Blockchain Papers

Chao Li, Runshuo Liu, Yafei Zhang, Nengfu Xie · 5 authors

No abstract is available for this record.

Vasavi Chithanuru, Mangayarkarasi Ramaiah

No abstract is available for this record.

Wenkai Li, Xiaoqi Li, Yingjie Mao, Yuqing Zhang

The detection of vulnerabilities in smart contracts remains a significant challenge. While numerous tools are available for analyzing smart contracts in source code, only about 1.79% of smart contracts on Ethereum are open-source. For existing tools that target bytecodes, most of them only consider the semantic logic context and disregard function interface information in the bytecodes. In this paper, we propose COBRA, a novel framework that integrates semantic context and function interfaces to detect vulnerabilities in bytecodes of the smart contract. To our best knowledge, COBRA is the first framework that combines these two features. Moreover, to infer the function signatures that are not present in signature databases, we propose SRIF, automatically learn the rules of function signatures from the smart contract bytecodes. The bytecodes associated with the function signatures are collected by constructing a control flow graph (CFG) for the SRIF training. We optimize the semantic context using the operation code in the static single assignment (SSA) format. Finally, we integrate the context and function interface representations in the latent space as the contract feature embedding. The contract features in the hidden space are decoded for vulnerability classifications with a decoder and attention module. Experimental results demonstrate that SRIF can achieve 94.76% F1-score for function signature inference. Furthermore, when the ground truth ABI exists, COBRA achieves 93.45% F1-score for vulnerability classification. In the absence of ABI, the inferred function feature fills the encoder, and the system accomplishes an 89.46% recall rate.

Gibran Gómez, Kevin van Liebergen, Davide Sanvito, Giuseppe Siracusano · 6 authors

Cryptocurrency abuse reporting services are a valuable data source about abusive blockchain addresses, prevalent types of cryptocurrency abuse, and their financial impact on victims. However, they may suffer data pollution due to their crowd-sourced nature. This work analyzes the extent and impact of data pollution in cryptocurrency abuse reporting services and proposes a novel LLM-based defense to address the pollution. We collect 289K abuse reports submitted over 6 years to two popular services and use them to answer three research questions. RQ1 analyzes the extent and impact of pollution. We show that spam reports will eventually flood unchecked abuse reporting services, with BitcoinAbuse receiving 75% of spam before stopping operations. We build a public dataset of 19,443 abuse reports labeled with 19 popular abuse types and use it to reveal the inaccuracy of user-reported abuse types. We identified 91 (0.1%) benign addresses reported, responsible for 60% of all the received funds. RQ2 examines whether we can automate identifying valid reports and their classification into abuse types. We propose an unsupervised LLM-based classifier that achieves an F1 score of 0.95 when classifying reports, an F1 of 0.89 when classifying out-of-distribution data, and an F1 of 0.99 when identifying spam reports. Our unsupervised LLM-based classifier clearly outperforms two baselines: a supervised classifier and a naive usage of the LLM. Finally, RQ3 demonstrates the usefulness of our LLM-based classifier for quantifying the financial impact of different cryptocurrency abuse types. We show that victim-reported losses heavily underestimate cybercriminal revenue by estimating a 29 times higher revenue from deposit transactions. We identified that investment scams have the highest financial impact and that extortions have lower conversion rates but compensate for them with massive email campaigns.

Shiji Wang, Xiangfu Zhao

No abstract is available for this record.

Wenkai Li, Xiaoqi Li, Zongwei Li, Yuqing Zhang

The detection of vulnerabilities in smart contracts remains a significant challenge. While numerous tools are available for analyzing smart contracts in source code, only about 1.79% of smart contracts on Ethereum are open-source. For existing tools that target bytecodes, most of them only consider the semantic logic context and disregard function interface information in the bytecodes. In this paper, we propose COBRA, a novel framework that integrates semantic context and function interfaces to detect vulnerabilities in bytecodes of the smart contract. To our best knowledge, COBRA is the first framework that combines these two features. Moreover, to infer the function signatures that are not present in signature databases, we present SRIF (Signatures Reverse Inference from Functions), automatically learn the rules of function signatures from the smart contract bytecodes. The bytecodes associated with the function signatures are collected by constructing a control flow graph (CFG) for the SRIF training. We optimize the semantic context using the operation code in the static single assignment (SSA) format. Finally, we integrate the context and function interface representations in the latent space as the contract feature embedding. The contract features in the hidden space are decoded for vulnerability classifications with a decoder and attention module. Experimental results demonstrate that SRIF can achieve 94.76% F1-score for function signature inference. Furthermore, when the ground truth ABI exists, COBRA achieves 93.45% F1-score for vulnerability classification. In the absence of ABI, the inferred function feature fills the encoder, and the system accomplishes an 89.46% recall rate.

Cong Wu, Jing Chen, Ziwei Wang, Ruichao Liang · 5 authors

Smart contracts, self-executing agreements directly encoded in code, are fundamental to blockchain technology, especially in decentralized finance (DeFi) and Web3. However, the rise of Ponzi schemes in smart contracts poses significant risks, leading to substantial financial losses and eroding trust in blockchain systems. Existing detection methods, such as PonziGuard, depend on large amounts of labeled data and struggle to identify unseen Ponzi schemes, limiting their reliability and generalizability. In contrast, we introduce PonziSleuth, the first LLM-driven approach for detecting Ponzi smart contracts, which requires no labeled training data. PonziSleuth utilizes advanced language understanding capabilities of LLMs to analyze smart contract source code through a novel two-step zero-shot chain-of-thought prompting technique. Our extensive evaluation on benchmark datasets and real-world contracts demonstrates that PonziSleuth delivers comparable, and often superior, performance without the extensive data requirements, achieving a balanced detection accuracy of 96.06% with GPT-3.5-turbo, 93.91% with LLAMA3, and 94.27% with Mistral. In real-world detection, PonziSleuth successfully identified 15 new Ponzi schemes from 4,597 contracts verified by Etherscan in March 2024, with a false negative rate of 0% and a false positive rate of 0.29%. These results highlight PonziSleuth's capability to detect diverse and novel Ponzi schemes, marking a significant advancement in leveraging LLMs for enhancing blockchain security and mitigating financial scams.

Wenkai Li, Zhijie Liu, Xiaoqi Li, Sen Nie

The web3 applications have recently been growing, especially on the Ethereum platform, starting to become the target of scammers. The web3 scams, imitating the services provided by legitimate platforms, mimic regular activity to deceive users. The current phishing account detection tools utilize graph learning or sampling algorithms to obtain graph features. However, large-scale transaction networks with temporal attributes conform to a power-law distribution, posing challenges in detecting web3 scams. In this paper, we present ScamSweeper, a novel framework to identify web3 scams on Ethereum. Furthermore, we collect a large-scale transaction dataset consisting of web3 scams, phishing, and normal accounts. Our experiments indicate that ScamSweeper exceeds the state-of-the-art in detecting web3 scams.

Scott Shackelford, Esfan Haghverdi

Cybersecurity has emerged as a paramount concern in today’s digital age, especially when considering the vast range of digital assets now in circulation, among which non-fungible tokens (NFTs) hold significant prominence. This chapter delves deeply into the intricate landscape of cybersecurity as it pertains to NFTs. By meticulously analyzing the multifaceted technical challenges and potential vulnerabilities inherent to NFTs from a cybersecurity perspective, this chapter seeks to provide an overview of the landscape as of this writing. Furthermore, this chapter explores how existing laws, policies, and societal norms have addressed these issues thus far, and speculates on how they might evolve in the future to more effectively bridge the governance gaps and safeguard these unique digital assets.

Huaiguang Wu, Yizhou Peng, Yaqiong He, Siqi Lu

Ensuring the absence of vulnerabilities or flaws in smart contracts before their deployment is crucial for the smooth progress of subsequent work. Existing detection methods heavily rely on expert rules, resulting in low robustness and accuracy. Therefore, we propose EDSCVD, an enhanced deep learning vulnerability detection model based on dual-channel networks. Firstly, the contract fragments are preprocessed by BERT into the required word embeddings. Next, we utilized adversarial training FGM to the word embeddings to generate perturbations, thereby producing symmetric adversarial samples and enhancing the robustness of the model. Then, the dual-channel model combining BiLSTM and CNN is utilized for feature training to obtain more comprehensive and symmetric information on temporal and local contract features.Finally, the combined output features are passed through a classifier to classify and detect contract vulnerabilities. Experimental results show that our EDSCVD exhibits excellent detection performance in the detection of classical reentrancy vulnerabilities, timestamp dependencies, and integer overflow vulnerabilities.

Shinu M. Rajagopal, M. Supriya, Rajkumar Buyya

The Secure Women Safety Platform envisions a decentralised application on the Ethereum blockchain, merging AI, IoT, and blockchain technologies to tackle societal safety challenges. Through Ethereum’s blockchain, it ensures tamper-proof identity management, empowering users with control over their data. IoT wearables equipped with GPS and sensors enable real-time tracking and swift response to emergencies, while AI-driven anomaly detection analyses user behaviour patterns for proactive threat identification. An emergency alert system triggers timely notifications to contacts and authorities, enhancing user safety. User-centric data management safeguards privacy, with Ethereum’s blockchain facilitating secure access permissions. Crowdsourced safety ratings and incident reporting foster a collaborative ecosystem, with blockchain’s immutability ensuring data integrity. This holistic solution advances women’s safety, setting a precedent for future innovations in personal security by combining AI, IoT, and cloud computing within a decentralised framework.

Weihong Wang, Tom Van Cutsem

Web3, also known as the Decentralized Web, is a vision for the next generation of Web applications, supported by blockchain technology, where users have stronger ownership over their data and identity. One of the key components in Web3 is wallets, which hold a user’s public and private keys, manage digital tokens, and sign transaction details. Despite their significance in securely managing digital identities, wallets also introduce vulnerabilities that, if overlooked, can compromise users’ privacy and security, particularly during data exchange with network endpoints. We investigate how popular wallets like MetaMask can inadvertently expose sensitive information to RPC endpoints, even when no transactions are made. Additionally, we examine the confidentiality risks associated with the registration requirements of major node providers, highlighting how the collection of personal and financial details can further threaten user privacy. We briefly report on ongoing work in analyzing the characteristics of wallets across various blockchain networks to identify key security and privacy features that can be integrated into new wallet designs. This research aims to address the challenges inherent in wallet security and privacy within Web3.

Marco Ortu, Giacomo Ibba, Giuseppe Destefanis, Claudio Conversano · 5 authors

The expansion of smart contracts on the Ethereum blockchain has created a diverse ecosystem of decentralized applications. This growth, however, poses challenges in classifying and securing these contracts. Existing research often separately addresses either classification or vulnerability detection, without a comprehensive analysis of how contract types are related to security risks. Our study addresses this gap by developing a taxonomy of smart contracts and examining the potential vulnerabilities associated with each category. We use the Latent Dirichlet Allocation (LDA) model to analyze a dataset of over 100,040 Ethereum smart contracts, which is notably larger than those used in previous studies. Our analysis categorizes these contracts into eleven groups, with five primary categories: Notary, Token, Game, Financial, and Blockchain interaction. This categorization sheds light on the various functions and applications of smart contracts in today's blockchain environment. In response to the growing need for better security in smart contract development, we also investigate the link between these categories and common vulnerabilities. Our results identify specific vulnerabilities associated with different contract types, providing valuable insights for developers and auditors. This relationship between contract categories and vulnerabilities is a new contribution to the field, as it has not been thoroughly explored in previous research. Our findings offer a detailed taxonomy of smart contracts and practical recommendations for enhancing security. By understanding how contract categories correlate with vulnerabilities, developers can implement more effective security measures, and auditors can better prioritize their reviews. This study advances both academic knowledge of smart contracts and practical strategies for securing decentralized applications on the Ethereum platform.

Peter Howson, Antulio Rosales, Olivier Jutel, Inte Gloerich · 8 authors

This paper explores how so-called ‘Web3’ blockchain projects are materially and socially constituted. A blockchain is an append-only distributed database. The technology is being hyped as applicable for a whole range of industries, social service provisions, and as a fix for economic disparities in communities left behind by mainstream financial systems. Drawing on case studies from our ongoing research we explain how, despite being virtual, Web3 projects are dependent on clearly defined spaces of production from which they derive their speculative value. We conceptualise this relationship as Crypto/Space, where space and blockchain software are mutually constituted. We consider how Crypto/Spaces are produced in three ways: 1) how project developers are adopting a parasitic relationship with host locations to appropriate energy, infrastructure, and local resources; 2) how projects enable ‘virtual land grabs’ where developers are engaging in land acquisitions, and associated displacement of local people, with no real intention to use the land for the declared purpose; and 3) how blockchain technology and speculative finance imaginaries are inspiring new anarcho-capitalist crypto-utopian ‘Exit zones’, often in the Global South. Far from being a zero-sum virtual game world, we argue that cryptocurrency projects are parasitic, often requiring predation on poor and otherwise marginalised communities to appropriate resources, onboard new users and enable favourable regulation.

Senlin Ren, Jun Yang, Xiguo Gu, Liwei Zheng · 5 authors

Smart contracts usually hold a large amount of digital assets, which can cause substantial losses if these contracts have vulnerabilities. Thus, it is essential to adequately detect possible vulnerabilities in smart contracts before deployment. There are many types of vulnerabilities in smart contracts, and different detection methods have their own unique advantages, some vulnerabilities may be more suitable for expert rule-based methods, while some vulnerabilities are more suitable for deep learning-based methods. A single detection method usually fails to fully use its ability to detect vulnerabilities. To address the above problems, we propose a composite approach named CDE-VD (Combining Deep Learning and Expert Rules for Smart Contract Vulnerability Detection) to improve the performance of vulnerability detection. The method divides smart contract samples into deep learning-prone sam-ples and expert rule-prone samples by classifying them before detection, and extracts expert rule features to train the smart contract detection method classifier to predict the category of the samples under analysis, then selects the suitable method for detection. The experimental results show that the vulnerability detection performance of CDE-VD outperforms that of single detection methods. Compared with the SOTA method MANDO, CDE-VD achieves average improvements of 3.22%, 2.32%, 9.25%, and 6.54% in terms of the Accuracy, Precision, Recall, and F1-score for five categories of vulnerabilities such as access control and time manipulation, respectively, which indicates that category prediction of the smart contract samples could improve vulnerability detection performance.

Mallellu Sai Prashanth, Ramesh Karnati, Muni Sekhar Velpuru, Harsha Reddy

No abstract is available for this record.

Akhil John Mampilly, Vijaya Kittu Manda, Chithirai Pon Selvan

Blockchain is a promising technology that can help organizations improve their cybersecurity. Blockchain has many inherent features that can help enhance data security, improve threat detection and response, strengthen authentication and authorization, and enhance cyber threat intelligence sharing. This is possible because of the innovative approach that Blockchain uses, such as immutable ledgers to store transactions, monitor assets, and build trust by providing access only to authorized participants. The chapter discusses cybersecurity best practices related to smart contracts, key management, network security, user education and awareness, incident reporting, privacy challenges, software updates, and decentralization. Key regulatory compliance aspects, such as GDPR and HIPPA, are discussed. The increasing interactions of Artificial Intelligence (AI), Machine Learning (ML), and the Internet of Things (IoT) with Blockchain can further provide improved cybersecurity services and hence form the discussion of the trends and potential future research section of this chapter.

Ayush Agarwal, Lu Lv, Arjun Maheswaran, Mahadevan, Varsha · 5 authors

Like any other useful technology, cryptocurrencies are sometimes used for criminal activities. While transactions are recorded on the blockchain, there exists a need for a more rapid and scalable method to detect addresses associated with fraudulent activities. We present RiskSEA, a scalable risk scoring system capable of effectively handling the dynamic nature of large-scale blockchain transaction graphs. The risk scoring system, which we implement for Ethereum, consists of 1. a scalable approach to generating node2vec embedding for entire set of addresses to capture the graph topology 2. transaction-based features to capture the transactional behavioral pattern of an address 3. a classifier model to generate risk score for addresses that combines the node2vec embedding and behavioral features. Efficiently generating node2vec embedding for large scale and dynamically evolving blockchain transaction graphs is challenging, we present two novel approaches for generating node2vec embeddings and effectively scaling it to the entire set of blockchain addresses: 1. node2vec embedding propagation and 2. dynamic node2vec embedding. We present a comprehensive analysis of the proposed approaches. Our experiments show that combining both behavioral and node2vec features boosts the classification performance significantly, and that the dynamic node2vec embeddings perform better than the node2vec propagated embeddings.

Arif Perdana, Hee Jhee Jiow

• Study analyzes victim reports to understand cryptocurrency scam mechanics and prevention strategies. • Seven scam dimensions: techniques, tools, victim profiling, consequences, info harvesting, manipulation, and culture. • The “Crypto-Cognitive Exploitation Model” (CCEM) is to explain cryptocurrency scam dynamics. • Findings show cryptocurrency scams evolve, needing ongoing research and countermeasure adaptation. • Key recommendations focus on digital strategies and regulatory frameworks to prevent cryptocurrency scams. The rising prominence of cryptocurrency in global finance has unfortunately rendered it a prime target for scams, leading to significant financial losses. This study employs Cognitive Vulnerability Theory and the Social Engineering Approach to examine the dimensions, consequences, and prevention strategies of cryptocurrency scams. We analyzed data from the U.S. Department of Financial Protection and Innovation (DFPI), focusing on the dimensions of scams within the digital landscape and the efficacy of digital strategies and regulations in mitigating them. Our findings reveal seven critical dimensions of cryptocurrency scams and introduce the “Crypto-Cognitive Exploitation Model” (CCEM), which integrates theoretical insights with the unique aspects of these scams. Quantitative analysis indicates that fraudulent trading platform scams are the most prevalent, often intertwined with pig butchering scams, highlighting the complex, multifaceted nature of these fraudulent activities. We demonstrate the practical application of our recommendations, bridging theory and practice in scam mitigation. The study concludes with strategic recommendations for tailored digital approaches and enhanced regulatory mechanisms to combat evolving deceptive practices.

Yury P. Garmaev, Grigory P. Osipov

The spread and use of cryptocurrencies (digital currency) in Russia and globally is increasing significantly every year. As the cryptocurrency market has grown, its criminal component has also grown at the same time. The number and degree of public danger of crimes where cryptocurrency acts as an object, aim or means of crime is steadily increasing. Civil and arbitration disputes over cryptocurrencies are also on the rise. Consequently, there is an objective need to effectively protect the interests of victims from criminal offenses, investigate relevant crimes and resolve disputes. Addressing these issues is impossible without the assistance of cryptocurrency specialists. The article formulates a definition of cryptocurrency crime, analyzes the challenges of using cryptocurrencies, ranging from the incomplete regulatory framework of its circulation to the lack of expertise among most practicing lawyers. It investigates and summarizes the conflicting practices in terms of requirements for cryptocurrency specialists, their conditions and procedure of their involvement in various legal proceedings. The prevalence of incompetence and dishonesty among individuals and companies offering services in the crypto market is noted, and appropriate warnings are put forth. The study systematizes and describes typical criminal, investigative and judicial scenarios where the expertise of a cryptocurrency specialist is necessary. It also provides conclusions and recommendations on organizing and strategizing interaction with cryptocurrency specialists in the interests of victims (including organizations), investigative authorities and/or the court. The conclusion summarizes the roles of cryptocurrency research specialists in various stages and legal proceedings (criminal, civil and arbitration) from oral and written consultations, preparation of specialist opinions to participation in investigative actions, court hearings and negotiations between conflicting parties. The research incorporates both general and specific scientific methodologies such as system-structural analysis, formal-logical extrapolation, document analysis, statistical analysis, prognostic and interviewing techniques.

Paranjay Haldar, Rajdeep Roy, Utpal Biswas

No abstract is available for this record.

산업정책연구원/연구교수, Byung Wan Suh, Won-Woong Kim

가상화폐는 익명성과 탈중앙화 특성으로 인해 범죄에 악용될 가능성이 높으며, 이에 따라 효과적인 추적 기법의 개발이 요 구된다. 공개출처정보는 공공 데이터, 소셜 미디어, 온라인 포럼 등 다양한 오픈 소스 데이터를 분석하여 범죄자의 신원 파악 과 가상화폐 자금 흐름 추적에 유용한 정보를 제공할 수 있다. 본 논문에서는 공개출처정보의 활용 방안을 종합적으로 제시하 고자 한다. 이를 위해 우선 가상화폐의 현황과 추세 및 관련 범죄 현황에 대해 살펴보고, 공개출처정보의 개념 및 방법에 대해 알아본다. 이후 가상화폐 관련 범죄의 추적 및 분석을 위한 공개출처정보의 5가지 방법과 7가지 프레임워크를 중점 분석하고, 공개출처정보 방법과 프레임워크를 적용하는 통합 기법을 제시한다.

Dongcheng Li, W. Eric Wong, Xiaodan Wang, Sean Pan · 5 authors

This paper introduces a method for detecting vulnerabilities in smart contracts using static analysis and a multi-objective optimization algorithm. We focus on four types of vulnerabilities: reentrancy, call stack overflow, integer overflow, and timestamp dependencies. Initially, smart contracts are compiled into an abstract syntax tree to analyze relationships between contracts and functions, including calls, inheritance, and data flow. These analyses are transformed into static evaluations and intermediate representations that reveal internal relations. Based on these representations, we examine contract's functions, variables, and data dependencies to detect the specified vulnerabilities. To enhance detection accuracy and coverage, we apply a multi-objective optimization algorithm to the static analysis process. This involves assigning initial numeric values to input data and monitoring changes in statement coverage and detection accuracy. Using coverage and accuracy as fitness values, we calculate Pareto front and crowding distance values to select the best individuals for the new parent population, iterating until optimization criteria are met. We validate our approach using an open-source dataset collected from Etherscan, containing 6,693 smart contracts. Experimental results show that our method outperforms state-of-the-art tools in terms of coverage, accuracy, efficiency, and effectiveness in detecting the targeted vulnerabilities.

Yichen Wang, Xiangfu Zhao, Long He, Zixian Zhen · 5 authors

Smart contracts have been widely used for their capability of giving blockchain a user-defined logic. In recent years, several smart contract security incidents have resulted in enormous financial losses. Therefore, it is important to detect vulnerabilities in smart contracts before deployment. Machine learning has been used recently in smart contract vulnerability detection. Unfortunately, due to the loss of information during feature extraction, the detection results are unsatisfactory. Hence, we propose a novel approach called ContractGNN, which combines a new concept of avulnerability sub-graph(VSG) withgraph neural networks(GNNs). Compared with traditional methods, checking a VSG is more accurate because the VSG removes irrelevant vertexes in the control flow graph. Furthermore, a VSG can be aggregated and simplified, thus improving the efficiency of message passing in a GNN. Based on aggregated VSGs, we design a new feature extraction method that preserves semantic information, the order of opcode, and control flows of smart contracts. Moreover, we compare a large number of GNN classification models and select the best one to implement ContractGNN. We then test ContractGNN on 48,493 real-world smart contracts, and the experimental results show that ContractGNN outperforms other smart contract vulnerability detection tools, with an average F1 score of 89.70%.