Abstract Suppose that a sequence of $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> cards, numbered 1 to $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> , is placed face up in random order. Let $${\varvec{k}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>k</mml:mi> </mml:mrow> </mml:math> be the number on the first card in the sequence. Then take the first $${\varvec{k}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>k</mml:mi> </mml:mrow> </mml:math> cards from the sequence, rearrange that subsequence of $${\varvec{k}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>k</mml:mi> </mml:mrow> </mml:math> cards in reverse order, and return them to the original sequence. Repeat this prefix reversal until the number on the first card in the sequence becomes 1. This is a one-player card game called Topswops. The computational complexity of Topswops has not been thoroughly investigated. For example, letting $${\varvec{f}}({\varvec{n}})$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mrow> <mml:mi>f</mml:mi> </mml:mrow> <mml:mo>(</mml:mo> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> <mml:mo>)</mml:mo> </mml:mrow> </mml:math> denote the maximum number of prefix reversals for Topswops with $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> cards, values of $${\varvec{f}}({\varvec{n}})$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mrow> <mml:mi>f</mml:mi> </mml:mrow> <mml:mo>(</mml:mo> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> <mml:mo>)</mml:mo> </mml:mrow> </mml:math> for $${\varvec{n}}\ge 20$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> <mml:mo>≥</mml:mo> <mml:mn>20</mml:mn> </mml:mrow> </mml:math> remain unknown. In general, there is no known efficient algorithm for finding an initial sequence of $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> cards that requires exactly $$\ell $$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> prefix reversals for any integers $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> and $${\varvec{\ell }}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>ℓ</mml:mi> </mml:mrow> </mml:math> . In this paper, using a deck of cards, we propose a physical zero-knowledge proof protocol that allows a prover to convince a verifier that the prover knows an initial sequence of $${\varvec{n}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> cards that requires $${\varvec{\ell }}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>ℓ</mml:mi> </mml:mrow> </mml:math> prefix reversals without leaking knowledge of that sequence. We also deal with Botdrops, a variant of Topswops.
The Internet of Things (IoT) has revolutionized industries and daily life by connecting devices, sensors, and systems to autonomously collect, process, and share data. While offering immense possibilities, the distributed nature of IoT networks introduces significant security challenges. Conventional security measures struggle to address IoT's unique needs, and blockchain solutions face limitations. IOTA presents the Tangle, a novel Distributed Ledger Technology (DLT) tailored for IoT applications, offering feeless transactions, scalability, and decentralized consensus. This survey explores IOTA-based security solutions, focusing on access control, authentication, data integrity, confidentiality, threat modeling, risk assessment, performance, and scalability in IoT environments. Through a comprehensive review of literature, we highlight the efficacy of IOTA in enhancing IoT security. We identify future research directions, including interoperability, integration with emerging technologies, real-world deployments, and advanced trust management, to further strengthen IoT security using IOTA technology.
Luca Aceto, Daniele Gorla, Stian Lybech, Mohammad Hamdaqa
We continue the development of TinySol, a minimal object-oriented language based on Solidity, the standard smart-contract language used for the Ethereum platform. We first extend TinySol with exceptions and a gas mechanism, and equip it with a small-step operational semantics. Introducing the gas mechanism is fundamental for modelling real-life smart contracts in TinySol, since this is the way in which termination of Ethereum smart contracts is usually ensured. We then devise a type system for smart contracts guaranteeing that such programs never run out of gas at runtime. This is a desirable property for smart contracts, since a transaction that runs out of gas is aborted, but the price paid to run the code is not returned to the invoker.
The rapid growth of Decentralized Finance (DeFi) has been accompanied by substantial financial losses due to smart contract vulnerabilities, underscoring the critical need for effective security auditing. With attacks becoming more frequent, the necessity and demand for auditing services has escalated. This especially creates a financial burden for independent developers and small businesses, who often have limited available funding for these services. Our study builds upon existing frameworks by integrating Retrieval-Augmented Generation (RAG) with large language models (LLMs), specifically employing GPT-4-1106 for its 128k token context window. We construct a vector store of 830 known vulnerable contracts, leveraging Pinecone for vector storage, OpenAI's text-embedding-ada-002 for embeddings, and LangChain to construct the RAG-LLM pipeline. Prompts were designed to provide a binary answer for vulnerability detection. We first test 52 smart contracts 40 times each against a provided vulnerability type, verifying the replicability and consistency of the RAG-LLM. Encouraging results were observed, with a 62.7% success rate in guided detection of vulnerabilities. Second, we challenge the model under a "blind" audit setup, without the vulnerability type provided in the prompt, wherein 219 contracts undergo 40 tests each. This setup evaluates the general vulnerability detection capabilities without hinted context assistance. Under these conditions, a 60.71% success rate was observed. While the results are promising, we still emphasize the need for human auditing at this time. We provide this study as a proof of concept for a cost-effective smart contract auditing process, moving towards democratic access to security.
Smart contract developers frequently seek solutions to developmental challenges on Q&A platforms such as Stack Overflow (SO). Although community responses often provide viable solutions, the embedded code snippets can also contain hidden vulnerabilities. Integrating such code directly into smart contracts may make them susceptible to malicious attacks. We conducted an online survey and received 74 responses from smart contract developers. The results of this survey indicate that the majority (86.4%) of participants do not sufficiently consider security when reusing SO code snippets. Despite the existence of various tools designed to detect vulnerabilities in smart contracts, these tools are typically developed for analyzing fully-completed smart contracts and thus are ineffective for analyzing typical code snippets as found on SO. We introduce SOChecker, the first tool designed to identify potential vulnerabilities in incomplete SO smart contract code snippets. SOChecker first leverages a fine-tuned Llama2 model for code completion, followed by the application of symbolic execution methods for vulnerability detection. Our experimental results, derived from a dataset comprising 897 code snippets collected from smart contract-related SO posts, demonstrate that SOChecker achieves an F1 score of 68.2%, greatly surpassing GPT-3.5 and GPT-4 (20.9% and 33.2% F1 Scores respectively). Our findings underscore the need to improve the security of code snippets from Q&A websites.
Abstract Blockchain technology has created a new software development context, with its own peculiarities, mainly due to the guarantees that the technology must satisfy, that is, immutability , distributability , and decentralization of data. Its rapid evolution over the last decade implied a lack of adequate verification tools, exposing developers and users to critical vulnerabilities and bugs. This paper clarifies the extent of block chain-oriented software (BoS), that goes well beyond smart contracts. Moreover, it provides an overview of the challenges related to software verification in the blockchain context, encompassing smart contracts, blockchain layers, cross-chain applications, and, more generally, BoS. This study aims to highlight the shortcomings of the state-of-art and of the state-of-practice of software verification in that context and identify, at the same time, new research directions.
Smart contracts (SCs) significance and popularity increased exponentially with the escalation of decentralised applications (dApps), which revolutionised programming paradigms where network controls rest within a central authority. Since SCs constitute the core of such applications, developing and deploying contracts without vulnerability issues become key to improve dApps robustness to external attacks. This paper introduces a dataset that combines smart contract metrics with vulnerability data identified using Slither, a leading static analysis tool proficient in detecting a wide spectrum of vulnerabilities. Our primary goal is to provide a resource for the community that supports exploratory analysis, such as investigating the relationship between contract metrics and vulnerability occurrences. Further, we discuss the potential of this dataset for the development and validation of predictive models aimed at identifying vulnerabilities, thereby contributing to the enhancement of smart contract security. Through this dataset, we invite researchers and practitioners to study the dynamics of smart contract vulnerabilities, fostering advancements in detection methods and ultimately, fortifying the resilience of smart contracts.
The contemporary era experiences an unprecedented dependence on data generated by individuals via an array of interconnected devices constituting the Internet of Things (IoT). The information amassed through IoT devices serves many objectives, including prescriptive analytics and predictive maintenance, preemptive healthcare measures, disaster mitigation, operational efficiency, and increased yield. In contrast, most applications or systems that rely on user-generated data to fulfill their business objectives face challenges in adhering to privacy protocols. Consequently, users are exposed to many privacy risks. Such infringements upon privacy provisions give rise to apprehensions regarding the authenticity of the processed data. Hence, this paper presents weaknesses and challenges in current practices and proposes “PrivySeC,” a distributed ledger technology (DLT) based framework for privacy-preserving and secure sharing of personally and non-personally identifiable information. The security analysis indicates that the proposed solution ensures data privacy by design and complies with most of the requirements mandated by various privacy regulations. Similarly, PrivySeC promises low transaction latency and provides high throughput. Although we have created a privacy-preserving solution for sharing smart farm data, it can be customized to meet the specific privacy requirements of individual applications.
Solidity compiler plays a key role in enabling the development of smart contract applications on Ethereum by governing the syntax of a domain-specific language called Solidity and performing compilation and optimization of Solidity code. The correctness of Solidity compiler is critical in fostering transparency, efficiency, and trust in industries reliant on smart contracts. However, like other software systems, Solidity compiler is prone to bugs, which may produce incorrect bytecodes on blockchain platforms, resulting in severe security concerns. As a domain-specific compiler for smart contracts, Solidity compiler differs from other compilers in many perspectives, posing unique challenges to detect its bugs. To understand the bugs in Solidity compiler and benefit future research, in this paper, we present the first systematic study on 533 Solidity compiler bugs. We carefully examined their characteristics (including symptoms, root causes, and distribution), and their triggering test cases. Our study leads to seven bug-revealing takeaways for Solidity compiler. Moreover, to study the limitations of Solidity compiler fuzzers and bring our findings into practical scenarios, we evaluate three Solidity compiler fuzzers on our constructed benchmark. The results show that these fuzzers are inefficient in detecting Solidity compiler bugs. The inefficiency arises from their failure to consider the interesting bug-inducing features, bug-related compilation flags, and test oracles.
Junaid Arshad, Muhammad Talha, Bilal Saleem, Zoha Shah · 6 authors
The increasing reliance on computer networks and blockchain technology has led to a growing concern for cybersecurity and privacy. The emergence of zero-day vulnerabilities and unexpected exploits has highlighted the need for innovative solutions to combat these threats. Bug bounty programs have gained popularity as a cost-effective way to crowdsource the task of identifying vulnerabilities, providing a secure and efficient means of enhancing cybersecurity. This paper provides a comprehensive survey of various free and paid bug bounty programs in the computer networks and blockchain industry, evaluating their effectiveness, impact, and credibility. The study explores the structure, incentives, and nature of vulnerabilities uncovered by these programs, as well as their unique value proposition. A comparative analysis is conducted to identify advantages and disadvantages, highlighting the strengths and weaknesses of each program. The paper also examines the role of ethical hackers in bug bounty programs and their contributions to strengthening cybersecurity and privacy. Finally, the study concludes with recommendations for addressing the challenges faced by bug bounty programs and suggests potential future directions to enhance their impact on computer networks and blockchain security.
In recent years, phishing scams have seriously threatened Ethereum's ecological security and caused massive economic losses. Moreover, the significant disparity between the number of normal addresses and phishing addresses on Ethereum poses a challenge for detecting phishing scams. Existing studies primarily employ methods such as oversampling, filtering rules, and traditional machine learning models to resolve the Ethereum data imbalance problem. However, these methods disregard topological structure features of the transaction network and the link relationship between nodes. In this paper, we propose an Ethereum phishing scams detection model based on Generative Adversarial Graph Networks called EGAGN to alleviate imbalanced data, enhance node representation, and then improve detection performance. Specifically, the graph generator and discriminator play with each other to generate synthetic nodes that satisfy the real nodes distribution to balance Ethereum data and extract effective network structural features. We further extract statistical features from the transaction network and aggregate transaction records based on time series to obtain trading features. The complete representation of nodes is composed of the above three types of features to detect phishing nodes. Experimental results on the real-world Ethereum dataset show that EGAGN outperforms existing models and is far ahead in recall, which indicates that our model can effectively detect Ethereum phishing scams.
Smart contracts, known for their immutable nature to ensure trust via automated enforcement, have evolved to require upgradeability due to unforeseen vulnerabilities and the need for feature enhancements post-deployment. This contradiction between immutability and the need for modifications has led to the development of upgradeable smart contracts. These contracts are immutable in principle yet upgradable by design, allowing updates without altering the underlying data or state, thus preserving the contract's intent while allowing improvements. This study aims to understand the application and implications of upgradeable smart contracts on the Ethereum blockchain. By introducing a dataset that catalogs the versions and evolutionary trajectories of smart contracts, the research explores key dimensions: the prevalence and adoption patterns of upgrade mechanisms, the likelihood and occurrences of contract upgrades, the nature of modifications post-upgrade, and their impact on user engagement and contract activity. Through empirical analysis, this study identifies upgradeable contracts and examines their upgrade history to uncover trends, preferences, and challenges associated with modifications. The evidence from analyzing over 44 million contracts shows that only 3% have upgradeable characteristics, with only 0.34% undergoing upgrades. This finding underscores a cautious approach by developers towards modifications, possibly due to the complexity of upgrade processes or a preference for maintaining stability. Furthermore, the study shows that upgrades are mainly aimed at feature enhancement and vulnerability mitigation, particularly when the contracts' source codes are accessible. However, the relationship between upgrades and user activity is complex, suggesting that additional factors significantly affect the use of smart contracts beyond their evolution.
Today's digital revolution is built on the fusion of blockchain technology and cryptography. This paper examines how cryptographic algorithms support blockchain network security, integrity, and decentralization by delving into the complex interactions between these fields. We explore the landscape of cryptographic techniques that guarantee transactions and block authenticity through a thorough discussion. We also delve into the creation and administration of cryptographic keys within blockchain ecosystems and reveal the cryptographic underpinnings of consensus mechanisms. This paper also covered zero-knowledge proofs, multi-party computation, scalable solutions, secure cooperation, and the effective development of post-quantum cryptography. The findings shed light on a secure, inclusive, and radically transformational future powered by blockchain technology.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The Internet of Things (IoT) revolutionizes technology interaction by enabling seamless connectivity and automation, but it introduces significant security challenges. A distributed ledger technology (DLT) called IOTA Tangle, a utilizing a Directed Acyclic Graph (DAG), enables secure and feeless transactions among IoT devices. Despite its advantages, the IOTA Tangle faces threats such as replay attacks and double spending, which highlight vulnerabilities in distributed ledger technologies. To address these security concerns, we initially developed EdgeGuard, a rule-based system for spam detection within the IOTA ecosystem. However, its reliance on predetermined rulesets limited its adaptability. We have now enhanced our approach with EdgeShield, incorporating a neural network for superior threat detection.EdgeShield enhances adaptability over EdgeGuard in threat detection for the IOTA Tangle by integrating machine learning. EdgeShield analyzes network packets to identify threats, leveraging machine learning to adapt to evolving risks. Trained using the MQTTSet dataset, it detects network-based threats such as denial-of-service (DoS) attacks and packet flooding. Tested with simulated IoT data, EdgeShield demonstrates effectiveness across various domains, particularly in healthcare IoT. Its decentralized processing on edge devices like the Raspberry Pi 4 enables immediate network traffic analysis, reducing reliance on centralized servers and improving system resilience. Additionally, real-time alerts empower administrators to proactively secure IoT deployments and maintain transaction integrity within the IOTA Tangle. This paper traces our research evolution from EdgeGuard to EdgeShield, highlighting advancements and demonstrating the enhanced security of IoT transactions on the IOTA Tangle.
Function-as-a-Service providers manage security devices that are shared among multiple tenants. It is undesirable to give them access to cleartext HTTP requests to perform tasks such as traffic inspection. The recent Zero-Knowledge Middlebox (ZKMB) can be used to enforce network policies on TLS traffic without revealing any information on the content to the policy verifier. In this paper, we describe a ZKMB implementation and a policy designed to check whether the HTTPS function invocations by the clients follow a legitimate pattern. We also present and compare two strategies to distribute allowed patterns, introducing a Moving-Target Defense approach for the function URI randomization, which shows a good tradeoff between detection effectiveness and confidentiality. Performance assessment in our prototype implementation shows that the ZK algorithms are not yet suitable for real-time execution, but current research interest in this technology is expected to narrow this gap.
H S Byun, Jueun Kim, Yun-Seok Jeong, Byoungjin Seok · 6 authors
Currently, the monetary value of cryptocurrencies is extremely high, leading to frequent theft attempts. Cyberattacks targeting cryptocurrency wallets and the scale of these attacks are also increasing annually. However, many studies focus on large-scale exchanges, leading to a lack of research on cryptocurrency wallet security. Nevertheless, the threat to individual wallets is real and can lead to severe consequences for individuals. In this paper, we analyze the security of the open-source cryptocurrency wallets Sparrow, Etherwall, and Bither against brute-force attacks, a fundamental threat in password-based systems. As cryptocurrency wallets use passwords to manage users’ private keys, we analyzed the private key management mechanism and implemented a password verification oracle. We used this oracle for brute-force attacks. We identified the private key management mechanism by conducting a code-level investigation and evaluated the three wallets’ security through practical experimentation. The experiment results revealed that the wallets’ security, which depends on passwords, could be diminished due to the password input space and the configuration of password length settings. We propose a general methodology for analyzing the security of desktop cryptocurrency wallets against brute-force attacks and provide practical guidelines for designing secure wallets. By using the analysis methods suggested in this paper, one can evaluate the security of wallets.
Solana gained considerable attention as one of the most popular blockchain platforms for deploying decentralized applications. Compared to Ethereum, however, we observe a lack of research on how Solana smart contract developers handle security, what challenges they encounter, and how this affects the overall security of the ecosystem. To address this, we conducted the first comprehensive study on the Solana platform consisting of a 90-minute Solana smart contract code review task with 35 participants followed by interviews with a subset of seven participants. Our study shows, quite alarmingly, that none of the participants could detect all important security vulnerabilities in a code review task and that 83% of the participants are likely to release vulnerable smart contracts. Our study also sheds light on the root causes of developers' challenges with Solana smart contract development, suggesting the need for better security guidance and resources. In spite of these challenges, our automated analysis on currently deployed Solana smart contracts surprisingly suggests that the prevalence of vulnerabilities - especially those pointed out as the most challenging in our developer study - is below 0.3%. We explore the causes of this counter-intuitive resilience and show that frameworks, such as Anchor, are aiding Solana developers in deploying secure contracts.
Lukas Ingmarsson, Karl Duckert Karlsson, Niklas Carlsson
Bitcoin and the Dark Web present an interesting synergy that enables both legitimate anonymity and illicit activities, making it an important landscape to understand, especially as the Dark Web, with its hidden services, relies heavily on Bitcoin as a pseudonymous currency for transactions. However, a lack of scalable tools and timely datasets has limited systematic analysis of this ecosystem. To address this gap, we introduce Venom, a scalable framework for mapping Bitcoin activity on the Dark Web. Venom integrates multithreaded crawling, data extraction, and dataset generation, resulting in a comprehensive resource that allows us to easily collect snapshots of over 177,000 onion sites in roughly 24 hours. With the paper, we share both the tool and an example snapshot containing both per-site metadata and Bitcoin transaction data. Preliminary analysis reveals concentrated activity among key players and widespread content mirroring, offering new insights into the Dark Web's economic structure. Venom provides a critical resource for advancing research and monitoring in this domain.
Detecting phishing scams has become an important task in blockchain-based cryptocurrency applications. While many network representation learning-based approaches have been proposed for this task, they suffer from various issues including (1) the requirement of handcrafted features, which may not capture complex relationships and patterns in graph data, and/or (2) considering only node features while ignoring the more significant edge features, and/or (3) incapability of preserving complete network topology, which affects the generalization ability. In this paper, we propose a novel Edge-feature modeling-based Topological Graph Neural Network (ETGNN) to detect phishing scams on Ethereum, which avoids all aforementioned issues of existing approaches. Specifically, ETGNN involves two key components, one responsible for learning weighted features of nodes and edges in the Ethereum transaction graph, and the other responsible for incorporating global topological information of the graph using persistent homology. Finally, phishing scams are detected based on these two learned features. The experimental results demonstrate that ETGNN outperforms the state-of-the-art method with an improvement rate of 14.38% on F1-score.
Wenbing Zhao, Izdehar M. Aldyaflah, Zhaohua Zheng, Xiong Luo
We propose a novel blockchain-based academic degree verification system. The system relies on a smart contract deployed on the Ethereum blockchain platform. The system protects the privacy of the students who have been verified without the need of encryption, and hence, avoid the complexity of security key management and the potential disaster if the keys are stolen or revealed. The amount of degree data is also designed to be minimum for proper verification. All operations on the critical path of the system are automated without any human intervention. However, the system does assume that the organization would stand behind the proposed system to ensure the system's integrity. The system is open to anyone who wishes to verify the degree of a student. To prevent spamming and to support the long-term sustainability of the system, a small fee is charged for each verification request. A portion of the fees collected is immediately credited to the participating schools. To facilitate automated school enrollment into the system, any school may request to enroll by placing a significant amount of stake in ETH. The stake can be refunded when the school decides to leave the system. However, if the school is blacklisted due to misbehavior, the stake is confiscated. This design strongly discourages adversaries from abusing the system. The performance of the system is fully characterized with regard to the gas consumption of key operations in various use cases. We demonstrate that the system is conducive for long-term sustainability.
We survey large-scale cryptocurrency thefts over the past decade, estimating the total value of stolen cryptocurrencies. We find that depending on when the cryptocurrency was converted to fiat, the stolen amounts are valued between $7 to $88 billion, with longer cryptocurrency holding periods corresponding to the larger estimate due to the market’s rising value. We also document that as the cryptocurrency market develops, the incidence of large-scale cryptocurrency thefts has also increased in both number and stolen values in recent years. Large-scale thefts can be attributed to security breaches accounting for 20 of the 30 thefts, human errors accounting for five, and agency problems arising from insider thefts accounting for the remaining five.
The rapid evolution of ransomware attacks necessitates robust and scalable detection mechanisms to safeguard digital assets. This study leverages the Bitcoin Ransomware Dataset, comprising 2,916,697 transactions, to evaluate the effectiveness of the Random Forest algorithm in classifying ransomware-related activities. Through comprehensive preprocessing, including feature encoding and standardization, and exploratory data analysis (EDA), the dataset is prepared for modeling. The Random Forest model achieves an overall accuracy of 99%, demonstrating exceptional performance in identifying the majority class. However, challenges persist in classifying minority classes, highlighting the impact of class imbalance. Feature importance analysis reveals that attributes such as income, weight, and length play pivotal roles in the classification process. The study underscores the potential of Random Forest for ransomware detection while emphasizing the need for advanced techniques to address class imbalance and improve minority class performance.
As the field of Web3 continues its rapid expansion, the security of Web3 authentication, often the gateway to various Web3 applications, becomes increasingly crucial. Despite its widespread use as a login method by numerous Web3 applications, the security risks of Web3 authentication have not received much attention. This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages, thereby achieving unauthorized access to the target application. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities. Our evaluation of real-world Web3 applications shows that a staggering 75.8% (22/29) of Web3 authentication deployments are at risk of blind message attacks. In response to this alarming situation, we implemented Web3AuthGuard on the open-source wallet MetaMask to alert users of potential attacks. Our evaluation results show that Web3AuthGuard can successfully raise alerts in 80% of the tested Web3 authentications. We have responsibly reported our findings to vulnerable websites and have been assigned two CVE IDs.