Escrow trust is a foundational requirement for high-value campaign execution in Web3 marketing marketplaces. When campaign budgets exceed USD 50,000 and settlement is enforced on-chain, the security properties of the escrow contract and its surrounding settlement architecture determine whether the platform can be trusted by enterprise brands. Naive escrow designs — single-key deployment, monolithic contract logic, and implicit state transitions — expose platforms to fund loss through key compromise, smart contract exploit, and fraudulent dispute resolution. This paper presents SESA (Secure Escrow and Settlement Architecture), a formal engineering framework for Web3 campaign escrow that integrates multi-signature approval policies, strict role segregation between campaign management and fund release authority, control-plane and data-plane separation with hardware-backed signing, and explicit finite-state machine governance of all escrow lifecycle transitions including dispute resolution. SESA is grounded in a formal threat model that enumerates eleven attack vectors specific to Web3 escrow systems and maps each to a corresponding architectural control. A formal verification of the escrow state machine using the TLA+ specification language demonstrates the absence of deadlock, fund loss, and unauthorised release under all reachable states. A gas cost analysis of the reference Solidity implementation demonstrates that SESA's security controls add a mean overhead of 23% in gas cost relative to a naive single-key escrow — a trade-off that enterprise buyers consistently accept in exchange for verifiable security assurances. SESA enables campaign budgets that would be commercially unviable under insecure escrow designs to flow safely through the platform, directly expanding the addressable market for high-value brand partnerships.
Web3 applications require execution platforms that maintain confidentiality and integrity without relying on centralized trust authorities. While Trusted Execution Environments (TEEs) offer promising capabilities for confidential computing, current implementations face significant limitations when applied to Web3 contexts, particularly in security reliability, censorship resistance, and vendor independence. This paper presents dstack, a comprehensive framework that transforms raw TEE technology into a true Zero Trust platform. We introduce three key innovations: (1) Portable Confidential Containers that enable seamless workload migration across heterogeneous TEE environments while maintaining security guarantees, (2) Decentralized Code Management that leverages smart contracts for transparent governance of TEE applications, and (3) Verifiable Domain Management that ensures secure and verifiable application identity without centralized authorities. These innovations are implemented through three core components: dstack-OS, dstack-KMS, and dstack-Gateway. Together, they demonstrate how to achieve both the performance advantages of VM-level TEE solutions and the trustless guarantees required by Web3 applications. Our evaluation shows that dstack provides comprehensive security guarantees while maintaining practical usability for real-world applications.
Internet of Underwater Things (IoUT) introduces critical security challenges, especially for protecting distributed infrastructures in resource-constrained environments. Conventional asymmetric and centralized authentication models are unsuitable due to computational and communication overhead, while symmetric approaches lack robustness without trusted storage or hardware. We propose a non-interactive, asynchronous authentication protocol based on NIZKP, combining PUFs-derived secrets with decentralized identifiers on a distributed ledger. This approach enables direct node authentication with cryptographically verifiable identity binding, minimal resource usage, offline verification, and full support for asynchronous operation in constrained environments. The protocol is formally analysed and implemented on COTS hardware without additional secure components. Evaluation shows low energy consumption (827.2 mJ), minimal communication overhead (113 B, 1.513s, 817.9 mJ), and reasonable execution times (worst case ≈ 5.310s), outperforming state-of-the-art solutions in the first four metrics.
David Chaum, Richard Carback, Jeremy Clark, Liu Chao · 11 authors
Abstract We revisit “silent coercion” where an adversary gains access to a voter’s credential without the voter’s knowledge in an E2E verifiable, coercion-resistant Internet voting system. We argue that in this setting, casting an intended vote is impossible since the cryptographic backend can no longer distinguish the voter and adversary. However, we affirm that the voter can still act to nullify adversarial ballots, which is preferable to inaction. We provide a new instantiation of nullification using zero-knowledge proofs and multiparty computation, which improves on the efficiency of the current state-of-the-art. We also demonstrate an example voting system—VoteXX—that uses nullification. Our nullification protocol can complement new and existing techniques for coercion resistance (which all require voters to hide cryptographic keys from the coercer), providing a failsafe option for voters whose keys leak.
Nan Wang, Nan Wu, Xiangyu Hui, Jiafan Wang · 5 authors
As the demand for exercising the "right to be forgotten" grows, the need for verifiable machine unlearning has become increasingly evident to ensure both transparency and accountability. We present {\em zkUnlearner}, the first zero-knowledge framework for verifiable machine unlearning, specifically designed to support {\em multi-granularity} and {\em forgery-resistance}. First, we propose a general computational model that employs a {\em bit-masking} technique to enable the {\em selectivity} of existing zero-knowledge proofs of training for gradient descent algorithms. This innovation enables not only traditional {\em sample-level} unlearning but also more advanced {\em feature-level} and {\em class-level} unlearning. Our model can be translated to arithmetic circuits, ensuring compatibility with a broad range of zero-knowledge proof systems. Furthermore, our approach overcomes key limitations of existing methods in both efficiency and privacy. Second, forging attacks present a serious threat to the reliability of unlearning. Specifically, in Stochastic Gradient Descent optimization, gradients from unlearned data, or from minibatches containing it, can be forged using alternative data samples or minibatches that exclude it. We propose the first effective strategies to resist state-of-the-art forging attacks. Finally, we benchmark a zkSNARK-based instantiation of our framework and perform comprehensive performance evaluations to validate its practicality.
Omar Jarkas, Ryan K. L. Ko, Naipeng Dong, Redowan Mahmud
Integrity verification and attestation are critical in containerized environments, where traditional Linux Integrity Measurement Architecture (IMA) falls short due to its lack of container-specific contextualization. These gaps undermine container autonomy, escalate privacy risks, and impede granular integrity checks. Addressing these challenges, this paper introduces the Virtual IMA (VIMA), a novel framework that refines Linux IMA’s principles to support containerized settings. Using nested Merkle trees, VIMA’s Two-Tree Architecture (2TA) enables detailed integrity assessments across system-wide monolithic trees and individual container trees. Integrating Merkle and zero-knowledge (ZK) proofs establishes VIMA as a secure, privacy-preserving verification and attestation solution. Our comparative analysis and initial prototype testing reveal that VIMA significantly improves upon traditional IMA with minimal performance overhead, offering substantial scope for optimization.
Thibauld Feneuil, Matthieu Rivain, Auguste Warmé-Janville
Side-channel attacks pose significant threats to cryptographic implementations, which require the inclusion of countermeasures to mitigate these attacks. In this work, we study the masking of state-of-the-art post-quantum signatures based on the MPC-in-the-head paradigm. More precisely, we focus on the recent threshold-computation-in-the-head (TCitH) framework that applies to some NIST candidates of the post-quantum standardization process. We first provide an analysis of side-channel attack paths in the signature algorithms based on the TCitH framework. We then explain how to apply standard masking to achieve a d-probing secure implementation of such schemes, with performance scaling in O(d2), for d the masking order.Our main contribution is to introduce different ways to tweak those signature schemes towards their masking friendliness. While the TCitH framework comes in two variants, the GGM variant and the Merkle tree variant, we introduce a specific tweak for each of these variants. These tweaks allow us to achieve complexities of O(d) and O(d log d) at the cost of non-constant signature size, caused by the inclusion of additional seeds in the signature. We also propose a third tweak that takes advantage of the threshold secret sharing used in TCitH. With the right choice of parameters, we show how, by design, some parts of the TCitH algorithms satisfy probing security without additional countermeasures. While this approach can substantially reduce the cost of masking in some part of the signature algorithm, it degrades the soundness of the core zero-knowledge proof, hence slightly increasing the size of the signature.We analyze the complexity of the masked implementations of our tweaked TCitH signatures and provide benchmarks on a RISC-V platform with built-in hash accelerator. We use a modular benchmarking approach, allowing to estimate the performance of diverse signature instances with different tweaks and parameters. Our results illustrate how the different variants scale for an increasing masking order. For instance, for a masking order d = 3, we obtain signatures of around 14 kB that run in 0.67 second on a the target RISC-V CPU with a 250MHz frequency. This is to be compared with the 4.7 seconds required by the original signature scheme masked at the same order on the same platform. For a masking order d = 7, we obtain a signature of 17.5 kB running in 1.75 second, to be compared with 16 seconds for the stardard masked signature.Finally, we discuss the extension of our techniques to signature schemes based on the VOLE-in-the-Head framework, which shares similarities with the GGM variant of TCitH. One key takeaway of our work is that the Merkle tree variant of TCitH is inherently more amenable to efficient masking than frameworks based on GGM trees, such as TCitH-GGM or VOLE-in-the-Head.
Smart contracts are software that runs in blockchain and expresses the rules of an agreement between parties. An incorrect smart contract might allow blockchain users to violate its rules and even jeopardize its expected security. Smart contracts cannot be easily replaced to patch a bug since the nature of contracts requires them to be immutable. More problems occur when a smart contract is written in a general-purpose language, such as Java, whose executions, in a blockchain, could hang the network, break consensus or violate data encapsulation. To limit these problems, there exist automatic static analyzers that find bugs before smart contracts are installed in the blockchain. This so-called off-chain verification is optional because programmers are not forced to use it. This paper presents a general framework for the verification of smart contracts, instead, that is part of the protocol of the nodes and applies when the code of the smart contracts gets installed. It is a mandatory entry filter that bans code that does not abide by the verification rules. Consequently, such rules become part of the consensus rules of the blockchain. Therefore, an improvement in the verification protocol entails a consensus update of the network. This paper describes an implementation of a smart contracts application layer with protocol-based verification for smart contracts written in the Takamaka subset of Java, that filters only those smart contracts whose execution in blockchain is not dangerous. This application layer runs on top of a consensus engine such as Tendermint and its derivatives Ignite and CometBFT (proof of stake), or Mokamint (proof of space). This paper provides examples of actual implementations of verification rules that check if the smart contracts satisfy some constraints required by the Takamaka language. This paper shows that protocol-based verification works and reports how consensus updates are implemented. It shows actual experiments as well as limits to its use, mainly related to the fact that protocol-based verification must be fast and its complexity must never explode, or otherwise, it would compromise the performance of the blockchain network.
The rapid expansion of Internet of Things (IoT) deployments across smart environments introduces critical security challenges, particularly at the device identity and physical layers. Traditional cryptographic methods and Distributed Ledger Technologies (DLTs), while valuable, often fail to account for the constrained resources of IoT devices and their susceptibility to physical-layer attacks. This paper proposes a scalable, lightweight security framework that integrates Physical Unclonable Functions (PUFs), Zero-Knowledge Proofs (ZKPs), and a permissioned blockchain to establish end-to-end trust in distributed IoT ecosystems. PUFs act as hardware-rooted trust anchors, enabling secure key generation and unclonable device identity without relying on non-volatile memory. ZKPs facilitate mutual authentication by allowing devices to prove legitimacy without revealing any identifying information. A permissioned blockchain acts as a decentralised verification and audit layer, immutably recording authentication events and ensuring tamper resistance with controlled governance. The proposed architecture is designed to counteract physical tampering, spoofing, and identity forgery while remaining computationally viable for resource-constrained IoT devices. This work presents the foundation for a robust, privacy-preserving, and decentralised security model, bridging the gap between hardware-level assurance and scalable trust in future IoT deployments.
Physical Unclonable Functions (PUFs) and Hardware Security
Ethereum enables the creation and execution of decentralized applications through smart contracts, that are compiled to Ethereum Virtual Machine (EVM) bytecode. Once deployed in the blockchain, the bytecode is immutable; hence, ensuring that smart contracts are bug-free before their deployment is of utmost importance. A crucial preliminary step for any effective static analysis of EVM bytecode is the extraction of the control-flow graph (CFG): this presents significant challenges due to potentially statically unknown jump destinations. In this paper we present a novel approach, based on Abstract Interpretation, aiming to build a sound CFG from EVM bytecode smart contracts. Our analysis, which is implemented in our static analyzer EVMLiSA, is based on a parametric abstract domain that approximates concrete execution stacks at each program point as an l -sized set of abstract stacks of maximal height h ; the results of the analysis are then used to resolve the jump destinations at jump nodes. Furthermore, EVMLiSA includes a checker for reentrancy detection, working on the constructed CFG. Our experiments show that, by fine-tuning the analysis parameters, EVMLiSA is able to build sound CFGs for all real-world smart contracts in the considered benchmark suite. Moreover, EVMLiSA successfully detects all reentrancy vulnerabilities in EVM bytecode smart contracts, while producing a small number of false positives.
Fine-tuning large language models (LLMs) is crucial for adapting them to specific tasks, yet it remains computationally demanding and raises concerns about correctness and privacy, particularly in untrusted environments. Although parameter-efficient methods like Low-Rank Adaptation (LoRA) significantly reduce resource requirements, ensuring the security and verifiability of fine-tuning under zero-knowledge constraints remains an unresolved challenge. To address this, we introduce VeriLoRA, the first framework to integrate LoRA fine-tuning with zero-knowledge proofs (ZKPs), achieving provable security and correctness. VeriLoRA employs advanced cryptographic techniques -- such as lookup arguments, sumcheck protocols, and polynomial commitments -- to verify both arithmetic and non-arithmetic operations in Transformer-based architectures. The framework provides end-to-end verifiability for forward propagation, backward propagation, and parameter updates during LoRA fine-tuning, while safeguarding the privacy of model parameters and training data. Leveraging GPU-based implementations, VeriLoRA demonstrates practicality and efficiency through experimental validation on open-source LLMs like LLaMA, scaling up to 13 billion parameters. By combining parameter-efficient fine-tuning with ZKPs, VeriLoRA bridges a critical gap, enabling secure and trustworthy deployment of LLMs in sensitive or untrusted environments.
Ziwei Li, Jiajing Wu, Zhiying Wu, D. Tan · 9 authors
Smart contracts are self-executing computer programs on blockchains. With the development of blockchain technology, the number of smart contracts has grown rapidly, as has the concern for their security. Regrettably, inconsistencies between the logic implemented in the code and the intentions described in the comments, known as Code–Comment Inconsistencies (CCI), are frequently present in some smart contracts. These inconsistencies can mislead readers in understanding the contract code and, in severe cases, may lead to vulnerabilities and economic losses. Existing learning-based methods are not tailored for smart contract languages, overlook the issue of insufficient context information caused by comment references and nested intentions, and rely on large-scale labeled data; whereas rule-based methods struggle to accommodate the flexibility with which developers express intentions, often resulting in false positives. To tackle the challenges posed by insufficient context information and the scarcity of labeled data, we introduce CCIHunter, a tool designed to detect CCIs in smart contracts. CCIHunter addresses the issue of insufficient context information during data modeling and incorporates a two-stage pre-training process that does not depend on labeled data to enhance its detection capabilities. Specifically, CCIHunter enhances comments based on templates and models code as a heterogeneous graph based on function calls. It utilizes CodeBERT and UniMp to generate embeddings for comments and code, respectively, and then calculates the similarity between these two embeddings. Consistency is judged by combining code embeddings, comment embeddings, and similarity scores. Notably, CCIHunter undergoes a two-stage pre-training that includes contrastive learning and mutation analysis, aiming to improve its ability to bridge the gap between code and comments and to focus on code elements at different granularities. Experimental results demonstrate that CCIHunter achieves a precision of 0.95, a recall of 0.90, and an F1 score of 0.93, outperforming existing tools.
The growing integration of microservices exacerbates the mounting concern over privacy and trust caused by frequent data leaks and breaches. These systems are inherently decentralized, making them harder to manage, increasing the attack surface, and complicating trust between independently deployed services. Despite these persistent challenges, trust and authentication are often handled using centralized and stateful methods that require storing extensive state information. Existing so-called stateless authentication methods typically shift state storage from the server to the client side rather than detaching from state dependency. To address this challenge, we propose a lightweight, scalable, and truly stateless authentication approach that is non-idempotent and utilizes self-resetting nested Zero-Knowledge Proofs (ZKPs) to eliminate reliance on past actions. This platform anticipates user intentions and rigorously monitors them, ensuring bidirectional operational integrity while preserving privacy. Specifically, the self-resetting ZKP mechanism leverages the dynamic nature of microservices and incorporates random proof segmentation as a random generator to ensure each request is unique. Our tests using the OpenTelemetry Demo confirm its functionality and the independence between requests. Furthermore, security analysis demonstrates comprehensive security through non-idempotent authentication and the uniqueness of proof segmentation for each request.
Aug 24, 2025·Proceedings of the 31st ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, 2026
Thomas Gassmann, Stefanos Chaliasos, Thodoris Sotiropoulos, Zhendong Su
Zero-knowledge proofs (ZKPs) are the cornerstone of programmable cryptography. They enable (1) privacy-preserving and verifiable computation across blockchains, and (2) an expanding range of off-chain applications such as credential schemes. Zero-knowledge virtual machines (zkVMs) lower the barrier by turning ZKPs into a drop-in backend for standard compilation pipelines. This lets developers write proof-generating programs in conventional languages (e.g., Rust or C++) instead of hand-crafting arithmetic circuits. However, these VMs inherit compiler infrastructures tuned for traditional architectures rather than for proof systems. In particular, standard compiler optimizations assume features that are absent in zkVMs, including cache locality, branch prediction, or instruction-level parallelism. Therefore, their impact on proof generation is questionable. We present the first systematic study of the impact of compiler optimizations on zkVMs. We evaluate 64 LLVM passes, six standard optimization levels, and an unoptimized baseline across 58 benchmarks on two RISC-V-based zkVMs (RISC Zero and SP1). While standard LLVM optimization levels do improve zkVM performance (over 40\%), their impact is far smaller than on traditional CPUs, since their decisions rely on hardware features rather than proof constraints. Guided by a fine-grained pass-level analysis, we~\emph{slightly} refine a small set of LLVM passes to be zkVM-aware, improving zkVM execution time by up to 45\% (average +4.6\% on RISC Zero, +1\% on SP1) and achieving consistent proving-time gains. Our work highlights the potential of compiler-level optimizations for zkVM performance and opens new direction for zkVM-specific passes, backends, and superoptimizers.
Zero-Knowledge Proofs (ZKPs) have emerged as a powerful tool for secure and privacy-preserving computation. ZKPs enable one party to convince another of a statement's validity without revealing anything else. This capability has profound implications in many domains, including machine learning, blockchain, image authentication, and electronic voting. Despite their potential, ZKPs have seen limited deployment because of their exceptionally high computational overhead, which manifests primarily during proof generation. To mitigate these overheads, a (growing) body of researchers has proposed hardware accelerators and GPU implementations of both kernels and complete protocols. Prior art spans a wide variety of ZKP schemes that vary significantly in computational overhead, proof size, verifier cost, protocol setup, and trust. The latest and widely used ZKP protocols are intentionally designed to balance these trade-offs. One particular challenge in modern ZKP systems is supporting complex, high-degree gates using the SumCheck protocol. We address this challenge with a novel programmable accelerator to efficiently handle arbitrary custom gates via SumCheck. Our accelerator achieves upwards of $1000\times$ geomean speedup over CPU-based SumChecks across a range of gate types. We include this unit in zkPHIRE, a programmable, full-system accelerator that accelerates the HyperPlonk protocol. zkPHIRE achieves $1486\times$ geomean speedup over CPU and $11.87\times$ geomean speedup over the state-of-the-art at iso-area. Together, these results demonstrate compelling performance while scaling to large problem sizes (upwards of $2^{30}$ constraints) and maintaining small proof sizes ($4-5$ KB).
Power industry software, as a core tool for modern power equipment control and management, is facing increasingly severe cybersecurity threats.Distributed ledger technology provides new ideas for power software security detection due to its decentralization, transparency and tamper-proof characteristics.This paper discusses the application of distributed ledger technology in the security detection of software development in the electric power industry, and proposes a trusted traceability and quality access control reinforcement method based on distributed ledger.The research designs the traceability data model and smart contract system to realize the trusted collection, storage and verification of security data; at the same time, it proposes the sensitive data aggregation method based on homomorphic encryption and the tamper-proof technology of RSA asymmetric encryption, and constructs the data communication structure of Overlay structure, which guarantees the complete transmission of electric power software security detection data and traceability tracking.The experimental results show that compared with SHA256 algorithm and DyRH model, the average value of the error localization time of this method is reduced to 9.23ms, which is 8.6ms and 4.1ms less than the control group, respectively; the accuracy rate of the error localization reaches 98.33%, which is improved by 4.77% and 1.79%; and in the test of the anti-attack performance, the average number of tampered data is only 189, which is respectively reduced by 184 and 156.The study proves that distributed ledger technology can effectively enhance data credibility, strengthen traceability, and enhance the strength of system quality access control in software development security detection in the power industry, which provides a new technical path and solution for the information security of the power system.
The robustness and reliability of blockchain applications, critically depend on thorough testing. This study introduces AGTS, an automated framework for generating smart contract test suites on Hyperledger Fabric, significantly reducing manual effort while improving test coverage and security. The framework integrates static and dynamic analysis, leveraging symbolic execution and fuzz testing to detect vulnerabilities. The project is implemented in C#, and uses three test cases: CoCoME, LibraryMS and LoanPS, with their requirements as input, and generates their closely related test cases. We generated 34 test cases for CoCoME, 32 for LibraryMS, and 28 for LoanPS. Combining the test cases, their executable scripts were generated. Finally, we tested all the targeted smart contracts rigorously against the predefined criteria. The generated scripts undergo the quality assurance using ShellCheck, deploying on the continuous integration system, that further enhances the reliability and maintainability of these tests. AGTS automates the entire process of test script creation and verification, drastically reducing the manual effort involved in preparing test cases. It facilitates rapid and thorough testing cycles by generating dedicated scripts that execute specific test scenarios on smart contracts, verifying their behavior and performance. By automating the tedious and error-prone task of writing test cases, AGTS accelerates the development process and fortifies the security framework of blockchain applications. Comprehensive evaluation of AGTS across diverse real world smart contracts demonstrated the effectiveness in defect detection, significantly outperforming existing methods. The contribution of AGTS extends beyond providing a practical testing tool, by offering developers a robust framework for ensuring the reliability and security of their smart contracts. AGTS not only expedites test preparation but also ensures comprehensive test coverage, thus improving the overall quality of blockchain applications.
We argue that the technical foundations of non-fungible tokens (NFTs) remain inadequately understood. Prior research has focused on market dynamics, user behavior, and isolated security incidents, yet systematic analysis of the standards underpinning NFT functionality is largely absent. We present the first study of NFTs through the lens of Ethereum Improvement Proposals (EIPs). We conduct a large-scale empirical analysis of 191 NFT-related EIPs and 10K+ Ethereum Magicians discussions (as of July, 2025). We integrate multi-dimensional analyses including the automated parsing of Solidity interfaces, graph-based modeling of inheritance structures, contributor profiling, and mining of community discussion data. We distinguish foundational from emerging standards, expose poor cross-version interoperability, and show that growing functional complexity heightens security risks.
Meihua Xiao, Y. P. Xu, Yongtuo Zhang, Ke Yang · 6 authors
Smart contracts, as a critical application of blockchain technology, significantly enhance its programmability and scalability, offering broad application prospects. However, frequent security incidents have resulted in substantial economic losses and diminished user trust, making security issues a key challenge for further development. Since smart contracts cannot be modified after deployment, flaws in their design or implementation may lead to severe consequences. Therefore, rigorous pre-deployment verification of their correctness is particularly crucial. This paper explores the symmetry in control flows and state transitions of Solidity smart contracts and leverages this inherent structural symmetry to develop a normalized state transition model based on a finite state machine. The FSM model is subsequently formalized into a Promela model with the Spin model checker. By integrating manually defined Linear Temporal Logic formulas with those generated by Smart Pulse, the Promela model is formally verified in Spin to ensure the correctness and security of smart contracts. This approach establishes a systematic verification framework, providing effective support to enhance the reliability and security of smart contracts.
Smart contracts enable contract terms to be automatically executed and verified on the blockchain, and recent years have witnessed numerous applications of them in areas such as financial institutions and supply chains. The execution logic of a smart contract is closely related to the contract state, and thus the correct and safe execution of the contract depends heavily on the precise control and update of the contract state. However, the contract state update process can have issues. In particular, inconsistent state update issues can arise for reasons such as unsynchronized modifications. Inconsistent state update bugs have been exploited by attackers many times, but existing detection tools still have difficulty in effectively identifying them. This paper conducts the first large-scale empirical study about inconsistent state update vulnerabilities (that is, inconsistent state update bugs that are exploitable) in smart contracts, aiming to shed light for developers, researchers, tool builders, and language or library designers in order to avoid inconsistent state update vulnerabilities. We systematically investigate 116 inconsistent state update vulnerabilities in 352 real-world smart contract projects, summarizing their root causes, fix strategies, and exploitation methods. Our study provides 11 original and important findings, and we also give the implications of our findings. To illustrate the potential benefits of our research, we also develop a proof-of-concept checker based on one of our findings. The checker effectively detects issues in 64 popular GitHub projects, and 19 project owners have confirmed the detected issues at the time of writing. The result demonstrates the usefulness and importance of our findings for avoiding inconsistent state update vulnerabilities in smart contracts.
Smart contracts are important for digital finance, yet they are hard to patch once deployed. Prior work has mainly explored LLMs for smart contract vulnerability detection, leaving end-to-end automated exploit generation (AEG) much less understood. We study that gap with \textsc{ReX}, an execution-grounded framework that links LLM-based exploit synthesis to the Foundry stack for end-to-end generation, compilation, execution, and validation. Five recent LLMs are evaluated across eight common vulnerability classes, supported by a curated dataset of 38{+} real incident PoCs and three automation aids: prompt refactoring, a compiler feedback loop, and templated test harnesses. Results indicate that current frontier LLMs can often produce deterministic PoCs for single-contract vulnerabilities, but remain weak on cross-contract attacks; outcomes depend mainly on the model and bug type, while code structure and prompt tuning contribute less in our setting. The study also surfaces important boundary conditions of LLM-driven AEG, including gaps between oracle-validated exploitability and real-world economic attacks, pointing to the need for stronger defenses and more realistic evaluation.
Aditya Shewale, Dhanyasree Thallapalli, S. Udhayakumar
Smart contracts, implemented on blockchain net-works, provide secure and decentralized transactions. Despite this, issues with Solidity-based smart contracts have resulted in major financial losses due to exploits like reentrancy attacks, integer overflows, and unauthorized access. In this paper, a thorough framework of vulnerability assessment that combines static, dynamic, and forensic analysis is proposed for the improvement of the security of smart contracts. Static analysis, facilitated by Slither, detects code-level vulnerabilities, whereas dynamic analysis, driven by Mythril, emulates attack patterns to find execution-time errors. Furthermore, a forensic analysis module utilizes transaction tracing and opcode analysis to study historical exploits and identify unusual contract behaviors. The proposed framework improves the accuracy of vulnerability detection, reduces false positives, and strengthens the security of smart contracts by offering security insights. Empirical assessment illustrates the efficiency of the framework in detecting security vulnerabilities with a high detection rate and low overhead. This work adds to reinforcing blockchain security by providing an automated, multi-layered method of auditing smart contracts