Tao Wang, Keyong Hong, Bo Yang, Qiliang Yang · 6 authors
The rapid growth in the NFT (Non-fungible token) market has offered a wide variety of opportunities for scammers, fraudsters, wash tradings, and so on. One of the most urgent security issues is how to efficiently authorize and validate the ownership to make the NFT ecosystem avoid infringement and counterfeiting. By exploiting linear homomorphic tagging and robust digital watermarking technologies, this article proposes a generic framework for ownership authorization and batch validation of NFTs. Within this framework, the digital artwork creators can authorize the ownership to a buyer before the NFT is minted in the public blockchain. Anytime in the future who questions the ownership of a claimant can initiate a validation procedure to get an auditing report by running a Challenge-Response protocol that supports efficient batch verification. The completeness and soundness of the proposed framework have been proven by assuming a secure homomorphic tag scheme and a robust watermarking scheme. We also present instantiations of the generic construction, especially with$\Pi _{Pub}$, one can outsource the validation procedure to the public blockchain to release local computation burden. A series of elaborated experiments have shown our proposed framework is practical and efficient.
Zero-Knowledge Proofs (ZKPs) are critical for privacy-preserving techniques and verifiable computation. Many ZKP protocols rely on key kernels such as the SumCheck protocol and Merkle Tree commitments to enable their key security properties. These kernels exhibit balanced binary tree computational patterns, which enable efficient hardware acceleration. Although prior work has investigated accelerating these kernels as part of an overarching ZKP protocol, exploiting this common tree pattern remains relatively underexplored. We conduct a systematic evaluation of these tree-based workloads under different traversal strategies, analyzing performance on multi-threaded CPUs and the Multifunction Tree Unit (MTU) hardware accelerator. We introduce a hardware-friendly Hybrid Traversal for binary tree that improves parallelism and scalability while significantly reducing memory traffic on hardware. Our results show that MTU achieves up to $1478\times$ speedup over CPU at DDR-level bandwidth and that our hybrid traversal outperforms breadth-first search by up to $3\times$. These findings offer practical guidance for designing efficient hardware accelerators for ZKP workloads with binary tree structures.
Bertalan Zoltán Péter, Zsófia Ádám, Zoltán Micskei, Imre Kocsis
Due to their decentralized and trustless nature, blockchain and distributed ledger technologies are increasingly used in several domains, including critical applications. The behavior of such blockchain-integrated systems is typically driven by smart contracts. However, smart contracts are application-specific software and may contain faults with severe system-level impacts. This is especially true in the case of the extensively used Hyperledger Fabric (HLF) platform, where smart contracts are written in general-purpose languages (Java, among others), and applications can go far beyond handling virtual-currency-like assets. In this work, we present a novel formal-verification-based approach to smart contract verification and a high-level empirical model of the HLF platform. Our Smart Contract in the Loop (SCIL) method uses a model checker (Java Pathfinder) to check whether specific error properties hold for a given smart contract, while a predefined combination of platform-level fault modes is active. We facilitate the checking of HLF smart contracts without modification and enable the propagation or non-propagation of platform faults through the smart contracts to the system failure level.
Z. H. Randriamiarison, H. Razafimahatratra, N. R Razafindrakoto, Yassine Rhazali
Blockchain technology is gaining popularity today, replacing centralized data storage on a central server with a decentralized network of ledgers, thus ensuring secure information exchange. A smart contract is a program written on the blockchain that runs autonomously within the Ethereum virtual machine: a transparent and secure program, but once deployed on the blockchain network, it cannot be modified. Despite its advantage over other technologies, smart contract has become a prime target for hackers, making it difficult for developers to eliminate all vulnerabilities before its deployment. In this paper, we propose a static analysis approach aimed at reducing vulnerabilities in smart contract. Our method builds upon PASO (Parser for Solidity) and MSmart approaches: we developed a test lifecycle model for smart contracts and created a tool based on ANTLR4's G4 grammar. It involves both syntactic and lexical analysis to effectively detect bugs and vulnerabilities in smart contract. To validate our method, we used FDR (False Discovery Rate) and FNR (False Negative Rate) as evaluation metrics, data collected from SmartBugs and Etherscan. We validated our approach compared with MSmart and SmartCheck. We got higher FDR and improved FNR, indicating enhanced detection capabilities. After thorough analysis and extensive testing, our tool has proven to be both specific and high-performing.
Smart contract vulnerabilities have led to billions in losses, yet finding actionable exploits remains challenging. Traditional fuzzers rely on rigid heuristics and struggle with complex attacks, while human auditors are thorough but slow and don't scale. Large Language Models offer a promising middle ground, combining human-like reasoning with machine speed. Early studies show that simply prompting LLMs generates unverified vulnerability speculations with high false positive rates. To address this, we present A1, an agentic system that transforms any LLM into an end-to-end exploit generator. A1 provides agents with six domain-specific tools for autonomous vulnerability discovery, from understanding contract behavior to testing strategies on real blockchain states. All outputs are concretely validated through execution, ensuring only profitable proof-of-concept exploits are reported. We evaluate A1 across 36 real-world vulnerable contracts on Ethereum and Binance Smart Chain. A1 achieves a 63% success rate on the VERITE benchmark. Across all successful cases, A1 extracts up to \$8.59 million per exploit and \$9.33 million total. Using Monte Carlo analysis of historical attacks, we demonstrate that immediate vulnerability detection yields 86-89% success probability, dropping to 6-21% with week-long delays. Our economic analysis reveals a troubling asymmetry: attackers achieve profitability at \$6,000 exploit values while defenders require \$60,000 -- raising fundamental questions about whether AI agents inevitably favor exploitation over defense.
Blockchain bridges have become essential infrastructure for enabling interoperability across different blockchain networks, with more than $24B monthly bridge transaction volume. However, their growing adoption has been accompanied by a disproportionate rise in security breaches, making them the single largest source of financial loss in Web3. For cross-chain ecosystems to be robust and sustainable, it is essential to understand and address these vulnerabilities. In this study, we present a comprehensive systematization of blockchain bridge design and security. We define three bridge security priors, formalize the architectural structure of 13 prominent bridges, and identify 23 attack vectors grounded in real-world blockchain exploits. Using this foundation, we evaluate 43 representative attack scenarios and introduce a layered threat model that captures security failures across source chain, off-chain, and destination chain components. Our analysis at the static code and transaction network levels reveals recurring design flaws, particularly in access control, validator trust assumptions, and verification logic, and identifies key patterns in adversarial behavior based on transaction-level traces. To support future development, we propose a decision framework for bridge architecture design, along with defense mechanisms such as layered validation and circuit breakers. This work provides a data-driven foundation for evaluating bridge security and lays the groundwork for standardizing resilient cross-chain infrastructure.
Zhikang Guo, Heng Pan, Ang He, Yueyue Dai · 8 authors
Blockchain technology presents significant security challenges despite its transformative impact on digital transactions and decentralized data management. Key vulnerabilities include insecure smart contract execution, data privacy risks on transparent ledgers, and susceptibility of certain consensus mechanisms to attacks. Trusted Execution Environments (TEEs) offer a robust hardware-based solution to these critical issues. By providing isolated execution spaces, TEEs safeguard code and data confidentiality and integrity, thereby fundamentally strengthening blockchain security. This paper presents a comprehensive analysis of TEEs in blockchain technology. First, we analyze the challenges inherent in blockchain systems and demonstrate the advantages of TEEs over current methods. A detailed analysis of TEE properties, variants, and evolution in the blockchain field is provided. Additionally, we explore innovative TEE-based solutions across three key application domains: consensus mechanism optimization, confidential computation and execution, and payment networks and financial applications. Furthermore, we propose a research agenda addressing current challenges such as vulnerabilities to side-channel attacks and dependencies on hardware trust assumptions. Finally, we propose five critical directions for future TEE-blockchain integration: enhancement of security and privacy protection with particular attention to the Trusted Computing Base (TCB) minimization, performance optimization through hardware architecture advancement, trust model refinement to reduce centralization, expansion of application scenarios through interdisciplinary collaboration, and development of cross-chain interoperability standards. Our work contributes to blockchain security knowledge and provides a roadmap for researchers and practitioners in this rapidly evolving field.
Custom tokens are fundamental in decentralized applications (dApps) operating on Ethereum and other Blockchain platforms. Ethereum, in particular, relies on the ERC-20 standard as a widely accepted token interface, facilitating seamless integration with numerous pre-existing dApps, user interface platforms, and popular web applications like exchange services. A notable security challenge within the ERC-20 framework is the “lost token problem”. This problem arises because users occasionally send tokens to the wrong addresses, and it has caused more than $27 million in damage. In this paper, we evaluate three existing solutions to this issue. Through the utilization of formal modeling, property specification, and the TLC model checker. Most importantly, we propose a novel double-layer solution to remedy the ERC-20 vulnerability. Our formal verification and experimental results indicate our approach encompasses the protection of the already deployed smart contracts, which is a critical aspect that has never been addressed in the existing mitigation techniques.
Open access
Security and Verification in Computing
Radiation Effects in Electronics
Physical Unclonable Functions (PUFs) and Hardware Security
Non-fungible tokens (NFT) have recently become a popular method of tokenizing \& commercializing personal artifacts. Designing NFTs requires selecting different blockchain-based consensus models, encryption techniques, and distribution mechanisms. Existing NFT design techniques use computationally complex encryption models like Elliptic Curve Cryptography (ECC), Advanced Encryption Standard (AES), etc., which restricts their general-purpose usability, limiting their scalability for real-time use cases. To overcome this drawback, while maintaining high security, this text proposes a design of a lightweight, restrictive non-fungible token based on Practically Unclonable Functions (PuFs) via image signature patterns. The proposed model initially collects context-specific information sets about the entity that needs tokenization and uses this information to generate restrictive hash sets. These hash sets are passed through a customized PuF model, which generates image-like hash signatures. The generated hash signatures are iteratively embedded into unique images, which are fused via a dual visual encryption-decryption process. The encryption process generates 2 image sets, for distribution among the buyer \& seller, while the decryption process aggregates these image sets to form a single file token. These tokens are passed through another encryption-decryption-based validation process while reselling operations. Due to use of PuFs and restrictive hash sets, the proposed model is capable of deployment for low-power IoT applications and can be scaled for general-purpose scenarios. The proposed model was tested on different NFT use cases, and showcased 10.4% lower processing delay, 8.3% lower energy consumption during selling, and 4.9% lower energy consumption during reselling processes. The tokens generated via this model were also tested under different attack types, and similar efficiency levels were observed under real-time scenarios.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
As democratic processes increasingly transition to digital environments, safeguarding voter privacy and maintaining electoral integrity have become paramount. This study investigates the application of Zero-Knowledge Proofs (ZKPs) as a cryptographic framework for developing secure and private electronic voting systems. A comparative performance evaluation was conducted between ZKP-based voting protocols and traditional systems, focusing on key metrics such as validation time, privacy leakage index, and memory usage. Quantitative data analysis, supported by statistical methods including mean comparisons and standard deviation assessments, highlights the superiority of ZKP-based systems in minimizing information leakage while maintaining verifiability. Although ZKP protocols introduce higher memory consumption, the trade-off results in substantially enhanced voter anonymity and reduced validation latency. The findings suggest that ZKPs provide a scalable and efficient solution to the dual challenge of transparency and privacy in digital voting infrastructures. This research contributes to the growing body of work on cryptographic voting technologies and underscores the importance of balancing security with performance in the design of future e-voting systems. Keywords: Zero-Knowledge Proofs, E-voting, Cryptography, Privacy, Secure Voting Systems, Digital Democracy, Voter Anonymity, Cryptographic Protocols, Electoral Integrity, Privacy-Preserving Computation
Xing Su, Hanzhong Liang, Hao Wu, Ben Niu · 6 authors
Understanding the Ethereum smart contract bytecode is essential for ensuring cryptoeconomics security. However, existing decompilers primarily convert bytecode into pseudocode, which is not easily comprehensible for general users, potentially leading to misunderstanding of contract behavior and increased vulnerability to scams or exploits. In this paper, we propose DiSCo, the first LLMs-based EVM decompilation pipeline, which aims to enable LLMs to understand the opaque bytecode and lift it into smart contract code. DiSCo introduces three core technologies. First, a logic-invariant intermediate representation is proposed to reproject the low-level bytecode into high-level abstracted units. The second technique involves semantic enhancement based on a novel type-aware graph model to infer stripped variables during compilation, enhancing the lifting effect. The third technology is a flexible method incorporating code specifications to construct LLM-comprehensible prompts for source code generation. Extensive experiments illustrate that our generated code guarantees a high compilability rate at 75%, with differential fuzzing pass rate averaging at 50%. Manual validation results further indicate that the generated solidity contracts significantly outperforms baseline methods in tasks such as code comprehension and attack reproduction.
Ethereum smart contracts determine state transition results not only by the previous states, but also by a mutable global state consisting of storage variables. This has resulted in state-inconsistency bugs, which grant an attacker the ability to modify contract states either through recursive function calls to a contract (reentrancy), or by exploiting transaction order dependence (TOD). Current studies have determined that identifying data races on global storage variables can capture all state-inconsistency bugs. Nevertheless, eliminating false positives poses a significant challenge, given the extensive number of execution paths that could potentially cause a data race. For simplicity, existing research considers a data race to be vulnerable as long as the variable involved could have inconsistent values under different execution orders . However, such a data race could be benign when the inconsistent value does not affect any critical computation or decision-making process in the program. Besides, the data race could also be infeasible when there is no valid state in the contract that allows the execution of both orders. In this paper, we aim to appreciably reduce these false positives without introducing false negatives. We present DivertScan , a precise framework to detect exploitable state-inconsistency bugs in smart contracts. We first introduce the use of flow divergence to check where the involved variable may flow to. This allows DivertScan to precisely infer the potential effects of a data race and determine whether it can be exploited for inducing unexpected program behaviors. We also propose multiplex symbolic execution to examine different execution orders in one time of solving. This helps DivertScan to determine whether a common starting state could potentially exist. To address the scalability issue in symbolic execution, DivertScan utilizes an overapproximated pre-checking and a selective exploration strategy. As a result, it only needs to explore a limited state space. DivertScan significantly outperformed state-of-the-art tools by improving the precision rate by 20.72% to 74.93% while introducing no false negatives. It also identified five exploitable real-world vulnerabilities that other tools missed. The detected vulnerabilities could potentially lead to a loss of up to $68.2M, based on trading records and rate limits.
Ruichao Liang, Jing Chen, Ruochen Cao, Kun He · 8 authors
Smart contracts, as Turing-complete programs managing billions of assets in decentralized finance, are prime targets for attackers. While fuzz testing seems effective for detecting vulnerabilities in these programs, we identify several significant challenges when targeting smart contracts: (i) the stateful nature of these contracts requires stateful exploration, but current fuzzers rely on transaction sequences to manipulate contract states, making the process inefficient; (ii) contract execution is influenced by the continuously changing blockchain environment, yet current fuzzers are limited to local deployments, failing to test contracts in real-world scenarios. These challenges hinder current fuzzers from uncovering hidden vulnerabilities, i.e., those concealed in deep contract states and specific blockchain environments. In this paper, we present SmartShot, a mutable snapshot-based fuzzer to hunt hidden vulnerabilities within smart contracts. We innovatively formulate contract states and blockchain environments as directly fuzzable elements and design mutable snapshots to quickly restore and mutate these elements. SmartShot features a symbolic taint analysis-based mutation strategy along with double validation to soundly guide the state mutation. SmartShot mutates blockchain environments using contract’s historical on-chain states, providing real-world execution contexts. We propose a snapshot checkpoint mechanism to integrate mutable snapshots into SmartShot’s fuzzing loops. These innovations enable SmartShot to effectively fuzz contract states, test contracts across varied and realistic blockchain environments, and support on-chain fuzzing. Experimental results show that SmartShot is effective to detect hidden vulnerabilities with the highest code coverage and lowest false positive rate. SmartShot is 4.8× to 20.2× faster than state-of-the-art tools, identifying 2,150 vulnerable contracts out of 42,738 real-world contracts which is 2.1× to 13.7× more than other tools. SmartShot has demonstrated its real-world impact by detecting vulnerabilities that are only discoverable on-chain and uncovering 24 0-day vulnerabilities in the latest 10,000 deployed contracts.
Ahmed Abubakar Aliyu, Mohammed Ibrahim, Sa’adatu Abdulkadir
Traditional Intrusion Detection Systems (IDSs) face significant challenges in keeping pace with the rapidly evolving landscape of cyber threats, primarily due to limitations in continuous learning and the accuracy of data classification and analysis. This often results in delayed detection and leaves networks susceptible to severe attacks. This paper introduces an innovative IDS empowered by blockchain technology to mitigate these shortcomings, leveraging continuous learning and self‑adaptive neural networks. The proposed system adopts a proactive approach by continuously assimilating intrusion logs, utilizing a Long Short‑Term Memory (LSTM) core to discern patterns and enhance its real‑time threat detection capabilities, removing a major bottleneck in traditional IDS models by eliminating the need for manual tagging. To further strengthen the security measures, self‑updating neural networks are embedded in each block of the blockchain, forming a decentralized “brain” that evolves defences against even the most sophisticated adversaries. These networks are securely housed in Trusted Execution Environments (TEEs) to maintain operational integrity, enabling tamper‑proof operation and effective threat detection. Real‑world evaluations conducted on the Binance Smart Chain and Ethereum Classic datasets demonstrate the system’s superior performance. With an impressive accuracy rate of 98.50% and a minimal false positive rate of 1.50%, the model demonstrates a remarkable ability to distinguish legitimate network activity from malicious intrusions.
The proposed research introduces blockchainbased trust system for Internet of Things (IoT) landscapes that overcomes three fundamental barriers of widely used IoT systems: security limitations and privacy requirements and requirements regarding scaling. The decentralized infrastructure of the blockchains and the properties which are unchangeable drive the proposed method which enhances authentication practices in devices and security in communication as well as the capabilities to assess trust. The system minimizes efficient and safe interactions between the IoT devices by virtue of incorporating Proof-of-Stake (PoS) consensus schemes as well as smart contracts that automate trust management whilst saving on computational costs. The methodology introduces decentralized identity management mechanisms also with the reputation-based trust models as well as off-chain storage options that enhance scalability and avoid network congestion. Intensive performance testing including the comparison of our proposed blockchain-based framework with existing centralized solutions and PoW-based current blockchain implementations take place. Greater transaction processing velocities coupled with reduced delays and reduced consumption of power makes the system more efficient thus proving its suitability for IoT hardware that operates in a resource-constrained environment. The proposed approach shows scalability ability as it can handle large number of devices without affecting the performance levels of the system.
Software-defined networking (SDN) enhances network management by centralizing control, but its reliance on a single controller introduces vulnerabilities such as distributed denial-of-service (DDoS) attacks and unauthorized access. Traditional SDN architectures lack authentication mechanisms for verifying network compliment, allowing malicious switches to disrupt operations. To mitigate these risks, blockchain technology provided a decentralized and tamper-proof authentication mechanism by recording the registration status of network devices using smart contracts. By integrating blockchain with the SDN controller (RYU) via Web3, switches are authenticated based on their Datapath Identifier (DPID), enabling secure enforcement of OpenFlow policies. This approach ensures that only registered switches can forward traffic, effectively isolating unauthorized devices and reducing the impact of DDoS attacks. The prototype implementation demonstrates improved security and trust in SDN environments. We combined blockchain’s immutability with SDN’s dynamic programmability.
The explosive growth of Non-Fungible Tokens (NFTs) has revolutionized digital ownership by enabling the creation, exchange, and monetization of unique assets on blockchain networks. However, this surge in popularity has also given rise to a disturbing trend: the emergence of rug pulls - fraudulent schemes where developers exploit trust and smart contract privileges to drain user funds or invalidate asset ownership. Central to many of these scams are hidden backdoors embedded within NFT smart contracts. Unlike unintentional bugs, these backdoors are deliberately coded and often obfuscated to bypass traditional audits and exploit investor confidence. In this paper, we present a large-scale static analysis of 49,940 verified NFT smart contracts using Slither, a static analysis framework, to uncover latent vulnerabilities commonly linked to rug pulls. We introduce a custom risk scoring model that classifies contracts into high, medium, or low risk tiers based on the presence and severity of rug pull indicators. Our dataset was derived from verified contracts on the Ethereum mainnet, and we generate multiple visualizations to highlight red flag clusters, issue prevalence, and co-occurrence of critical vulnerabilities. While we do not perform live exploits, our results reveal how malicious patterns often missed by simple reviews can be surfaced through static analysis at scale. We conclude by offering mitigation strategies for developers, marketplaces, and auditors to enhance smart contract security. By exposing how hidden backdoors manifest in real-world smart contracts, this work contributes a practical foundation for detecting and mitigating NFT rug pulls through scalable automated analysis.
Stephan Rabanser, Ali Shahin Shamsabadi, Olive Franzese, Xiao Wang · 6 authors
Cautious predictions -- where a machine learning model abstains when uncertain -- are crucial for limiting harmful errors in safety-critical applications. In this work, we identify a novel threat: a dishonest institution can exploit these mechanisms to discriminate or unjustly deny services under the guise of uncertainty. We demonstrate the practicality of this threat by introducing an uncertainty-inducing attack called Mirage, which deliberately reduces confidence in targeted input regions, thereby covertly disadvantaging specific individuals. At the same time, Mirage maintains high predictive performance across all data points. To counter this threat, we propose Confidential Guardian, a framework that analyzes calibration metrics on a reference dataset to detect artificially suppressed confidence. Additionally, it employs zero-knowledge proofs of verified inference to ensure that reported confidence scores genuinely originate from the deployed model. This prevents the provider from fabricating arbitrary model confidence values while protecting the model's proprietary details. Our results confirm that Confidential Guardian effectively prevents the misuse of cautious predictions, providing verifiable assurances that abstention reflects genuine model uncertainty rather than malicious intent.
Modern blockchain applications are often constrained by a trade-off between user experience and trust. Chainless Apps present a new paradigm of application architecture that separates execution, trust, bridging, and settlement into distinct compostable layers. This enables app-specific sequencing, verifiable off-chain computation, chain-agnostic asset and message routing via Agglayer, and finality on Ethereum - resulting in fast Web2-like UX with Web3-grade verifiability. Although consensus mechanisms have historically underpinned verifiable computation, the advent of zkVMs and decentralized validation services opens up new trust models for developers. Chainless Apps leverage this evolution to offer modular, scalable applications that maintain interoperability with the broader blockchain ecosystem while allowing domain-specific trade-offs.
Type systems are routinely employed in many modern programming languages to statically ensure various notions of runtime safety. We explore issues of typability and notions of safety in two different fields: Firstly, we focus on process calculi with composite channel names, where the type of a channel must somehow be derived from the types of its constituents. This collection of results includes a simple type system for the -calculus, along with some results of expressivity w.r.t. the -calculus; a generic type system for the Higher-Order Ψ-calculus, extending a similar type system for the ‘first-order’ Ψ-calculus; and a simple type system for , which aims to highlight a connexion to type structures from class-based/object-oriented languages. Secondly, we focus on the language TinySol, which models core features of the smart-contract language Solidity. Smart contracts are immutable programs with publicly visible code, that run atop a blockchain and are used to manage financial assets of users. Guided by insights from our work in process calculi, we develop type systems for ensuring three different properties: non-interference, call-integrity, and absence of out-of-gas exceptions. Lastly, we seek to tackle some of the shortcomings of the conventional, syntactic approach to type soundness, which had become evident in our previous developments. In particular, we study a peculiar construct in Solidity, known as the fallback function, which is untypable by syntactic type rules. Hence, we turn to a semantic approach to type soundness which allows type safety to be shown, even in cases where well-typedness cannot be proved by ordinary syntactic type rules. We use this approach to propose a method by which type safety may be recovered, even for contracts containing fallback functions, by allowing the programmer to supply a manual proof of type-safety for untypable pieces of code. This method does not depend on specific features of the fallback function, or even of TinySol or Solidity, and it may therefore also be developed for other smart-contract languages.
Web Assembly (Wasm) and blockchain technology offer a viable solution for reliable and high-performance front-end systems. Wasm provides high execution speeds by incorporating code from high-level languages to improvise on performance limitations. Its sand-boxed execution model enhances security by extenuating memory-related weaknesses. Similarly, blockchain reinforces security with decentralized, tamper-resistant data structures and smart contracts. Conventional blockchain frameworks often suffer from computational overhead, but Wasm-based execution platforms like Polkadot and EOS optimize resource utilization and improve interoperability. This integration facilitates high-speed, reliable interactions in decentralized applications (dApps). Potential benefits include fast and secure off-chain computations, hence reducing blockchain congestion in front-end frameworks. However, challenges remain in securing Wasm execution in decentralized environments and optimizing blockchain and Wasm interoperability. A promising direction is to exploit Just-In-Time (JIT), Ahead-of-Time (AOT) compilation schemes along with zero-knowledge proofs to further enhance performance and security characteristics. By coupling Wasm’s efficiency with blockchain’s security, scalable and decentralized front-end systems are evolving to meet challenging web demand scenarios.
With the rapid advancement of the digital age, the Internet has become an integral part of daily life. While users benefit from the convenience of online services, they are increasingly confronted with a critical conflict between identity privacy and security. Under traditional authentication mechanisms, malicious actors often exploit the login channel immediately after user registration, leading to the leakage of personal data. To address this issue, this paper proposes an anonymous identity authentication scheme based on non-interactive zero-knowledge proof. By employing ring signatures in combination with non-interactive zero-knowledge proofs, the proposed method ensures both the legitimacy of user identities and the security of the authentication process. Furthermore, the use of national cryptographic algorithms enhances the scheme's resilience against external attacks. Finally, we conduct comparative experiments to evaluate the proposed scheme. The results demonstrate that it provides anonymity, zero-knowledge soundness, resistance to quantum attacks, replay attacks, and double-spending. Additionally, the scheme achieves higher efficiency in signature generation and verification compared to an RSA+SHA-based ring signature authentication approach.
With the promise of greater decentralization and sustainability, Ethereum transitioned from a Proof-of-Work (PoW) to a Proof-of-Stake (PoS) consensus mechanism. The new consensus protocol introduces novel vulnerabilities that warrant further investigation. The goal of this paper is to investigate the security of Ethereum's PoS system from an Internet routing perspective. To this end, this paper makes two contributions: First, we devise a novel framework for inferring the distribution of validators on the Internet without disturbing the real network. Second, we introduce a class of network-level attacks on Ethereum's PoS system that jointly exploit Internet routing vulnerabilities with the protocol's reward and penalty mechanisms. We describe two representative attacks: StakeBleed, where the attacker triggers an inactivity leak, halting block finality and causing financial losses for all validators; and KnockBlock, where the attacker increases her expected MEV gains by preventing targeted blocks from being included in the chain. We find that both attacks are practical and effective. An attacker executing StakeBleed can inflict losses of almost 300 ETH in just 2 hours by hijacking as few as 30 IP prefixes. An attacker implementing KnockBlock could increase their MEV expected gains by 44.5% while hijacking a single prefix for less than 2 minutes. Our paper serves as a call to action for validators to reinforce their Internet routing infrastructure and for the Ethereum P2P protocol to implement stronger mechanisms to conceal validator locations.