Md. Hasibul Alam Ratul, Sepideh Mollajafari, Martín Wynn
Digital evidence plays a crucial role in cybercrime investigations by linking individuals to criminal activities. Data collection, preservation, and analysis can benefit from emerging technologies like blockchain to provide a secure, distributed ledger for managing digital evidence. This study proposes a blockchain-based solution for managing digital evidence in cybercrime cases in the judicial domain. The proposed solution provides the basis for the development of a new model that leverages a consortium blockchain, allowing secure collaboration among judicial stakeholders, while ensuring data integrity and admissibility in court. An extensive literature review demonstrates blockchain’s potential to create a more secure, efficient evidence management system. The proposed model was implemented in a test environment using a localised blockchain for developing and testing smart contracts, as well as integrating a web interface, with off-chain storage for managing evidence data. The system was subsequently deployed in both the Polygon and Ethereum test networks, simulating real-world blockchain environments, revealing that the operational cost in the Polygon network is reduced by 99.96% compared to Ethereum, thereby offering scalability without compromising security. This study underscores blockchain’s potential to revolutionise the chain of custody procedures, improving dependability and security in evidence management and providing more sustainable solutions within the criminal justice system.
Xiaolin Wen, Tai D. Nguyen, Shaolun Ruan, Qiaomu Shen · 7 authors
With the prevalence of smart contracts, smart Ponzi schemes have become a common fraud on blockchain and have caused significant financial loss to cryptocurrency investors in the past few years. Despite the critical importance of detecting smart Ponzi schemes, a reliable and transparent identification approach adaptive to various smart Ponzi schemes is still missing. To fill the research gap, we first extract semantic-meaningful actions to represent the execution behaviors specified in smart contract bytecodes, which are derived from a literature review and in-depth interviews with domain experts. We then propose PonziLens+, a novel visual analytic approach that provides an intuitive and reliable analysis of Ponzi-scheme-related features within these execution behaviors. PonziLens+ has three visualization modules that intuitively reveal all potential behaviors of a smart contract, highlighting fraudulent features across three levels of detail. It can help smart contract investors and auditors achieve confident identification of any smart Ponzi schemes. We conducted two case studies and in-depth user interviews with 12 domain experts and common investors to evaluate PonziLens+. The results demonstrate the effectiveness and usability of PonziLens+ in achieving an effective identification of smart Ponzi schemes.
Charles Gomarga, Gregorius Jason Winata, Joshiah Elroi Thungriallu, Richard Wiputra
The invention of the smart contract has advanced the transaction system due to its transparency and immutability. However, it also raised many concerns when the source code was vulnerable. Many detection and repair tools have been developed to tackle these issues, yet they must still be appropriately standardized. This paper created a security procedure, adapting one of the most trustworthy cybersecurity standards, the NIST Cybersecurity Framework 2.0. There are 38 reviewed studies through the Systematic Literature Review (SLR) protocol, which will be arranged and classified with NIST CSF 2.0 functions as the output. This paper suggested the application of NIST CSF 2.0 as a smart contracts development standard to ensure the robustness of the contract. Moreover, this paper provides future work to enhance the approaches' scalability in discovering new threat or attack patterns.
Zhuo Zhang, Donghui Li, Kun Jiang, Ya Li · 6 authors
Smart contracts are self-executing programs that operate on a blockchain. Once deployed, they cannot be altered, which introduces distinct maintenance challenges unlike those found in traditional software systems. Bugs and vulnerabilities in smart contracts have led to significant economic losses, drawing increased attention to their security. The immutability of smart contracts has made thorough security checks prior to deployment a priority. In this paper, we introduce a smart contract timestamp vulnerability detection technique PropaDT with propagation-based code clone analysis. The core idea of this technique involves using dataflow analysis based on an Abstract Syntax Tree (AST) to extract propagation chains that reveal how variables interact, potentially leading to vulnerabilities. Next, we extract code snippets based on the propagation chains and compare them with known vulnerability patterns in a database. This allows us to determine whether the tested smart contract contains a timestamp vulnerability, facilitating the detection of potential timestamp vulnerabilities in the code.
The Police Complaint Management System (PCMS) is a decentralized application template designed to modernize the processes of lodging, tracking, and resolving complaints within law enforcement systems. Leveraging the Next.js framework, Web3 technologies, and blockchain integration, the system ensures tamper-proof complaint records, real-time updates, and enhanced transparency for citizens and authorities. By utilizing Wagmi and Ethers.js for seamless wallet connections, IPFS for decentralized evidence storage, and a user-friendly interface styled with Tailwind CSS, the PCMS provides a scalable, efficient, and accessible platform. With automated processes for complaint categorization and routing, as well as immutable blockchain records, the system fosters greater accountability and trust in public services. Built with TypeScript for reliability and enhanced with modular tools for rapid deployment, the PCMS exemplifies a modern, citizen-centric approach to grievance management, ensuring data security and operational efficiency in law enforcement agencies
Cryptocurrency, based on block-chain technology is defined as a decentralized digital peer-to-peer currency. The emergence of cryptocurrency is a boon for future economy; it has been tagged along with innumerable practical and legal issues including risks associated with consumer's protection such as theft, misinformation, and unpredictability; complexity surrounding the legal characterization of cryptocurrencies, illegal activities driven through cryptocurrencies and lack of uniform comprehensive global legislation to address the issues and challenges associated with it. Though valiant efforts have been made by few countries like Canada, United Kingdom, Switzerland, El Salvador etc. to formulate broad range of rules and regulations for digital currency but other developed and developing economies has largely remained silent on the debate surrounding the regulation of cryptocurrencies. This chapter seeks to explore into risk posed by digital currency and provide a need for formulation of legal structure appropriate for regulating the cryptocurrencies.
This paper examines the role of hardware security as the basis for order in the decentralised metaverse. It does this by considering the infrastructural tools and governance practices at the heart of KONG Land, an example of a blockchain-based decentralised autonomous organisation (DAO) and decentralised physical infrastructure network (DePIN) project. KONG Land manufactures open-source microchips to create verifiable hardware that anyone can use or integrate into their own application. KONG Land’s focus on the materiality of infrastructure led them to pursue a governance model as a digital-physical, politically decentralised polity. By foregrounding the physicality and affordances of decentralised efforts to manufacture microchips, this paper shows how rematerialising digital domains leads back to questions of statehood and its purpose and provides an explanation for emerging sovereignties. Building on Olson’s (1993. Dictatorship, democracy, and development. American Political Science Review , 87 (3), 567–576) theory of the stationary bandit, the paper positions projects like KONG Land as an attempt to create a ‘better bandit’ – one that sets out to provide its citizens with a superior level of security than that offered by either nation states or the corporate metaverse, with the intention of creating the conditions for Web3 production and expansion.
A privacy pool enables clients to deposit units of a cryptocurrency into a shared pool where ownership of deposited currency is tracked via a system of cryptographically hidden records. Clients may later withdraw from the pool without linkage to previous deposits. Some privacy pools also support hidden transfer of currency ownership within the pool. In August 2022, the U.S. Department of Treasury sanctioned Tornado Cash, the largest Ethereum privacy pool, on the premise that it enables illicit actors to hide the origin of funds, citing its usage by the DPRK-sponsored Lazarus Group to launder over $455 million dollars worth of stolen cryptocurrency. This ruling effectively made it illegal for U.S. persons/institutions to use or accept funds that went through Tornado Cash, sparking a global debate among privacy rights activists and lawmakers. Against this backdrop, we present Derecho, a system that institutions could use to request cryptographic attestations of fund origins rather than naively rejecting all funds coming from privacy pools. Derecho is a novel application of proof-carrying data, which allows users to propagate allowlist membership proofs through a privacy pool's transaction graph. Derecho is backwards-compatible with existing Ethereum privacy pool designs, adds no overhead in gas costs, and costs users only a few seconds to produce attestations.
This paper presents a comprehensive analysis of adaptive behavioral authentication systems designed for fraud detection in financial services. These systems leverage real-time user behavior, such as typing patterns, mouse movements, and geolocation data, to continuously monitor and assess authentication risks. A layered approach integrates behavioral analysis with traditional credentials, providing enhanced security against evolving fraud techniques. The proposed system illustrates the interaction between users, the authentication system, a behavioral engine, and fraud detection models, enabling dynamic decision-making processes. The proposed framework enhances fraud detection by ensuring robust monitoring without compromising user experience. Future work aims to address challenges in data privacy, ethical considerations, and system adaptability to emerging financial technologies like decentralized finance (DeFi).
Client diversity is a cornerstone of blockchain resilience, yet most networks suffer from a dangerously skewed distribution of client implementations. This monoculture exposes the network to very risky scenarios, such as massive financial losses in the event of a majority client failure. In this article, we present a novel framework that combines verifiable execution and economic incentives to provably identify and reward the use of minority clients, thereby promoting a healthier, more robust ecosystem. Our approach leverages state-of-the-art verifiable computation (zkVMs and TEEs) to generate cryptographic proofs of client execution, which are then verified on-chain. We design and implement an end-to-end prototype of verifiable client diversity in the context of Ethereum by modifying the popular Lighthouse client and by deploying our novel diversity-aware reward protocol. Through comprehensive experiments, we quantify the practicality of our approach, from overheads of proof production and verification to the effectiveness of the incentive mechanism. This work demonstrates, for the first time, a practical and economically viable path to encourage and ensure provable client diversity in blockchain networks. Our findings inform the design of future protocols that seek to maximize the resilience of decentralized systems.
Software built on poor structural patterns often shows higher exposure to security defects. When code differs from established best practices, verification and maintenance become increasingly difficult, thereby raising the risk of unintentional vulnerabilities. In the context of blockchain technology, where immutable smart contracts handle high-value transactions, the need for strict security assurance is important. This research analyzes the utility of software complexity metrics as diagnostic tools for identifying vulnerable Solidity smart contracts. We evaluate the hypothesis that complexity measures serve as vital, complementary signals for security assessment. Through an empirical examination of 21 distinct metrics, we analyzed their inter-dependencies, statistical association with vulnerabilities, and discriminative capabilities. Our findings indicate a significant degree of redundancy among certain metrics and a relatively low correlation between any single metric and the presence of vulnerabilities. However, the data demonstrates that these metrics possess strong power to distinguish between secure and vulnerable code when analyzed collectively. Notably, with only three exceptions, vulnerable contracts consistently exhibited higher mean complexity scores than their neutral counterparts. While our results show a statistical association, we emphasize that complexity is an indicator rather than a direct cause of vulnerability.
Smart contracts have been increasingly deployed and applied on various blockchain platforms. Nevertheless, vulnerabilities may cause significant financial losses due to the involvement of substantial funds in smart contracts. Traditional analysis tools heavily rely on manually predefined rules. Recent studies have demonstrated the promising potential of deep learning techniques in smart contract vulnerability detection. However, existing approaches often disregard cross-function and cross-contract vulnerability scenarios, focusing primarily on characterization or detection tasks at the function level. In this study, we propose CL-HGAN, a novel framework for smart contract vulnerability detection at the contract level. Firstly, we construct a contract-level heterogeneous graph to embody the relationships between contracts and functions. Specifically, we build the backbone of the heterogeneous graph based on the abstract syntax tree (AST) and multiple types of edges and then incorporate two additional categories of edges to augment its structural information. Subsequently, we design a two-phase feature learning method to automatically generate graph-level representations based on a heterogeneous graph attention network and meta-paths specific to the constructed graph. Finally, we employ a classifier to perform vulnerability detection tasks. In particular, the proposed CL-HGAN comprehensively captures vulnerability features and accurately identifies vulnerabilities at the contract level. Furthermore, we evaluate the CL-HGAN framework on an Ethereum smart contract dataset containing thirty types of vulnerabilities. The experimental results show that the average metrics of our approach outperform the state-of-the-art baselines.
Samer Muthana Sarsam, Ahmed Ibrahim Alzahrani, Hosam Al‐Samarraie, Fahad Alblehai
This study explored the role of gender preferences in cryptocurrency investments using sentiment analysis. X (Twitter) users’ gender (male/female) together with relevant sentiments (positive/negative) were extracted and investigated in this study. The Latent Dirichlet Allocation technique was utilised to model gender-related topics in an attempt to understand male and female users’ preferences to invest in cryptocurrency. The Apriori algorithm was employed to predict the highly associated investment terminologies with each gender. A predictive model was built to predict the type of digital currency preferred by X users. Using sentiment-based gender data, the results showed a high prediction accuracy (98.64%) of digital currency preferences. The study demonstrated that male users would most likely use Bitcoin, compared to female users who preferred Ethereum. This study further offers a novel mechanism to predict users’ preferences for cryptocurrency platforms using their sentiment features. It extends the knowledge of cryptocurrencies in the financial business profile by revealing how investors’ gender contributes to investment-related decisions.
Shikah J. Alsunaidi, Hamoud Aljamaan, Mohammad Hammoudeh
Identifying vulnerabilities in Smart Contracts (SCs) is crucial, as they can lead to significant financial losses if exploited. Although various SC vulnerability identification methods exist, selecting the most effective approach remains challenging. This article examines these challenges and introduces solutions to enhance SC vulnerability identification. It introduces MultiTagging, a modular SC multi-labeling framework designed to overcome limitations in existing SC vulnerability identification approaches. MultiTagging automates SC vulnerability tagging by parsing analysis reports and mapping tool-specific tags to standardized labels, including SC Weakness Classification (SWC) codes and Decentralized Application Security Project (DASP) ranks. Its mapping strategy and the proposed vulnerability taxonomy resolve tool-level labeling inconsistencies, where different tools use distinct labels for identical vulnerabilities. The framework integrates an evaluation module to assess SC vulnerability identification methods. MultiTagging enables both tool-based and vote-based SC vulnerability labeling. To improve labeling accuracy, the article proposes Power-based voting, a method that systematically defines voter roles and voting thresholds for each vulnerability. MultiTagging is used to evaluate labeling across six tools: MAIAN, Mythril, Semgrep, Slither, Solhint, and VeriSmart. The results reveal high coverage for Mythril, Slither, and Solhint, which identified eight, seven, and six DASP classes, respectively. Tool performance varied, underscoring the impracticality of relying on a single tool to identify all vulnerability classes. A comparative evaluation of Power-based voting and two threshold-based methods—AtLeastOne and Majority voting—shows that while voting methods can increase vulnerability identification coverage, they may also reduce detection performance. Power-based voting proved more effective than pure threshold-based methods across all vulnerability classes.
To address the challenges of low accuracy and limited generalization in existing vulnerability detection methods, this paper presents a novel deep learning approach utilizing graph-based algorithms for detecting vulnerabilities in smart contracts. We begin by analyzing the characteristics of vulnerable smart contracts and introducing the concept of “critical opcodes.” A keyword extraction method is developed to effectively identify and select these critical opcodes from smart contracts. Following this, we integrate a critical opcode weighting mechanism into graph-based algorithms, enabling the capture of both hidden relational features and critical opcode characteristics inherent in vulnerable smart contracts. Experimental results indicate that our approach achieves a significant improvement in recognition accuracy, with F1-scores enhancing by 2.39% and 19.54% in binary and multi-class detection scenarios, respectively, when compared to traditional methods such as the LightGBM model.
Smart contracts are self-executing digital contracts that run on a blockchain network. They enable the automation and decentralization of various operations and have become increasingly popular in recent years. However, smart contracts are susceptible to vulnerabilities, and their deployment without proper security testing can result in severe consequences, such as financial losses and reputational damage. In this article, we explore the use of deep learning techniques, particularly Convolutional Neural Networks (CNNs), for detecting and classifying vulnerabilities in smart contracts deployed on the Ethereum main net. We compare different kinds of neural architectures, i.e., a baseline LSTM, multiple 1D CNNs working on the smart contracts’ bytecode, a Vision Transformer (Swin v2 Tiny), and various 2D CNNs that work on RGB images obtained from the bytecode (i.e., ResNet-50, ResNeXt-50, Inception v3, and EfficientNetv2 Small). We provide an in-depth analysis of these techniques to classify a dataset of smart contracts we have collected. Our study shows that the use of deep neural networks can represent a promising technique to automatically assess smart contracts’ correctness and classify potential vulnerabilities. According to our experiments, the ResNet 1D CNN working directly on the smart contract bytecode offers the best results in terms of classification capabilities. Moreover, due to the unbalanced sizes of the different classes, the classification resulted in more effectiveness for the unchecked calls and reentrancy vulnerability classes while still providing good results for others.