Fatemeh Erfan, Mohammad Yahyatabar, Martine Bellaïche, Talal Halabi
• Created a refined, expanded, and precisely labeled dataset with explanations, risk assessments, and fixes for each vulnerability • Fine-tuned an open-source LLM: LLaMA-3.1-8B using parameter-efficient techniques (LoRA) for smart contract vulnerability detection • Fine-tuned GPT-4o-mini on the same corpus for comparative analysis • Developed a real-time Visual Studio Code (VSCode) plugin integrating GPT-4o-mini for smart contract auditing • Released the datasets, tool, and fine-tuned model to advance research in smart contract security Since the advent of Ethereum, ensuring the security of smart contracts has become imperative. Integer overflow and underflow, reentrancy, and timestamp dependency remain the three most prevalent vulnerabilities in deployed contracts. Existing static-analysis tools often yield insufficient accuracy, and datasets derived from them inherit the same shortcomings. Moreover, the smart contract ecosystem lacks a dependable, real-time auditing aid for developers and a fine-tuned model trained on a truly comprehensive corpus. In this paper, we present three main contributions. (1) Dataset curation: the state-of-the-art vulnerability datasets are aggregated and harmonized, producing a clean, fully labeled dataset that integrates detailed explanations, potential security risks, vulnerable line ranges, code snippets, and corresponding fixes. The dataset is publicly available via our GitHub repository. (2) Model fine-tuning: the LLaMA-3.1-8B model as well as GPT-4o-mini are fine-tuned on this corpus and evaluated with both standard classification metrics and text-quality measures. The fine-tuned LLaMA-3.1 model achieves a precision of 93.55%, an average semantic similarity of 77.48%, and a code similarity of 87.25%. (3) IDE integration: We implement a real-time Visual Studio Code extension, backed by the GPT-4o API, that highlights, explains, and automatically patches vulnerabilities as the developer writes. Together, these contributions deliver a rigorously validated model and a practical developer toolchain that markedly advance the state of smart contract security research and practice.
The growth of digital music streaming platforms has changed the way music is distributed and accessed across the world. These platforms make music easily available to listeners the royalty distribution process still faces several challenges. Limited transparency, delayed payments, and the involvement of multiple intermediaries often reduce efficiency and affect the earnings received by artists. This work shows a blockchain-based framework for music royalty distribution. The given system combines Ethereum smart contracts, Non-Fungible Tokens (NFTs), and the Inter Planetary File System (IPFS) to support secure ownership management and automated royalty payments. Smart contracts execute royalty transactions based on predefined conditions, while NFTs represent ownership of digital music files. IPFS is used for decentralized storage to maintain secure and tamper resistant media files. By reducing dependency on central authorities, the framework makes royalty transactions easier to track and supports fair revenue distribution for artists. The obtained results show fast royalty processing and improved revenue sharing compared with old royalty management systems [18].
Camilo Molina Bolívar, Carla Celi Medina, Diego Martínez Godoy
This article examines governance and territorial transformation in Lago Agrio, an Amazonian frontier city shaped by processes of forced migration and political decentralization. Through a comparative qualitative methodology, it analyzes how local governance unfolds within a framework of functional centralism, wherein responsibilities are delegated without the transfer of substantive autonomy. Integrating legal, spatial planning, and community perspectives, the study applies a governance matrix to twelve clusters of informal urbanization. The cases of ACER and Nuevo Recinto serve to illustrate contrasting governance outcomes. The findings reveal that in Lago Agrio, institutions depend primarily on negotiation, rather than autonomous municipal authority. ACER has achieved partial formalization as a peri-urban settlement through mechanisms of collective land tenure and cohesive grassroots organization. Conversely, Nuevo Recinto, established on private land, remains marginal to formal planning and redistributive frameworks. These divergences underscore a model of governance rooted in relational proximity and external alliances. The study concludes that hybrid urban–rural forms emerge from such negotiated arrangements, sustaining Lago Agrio’s character as a city of refuge. It calls for policy frameworks that integrate land rights, livelihood strategies, and public investment to strengthen inclusive urban governance in peripheral and borderland contexts.
Agriculture, Land Use, Rural Development
Conservation, Biodiversity, and Resource Management
Smart contracts (SCs) implemented on blockchain represent a breakthrough in decentralized applications, enabling a range of functions such as managing supply chains and handling elections. As the adoption of SCs increases, the need to detect flaws and vulnerabilities in their execution grows. To address this challenge, we present Branch Reinforcement Learning Fuzzer (BRLF), a deep reinforcement learning-based solution for the detection of vulnerabilities in SCs. The novelty of our method is threefold: first, our deep model uses text-based embeddings of conditional branches to enhance its adaptability and flexibility. Secondly, we propose a reward function that considers multiple aspects of fuzzing, such as opcode analysis and gas usage. Finally, we incorporate evolutionary algorithms into our approach, which significantly bolsters its ability to produce varied outputs. Extensive evaluation on three datasets of Ethereum-based SCs shows that BRLF outperforms state-of-the-art methods, detecting more vulnerabilities and achieving higher code coverage than existing solutions. Our code and data are available at: https://zenodo.org/records/15022152
Tsvetelina Ivanova, L Koleva, Idilia Batchkova, G Kolev
Abstract Reliable vacuum control in high-precision installations such as the Electron Beam Melting and Refining (EBMR) plant requires an intelligent architecture that integrates physical subsystems and cyber entities under an adaptive control framework. This paper proposes a multi-agent system (MAS) representation of the EBMR vacuum creation subsystem, developed using the Organizational Multi-Agent Systems Engineering (O-MaSE) methodology. The model unites the IEC 61512 (S88) batch-process standard with the IEC 61499 distributed-control architecture to form a modular and interoperable cyber-physical system (CPS). Each pump, valve, and sensor is modelled as an autonomous agent with defined goals, roles, and communication protocols. The O-MaSE-based design enhances scalability, fault tolerance, and system adaptability, enabling decentralized decision-making and efficient vacuum regulation. The integrated case study demonstrates that MAS-based CPS design substantially improves the responsiveness and resilience of EBMR operations, supporting the principles of Industry 4.0.
Decentralized finance (DeFi) applications have attracted a recent surge in popularity. Token contracts underpin DeFi applications by managing liquidity. To regulate the interactions between token contracts and DeFi applications, token standards have been proposed to ensure predictable execution semantics and out-comes, thereby enabling reliable interoperability. However, there is no mechanism to prevent developers from customizing token contracts in ways that violate these standards. Even without malicious intent, such customizations pose severe risks to DeFi applications. Therefore, a comprehensive understanding of financially risky behaviors in token contracts is essential to better safeguard DeFi applications. To this end, we conduct the first systematic study that uncovers these behaviors and their concrete threats to DeFi applications. Specifically, we begin by constructing a taxonomy of nine financially risky behaviors in ERC20 token contracts. We then recognize the financial risks these behaviors pose to DeFi applications, which can result in significant financial losses, through a rigorous open-coding process on the real-world incidents of DeFi applications. To enable a large-scale study, we develop FRBScan, a novel tool that automatically identifies financially risky behaviors in ERC20 token contracts by combining Datalog analysis with token behavior inference heuristics. Our evaluation on a manually labeled dataset shows that FRBScan achieves 98.7% accuracy in identifying financially risky behaviors, with an average analysis time of just 4.73 seconds per contract. In contrast, the baseline tool Pied-Piper achieves only 72.5% accuracy while taking approximately 27.2 times longer, highlighting FRBScan's superior efficiency and effectiveness. Leveraging FRBScan, we conduct a large-scale study of ERC20 token contracts in Ethereum, and find that each type of financially risky behavior is present in practice, with 65.8% of token contracts exhibiting at least one such behavior. These findings underscore the widespread prevalence of financially risky behaviors in practice, and highlight the substantial threats they pose to DeFi applications.
Hybrid fuzzing combines greybox fuzzing's throughput with the precision of symbolic execution to uncover deep smart contract vulnerabilities. However, its effectiveness is often limited by constraint pollution: in real world contracts, path conditions pick up semantic noise from global state and defensive checks that are syntactically intertwined with, but semantically peripheral to, the target branch, causing SMT timeouts. We propose NeuroSCA (Neuro-Symbolic Constraint Abstraction), a lightweight framework that selectively inserts a Large Language Model (LLM) as a semantic constraint abstraction layer. NeuroSCA uses the LLM to identify a small core of goal-relevant constraints, solves only this abstraction with an SMT solver, and validates models via concrete execution in a verifier-in-the-loop refinement mechanism that reintroduces any missed constraints and preserves soundness. Experiments on real-world contracts show that NeuroSCA speeds up solving on polluted paths, increases coverage and bug-finding rates on representative hard contracts, and, through its selective invocation policy, achieves these gains with only modest overhead and no loss of effectiveness on easy contracts.
Smart contracts underpin high-value ecosystems such as decentralized finance (DeFi), yet recurring vulnerabilities continue to cause losses worth billions of dollars. Although numerous security analyzers that detect such flaws exist, real-world attacks remain frequent, raising the question of whether these tools are truly effective or simply under-used due to low developer trust. Prior benchmarks have evaluated analyzers on synthetic or vulnerable-only contract datasets, limiting their ability to measure false positives, false negatives, and usability factors that drive adoption. To close this gap, we present a mixed-methods study that combines large-scale benchmarking with practitioner insights. We evaluate six widely used analyzers (i.e., Confuzzius, Dlva, Mythril, Osiris, Oyente, and Slither) on 653 real-world smart contracts that cover three high-impact vulnerability classes from the OWASP Smart Contract Top Ten (i.e., reentrancy, suicidal contract termination, and integer arithmetic errors). Our results show substantial variation in accuracy (F1 = 31.2 to 94.6%), high false-positive rates (up to 32.6%), and runtimes exceeding 700 seconds per contract. We then survey 150 professional developers and auditors to understand how they use and perceive these tools. Our findings reveal that excessive false positives, vague explanations, and long analysis times are the main barriers to trust and adoption in practice. By linking measurable performance gaps to developer perceptions, we provide concrete recommendations for improving the precision, explainability, and usability of smart-contract security analyzers.
This review explores the application of machine learning techniques for fraud detection and prevention in the Ethereum blockchain. As a leading platform for decentralized applications (dApps), Ethereum is vulnerable to fraudulent activities such as scams, hacking attempts, and malicious transactions. This paper provides a comprehensive analysis of machine learning models used to predict, detect, and mitigate fraudulent behavior within the Ethereum ecosystem. By overviewing various machine learning methods, this study identifies the most effective approaches for addressing different types of vulnerabilities while offering a thorough review of existing research, key challenges, and limitations. It also examines the datasets and feature engineering techniques applied in this domain, outlining future directions and potential strategies for improving fraud detection. While machine learning has enhanced Ethereum’s security, challenges such as data availability, adversarial attacks, and model interpretability remain significant concerns. To address these gaps, this study highlights the potential of integrating deep learning architectures, graph representations, and hybrid models that combine supervised and unsupervised learning. Additionally, it explores the use of active learning and genetic programming to further enhance fraud detection capabilities. Furthermore, leveraging AI, particularly through large language models, could improve interpretability at the account, block, or transaction level, offering a clearer, more comprehensive view of fraudulent behavior across the Ethereum network. By tackling these challenges, future advancements in machine learning could further strengthen the resilience, security, and trustworthiness of Ethereum’s infrastructure.
Blockchain has gained significant attention in recent years, with smart contracts enabling automated and trustless financial interactions such as decentralized exchanges, tokenized assets, and on-chain governance. Because these programs often control assets of substantial value, a large body of research has focused on detecting security vulnerabilities in smart contracts. However, beyond security, understanding the actual behavior of a contract remains challenging, particularly when source code is unavailable. This work addresses the identification of semantic properties, defined as behavior-level characteristics that describe a contract's purpose based on its state changes and interactions. Detecting such properties can support applications such as regulatory analysis of relevant contracts and the simplification of contract logic by filtering semantically uninformative boilerplate code. The work focuses on static analysis approaches utilizing Datalog.The methodology first includes a systematic literature review to identify existing approaches for the static analysis of Ethereum bytecode using Datalog, as well as related work on semantic properties. The review indicates that Gigahorse is currently the most prominent tool in this category; consequently, it was selected as the basis for the following analysis.Based on this foundation, several function-level properties are defined, including authenticated functions as well as different types of setter and getter functions. In addition, a contract-level property representing a simple token contract is defined. Detection mechanisms for these properties are implemented in Datalog and subsequently evaluated. The results indicate that Gigahorse is generally well-suited for detecting such semantic properties, although practical limitations were encountered, particularly in the form of limited or missing documentation.
ABSTRACT Deterministic execution models used in distributed systems and generative pipelines share a common weakness, fixed concurrency schedules that fail under skewed workloads, hotspots, or noisy inputs. This paper proposes Adaptive Time stamp Informed Deterministic Flow Control (ATDFC), a unified concurrency control framework that combines time stamp‐based ordering with adaptive deterministic flow execution. ATDFC dynamically adjusts segmentation, initialization, and replay based on conflict intensity or input quality, enabling deterministic correctness while eliminating unnecessary computation. Experimental evaluation shows that ATDFC reduces conflict rates by more than half, lowers bandwidth consumption significantly, and maintains higher throughput and lower latency under extreme skew when compared to leading deterministic flow and concurrency control approaches. The results demonstrate that ATDFC offers a domain‐agnostic concurrency model capable of unifying deterministic computation across distributed ledgers, databases, and multimodal generative systems.
This study evaluates the robustness of Proof of Team Sprint (PoTS) against adversarial attacks through simulations, focusing on both the attacker win rate and computational efficiency under varying team sizes (N) and attacker ratios (α). PoTS is a recently proposed consensus mechanism that relies on randomly formed teams of participants to collaboratively generate blocks. Unlike traditional consensus methods where individual nodes compete independently, PoTS distributes responsibility across multiple nodes in a team, thereby increasing resilience against coordinated attacks. Our simulation results demonstrate that PoTS effectively reduces an attacker’s ability to dominate the consensus process, even under challenging conditions. For instance, when α ＝ 0.5, the attacker win rate decreases from 50.7% at N ＝ 1 to below 0.4% at N ＝ 8, effectively neutralizing adversarial influence. Similarly, at α ＝ 0.8, the attacker win rate drops from 80.47% at N ＝ 1 to only 2.79% at N ＝ 16, highlighting PoTS’s robustness under extreme threat levels. In addition to its strong security properties, PoTS maintains high computational efficiency by synchronizing block generation within each team. We introduce the concept of Normalized Computation Efficiency (NCE) to quantify this efficiency gain, demonstrating that PoTS significantly improves resource utilization as team size increases. As N grows, PoTS not only enhances security but also achieves better computational efficiency due to the averaging effects of execution time variations among team members. These findings underscore PoTS as a promising and practical alternative to traditional consensus mechanisms, such as Proof of Work (PoW) and Proof of Stake (PoS). By leveraging team-based block generation, sequential execution, and randomized participant reassignment in each round, PoTS provides a scalable, resilient, and energy-efficient framework for decentralized consensus in blockchain systems.
Nach dem anfänglichen Hype um die Blockchain-Technologie, die erstmals durch Satoshi Nakamotos Bitcoin bekannt wurde, hat sich der Bereich in Richtung der Entwicklung ausgereifter Blockchain-basierter Systeme und Anwendungen weiterentwickelt. In dieser weitläufigen Landschaft fungieren die einzelnen Blockchain-Plattformen und Ökosysteme häufig als isolierte Silos, die strikt von anderen Plattformen getrennt sind und über keine inhärenten Interoperabilitätsfunktionen verfügen. Trotz der Existenz etablierter Mechanismen für den Austausch von Coins und Tokens über heterogene Blockchains hinweg müssen Entwickler von Web3-Anwendungen, die aus Smart Contracts bestehen, möglicherweise auf individuelle Anpassungen zurückgreifen, um Blockchain-übergreifende Anwendungen zu ermöglichen. In vielen Fällen sind diese Ansätze nicht ausreichend skalierbar, wenn die Anwendung auf zusätzlichen Blockchain-Plattformen verteilt werden muss. Folglich sind weitere Anpassungen erforderlich. Darüber hinaus stellt sich die Frage der Speicherung gemeinsamer Anwendungsdaten, die mit Smart Contracts kompatibel und für das dezentrale Konzept der Blockchain geeignet sein muss. Diese Arbeit präsentiert einen Vorschlag für eine Blockchain-übergreifende Datenspeicherlösung, die das InterPlanetary File System (IPFS) als dezentrale Off-Chain-Persistenzschicht und Blockchain-Oracles nutzt, um Lese- und Schreibvorgänge zu ermöglichen. Der Einsatz von incentivierten Vermittlern in Verbindung mit einem neuartigen Oracle-Verifizierungsmechanismus für Schreibzugriffe erlaubt die Formulierung eines Lösungsentwurfs für ein vollständig dezentrales System. Dieser Ansatz ermöglicht die lose gekoppelte Verbindung von Blockchain-übergreifenden Anwendungen, wobei die einzelnen Blockchain-Plattformen nicht direkt aufeinander zugreifen müssen. Wir präsentieren eine prototypische Implementierung des Lösungsentwurfs und bewerten anschließend den Prototyp hinsichtlich Kosten, Leistung und Sicherheit. Im Vergleich zu einer hypothetischen Referenzlösung, die eine zentralisierte Persistenzschicht verwendet, zeigen wir, dass vollständige Dezentralisierung die Betriebskosten und die Leistung sowie die Integrität der gemeinsam genutzten Daten erheblich negativ beeinträchtigt.
Global disruptions, such as the COVID-19 pandemic, have exposed the fragility of supply chains and the critical need for coordination. However, effective collaboration is often hindered by the reluctance of firms to disclose sensitive proprietary data, such as inventory levels or logistical bottlenecks, due to competitive concerns. To resolve this dilemma, this study introduces a privacy-preserving framework integrating Zero-Knowledge Proofs (ZKPs) with blockchain technology. This approach allows stakeholders to validate compliance and operational status without revealing the underlying raw data, thereby fostering trust and resilience in decentralized networks.
This paper examines the most common smart contracts security issues included in the OWASP Smart Contract Top 10. The purpose of the study is to synthesize a set of recommendations that can help eliminate these key weaknesses or mitigate associated risks. The relevance of this research stems from the rapid development of Web3 technologies, particularly the expanding use of smart contracts. According to various estimates, this market is expected to grow at a CAGR of approximately 25% in the medium term. Furthermore, another factor contributing to the relevance of this topic in Russia is the lack of comprehensive regulation for this class of instruments, especially concerning security requirements and compliance verification. This paper proposes a smart contracts lifecycle model best suited to the research context, describing each stage with particular attention to its impact on security. Existing security weaknesses classifiers specific to smart contracts are identified, with a detailed review of the ten most common vulnerability classes. Based on this review, recommendations are provided to prevent these vulnerabilities or mitigate their associated risks. The findings can be applied by both smart contract developers and security auditors. Additionally, the presented materials contribute to the development of a methodological framework for addressing regulatory issues in the industry.
Autonomous software agents on blockchains solve distributed-coordination problems by reading shared ledger state instead of exchanging direct messages. Liquidation keepers, arbitrage bots, and other autonomous on-chain agents watch balances, contract storage, and event logs; when conditions change, they act. The ledger therefore functions as a replicated shared-state medium through which decentralized agents coordinate indirectly. This form of indirect coordination mirrors what Grassé called stigmergy in 1959: organisms coordinating through traces left in a shared environment, with no central plan. Stigmergy has mature formalizations in swarm intelligence and multi-agent systems, and on-chain agents already behave stigmergically in practice, but no prior application-layer framework cleanly bridges the two. We introduce Indirect coordination grounded in ledger state (Coordinación indirecta basada en el estado del registro contable) as a ledger-specific applied definition that maps Grassé's mechanism onto distributed ledger technology. We operationalize this with a state-transition formalism, identify three recurring base on-chain coordination patterns (State-Flag, Event-Signal, Threshold- Trigger) together with a Commit-Reveal sequencing overlay, and work through a State-Flag task-board example to compare ledger-state coordination analytically with off-chain messaging and centralized orchestration. The contribution is a reusable vocabulary, a ledger-specific formal mapping, and design guidance for decentralized coordination over replicated shared state at the application layer.
D. Victor Abhishek, Y. Meena Kumari, G Surekha, B. Sai Hemanth Reddy
Web3 authentication has become a key to the decentralized applications and allows users to sign in using cryptographic wallet signatures rather than centralized credentials. Nevertheless, recent research has shown that the current Web3 authentication systems are very susceptible to message-based attacks especially Blind Message Attacks, which takes advantage of unclear message semantics, lack of domain binding, insecurity with nonce, and lack of verification on the server side. This paper critically examines those vulnerabilities based on realworld deployments of Web3 authentication and shows that a large percentage of extant implementations can be compromised by an attacker. In order to handle such issues, we present a configurable and deployable authentication model, the socalled Secure Web3 Authentication Framework (SWAF), that implements structured authentication messages, high message equality checking, nonce management in context-sensitive fashion, and protocol-level domain binding. The suggested scheme is tested on a real-world set of 29 Web3 authentication examples, in which it perfectly mitigates Blind Message Attacks, Replay Attacks, Blind Multi-Message Attacks, as well as, cross-domain authentication abuses keeping its computational overhead at only a small fraction. Our findings indicate that looking at protocol-level authentication semantics strictly is feasible and necessary to enhancing confidence and security in Web3 authentication schemes.
Blockchain provides a decentralized and tamper-resistant ledger for securely recording transactions across a network of untrusted nodes. While its transparency and integrity are beneficial, the substantial storage requirements for maintaining a complete transaction history present significant challenges. For example, Ethereum nodes require around 23TB of storage, with an annual growth rate of 4TB. Prior studies have employed various strategies to mitigate the storage challenges. Notably, COLE significantly reduces storage size and improves throughput by adopting a column-based design that incorporates a learned index, effectively eliminating data duplication in the storage layer. However, this approach has limitations in supporting chain reorganization during blockchain forks and state pruning to minimize storage overhead. In this paper, we propose COLE$^+$, an enhanced storage solution designed to address these limitations. COLE$^+$ incorporates a novel rewind-supported in-memory tree structure for handling chain reorganization, leveraging content-defined chunking (CDC) to maintain a consistent hash digest for each block. For on-disk storage, a new two-level Merkle Hash Tree (MHT) structure, called prunable version tree, is developed to facilitate efficient state pruning. Both theoretical and empirical analyses show the effectiveness of COLE$^+$ and its potential for practical application in real-world blockchain systems.
Decentralized financial platforms rely heavily on Web of Trust reputation systems to mitigate counterparty risk in the absence of centralized identity verification. However, these pseudonymous networks are inherently vulnerable to adversarial behaviors, such as Sybil attacks and camouflaged fraud, where malicious actors cultivate artificial reputations before executing exit scams. Traditional anomaly detection in this domain faces two critical limitations. First, reliance on naive statistical heuristics (e.g., flagging the lowest 5% of rated users) fails to distinguish between victims of bad-mouthing attacks and actual fraudsters. Second, standard Graph Neural Networks (GNNs) operate on the assumption of homophily and cannot effectively process the semantic inversion inherent in signed (trust vs. distrust) and directed (status) edges. We propose TAS-GNN (Topology-Aware Signed Graph Neural Network), a novel framework designed for feature-sparse signed networks like Bitcoin-Alpha. TAS-GNN integrates recursive Web-of-Trust labeling and a dual-channel message-passing architecture that separately models trust and distrust signals, fused through a Status-Aware Attention mechanism. Experiments demonstrate that TAS-GNN achieves state-of-the-art performance, significantly outperforming existing signed GNN baselines.