Blockchain Papers

Ruibin Yan, Zeyu Zhang, Dechun Yin, Zhihao Li · 6 authors

No abstract is available for this record.

Ken Lew, Arijet Sarker, Simeon Wuthier, Jinoh Kim · 6 authors

Computing and networking are increasingly implemented in software. We design and build a software build assurance scheme detecting if there have been injections or modifications in the various steps in the software supply chain, including the source code, compiling, and distribution. Building on the reproducible build and software bill of materials (SBOM), our work is distinguished from previous research in assuring multiple software artifacts across the software supply chain. Reproducible build, in particular, enables our scheme, as our scheme requires the software materials/artifacts to be consistent across machines with the same operating system/specifications. Furthermore, we use blockchain to deliver the proof reference, which enables our scheme to be distributed so that the assurance beneficiary and verifier are the same, i.e., the node downloading the software verifies its own materials, artifacts, and outputs. Blockchain also significantly improves the assurance efficiency. We first describe and explain our scheme using abstraction and then implement our scheme to assure Ethereum as the target software to provide concrete proof-of-concept implementation, validation, and experimental analyses. Our scheme enables more significant performance gains than relying on a centralized server thanks to the use of blockchain (e.g., two to three orders of magnitude quicker in verification) and adds small overheads (e.g., generating and verifying proof have an overhead of approximately one second, which is two orders of magnitude smaller than the software download or build processes).

Joshua Zhu, Arnav Vora, Kevin Zhao, Andy Huang · 10 authors

We present the Ethereum-Sourced Package Registry (ESPR), an open-source implementation of a blockchain-based software package registry. Software supply chain security is a developing field in cybersecurity which ESPR aims to contribute to. ESPR uses smart contracts to maintain package information while storing package files off-chain using IPFS. ESPR also includes a website interface to easily interface with the smart contracts. We demonstrate that ESPR is less vulnerable to certain supply-chain attacks through its decentralized structure. Although our application presents financial costs to package developers, we explore strategies to mitigate them and provide a comparative analysis against centralized package hosting solutions.

Ningran Li, Minfeng Qi, Zhiyu Xu, Xiaogang Zhu · 7 authors

Cross-chain bridges, one of the foundational infrastructures of blockchain, provide the infrastructure and solutions for inter-operability, asset liquidity, data transfer, decentralized finance, and cross-chain governance between blockchain networks. However, because cross-chain bridges often have to handle communication and asset transfers between multiple blockchains, they involve complex protocols and technologies. This complexity increases the likelihood of vulnerabilities and potential attacks. In order to ensure the security and reliability of cross-chain bridges, this article launches a thorough investigation of existing cross-chain bridge projects, clarifying bridging mechanisms, bridge types, and security features. The following part goes into the subject of security and sheds light on the considerable challenges faced by cross-chain bridges. It conducts a thorough analysis of security flaws, covering problems like smart contract vulnerabilities, centralization risks, liquidity issues, and oracle manipulations. Furthermore, this study promotes a compendium of security solutions and best practises, pointing the way toward a cross-chain bridge scenario that is more secure.

Blerim Krasniqi, Eliza Stefanova

The emergence of Web3 technologies presents new challenges and implications for investigative techniques and evidence acquisition in the field of digital forensics. This research paper delves into the intricate landscape of Web3 and its impact on the investigative processes involved in digital forensics. By examining the unique characteristics of Web3, such as decentralized networks, blockchain technology, and smart contracts, this study aims to highlight the complexities that digital forensic investigators face in this rapidly evolving environment.Through a comprehensive review of existing literature, this paper identifies key challenges in conducting digital investigations within Web3 ecosystems. These challenges include issues related to data integrity, privacy concerns, jurisdictional boundaries, and the authentication of digital evidence. Furthermore, the implications of these challenges on traditional investigative techniques are discussed, emphasizing the need for adaptation and innovation in digital forensic practices.Overall, this research sheds light on the evolving nature of digital forensics in the context of Web3 technologies, providing insights for forensic practitioners, law enforcement agencies, and policymakers to better navigate and address the complexities of investigating digital crimes in decentralized and blockchain-based environments.

Deepesh Chaudhari, Sandeep K. Shukla

As the adoption of cryptocurrencies continues to grow, so does the complexity and scale of financial crimes involving digital assets. The need for a robust crypto crime investigation tool has never been more critical. Blockstash Intelligence is an advanced solution designed to meet this demand by equipping law enforcement agencies, financial institutions, and compliance teams with the tools necessary to track, analyse, and combat illicit activities in the crypto space. Our platform supports multiple blockchains, including Bitcoin (BTC), Ethereum (ETH), and Tron(TRX), offering a wide-ranging capability to investigate across different cryptocurrency ecosystems. Blockstash Intelligence provides a suite of features such as graph visualization of crypto transactions, real-time transaction monitoring, and compliance capabilities. With real-time off-chain to on-chain data mapping, path generation from wallets to exchanges, and comprehensive wallet assessments, Blockstash Intelligence is a helpful resource for tracing and investigating cryptocurrency-related crimes.

Paul Hancock, Gert Jan van Hardeveld, Jarek Jakubcek, Babak Akhgar · 6 authors

Tracing cryptocurrency transactions is a far from trivial process. This likely explains the increasing utilisation by criminal networks for a significant amount of criminal activity, not just cybercrime, but any crime requiring monetary transfers [ 1 ]. It is, therefore, vitally important that adequate training exists and is readily available for both new and experienced investigators to ensure that they are familiar with the latest techniques, tools and trends. Traditional training methods can be costly and resource-intensive, requiring highly qualified trainers to give their time to conduct training sessions. To address this issue, a training resource, in the form of a serious game, has been created. The game aims at providing a platform to improve the skills and expertise of law enforcement officers whilst reducing the workload of experienced investigators. This article describes the collaborative design and development of the serious game Cryptopol in a partnership between Europol and CENTRIC, which is a multi-disciplinary and end-user focused Center of Excellence, located within Sheffield Hallam University. Cryptopol is the first cryptocurrency-tracing training game of its kind, used by over 1,500 people representing over 550 law enforcement agencies from across the world.

Venkata Naga Mahesh Kumar Vankayala

This article examines the application of blockchain technology as a solution for secure and transparent software update distribution. As cyber threats evolve, traditional centralized update mechanisms face increasing vulnerabilities to tampering and unauthorized modifications. We propose a blockchain-based framework that leverages distributed ledger technology to create an immutable, decentralized environment for software updates. Our article demonstrates how this approach can eliminate single points of failure, ensure update integrity through cryptographic signing and network-wide verification, and enhance transparency in the update process. We discuss the system architecture, including update creation, distribution, and verification mechanisms, and evaluate its integration with existing software ecosystems. While acknowledging challenges such as scalability and implementation costs, we argue that blockchain-based solutions significantly advance securing software distribution. Our findings suggest that this approach has the potential to become a standard practice in the industry, substantially improving trust and reliability in software update systems. This article contributes to the growing body of research on blockchain applications in cybersecurity and provides insights for future developments in secure software distribution methods.

Yichuan Li, Wei Song, Jeff Huang

Since funds or tokens in smart contracts are maintained through specific state variables, contract audit, an effective means for security assurance, particularly focuses on these variables and their related operations. However, the absence of publicly accessible source code for numerous contracts, with only bytecode exposed, hinders audit efforts. Recovering variables and their types from Solidity bytecode is thus a critical task in smart contract analysis and audit, yet this is a challenging task because the bytecode loses variable and type information, only with low-level data operated by stack manipulations and untyped memory/storage accesses. The state-of-the-art smart contract decompilers miss identifying many variables and incorrectly infer the types for many identified variables. To this end, we propose VarLifter , a lifter dedicated to the precise and efficient recovery of typed variables. VarLifter interprets every read or written field of a data region as at least one potential variable, and after discarding falsely identified variables, it progressively refines the variable types based on the variable behaviors in the form of operation sequences. We evaluate VarLifter on 34,832 real-world Solidity smart contracts. VarLifter attains a precision of 97.48% and a recall of 91.84% for typed variable recovery. Moreover, VarLifter finishes analyzing 77% of smart contracts in around 10 seconds per contract. If VarLifter is used to replace the variable recovery modules of the two state-of-the-art Solidity bytecode decompilers, 52.4%, and 74.6% more typed variables will be correctly recovered, respectively. The applications of VarLifter to contract decompilation, contract audit, and contract bytecode fuzzing illustrate that the recovered variable information improves many contract analysis tasks.

Sylvain Bellemare

A niche corner of the Web3 world is increasingly making use of hardware-based Trusted Execution Environments (TEEs) to build decentralized infrastructure. One of the motivations to use TEEs is to go beyond the current performance limitations of cryptography-based alternatives such as zero-knowledge proofs (ZKP), fully homomorphic encryption (FHE), and multi-party computation (MPC). Despite their appealing advantages, current TEEs suffer from serious limitations as they are not secure against physical attacks, and their attestation mechanism is rooted in the chip manufacturer's trust. As a result, Web3 applications have to rely on cloud infrastruture to act as trusted guardians of hardware-based TEEs and have to accept to trust chip manufacturers. This work aims at exploring how we could potentially architect and implement chips that would be secure against physical attacks and would not require putting trust in chip manufacturers. One goal of this work is to motivate the Web3 movement to acknowledge and leverage the substantial amount of relevant hardware research that already exists. In brief, a combination of: (1) physical unclonable functions (PUFs) to secure the root-of-trust; (2) masking and redundancy techniques to secure computations; (3) open source hardware and imaging techniques to verify that a chip matches its expected design; can help move towards attesting that a given TEE can be trusted without the need to trust a cloud provider and a chip manufacturer.

Arif Perdana, Hee Jhee Jiow

• Study analyzes victim reports to understand cryptocurrency scam mechanics and prevention strategies. • Seven scam dimensions: techniques, tools, victim profiling, consequences, info harvesting, manipulation, and culture. • The “Crypto-Cognitive Exploitation Model” (CCEM) is to explain cryptocurrency scam dynamics. • Findings show cryptocurrency scams evolve, needing ongoing research and countermeasure adaptation. • Key recommendations focus on digital strategies and regulatory frameworks to prevent cryptocurrency scams. The rising prominence of cryptocurrency in global finance has unfortunately rendered it a prime target for scams, leading to significant financial losses. This study employs Cognitive Vulnerability Theory and the Social Engineering Approach to examine the dimensions, consequences, and prevention strategies of cryptocurrency scams. We analyzed data from the U.S. Department of Financial Protection and Innovation (DFPI), focusing on the dimensions of scams within the digital landscape and the efficacy of digital strategies and regulations in mitigating them. Our findings reveal seven critical dimensions of cryptocurrency scams and introduce the “Crypto-Cognitive Exploitation Model” (CCEM), which integrates theoretical insights with the unique aspects of these scams. Quantitative analysis indicates that fraudulent trading platform scams are the most prevalent, often intertwined with pig butchering scams, highlighting the complex, multifaceted nature of these fraudulent activities. We demonstrate the practical application of our recommendations, bridging theory and practice in scam mitigation. The study concludes with strategic recommendations for tailored digital approaches and enhanced regulatory mechanisms to combat evolving deceptive practices.

산업정책연구원/연구교수, Byung Wan Suh, Won-Woong Kim

가상화폐는 익명성과 탈중앙화 특성으로 인해 범죄에 악용될 가능성이 높으며, 이에 따라 효과적인 추적 기법의 개발이 요 구된다. 공개출처정보는 공공 데이터, 소셜 미디어, 온라인 포럼 등 다양한 오픈 소스 데이터를 분석하여 범죄자의 신원 파악 과 가상화폐 자금 흐름 추적에 유용한 정보를 제공할 수 있다. 본 논문에서는 공개출처정보의 활용 방안을 종합적으로 제시하 고자 한다. 이를 위해 우선 가상화폐의 현황과 추세 및 관련 범죄 현황에 대해 살펴보고, 공개출처정보의 개념 및 방법에 대해 알아본다. 이후 가상화폐 관련 범죄의 추적 및 분석을 위한 공개출처정보의 5가지 방법과 7가지 프레임워크를 중점 분석하고, 공개출처정보 방법과 프레임워크를 적용하는 통합 기법을 제시한다.

Eric C Li, Hui‐Tang Lin, Hao-Ren Yang

The Internet of Things (IoT) offers significant convenience but also exposes users to heightened risks from malicious attacks aiming to compromise device authentication and forge identities. Existing identity authentication systems typically rely on centralized architectures, leading to single points of failure and trust issues. This study introduces a mutual identity authentication scheme leveraging blockchain technology and the unique properties of physical unclonable functions (PUFs) embedded in IoT devices. PUFs are inherently unpredictable and unique, even among chips manufactured in the same batch, rendering it virtually impossible for attackers to replicate device authentication information and forge identities. By integrating blockchain technology with zero-knowledge proof protocols, the proposed scheme ensures secure authentication within open and transparent networks. Once the authentication process is completed, results are recorded on the blockchain to prevent tampering, and aggregate signature technology safeguards against man-in-the-middle attacks during data transmission from gateways to devices. Security analysis demonstrates that the proposed blockchain-PUF method is robust against common IoT security threats and is suitable for IoT devices with limited computational and storage capacities, offering a secure and efficient solution for modern IoT networks.

Yibin Xu, Tijs Slaats, Boris Düdder, Thomas Hildebrandt · 5 authors

Abstract Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed and evolved independently and cannot share a joint access control policy. This makes it challenging to ensure the correctness of access control properties and to maintain correctness when the contracts are adapted. We propose using dynamic condition response (DCR) graphs for role‐based and declarative access control for smart contracts and techniques for test‐driven modelling and refinement of DCR graphs to support the safe design and evolution of smart contracts. We show that they allow for capturing and visualizing a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports the straightforward declaration of access control rights, improved code auditing, test‐driven modelling, and safe evolution of smart contracts and improves users' understanding.

Zhibo Wang, Liu Guoming, Hongzhen Xu, Shengyu You · 6 authors

Smart contracts play an essential role in the handling and management of digital assets, where vulnerabilities can lead to severe security issues and financial losses. Current detection techniques are largely limited to identifying single vulnerabilities and lack comprehensive identification capabilities for multiple vulnerabilities that may coexist in smart contracts. To address this challenge, we propose a novel multi-label vulnerability detection model that integrates extractive summarization methods with deep learning, referred to as Ext-ttg. The model begins by preprocessing the data using an extractive summarization approach, followed by the deployment of a custom-built deep learning model to detect vulnerabilities in smart contracts. Experimental results demonstrate that our method achieves commendable performance across various metrics, establishing the effectiveness of the proposed approach in the multi-vulnerability detection tasks within smart contracts.

Francisco Javier Aguilar Feijóo, Diego Fernando Andaluz Espinosa

This research aims to determine the incidence of computer attacks on servers with the Linux operating system of local government entities. The study is limited to the decentralized autonomous government (GAD) of the Ecuadorian Amazon. Initially, the most common computer attacks that have affected organizations in recent years were determined using statistical reports from important computer security companies positioned as leaders in Gartner’s magic quadrant. Phishing and distributed denial of service (DDoS) attacks are established as computer attacks under study. Computer attacks are carried out before and after mitigation measures are established. With the help of the information systems risk analysis and management methodology (MAGERIT), the vulnerability, level of impact, and risk computer attacks cause on servers with the Linux operating system are determined. This research aims to serve as a guide to the information technology departments of local governments in implementing mechanisms that safeguard the most important asset of an organization, such as information. Keywords: computer attack, phishing, DDoS, MAGERIT, Linux. Resumen La presente investigación tiene como finalidad determinar la incidencia de los ataques informáticos en los servidores con sistema operativo Linux de entidades de gobierno local. El estudio está delimitado a un gobierno autónomo descentralizado (GAD) de la Amazonía ecuatoriana. Inicialmente se determina los ataques informáticos más comunes que han afectado a las organizaciones en los últimos años haciendo uso de reportes estadísticos de importantes empresas de seguridad informática posicionadas como líderes en el cuadrante mágico de Gartner. Se establece como ataques informáticos objeto de estudio los ataques de phishing y de denegación de servicio distribuido (DDoS). Se realizan ataques informáticos antes y después de establecer las medidas de mitigación y con la ayuda de la metodología de análisis y gestión de riesgos de los sistemas de información (MAGERIT) se determina la vulnerabilidad, el nivel de impacto y el riesgo que los ataques informáticos provocaban en los servidores con sistema operativo Linux. El presente trabajo de investigación pretende ser de gran utilidad y servir de guía a los departamentos de tecnologías de la información de gobiernos locales en la implementación de mecanismos que salvaguarden el activo más importante de una organización como lo es la información. Palabras Clave: ataque informático, phishing, ddos, magerit, linux.

Fatma S. Alrayes, Mohammed Aljebreen, MOHAMMED ALGHAMDI, Faheed A. F. Alrslani · 8 authors

Consumer electronics (CE) and the Internet of Things (IoTs) are transforming daily routines by integrating smart technology into household gadgets. IoT allows devices to link and communicate from the Internet with better functions, remote control, and automation of various complex systems simulation platforms. The quick progress in IoT technology has continuously driven the progress of further connected and intelligent CEs, shaping more smart cities and homes. Blockchain (BC) technology is emerging as a promising technology offering immutable distributed ledgers that improve the security and integrity of data. However, even with BC resilience, the IoT ecosystem remains vulnerable to Distributed Denial of Service (DDoS) attacks. In contrast, the malicious actor overwhelms the network with traffic, disrupting services and compromising device functionality. Incorporating BC with IoT infrastructure presents groundbreaking techniques to alleviate these threats. IoT networks can better detect and respond to DDoS attacks in real time by leveraging BC cryptographic techniques and decentralized consensus mechanisms, which safeguard against disruptions and enhance resilience. There must be a reliable mechanism of recognition based on adequate techniques to detect and identify whether these attacks have happened or not in the system. Artificial intelligence (A) is the most common technique that uses machine learning (ML) and deep learning (DL) to recognize cyber threats. This research presents a new Blockchain with Ensemble Deep Learning-based Distributed DoS Attack Detection (BCEDL-DDoSD) approach in the IoT platform. The primary intention of the BCEDL-DDoSD approach is to leverage BC with a DL-based attack recognition process in the IoT platform. BC technology is utilized to enable a secure data transmission process. In the BCEDL-DDoSD approach, Z-score normalization is initially employed to measure the input data. Besides, the selection of features takes place using the Fractal Wombat optimization algorithm (WOA). For attack recognition, the BCDL-DDoSD technique applies an ensemble of three models, namely denoising autoencoder (DAE), gated recurrent unit (GRU), and long short-term memory (LSTM). Lastly, an orca predator algorithm (OPA)-based hyperparameter tuning procedure has been implemented to select the parameter value of DL models. A sequence of simulations is made on the benchmark database to authorize the performance of the BCDL-DDoSD approach. The simulation results showed that the BCDL-DDoSD approach performs better than other DL techniques.

Anurag Soin, Tālis J. Putniņš, Mark Staples

Abstract The adoption of digital assets and distributed ledger technology in finance is rapidly increasing. This adoption introduces new types of risks, currently not adequately covered in conventional risk management frameworks. This paper identifies, reviews, and categorises these risks. It draws on a systematic review of literature and classifies the vulnerabilities by layer—network layer, consensus layer, protocol layer, and enablement layer.

Akhilraj V. Gadagkar, Shifana Begum

The proliferation of counterfeit items in the worldwide market has emerged as a pressing concern for consumers, manufacturers, and regulatory agencies alike. Counterfeiting not only results in monetary damages for enterprises but also presents significant hazards to customer well-being and brand standing. Conventional techniques for identifying and verifying products are frequently inadequate in detecting and stopping counterfeit goods, necessitating the development of novel solutions. Blockchain technology has emerged as a viable method for tackling the problem of counterfeit product identification. Blockchain is a decentralised and secure ledger that enables the recording and verification of transactions in a distributed, visible, and unchangeable manner. By utilising the distinct characteristics of blockchain, such as its transparency, consensus mechanism, and cryptographic hashing, it is feasible to establish a resilient system for product identification that may efficiently address the issue of counterfeiting.

Ziyi Su, Shiwei Wang, Hongliu Cai, Jiaxuan Huang · 7 authors

Current authentication schemes based on zero-knowledge proof (ZKP) still face issues such as high computation costs, low efficiency, and security assurance difficulty. Therefore, we propose a secure and efficient authentication scheme (SEAS) for large-scale IoT devices based on ZKP. In the initialization phase, the trusted authority creates prerequisites for device traceability and system security. Then, we propose a new registration method to ensure device anonymity. In the identity tracing and revocation phase, we revoke the real identity of abnormal devices by decrypting and updating group public keys, avoiding their access and reducing revocation costs. In the authentication phase, we check the arithmetic relationship between blind certificates, proofs, and other random data. We propose a new anonymous batch authentication method to effectively reduce computation costs, enhance authentication efficiency, and guarantee device authentication security. Security analysis and experimental results show that an SEAS can ensure security and effectively reduce verification time and energy costs. Its security and performance exceed existing schemes.

Fiyan Mehfil Ayoob, M. Victor Jose, Sandeep Kumar

Blockchain technology, celebrated for its decentralized architecture and promise of transparency, has also become a conduit for illicit activities. This paper introduces a novel rule-based methodology for detecting illegal transactions within blockchain networks. By analyzing transaction data through parameters such as block range, transaction hashes, and addresses, the approach identifies suspicious patterns including high-value transactions, unusual fee structures, and links to known illicit addresses. Implemented in Python, the methodology has been rigorously tested and validated, achieving an accuracy of $88 \%$ with strong precision, recall, and $F 1$ scores. This research advances the field of cybersecurity, regulatory compliance, and law enforcement by providing a practical and computationally efficient framework for detecting illegal activities in Bitcoin transactions. The rule-based framework, utilizing both threshold-based and heuristic rules, offers valuable tools for financial institutions, law enforcement, and regulators to identify and investigate illicit transactions effectively. The study underscores the need for proactive measures in protecting digital ecosystems and proposes future enhancements, including advanced anomaly detection and realtime analysis, to further improve the framework’s efficacy and adaptability.

Sifis Lagouvardos, Yannis Bollanos, Neville Grech, Yannis Smaragdakis

Decompilation of binary code has arisen as a highly-important application in the space of Ethereum VM (EVM) smart contracts. Major new decompilers appear nearly every year and attain popularity, for a multitude of reverse-engineering or tool-building purposes. Technically, the problem is fundamental: it consists of recovering high-level control flow from a highly-optimized continuation-passing-style (CPS) representation. Architecturally, decompilers can be built using either static analysis or symbolic execution techniques. We present Shrnkr, a static-analysis-based decompiler succeeding the state-of-the-art Elipmoc decompiler. Shrnkr manages to achieve drastic improvements relative to the state of the art, in all significant dimensions: scalability, completeness, precision. Chief among the techniques employed is a new variant of static analysis context: shrinking context sensitivity. Shrinking context sensitivity performs deep cuts in the static analysis context, eagerly “forgetting” control-flow history, in order to leave room for further precise reasoning. We compare Shrnkr to state-of-the-art decompilers, both static-analysis- and symbolic-execution-based. In a standard benchmark set, Shrnkr scales to over 99.5% of contracts (compared to ∼95% for Elipmoc), covers (i.e., reaches and manages to decompile) 67% more code than Heimdall-rs, and reduces key imprecision metrics by over 65%, compared again to Elipmoc.

Changtong Dong, Hao Huang, Ying Shang

Smart contracts are automated programs that run on blockchain platforms and are a crucial component of blockchain technology. Due to their involvement in significant business logic and asset value, the security and reliability of smart contracts is critical. Fuzzing is an effective method for detecting vulnerabilities in smart contracts. However, most existing fuzzers face a common limitation in efficiently satisfying hard-to-cover branch constraints. To address this challenge, this paper introduces Erinys, a fuzzing tool based on sfuzz. We incorporate the definition and usage of state variables to define hard-to-cover branch constraints. Then we employ static analysis techniques to obtain the Define-Use relationships between functions and state variables in smart contracts. Additionally, we construct a graph, known as the State variables Define Use Graph, to describe the logical connections between functions based on state variables. Based on this graph, we design strategies to generate and optimize function invoke sequences. We implemented Erinys by integrating the proposed method into sfuzz. Experimental results conducted on a dataset containing 1970 contracts demonstrate that Erinys can effectively generate high-quality function invoke sequences, leading to improved branch coverage and vulnerability detection capabilities.

Konrad Weiss, Christof Ferreira Torres, Florian Wendland

Ethereum smart contracts are executable programs deployed on a blockchain. Once deployed, they cannot be updated due to their inherent immutability. Moreover, they often manage valuable assets that are worth millions of dollars, making them attractive targets for attackers. The introduction of vulnerabilities in programs due to the reuse of vulnerable code posted on Q&A websites such as Stack Overflow is not a new issue. However, little effort has been made to analyze the extent of this issue on deployed smart contracts. In this paper, we conduct a study on the impact of vulnerable code reuse from Q&A websites during the development of smart contracts and provide tools uniquely fit to detect vulnerable code patterns in complete and incomplete Smart Contract code. This paper proposes a pattern-based vulnerability detection tool that is able to analyze code snippets (i.e., incomplete code) as well as full smart contracts based on the concept of code property graphs. We also propose a methodology that leverages fuzzy hashing to quickly detect code clones of vulnerable snippets among deployed smart contracts. Our results show that our vulnerability search, as well as our code clone detection, are comparable to state-of-the-art while being applicable to code snippets. Our large-scale study on 18,660 code snippets reveals that 4,596 of them are vulnerable, out of which 616 can be found in 7,852 deployed smart contracts. These results highlight that the reuse of vulnerable code snippets is indeed an issue in currently deployed smart contracts.