial of an interactive oracle proof and the second is creating correct oracles of the polynomial commitment scheme using well-defined cryptographic methods for evaluating polynomials. Verifying the use of the same coefficients in each linear combination requires checking both polynomial consistency and variable consistency. To construct general schemes of concise non-interactive zerodisclosure knowledge argument, an interactive oracle proof polynomial was proposed that models messages as polynomial oracles. All tests are proved using polynomial commitment schemes and then evaluated with zero knowledge at a point specified by the person verifying the information. The reliability and confidentiality of all tests are based on three main categories of interactive oracle proof polynomials, namely polynomial commitment schemes with conjunction, with inner product argument and with code theory. The protocols of concise noninteractive zero-disclosure knowledge arguments are implemented through high-level programs (compilers), which are converted into an intermediate representation, i.e. a scheme defined by a system of constraints. The compilers used are divided into domain-oriented languages, embedded domain-oriented languages, and zero-knowledge virtual machines. Specialized domain-oriented hardware description languages or programming languages offer an adapted syntax for efficiently expressing constraints in arithmetic schemes. Embedded domain-oriented languages are implemented as functions in general-purpose programming languages and are oriented to the overhead schemes inherited from the embedded language. Zero-knowledge virtual machines process the opcode of the fetch-decodeexecute cycle, replicating the computation trace for general programs and generating corresponding zeroknowledge proofs. They are compatible with existing high-level programming languages and can use the features of existing compilers. Compilers are evaluated for cross- or syntactic compatibility. In general, the biggest obstacle to using non-interactive proof libraries is the lack of documentation. Standardization can help developers compare important features across libraries and establish a more consistent performance baseline. Library documentation for these core features is implicit, and developers need to understand the underlying cryptographic techniques to choose an appropriate scheme. Standardization of compiler options is important, making it difficult to reuse existing tools.
Ziqiao Kong, Xia, Wanxu, Zhengwei Li, Yi Lu · 9 authors
Move is a resource-oriented programming language designed for secure and verifiable smart contract development and has been widely used in managing billions of digital assets in blockchains, such as Sui and Aptos.Move features a strong static type system and explicit resource semantics to enforce safety properties such as the prevention of data races, invalid asset transfers, and entry vulnerabilities. However, smart contracts written in Move may still contain certain vulnerabilities that are beyond the reach of its type system. It is thus essential to validate Move smart contracts. Unfortunately, due to its strong type system, existing smart contract fuzzers are ineffective in producing syntactically or semantically valid transactions to test Move smart contracts. This paper introduces the first fuzzing framework, Belobog, for Move smart contracts. Belobog is type-aware and ensures that all generated and mutated transactions are well-typed. More specifically, for a target Move smart contract, Belobog first constructs a dependency graph based on Move's type system, and then generates or mutates a transaction based on the graph trace derived from the dependency graph. In order to overcome the complex checks in Move smart contracts, we further design and implement a concolic executor in Belobog. We evaluated Belobog on 109 real-world Move smart contract projects. The experimental results show that Belobog is able to detect 100% critical and 79% major vulnerabilities manually audited by human experts. We further selected two recent notorious incidents in the Move ecosystem, i.e., Cetus and Nemo. Belobog successfully reproduced full exploits for both of them, without any prior knowledge. Moreover, we applied Belobog on three ongoing auditing projects and found 2 critical, 2 major, and 3 medium new vulnerabilities, all acknowledged by the project developers.
A vulnerability in smart contracts refers to weaknesses in the code that can be exploited by attackers, leading to security breaches and unintended behavior. With the growing use of smart contracts in decentralized blockchain systems, particularly in internet of things (IoT) environments, ensuring their security has become increasingly critical. Traditional vulnerability detection techniques, such as formal verification and symbolic execution, face significant limitations, including high rates of false positives and negatives, scalability issues, and difficulty in detecting complex vulnerabilities. To address these challenges, this paper proposes semantic contract flow analysis and deep learning ensemble (SCADE) for smart contract vulnerability detection. SCADE leverages semantic flow analysis combined with an ensemble of deep learning models, including convolutional neural networks (CNN), bidirectional sequence encoder (BSE), layered probabilistic neural network (LPNN), and adaptive context learning network (ACLN), to detect vulnerabilities effectively. The methodology breaks down the smart contract code into structured components through a contract structure mapper, followed by extracting semantic paths and converting them into sequential vector representations. These representations are then processed through a deep learning ensemble to identify potential vulnerabilities such as reentrancy, timestamp dependency, code injection, and hardcoded gas amounts.