Junaid Arshad, Muhammad Talha, Bilal Saleem, Zoha Shah · 6 authors
The increasing reliance on computer networks and blockchain technology has led to a growing concern for cybersecurity and privacy. The emergence of zero-day vulnerabilities and unexpected exploits has highlighted the need for innovative solutions to combat these threats. Bug bounty programs have gained popularity as a cost-effective way to crowdsource the task of identifying vulnerabilities, providing a secure and efficient means of enhancing cybersecurity. This paper provides a comprehensive survey of various free and paid bug bounty programs in the computer networks and blockchain industry, evaluating their effectiveness, impact, and credibility. The study explores the structure, incentives, and nature of vulnerabilities uncovered by these programs, as well as their unique value proposition. A comparative analysis is conducted to identify advantages and disadvantages, highlighting the strengths and weaknesses of each program. The paper also examines the role of ethical hackers in bug bounty programs and their contributions to strengthening cybersecurity and privacy. Finally, the study concludes with recommendations for addressing the challenges faced by bug bounty programs and suggests potential future directions to enhance their impact on computer networks and blockchain security.
Decentralized cryptocurrencies, such as bitcoin, use peer-to-peer software protocol, disintermediating the traditional intermediaries that used to be banks and other financial intermediaries, effectuating cross-border transfer. In fact, by removing the requirement for a middleman, the technology has the potential to disrupt current financial transactions that rely on a trusted authority or intermediary operator. Traditional financial regulation, primarily based on the command-and-control approach, is ill-suited to regulating decentralized cryptocurrencies. The present paper aims to investigate the policy option most suitable for regulating decentralized cryptocurrencies. The study employs content analysis method to effectuate the purpose of the study. The paper argues that the combination of both direct and indirect regulatory approaches would be a feasible option for regulating decentralized cryptocurrencies. The absence of centralized authority and the borderless nature of decentralized cryptocurrencies would make them antithetical to centralized direct regulation. Therefore, the findings of the study suggest that regulators should focus on regulating intermediaries bridging the connection between the online world (crypto ecosystem) and the physical world (the point of converting crypto into fiat money). These intermediaries can work as passive actors or surrogate regulators who are indirectly responsible for implementing policy options on behalf of the central authority.
The deliberate fabrication of identity or information to deceive others, the unauthorised use of a credit card, debit card, or ATM, or the use of technology to transmit fraudulent information in an attempt to obtain money or valuables are all considered financial scams. There are many financial scams has been happening across the world, some of the example’s scams which happened in indie among that The Satyam Computers organizations shame was India's greatest corporate scam until 2010. The trailblazer and the heads of non mainstream based reexamining association Satyam PC organization, debased the records, expanded the proposition cost, and took enormous sums from the association a considerable amount of this was placed assets into property. This research paper covers Importance of the study, Objectives of the study, Why people should have an in depth study about Satyam computer and its various legal implication, Why people give valuable opinion and suggestion and also to create an awareness about financial scams and the stake holders, Legal compliance with fraud offense in India, Functions Of forensic accounting and it also explains about Examining financial information, bank statements, invoices, and other accounting records were all part of the forensic audit. and ends with how to prevent financial scams in India. Apparently corporate bookkeeping misrepresentation is a critical issue that is filling in both recurrence and seriousness, as confirmed by the instances of Enron, WorldCom, and Satyam. Research proof has exhibited that a rising number of false exercises have debilitated the respectability of financial reports, added to huge monetary misfortunes, and corrupted financial backers' certainty about the utility and unwavering quality of financial explanations.
As digital interactions proliferate, the need for secure, efficient, and user-controlled identity verification systems has become critical. Traditional identity frameworks are often centralized, vulnerable to breaches, and lack user privacy. Blockchain technology offers a decentralized and tamper-resistant solution to digital identity verification by providing transparency, immutability, and user sovereignty. This paper explores the core principles of blockchain-based identity systems, compares them with traditional models, and analyzes real-world applications across sectors including finance, healthcare, and government. It also addresses challenges such as interoperability, scalability, and regulatory compliance. The study concludes with recommendations for integrating blockchain into future identity ecosystems.
M. M. Rakibul Hasan, Gazi Md. Shakil Hossain, Sadia Hossain Moure, Md Shepon Sardar
Information about every criminal case is kept in a very secret police case database system. During the course of an investigation and case resolution, criminal information is handled differently in each case. However, the traditional police case information management system is not extremely secure. Although every police station has a system for recording criminal history, the data transfer is still not transparent. Many police stations still run their operations with manual systems. Any unethical action might cause unfairness for the victims. As a result, we are offering a secure platform that combines the openness as well as adaptability of smart contract-based systems with the accuracy and secrecy of current police case schemes. We have created a smart contract on the blockchain's Go Ethereum platform using the Proof-of-Authority (PoA) consensus mechanism to verify the user and offer transparency for the security of criminal records and evidence. Our proposed solution runs on a distributed network for the best possible data security that adheres to the Web 3.0 model.
The wide application of Ethereum technology has brought technological innovation to traditional industries. As one of Ethereum's core applications, smart contracts utilize diverse contract codes to meet various functional needs and have gained widespread use. However, the non-tamperability of smart contracts, coupled with vulnerabilities caused by natural flaws or human errors, has brought unprecedented challenges to blockchain security. Therefore, in order to ensure the healthy development of blockchain technology and the stability of the blockchain community, it is particularly important to study the vulnerability detection techniques for smart contracts. In this paper, we propose a Dual-view Aware Smart Contract Vulnerability Detection Framework named DVDet. The framework initially converts the source code and bytecode of smart contracts into weighted graphs and control flow sequences, capturing potential risk features from these two perspectives and integrating them for analysis, ultimately achieving effective contract vulnerability detection. Comprehensive experiments on the Ethereum dataset show that our method outperforms others in detecting vulnerabilities.
Van Tong, C. N. Dao, Thep Dong, Hai Anh Tran · 6 authors
Ethereum smart contracts offer innovative ways to automate transactions and execute agreements within blockchain systems. However, its inherent complexity can lead to exploitable vulnerabilities. With the advent of large language models, many studies put a special focus on identifying vulnerabilities using these models. Nonetheless, language models are ineffective with the lengthy input sequences. To overcome this limitation, this work proposes a novel multi-label vulnerability detection mechanism using pre-trained language model CodeT5+ combined with a unique multi-block fusion. The results demonstrate that the proposed mechanism can achieve up to 0.998 F1-score and require only 0.39 ms of processing time on a collected dataset comprising 421,266 contracts from Ethereum.
Smart contracts are one of the most successful applications of blockchain technology, providing the foundation for a wide range of real-world blockchain applications and occupying a crucial position within the blockchain ecosystem. Hyperledger Fabric, as a influential permissoned blockchain system, warrants in-depth research into the security of its smart contracts. This paper begins by elucidating the sources of security threats to Hyperledger Fabric smart contracts, detailing specific security threats in terms of language inconsistency, external inconsistency, read-write logic, and system security. Subsequently, it provides an overview of research progress in smart contract vulnerability detection techniques, covering feature code matching, symbolic execution, fuzz testing, and intermediate code representation. Based on existing work, it summarizes current methods for detection and evaluation. Finally, drawing upon the summary of existing research efforts, it discusses the challenges faced and potential avenues for future research in the domain of Hyperledger Fabric smart contract vulnerability detection.Related research also facilitates the extension to other heterogeneous permissioned blockchains.
Mingxi Ye, Yuhong Nan, Hong‐Ning Dai, Shuo Yang · 6 authors
With the increasing popularity of Decentralized Applications (DApps) in blockchain, securing smart contracts has been a long-term, high-priority subject in the domain. Among the various research directions for vulnerability detection, fuzzing has received extensive attention because of its high effectiveness. However, with the increasing complexity of smart contracts, existing fuzzers may waste substantial time exploring locations irrelevant to smart contract vulnerabilities. In this article, we present FunFuzz, a function-oriented fuzzer, which is dedicatedly tailored for detecting smart contract vulnerability with high effectiveness and efficiency. The key observation in our research is that most smart contract vulnerabilities exist in specific functions rather than randomly distributed in all program code like other traditional software. To this end, unlike traditional fuzzers which mainly target code coverage, FunFuzz identifies risky functions while pruning non-risky ones in smart contracts. In this way, it significantly narrows down the exploration scope during the fuzzing process. In addition, FunFuzz employs three unique strategies to direct itself toward effectively discovering vulnerabilities specific to smart contracts (e.g., reentrancy, block dependency, and gasless send). Extensive experiments on 170 real-world contracts demonstrate that FunFuzz outperforms state-of-the-art fuzzers in terms of effectiveness and efficiency.
Purpose The purpose of this paper is to estimate the implications of illicit market use for the value of Bitcoin in an event studies framework. Design/methodology/approach This study uses a data set of 58 state-level marijuana decriminalisation and legalisation bills and referenda in the USA in 2010–2022. Findings Decriminalisation is associated with a strong and consistent positive Bitcoin price response around the event, recreational legalisation induces a more ambiguous reaction and medical legalisation is found to have a negative albeit small impact on Bitcoin value. This suggests decriminalisation enhances shadow economy use value of Bitcoin, whereas recreational and medical legalisation are not consistently reducing illicit drug cryptomarket activity. The effects are robust to various estimation windows, in subsamples, and also when outliers, heavy tails, conditional heteroskedasticity and state size are accounted for. Originality/value New to the literature, the choice of US marijuana bills, specifically as sample events, is based on both theoretical and empirical grounds.
This paper presents a case study of a cryptocurrency scam that utilized coordinated and inauthentic behavior on Twitter. In 2020, 143 accounts sold by an underground merchant were used to orchestrate a fake giveaway. Tweets pointing to a fake blog post lured victims into sending Uniswap tokens (UNI) to designated addresses on the Ethereum blockchain, with the false promise of receiving more tokens in return. Using one of the scammer's addresses and leveraging the transparency and immutability of the Ethereum blockchain, we traced the flow of stolen funds through various addresses, revealing the tactics adopted to obfuscate traceability. The final destination of the funds involved two deposit addresses. The first, managed by a well-known cryptocurrency exchange, was likely associated with the scammer's own account on that platform and saw deposits exceeding $3.5 million. The second address was linked to a popular cryptocurrency swap service. These findings highlight the critical need for more stringent measures to verify the source of funds and prevent illicit activities.
Dr.Abdul Basit Khan, Hira Farman, Saif Hassan, Moomal Seelro · 5 authors
Bitcoin is the most successful cryptocurrency with the highest market capitalization of up to 53%. Due to its pseudonymous mechanism, bitcoin is being utilized in a variety of illicit activities. It is noticed, around US$72 billions of unlawful activities per year involve Bitcoin. In this study, systematic literature review is conducted on the illicit use of bitcoin, and the measures required to counter the illicit activities using Bitcon. In this work, authors have managed to select 45 research articles published during 2018-2022. The synthesis of selected articles revealed that bitcoin is proliferating in darknet markets. It is used to make payments for criminal activities such as drug trafficking, money laundering, human trafficking, pornography, ransomware, and other criminal activities like contract killers, Ponzi schemes, and terrorism financing. By the findings from this study, out of45 research articles 24.4% articles claim that bitcoin has been used in drug trafficking whereas 17.7% believe that people use bitcoin for money laundering. Moreover, Blockchain identity flexibility, dissociative anonymity, and a lack of deterrence encourage users to perform illegal activities. At present, the research community is actively involved in proposing and designing innovative approaches tocounter the illicit use of bitcoin. However, these solutions are unable to stop the misuse of bitcoin.
Analyzing the complex cybersecurity landscape of Uzbekistan’s crypto exchanges, the article emphasizes the importance of developing and implementing cybersecurity policies and regulatory frameworks. The article identifies the most pressing and evolving digital threats and evaluates the effectiveness of advanced mitigation measures. Furthermore, it explores the transformative potential of innovative legal and technological tools, such as blockchain-based identity verification, zero-knowledge proofs, and secure multi-party computation. The article provides an in-depth analysis of the current legislation governing cybersecurity practices within Uzbekistan’s crypto ecosystem and offers insights into future development prospects. To provide a comprehensive analysis of the cybersecurity situation in the cryptocurrency exchange industry, an extensive review of academic publications, industry reports and official documents related to cybersecurity in the cryptocurrency market is used. In addition, the article includes case studies of known cybersecurity incidents related to cryptocurrency exchanges. By analyzing real-life examples, the researchers aim to provide a more detailed understanding of the cybersecurity challenges faced by cryptocurrency exchanges and the effectiveness of various mitigation measures. Ultimately, the article presents practical recommendations for creating a secure, trustworthy, and innovation-driven environment for cryptocurrency users in Uzbekistan.
Block chain generation, acknowledged for its decentralized and immutable nature, has emerged as an ability solution to cozy networks from cyber-attacks. The convergence of block chain and community safety has opened up a new paradigm inside the discipline of cyber security. This generation can decorate network safety with the aid of imparting a decentralized and incredibly cozy network infrastructure. One of the key possibilities of this convergence is the usage of block chain’s distributed ledger machine to create a tamper-proof and obvious repository of community sports and transactions. This can help in figuring out and preventing capability cyber-attacks, mitigating community vulnerabilities, and ensuring a comfy statistics switch. Another gain of the block chain era is its capacity to offer tamper-proof identity management, ensuring secure admission to networks and preventing unauthorized rights of entry. It could additionally be used to cozy community gadgets and structures, developing comfy and trustless surroundings for conversation.
With the increasing popularity of blockchain, different blockchain platforms coexist in the ecosystem (e.g., Ethereum, BNB, EOSIO, etc.), which prompts the high demand for cross-chain communication. Cross-chain bridge is a specific type of decentralized application for asset exchange across different blockchain platforms. Securing the smart contracts of cross-chain bridges is in urgent need, as there are a number of recent security incidents with heavy financial losses caused by vulnerabilities in bridge smart contracts, as we call them Cross-Chain Vulnerabilities (CCVs). However, automatically identifying CCVs in smart contracts poses several unique challenges. Particularly, it is non-trivial to (1) identify application-specific access control constraints needed for cross-bridge asset exchange, and (2) identify inconsistent cross-chain semantics between the two sides of the bridge. In this paper, we propose SmartAxe, a new framework to identify vulnerabilities in cross-chain bridge smart contracts. Particularly, to locate vulnerable functions that have access control incompleteness, SmartAxe models the heterogeneous implementations of access control and finds necessary security checks in smart contracts through probabilistic pattern inference. Besides, SmartAxe constructs cross-chain control-flow graph (xCFG) and data-flow graph (xDFG), which help to find semantic inconsistency during cross-chain data communication. To evaluate SmartAxe, we collect and label a dataset of 88 CCVs from real-attacks cross-chain bridge contracts. Evaluation results show that SmartAxe achieves a precision of <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" display="inline"> <mml:mn>84.95</mml:mn> <mml:mo>%</mml:mo> </mml:math> and a recall of <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" display="inline"> <mml:mn>89.77</mml:mn> <mml:mo>%</mml:mo> </mml:math> . In addition, SmartAxe successfully identifies 232 new/unknown CCVs from 129 real-world cross-chain bridge applications (i.e., from 1,703 smart contracts). These identified CCVs affect a total amount of digital assets worth 1,885,250 USD.
Background: Research has been done on the vulnerabilities of Ethereum smart contract detection since the emergence of blockchain technologies. Ethereum is one of the most popular platforms for DApps (decentralized applications) and smart contracts but turns more undoubtedly when their number and popularity grow. Methods: The study evaluates different detection methods including static analysis, dynamic code analysis, symbolic execution, and machine learning. Findings: The performance metrics on key areas, e.g. detection time, true positive rate, false positive rate, and scalability are emphasized in this evaluation analysis. These inferences imply that although Static Analysis can provide fast detection and high accuracy, Machine Learning is better at High scalability. The study also identifies trending flaws often encountered such as re-entrancy attacks and lack of input validation and stresses further the necessity of strong security methods. Besides, you may consider the sensitivity analysis in different network load scenarios as it shows the efficiency of detection technique in changing operational settings. Novelty and applications: Overall, the research brings a reliable development to smart contracts in Ethereum's security industries through analyzing and profiling vulnerability types and performance metrics that inform the development of more stable and efficient security activities for distributed applications.
Grievance redressal has always been vital for any organization to maintain a good work environment for its stakeholders. Some organizations follow online portals, websites, or mobile applications to register grievances to provide more privacy to the complainant’s identity. However, online platforms provide better solutions to the existing manual methods for grievance redressal. Still, there are a lot of issues and challenges associated with them. This research has comprehensively analyzed the existing grievance redressal systems to identify and discuss all the challenges. After comprehensive analysis, it is found that presently there are several issues such as delayed response, opaque processes, biases, complexity and accessibility issues, lack of personalization, and other privacy and security concerns associated with existing grievance redressal methods. To address all these issues this study is proposing a blockchain-based solution for grievance redressal systems. The proposed solution will be a blockchain-based web and mobile application that consists of multiple entities such as complainants, redressal committee, and higher authorities. This system will provide the necessary privacy and confidentiality to the complainants through the immutable distributed ledger technology and auditability of the entire process with complete transparency.
In recent years, emerging trends like smart contracts (SCs) and blockchain have promised to bolster data security. However, SCs deployed on Ethereum are vulnerable to malicious attacks. Adopting machine learning methods is proving to be a satisfactory alternative to conventional vulnerability detection techniques. Nevertheless, most current machine learning techniques depend on sufficient expert knowledge and solely focus on addressing well-known vulnerabilities. This paper puts forward a systematic literature review (SLR) of existing machine learning-based frameworks to address the problem of vulnerability detection. This SLR follows the PRISMA statement, involving a detailed review of 55 papers. In this context, we classify recently published algorithms under three different machine learning perspectives. We explore state-of-the-art machine learning-driven solutions that deal with the class imbalance issue and unknown vulnerabilities. We believe that algorithmic-level approaches have the potential to provide a clear edge over data-level methods in addressing the class imbalance issue. By emphasizing the importance of the positive class and correcting the bias towards the negative class, these approaches offer a unique advantage. This unique feature can improve the efficiency of machine learning-based solutions in identifying various vulnerabilities in SCs. We argue that the detection of unknown vulnerabilities suffers from the absence of a unique definition. Moreover, current frameworks for detecting unknown vulnerabilities are structured to tackle vulnerabilities that exist objectively.
This comprehensive analysis delves into the intricate impact of cryptocurrency adoption on traditional banking systems. As cryptocurrencies achieve widespread acceptance, they challenge established norms of centralized control in financial transactions, necessitating a reconsideration of the resilience and adaptability of traditional banking models. The disruptive potential, particularly embodied in blockchain technology, prompts a critical evaluation of the ongoing transformation. The article scrutinizes the positive influence of cryptocurrencies on financial inclusion and accessibility, unlocking banking services for previously underserved populations. However, the decentralized and pseudonymous nature of cryptocurrencies introduces regulatory challenges, demanding a nuanced equilibrium between fostering innovation and ensuring compliance with anti-money laundering and know your customer regulations. Traditional banks respond by embracing blockchain technology, entering collaborative endeavors with cryptocurrency projects to augment operational efficiency and transparency. Nevertheless, the inherent volatility of cryptocurrencies poses systemic risks, necessitating adept navigation by traditional banking systems. The imperative for a delicate equilibrium between innovation and regulation emerges as pivotal for the harmonious coexistence of traditional banking and the ever-evolving cryptocurrency ecosystem. As the financial landscape undergoes profound changes, this analysis underscores the necessity for adaptability and a strategic alignment between traditional and innovative financial paradigms.
Ruichao Liang, Jing Chen, Cong Wu, Kun He · 9 authors
Ponzi schemes, a form of scam, have been discovered in Ethereum smart contracts in recent years, causing massive financial losses. Existing detection methods primarily focus on rule-based approaches and machine learning techniques that utilize static information as features. However, these methods have significant limitations. Rule-based approaches rely on pre-defined rules with limited capabilities and domain knowledge dependency. Using static information like opcodes for machine learning fails to effectively characterize Ponzi contracts, resulting in poor reliability and interpretability. Our research shows no significant difference between Ponzi and non-Ponzi contracts at the opcode level. Moreover, relying on static information like transactions for machine learning requires a certain number of transactions to achieve detection, which limits the scalability of detection and hinders the identification of 0-day Ponzi schemes. In this article, we propose PonziGuard , an efficient Ponzi scheme detection approach based on contract runtime behavior. Inspired by the observation that a contract’s runtime behavior is more effective in disguising Ponzi contracts from the innocent contracts, PonziGuard establishes a comprehensive graph representation called contract runtime behavior graph (CRBG), to accurately depict the behavior of Ponzi contracts. Furthermore, it formulates the detection process as a graph classification task on CRBG, enhancing its overall effectiveness. The experiment results show that PonziGuard surpasses the current state-of-the-art approaches in the ground-truth dataset, achieving a precision of 96.9%, recall of 98.2%, and F1-score of 97.5%. It also exhibits the highest level of interpretability among the current tools. We applied PonziGuard to Ethereum Mainnet and demonstrated its effectiveness in real-world scenarios. Using PonziGuard , we identified 805 Ponzi contracts on Ethereum Mainnet, which have resulted in an estimated economic loss of 281,700 Ether or approximately \($\) 500 million USD. We also found 0-day Ponzi schemes in the recently deployed 10,000 smart contracts.