Web3 applications, particularly decentralized finance (DeFi) protocols, have grown rapidly with over $100 billion locked in smart contracts, attracting sophisticated attacks causing billions in losses. When attack occur, security analysts need to perform fault localization to identify vulnerable functions and understand attack vectors. This critical process currently requires an average of 16.7 analyst hours per incident due to complex blockchain execution models, rapidly evolving protocol interactions, and multi-contract attack patterns that exceed existing analytical capabilities. Despite its critical importance, blockchain fault localization has received limited attention due to fundamental challenges requiring semantic understanding of economic models and protocol-specific logic. Existing blockchain-specific tools target only single vulnerability types, while the only comprehensive solution, DAppFL, relies on machine learning model that may miss sophisticated exploits and lacks interpretability in results. Recent advances in large language models (LLMs) demonstrate remarkable code comprehension capabilities, but existing applications focus on proactive vulnerability detection with minimal exploration of post-incident fault localization.We present FaultSeeker, an LLM-empowered framework for blockchain transaction fault localization. Our two-stage architecture combines transaction-level forensics for strategic scoping with coordinated specialist agents for sustained reasoning. This design provides long-term memory management via orchestrator agents and specialized attention allocation through coordinated workers, enabling comprehensive analysis across complex multi-contract transactions without context loss. We evaluate Fault-Seeker on a compiled dataset of 115 real-world malicious transactions with expert-validated annotations spanning diverse attack patterns and complexity levels. Results demonstrate that FaultSeeker significantly outperforms existing approaches, including DAppFL and leading native LLMs (GPT-4o, Claude 3.7 Sonnet, DeepSeek R1), while maintaining practical efficiency (4.4- 8.6 minutes) and cost-effectiveness ($1.55-$4.53 per transaction).
Web3 applications, built on blockchain technology, manage billions of dollars in digital assets through decentralized applications (dApps) and smart contracts. These systems rely on complex, software supply chains that introduce significant security vulnerabilities. This paper examines the software supply chain security challenges unique to the Web3 ecosystem, where traditional Web2 software supply chain problems intersect with the immutable and high-stakes nature of blockchain technology. We analyze the threat landscape and propose mitigation strategies to strengthen the security posture of Web3 systems.
Fuzzing is a widely used technique for detecting vulnerabilities in smart contracts, which generates transaction sequences to explore the execution paths of smart contracts. However, existing fuzzers are falling short in detecting sophisticated vulnerabilities that require specific attack transaction sequences with proper inputs to trigger, as they (i) prioritize code coverage over vulnerability discovery, wasting considerable effort on non-vulnerable code regions, and (ii) lack semantic understanding of stateful contracts, generating numerous invalid transaction sequences that cannot pass runtime execution. In this paper, we propose SmartFuzz, a novel collaborative reflective fuzzer for smart contract vulnerability detection. It employs large language model-driven agents as the fuzzing engine and continuously improves itself by learning and reflecting through interactions with the environment. Specifically, we first propose a new Continuous Reflection Process (CRP) for fuzzing smart contracts, which reforms the transaction sequence generation as a self-evolving process through continuous reflection on feedback from the runtime environment. Then, we present the Reactive Collaborative Chain (RCC) to orchestrate the fuzzing process into multiple sub-tasks based on the dependencies of transaction sequences. Furthermore, we design a multi-agent collaborative team, where each expert agent is guided by the RCC to jointly generate and refine transaction sequences from both global and local perspectives. We conduct extensive experiments to evaluate SmartFuzz's performance on real-world contracts and DApp projects. The results demonstrate that SmartFuzz outperforms existing state-of-the-art tools: (i) it detects 5.8\%-74.7\% more vulnerabilities within 30 minutes, and (ii) it reduces false negatives by up to 80\%.
Secure authentication along with malware detection are very important steps in modern cloud or IoT environment, with, privacy, accountability, and resilience against advanced threats. The present day anonymous authentication protocols reportedly have a high cryptographic overhead, low traceability, or static privacy mechanisms, while the current IoT malware forensic approaches happen to suffer from gradient leakage, low adaptability to zero day attacks, and slow resilience. This paper presents a comprehensive multi model framework combining five novel methods. The Dual Ledger Accountability Embedded Authentication (DLAA) model combines a primary blockchain with a secondary lightweight audit ledger and zero knowledge proofs, enabling revocable accountability without identity disclosure. The Layered Privacy Gradient Synthesis (LPGS) network applies adaptive differential privacy through learned gradient perturbations, balancing anonymity with service utility. The Quantum Inspired Entropy Guided Authentication Matrix (QEAM) replaces the key exchange with entropy driven, quantum inspired encoding, enabling faster keyless authentication. For IoT forensics, the Federated Swarm Vector Autoencoder Forensics (FSVAF) framework uses swarm optimized federated learning to detect anomalies in compressed latent space, reducing gradient leakage and improving zero day detection possibilities. The Temporal Hybrid Graph Reasoning Engine (THGRE) fuses symbolic rules with neural inference over evolving knowledge graphs for quick malware traceback. The experimental output reveals that the authentication time is reduced by 38%, with 94% malware detection accuracy in adaptive attack conditions, and is able to resolve forensics up to 67% more rapidly than previous static approaches with significantly reduced overhead. This framework collectively enhance privacy, accountability, scalability, and forensic dependability, making it efficient solution for next generation cloud and IoT ecosystems.
Access control is a security mechanism designed to ensure that only authorized users can access specific resources. Cross-domain access control involves access to resources across different organizations, institutions, or applications. Traditional access control, however, which handles authentication and authorization separately in centralized environments, faces challenges in identity dispersion, privacy leakage, and diversified permission requirements, failing to adapt to cross-domain scenarios. Thus, there is an urgent need for a new access control mechanism that empowers autonomous control over user identity and resources, addressing the demands for privacy-preserving authentication and flexible authorization in cross-domain scenarios.To address cross-domain access control challenges, we propose POLARIS, a unified and extensible architecture that enables policy-based, verifiable and privacy-preserving access control across different domains. POLARIS features a structured commitment mechanism for reliable, fine-grained, policy-based identity disclosure. It further introduces VPPL, a lightweight policy language that supports issuer-bound evaluation of selectively revealed attributes. A dedicated session-level security mechanism ensures binding between authentication and access, enhancing confidentiality and resilience to replay attacks.We implement a working prototype and conduct comprehensive experiments, demonstrating that POLARIS effectively provides scalable, privacy-preserving, and interoperable access control across heterogeneous domains. Our results highlight the practical viability of POLARIS for enabling secure and privacy-preserving access control in decentralized, cross-domain environments.
Zero-knowledge proofs (ZKPs) have been used to protect the integrity of machine learning (ML) models. However, existing ZKPs for ML are still inefficient, mainly due to the computational cost of evaluating non-linear functions. In this paper, we propose a ZKP framework for typical non-linear functions in ML, including Sigmoid, Softmax, etc. Compared to the state-of-the-art Hao et al. (USENIX Security ’24), our protocols obtain 115.6-2384.4× and 296.8-4104.7× runtime improvements for prover and verifier, respectively, with a 37.91269.5× reduction in proof size.
R. Krishnan, A.G. Samuelson, Emily Yao, Ethan Cecchetti
Non-Interactive Zero Knowledge (NIZK) proofs, such as zkSNARKS, let one prove knowledge of private data without revealing it or interacting with a verifier. While existing tooling focuses on specifying the predicate to be proven, real-world applications optimize predicate definitions to minimize proof generation overhead, but must correspondingly transform predicate inputs. Implementing these two steps separately duplicates logic that must precisely match to avoid catastrophic security flaws. We address this shortcoming with zkStruDul, a language that unifies input transformations and predicate definitions into a single combined abstraction from which a compiler can project both procedures, eliminating duplicate code and problematic mismatches. zkStruDul provides a high-level abstraction to layer on top of existing NIZK technology and supports important features like recursive proofs. We provide a source-level semantics and prove its behavior is identical to the projected semantics, allowing straightforward standard reasoning.
Parsa Hedayatnia, Tina Tavakkoli, Hadi Amini, Mohammad Allahbakhsh · 5 authors
Smart contracts concentrate high value assets and complex logic in small, immutable programs, where even minor bugs can cause major losses. Existing taxonomies and tools remain fragmented, organized around symptoms such as reentrancy rather than structural causes. This paper introduces an attack-centric, program-structure taxonomy that unifies Solidity vulnerabilities into eight root-cause families covering control flow, external calls, state integrity, arithmetic safety, environmental dependencies, access control, input validation, and cross-domain protocol assumptions. Each family is illustrated through concise Solidity examples, exploit mechanics, and mitigations, and linked to the detection signals observable by static, dynamic, and learning-based tools. We further cross-map legacy datasets (SmartBugs, SolidiFI) to this taxonomy to reveal label drift and coverage gaps. The taxonomy provides a consistent vocabulary and practical checklist that enable more interpretable detection, reproducible audits, and structured security education for both researchers and practitioners.
Decentralized finance protocols are frequently exploited, creating a demand for fast and reliable repair of vulnerable smart contracts and validation that reflects runtime security. Large language models are an emerging source of patches, yet many evaluations rely on manual checks or self-assessment, which cannot confirm whether attacker profit is actually prevented. We introduce an executable benchmark that replays verified real-world exploits against patched Solidity contracts under a resilient protocol that permits alternate attack paths and controlled state variation. Our framework compiles candidate patches, deploys them on a forked chain, and tests whether the exploit still yields profit. The benchmark covers six test cases drawn from reproducible incidents and is released as open-source. Among the nine evaluated models, GPT-5, GPT-4.1, and Claude Opus 4.1 performed the best, mitigating four of six test cases. Microsoft Phi-4 was the most reliable open-source model, mitigating two of six exploits and producing compilable patches for the remaining cases. No model mitigated the H2O case once resilient checks were enabled, while a simpler access control flaw, BTNFT, was often repaired with minimal edits. Grounding validation in executable exploit replay provides a precise and scalable method to measure whether proposed repairs harden contracts at runtime.
Cloud storage uses proofs of ownership to avoid redundant uploads while keeping file contents secret. Many existing schemes need extra round trips, or rely on predictable sampling. These choices reduce security when an adversary knows part of the file. We present MiS-PoW, a zero knowledge and non-interactive proof of ownership. The protocol derives a synchronized challenge seed from the existing HTTPS/TLS session. The seed binds a discretized time window and the file identifier. Both parties compute the same challenges locally, and the protocol adds no new messages. MiS-PoW samples blocks with a stratified policy without duplicates. The policy enforces coverage across partitions and reduces the advantage of contiguous knowledge and near duplicate files. The proof layer uses STARKs with simple AIR constraints. The constraints check that indices come from the seed, lie in range, are unique, and meet per partition counts. We analyze security and show seed unpredictability, resistance to replay, and bounds under partial knowledge with limited grinding. A prototype shows that verification time does not grow with file size, and proof and bandwidth costs remain modest. MiS-PoW is deployable, privacy preserving, and scalable for cloud storage.
Zero-knowledge proof is one of the most promising privacy-preserving approaches in the current literature. However, its complex nature leads its development and deployment to be time-consuming and error-prone. Furthermore, despite the increasing adoption of zero-knowledge proof in the blockchain applications, there is still no systematic framework that streamlines the end-to-end life-cycle of proof development. This paper introduces the first LLM-enhanced zero-knowledge proof DevOps framework for blockchain (i.e. zkOps) to the literature. To evaluate the performance of the framework on different real-life scenarios, a small benchmarking suite is constructed with the increasing computational complexity with respect to the size of circuit constraints. The experimental study identifies the effects of the model temperature on the code compilation rate, and the complexity of prompts on the service latencies. The findings show that the framework efficiently handles the varying-complexity of prompts with a maximum successful compilation rate of 70% (i.e., up to 200,000 proof constraints).
The exponential growth of blockchain-based tokens has heightened the need for reliable methods to assess their longterm viability at deployment, a stage where historical market data is absent and risks such as scams and project failures are prevalent. This study introduces an explainable machine learning framework to predict token viability using static features available at launch, including smart contract properties (e.g., mintability, centralization), deployment details (e.g., network), and metadata (e.g., presence of an icon). We collected 100,000 ERC-20 tokens from Ethereum, Binance Smart Chain, and Polygon and analyzed their characteristics available at deployment and derived features. We labeled them as live or failed based on post-deployment scores derived from liquidity, transfer frequency, and holder distribution. Among the models evaluated, XGBoost with class-weight adjustment excelled, creating an enriched token set that contained, on average, 11 times more live tokens than the original dataset, surpassing other classification models in identifying viable tokens. SHAP analysis highlighted key predictors: tokens with icons, complex yet high-quality code, and deployment on Ethereum were more likely to succeed, while Polygon deployments correlated with higher risk. Though effective as an early filter, the framework's modest standalone precision underscores its role as part of a broader strategy integrating post-launch data. This approach advances early-stage token evaluation, enhancing investor decision-making and risk assessment in decentralized finance.
Vivi Andersson, Sofia Bobadilla, Harald Hobbelhagen, Martin Monperrus
Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce PoCo, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. PoCo autonomously generates PoC exploits in an agentic manner by interacting with a set of code-execution tools in a Reason–Act–Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate PoCo on a dataset of 23 real-world vulnerability reports. PoCo consistently outperforms the Zero-shot and Workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides actionable knowledge for the smart contract security community.
Ethereum is currently the main blockchain ecosystem providing decentralised trust guarantees for applications ranging from finance to e-government. A common criticism of blockchain networks has been their energy consumption and operational costs. The switch from Proof-of-Work (PoW) protocol to Proof-of-Stake (PoS) protocol has significantly reduced this issue, though concerns remain, especially with network expansions via additional layers. The ERC-4337 standard is a recent proposal that facilitates end-user access to Ethereum-backed applications. It introduces a middleware called a bundler, operated as a third-party service, where part of its operational cost is represented by its power consumption. While bundlers have served over 500 million requests in the past two years, fewer than 15 official bundler providers exist, compared to over 100 regular Ethereum access providers. In this paper, we provide a first look at the active power consumption overhead that a bundler would add to an Ethereum access service. Using SmartWatts, a monitoring system leveraging Running Average Power Limit (RAPL) hardware interfaces, we empirically determine correlations between the bundler workload and its active power consumption.
Redactable blockchains enable controlled removal or modification of data to meet regulatory demands, but existing solutions often sacrifice decentralization or auditability. This paper presents a redactable blockchain architecture that combines a Redaction Policy Engine (RPE), multi-party validator voting, and post-quantum chameleon hash functions. We introduce a structured lifecycle—from submission and policy validation to execution and logging—anchored by cryptographic enforcement and on-chain governance. Our design supports GDPR-aligned features such as audit trails, user appeals, and purpose limitation enforcement. Implemented on a permissioned Ethereum network, our system demonstrates lower latency (1.82s), gas cost (128.5k), and storage overhead (1.2%) compared to prior solutions. A detailed security and compliance analysis confirms resilience against validator collusion and quantum threats. This work offers a practical framework for deploying redactable blockchains in regulated environments while preserving verifiability and decentralization.
Healthcare IoT systems must balance the need for continuous monitoring with strong guarantees of privacy and trust. We present ProofHealth, a zero-knowledge proof–based framework that shifts verification to the edge by generating zk-SNARKs on smartphones. In this design, wearable data is encrypted and accompanied by proofs that ensure only valid submissions are admitted to cloud storage, even on untrusted networks. We implement and evaluate ProofHealth under varying batch sizes, measuring latency, throughput, and proof size. Results show batching significantly improves per-sample efficiency while proof sizes remain constant at sub-kilobyte scale, enabling lightweight communication suitable for constrained devices. This demonstrates the practicality of proof-at-the-edge healthcare monitoring and establishes ProofHealth as a novel approach to secure and privacy-preserving health data collection.
Collision-resistant cryptographic hash functions (CRHs) are crucial for security, particularly for message authentication in Zero-knowledge Proof (ZKP) applications. However, traditional CRHs like SHA-2 or SHA-3, while optimized for CPUs, generate large circuits, rendering them inefficient in the ZK domain. Conversely, ZK-friendly hashes are designed for circuit efficiency but struggle on conventional hardware, often orders of magnitude slower than standard hashes due to their reliance on expensive finite field arithmetic. To bridge this performance gap, we present HashEmAll, a novel collection of FPGA-based realizations for three prominent ZK-friendly hashes: Griffin, Rescue-Prime, and Reinforced Concrete. Each offers distinct optimization pro les, with both area-optimized and latency-optimized variants available, allowing users to tailor hardware selection to specific application constraints regarding resource utilization and performance.Our extensive evaluation shows that latency-optimized HashEmAll designs outperform CPU implementations by at least 10×, with the leading design achieving a 23× speedup. These gains are coupled with lower power consumption and compatibility with accessible FPGAs. Importantly, the highly parallel and pipelined architecture of HashEmAll enables significantly better practical scaling than CPU-based approaches towards building real-world ZKP applications, such as data commitments with Merkle Trees, by mitigating the hashing bottleneck for large trees. This highlights the suitability of HashEmAll for real-world ZKP applications involving large-scale data authentication. We also highlight the ability to translate the HashEmAll methodology to various ZK-friendly hash functions and different field sizes.
Decentralized Finance (DeFi) smart contracts manage billions of dollars, making them a prime target for exploits. Price manipulation vulnerabilities, often via flash loans, are a devastating class of attacks causing significant financial losses. Existing detection methods are limited. Reactive approaches analyze attacks only after they occur, while proactive static analysis tools rely on rigid, predefined heuristics, limiting adaptability. Both depend on known attack patterns, failing to identify novel variants or comprehend complex economic logic. We propose PMDetector, a hybrid framework combining static analysis with Large Language Model (LLM)-based reasoning to proactively detect price manipulation vulnerabilities. Our approach uses a formal attack model and a three-stage pipeline. First, static taint analysis identifies potentially vulnerable code paths. Second, a two-stage LLM process filters paths by analyzing defenses and then simulates attacks to evaluate exploitability. Finally, a static analysis checker validates LLM results, retaining only high-risk paths and generating comprehensive vulnerability reports. To evaluate its effectiveness, we built a dataset of 73 real-world vulnerable and 288 benign DeFi protocols. Results show PMDetector achieves 88% precision and 90% recall with Gemini 2.5-flash, significantly outperforming state-of-the-art static analysis and LLM-based approaches. Auditing a vulnerability with PMDetector costs just $0.03 and takes 4.0 seconds with GPT-4.1, offering an efficient and cost-effective alternative to manual audits.
The growing digitalization of sectors such as education, healthcare, and public administration has driven Device-as-a-Service (DaaS) models. In the Portuguese educational context, the "Escola Digital" program is a clear example of this transformation, scaling the distribution and remote management of devices. With the massification of computer systems, risks of theft, misuse, and unauthorized configurations arise, exacerbated by profiles with low digital literacy (e.g., primary school students). Therefore, an agile and secure mechanism is needed to prevent or mitigate these issues before the operating system boots. Despite several proposals in the literature for device management and protection, existing solutions typically operate after boot, leaving a window open for attackers to exploit. This dissertation addresses this gap by introducing a UEFI module capable of querying and validating (cryptographically) the device’s state on a blockchain infrastructure before boot, reducing the attack surface and simplifying operational response. This dissertation investigates the feasibility of integrating a component into the UEFI firmware capable of communicating with a blockchain infrastructure to enhance device security and control during pre-boot. Specifically: (i) design a module that interacts with the blockchain before the operating system boots; and (ii) explore cryptographic mechanisms to verify the authenticity and integrity of received information.A UEFI module (EDK II) that queries the blockchain to obtain device status and enforce pre-boot lock/unlock policies is proposed and prototyped. The solution utilizes lightweight cryptographic mechanisms (authentication and anti-replay) and a key management and temporal lease scheme. The evaluation considers the impact on boot time, network latency, and on-chain cost. The results demonstrate technical feasibility, with modest boot overhead and reliable enforcement of control policies before the operating system boots.
This paper reconstructs zero-knowledge extensions on Solana as an architecture theory. Drawing on the existing ecosystem and on the author's prior papers and implementations as reference material, we propose a two-axis model that normalizes zero-knowledge (ZK) use by purpose (scalability vs. privacy) and by placement (on-chain vs. off-chain). On this grid we define five layer-crossing invariants: origin authenticity, replay-safety, finality alignment, parameter binding, and private consumption, which serve as a common vocabulary for reasoning about correctness across modules and chains. The framework covers the Solana Foundation's three pillars (ZK Compression, Confidential Transfer, light clients/bridges) together with surrounding components (Light Protocol/Helius, Succinct SP1, RISC Zero, Wormhole, Tinydancer, Arcium). From the theory we derive two design abstractions - Proof-Carrying Message (PCM) and a Verifier Router Interface - and a cross-chain counterpart, Proof-Carrying Interchain Message (PCIM), indicating concrete avenues for extending the three pillars.
The Internet of Medical Things (IoMT) transforms healthcare by enabling real-time monitoring of patient vitals, such as heart rate and glucose levels, but faces significant challenges in securing sensitive data against cyber threats and ensuring reliability in resource-constrained wearable devices, like low-power biosensors with limited computational capacity. The rise of quantum computing, particularly Shor algorithm, threatens to break traditional cryptographic methods (e.g., RSA, ECC) within 5–10 years by efficiently solving their underlying mathematical problems, endangering patient data confidentiality. Post-quantum cryptography (PQC), such as lattice-based schemes, offers resilience but demands high computational resources, challenging IoMT scalability. Unlike other PQC IoMT frameworks, such as those using NTRU, which prioritize computational simplicity but lack advanced privacy mechanisms, Q-PRADAX pioneers a secure, adaptive data aggregation framework, integrating Ring-LWE-based PQC for quantum-resilient confidentiality, compact zk-SNARK proofs for tamper-proof verification of patient vitals, and adaptive clustering for enhanced network reliability and scalability. Evaluated using OMNeT + + 6.0.3 with INET 4.5, Q-PRADAX achieves 94.5% diagnostic accuracy on ECG datasets, 100% tampering detection, and 99.9% packet delivery across 1000 devices in its Baseline scenario, with a security latency of 12.2 ms/packet and energy consumption of 0.38 mJ/packet on ARM Cortex-M4 devices (200 mAh). Outperforming existing IoMT solutions in security and fault tolerance, Q-PRADAX establishes a global standard for a secure, patient-centric IoMT ecosystem, redefining reliable healthcare delivery.