Immutable code and steep transaction fees make smart contract deployment uniquely unforgiving. While continuous integration (CI/CD) pipelines excel at catching standard software bugs, applying exhaustive security tests to Web3 applications severely bottlenecks development through massive computational overhead and gas consumption. This paper presents a testing architecture designed specifically to resolve this tension between security depth and execution speed. The system pipelines three core engines. First, an AI-driven pre-execution gate flags immediate vulnerabilities. Next, a structural reduction module applies the k + 1 symmetric pattern to strip out redundant test permutations. Finally, the system constrains the remaining test suite using the NSGA-II evolutionary algorithm. This multi-objective optimizer dynamically schedules execution to maximize fault detection against strict, predefined gas budgets. To evaluate the model empirically, I bridged a localized EVM sandbox with a Python optimization engine. Results confirm the framework collapses exponential test generation and throttlesexecution costs without sacrificing critical security coverage. Ultimately, it offers a highly scalable path forward for modern DevSecOps.
A zero-knowledge proximity proof certifies geometric nearness but carries no commitment to an application context. In stateful geo-content systems, where drops can share coordinates, policies evolve, and content has persistent identity, this gap can permit proof transfer between application objects unless extra operational invariants are maintained. We present a systems-security analysis of this deployment problem: a taxonomy of context-binding vulnerabilities, a formal off-circuit verification model for a transcript-adversary that holds a recorded proof but cannot obtain fresh coordinates, an assumption comparison across five binding strategy classes, and a concrete instantiation, Zairn-ZKP, that embeds drop identity, policy version, and session context as public circuit inputs. Compared with a strong off-circuit alternative based on stored-digest server checking, in-proof binding reduces operational invariants from four to two and adds no measurable proving cost relative to the sound geo-only baseline (-0.12 ms median in our setup). It also removes a correctness pitfall we identify empirically: a plausible off-circuit implementation that omits one server-side check remains vulnerable to cross-drop transfer. Measurements across six network conditions, seven venues in four countries, and an epoch-window simulation indicate that same-epoch transfer is realistic in dense urban deployments unless per-request nonces are maintained. Across five platforms and seven binding strategies, the results support a deployable methodology for reducing assumption surfaces in stateful ZK-backed verification workflows.
Java applications are prone to vulnerabilities stemming from the insecure use of security-sensitive APIs, such as file operations enabling path traversal or deserialization routines allowing remote code execution. These sink APIs encode critical information for vulnerability discovery: the program-specific constraints required to reach them and the exploitation conditions necessary to trigger security flaws. Despite this, existing fuzzers largely overlook such vulnerability-specific knowledge, limiting their effectiveness. We present GONDAR, a sink-centric fuzzing framework that systematically leverages sink API semantics for targeted vulnerability discovery. GONDAR first identifies reachable and exploitable sink call sites through CWE-specific scanning combined with LLM-assisted static filtering. It then deploys two specialized agents that work collaboratively with a coverage-guided fuzzer: an exploration agent generates inputs to reach target call sites by iteratively solving path constraints, while an exploitation agent synthesizes proof-of-concept exploits by reasoning about and satisfying vulnerability-triggering conditions. The agents and fuzzer continuously exchange seeds and runtime feedback, complementing each other. We evaluated GONDAR on real-world Java benchmarks, where it discovers four times more vulnerabilities than Jazzer, the state-of-the-art Java fuzzer. Notably, an earlier GONDAR version contributed to Team Atlanta's first-place CRS in the DARPA AI Cyber Challenge, and is integrated into OSS-CRS, a sandbox project in The Linux Foundation's OpenSSF, to analyze open-source Java projects, where it has already uncovered a zero-day vulnerability.
The rising frequency of cyber threats increases the need for incident reporting that is transparent, efficient, and privacy-preserving. This study designs and implements a hybrid Web2-Web3 cyber incident reporting prototype that anchors report references on a blockchain while storing full incident details off-chain, and explores non-fungible token (NFT) recognition incentives for reporters. Using an SDLC-based iterative prototyping approach, we built a React single-page application integrated with a Laravel REST API and MySQL for off-chain storage, and deployed Solidity smart contract modules on the Arbitrum Sepolia testnet to record report identifiers and UUID pointers (dataPointer) and to mint NFTs after administrative validation. We conducted black-box functional testing across core scenarios (submission, storage, pointer anchoring, validation, and minting) and a user acceptance study with 25 participants (15 cybersecurity students and 10 IT practitioners) using a 5-point Likert questionnaire. All tested scenarios executed as expected in the test environment, and on-chain events were traceable to corresponding backend records via transaction receipts and logged identifiers. The acceptance evaluation yielded an overall mean score of 3.4/5 (about 68%), indicating moderate acceptance and supporting the work as a prototype feasibility study rather than organizational-level generalization. The prototype demonstrates a practical workflow for hybrid incident reporting with transaction-level traceability and recognition incentives; future work should strengthen cryptographic binding (e.g., content hashing) and validate the approach with CSIRT stakeholders in operational settings.
This repo contains the artifact for ASE 26 submission 942: "Vulnerability Detection in Low-resource Smart Contracts via LLM-powered Code Translation" when it is under review.
Matteo Vaccargiu, Sabrina Aufiero, Silvia Bartolucci, Ronnie de Souza Santos · 6 authors
Labels on platforms such as GitHub support triage and coordination, yet little is known about how well they align with code modifications or how such alignment affects collaboration across contributor experience levels. We present a case study of the Kubernetes project, introducing label-diff congruence - the alignment between pull request labels and modified files - and examining its prevalence, stability, behavioral validation, and relationship to collaboration outcomes across contributor tiers. We analyse 18,020 pull requests (2014--2025) with area labels and complete file diffs, validate alignment through analysis of over one million review comments and label corrections, and test associations with time-to-merge and discussion characteristics using quantile regression and negative binomial models stratified by contributor experience. Congruence is prevalent (46.6\% perfect alignment), stable over years, and routinely maintained (9.2\% of PRs corrected during review). It does not predict merge speed but shapes discussion: among core developers (81\% of the sample), higher congruence predicts quieter reviews (18\% fewer participants), whereas among one-time contributors it predicts more engagement (28\% more participants). Label-diff congruence influences how collaboration unfolds during review, supporting efficiency for experienced developers and visibility for newcomers. For projects with similar labeling conventions, monitoring alignment can help detect coordination friction and provide guidance when labels and code diverge.
Smart contracts (SCs) cannot be modified once deployed on the blockchain, making pre-deployment vulnerability identification essential. Although numerous SC vulnerability (SCVul) detection tools (SCTs) have been developed, prior evaluations have examined only limited vulnerability types, leaving it uncertain whether SCTs can comprehensively detect vulnerabilities and what characteristics their detectable vulnerabilities exhibit. Because each SCT employs distinct analysis methods and detection strategies, using multiple SCTs can be advantageous; however, the detection accuracy of such combinations has not yet been systematically evaluated. In this study, we comprehensively investigate the types and characteristics of SCVuls targeted by eight SCTs whose execution environments were successfully established and verified.
Smart contract vulnerability benchmarking lacks standardized, reproducible datasets that enable fair and consistent evaluation of static analysis tools. This paper presents SARMF-Bench, a compact, deterministic, and fully reproducible benchmark dataset comprising five SWC-aligned Solidity smart contracts (SC01–SC05) covering reentrancy (SWC-107), integer overflow/underflow (SWC-101), access-control weakness (SWC-105), unchecked external calls (SWC-104), and denial-of-service via unbounded loops (SWC-113). Each contract is intentionally minimal to isolate a single structural vulnerability pattern and is paired with machine-readable JSON outputs generated using Slither v0.11.5 in a version-locked environment, preserving detector identifiers, impact levels, and confidence metadata. SARMF-Bench is archived across multiple open repositories with permanent DOIs to enable fully reproducible smart contract security tool evaluation experiments. Baseline static analysis results are reported for each vulnerability class. All artifacts are publicly released under open licenses.
Solana is rapidly gaining traction among smart contract developers and users. However, its growing adoption has been accompanied by a series of major security incidents, which have spurred research into automated analysis techniques for Solana smart contracts. Unfortunately, existing approaches do not address the unique and complex account model of Solana. In this paper, we propose SseRex, the first symbolic execution vulnerability detection approach for finding Solana-specific bugs such as missing owner checks, missing signer checks, and missing key checks, as well as arbitrary cross-program invocations. Our evaluation of 8,714 bytecode-only contracts shows that our approach outperforms existing approaches and identifies potential bugs in 467 different contracts. Additionally, we analyzed 120 open-source Solana projects and conducted in-depth case studies on four of them. Our findings reveal that subtle, easily overlooked issues often serve as the root cause of severe exploits, further highlighting the need for specialized analysis tools like SseRex.
Shikah J. Alsunaidi, Hamoud Aljamaan, Mohammad Hammoudeh
Smart Contract (SC) vulnerabilities are programming errors or design flaws that can lead to financial loss or functional failure, making accurate detection essential. Although Machine Learning (ML) is widely applied to SC vulnerability detection, existing datasets are often small, imbalanced, inconsistently labeled, or nonstandardized, and frequently rely on limited feature representations that do not account for different contract lifecycle stages, restricting generalization and degrading benchmark reliability. This study introduces DIVE, a multi-label dataset that addresses these structural and feature-level limitations. DIVE includes 22,330 real-world SCs deployed between 2016 and 2024, and spanning major Solidity compiler versions, annotated for eight vulnerability types aligned with the Decentralized Application Security Project (DASP) Top 10 taxonomy. It provides 221 pre-deployment and 176 post-deployment features and employs a standardized multi-tool labeling pipeline based on Power-based voting and post-hoc filtering, which corrected 14.3% false positives in DoS and 24.9% in Time Manipulation. Unlike prior datasets, DIVE offers two lifecycle-specific feature sets and an open-source framework enabling reproducible benchmarking and periodic reconstruction aligned with evolving vulnerability patterns.
D. Victor Abhishek, Y. Meena Kumari, G Surekha, B. Sai Hemanth Reddy
Web3 authentication has become a key to the decentralized applications and allows users to sign in using cryptographic wallet signatures rather than centralized credentials. Nevertheless, recent research has shown that the current Web3 authentication systems are very susceptible to message-based attacks especially Blind Message Attacks, which takes advantage of unclear message semantics, lack of domain binding, insecurity with nonce, and lack of verification on the server side. This paper critically examines those vulnerabilities based on realworld deployments of Web3 authentication and shows that a large percentage of extant implementations can be compromised by an attacker. In order to handle such issues, we present a configurable and deployable authentication model, the socalled Secure Web3 Authentication Framework (SWAF), that implements structured authentication messages, high message equality checking, nonce management in context-sensitive fashion, and protocol-level domain binding. The suggested scheme is tested on a real-world set of 29 Web3 authentication examples, in which it perfectly mitigates Blind Message Attacks, Replay Attacks, Blind Multi-Message Attacks, as well as, cross-domain authentication abuses keeping its computational overhead at only a small fraction. Our findings indicate that looking at protocol-level authentication semantics strictly is feasible and necessary to enhancing confidence and security in Web3 authentication schemes.
Description of the Invention The present invention relates to the field of cybersecurity and artificial intelligence, and more particularly to a method and system for local autonomous internal penetration testing using artificial intelligence agents augmented by retrieval-based knowledge mechanisms. The invention discloses a technical solution in which one or more autonomous artificial intelligence agents operate within an internal enterprise environment to continuously assess the security posture of information systems, networks, services, and configurations. Unlike conventional penetration testing approaches that rely on manual effort, predefined scripts, or static rule-based scanners, the proposed system dynamically adapts its behavior based on observed system states, retrieved security knowledge, and learned experience. The system employs reinforcement learning to model penetration testing as a sequential decision-making problem, wherein an agent observes an environment state, selects an action from a defined action space, receives a reward based on the outcome, and updates its policy to maximize an expected cumulative reward associated with discovering security weaknesses, misconfigurations, or policy violations. The environment may include hosts, network topology, authentication mechanisms, access control rules, and security monitoring components. To overcome the limitations of fixed context windows and static knowledge in machine learning models, the invention integrates retrieval-augmented mechanisms. At each decision step, the agent retrieves relevant contextual information from a locally stored vector database containing embeddings of security documentation, vulnerability descriptions, configuration policies, compliance requirements, historical findings, and system metadata. The retrieval process is performed using approximate nearest neighbor search, enabling low-latency access to relevant knowledge at scale. The retrieved contextual data is used to augment the agent’s internal state representation and, in some embodiments, to construct augmented prompts for a local large language model responsible for high-level planning, reasoning, or task decomposition. This combination enables the agent to make informed decisions grounded in both learned behavior and up-to-date domain-specific knowledge. In certain embodiments, the system supports multiple cooperating agents, each specializing in a subset of penetration testing activities, such as reconnaissance, vulnerability identification, exploitation simulation, lateral movement analysis, or compliance auditing. Coordination between agents is achieved through a centralized planner or critic during training, while execution may occur in a decentralized manner. A key feature of the invention is that all data processing, retrieval, learning, and inference are performed locally within the organization’s infrastructure, without transmitting sensitive information to external systems. This design preserves confidentiality, complies with regulatory and organizational privacy requirements, and enables deployment in restricted or high-security environments. The disclosed method and system provide continuous, adaptive, and knowledge-informed internal security assessment, improving the detection of security weaknesses while reducing reliance on manual testing and static tools.
We introduce TorusDB, the first database engine supporting practical SQL query processing over ciphertexts using a fully homomorphic encryption scheme derived entirely from elliptic curve cryptography. Unlike prior approaches based on lattice FHE or zero-knowledge proofs, TorusDB preserves the elliptic curve group structure and extends additive homomorphism via a formal multiplicative construction and rational extension, enabling full homomorphic evaluation without decryption. We formalize the underlying EC-based FHE scheme, prove its security under standard elliptic curve assumptions (ECDLP, DDH, BDH), and present a query execution model supporting selection, projection, aggregation, and grouping. Our implementation demonstrates that encrypted query execution incurs only 77% overhead relative to plaintext execution, marking a substantial improvement over existing homomorphic database systems which typically exhibit 10-100× overhead.
Jiaqi Gao, Zijian Zhang, Yuqiang Sun, Ye Liu · 8 authors
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or arithmetic errors, these vulnerabilities arise from missing or incorrectly enforced business invariants and are tightly coupled with protocol semantics. Existing static analysis techniques struggle to capture such high-level logic, while recent large language model based approaches often suffer from unstable outputs and low accuracy due to hallucination and limited verification. In this paper, we propose LogicScan, an automated contrastive auditing framework for detecting business logic vulnerabilities in smart contracts. The key insight behind LogicScan is that mature, widely deployed on-chain protocols implicitly encode well-tested and consensus-driven business invariants. LogicScan systematically mines these invariants from large-scale on-chain contracts and reuses them as reference constraints to audit target contracts. To achieve this, LogicScan introduces a Business Specification Language (BSL) to normalize diverse implementation patterns into structured, verifiable logic representations. It further combines noise-aware logic aggregation with contrastive auditing to identify missing or weakly enforced invariants while mitigating LLM-induced false positives. We evaluate LogicScan on three real-world datasets, including DeFiHacks, Web3Bugs, and a set of top-200 audited contracts. The results show that LogicScan achieves an F1 score of 85.2%, significantly outperforming state-of-the-art tools while maintaining a low false-positive rate on production-grade contracts. Additional experiments demonstrate that LogicScan maintains consistent performance across different LLMs and is cost-effective, and that its false-positive suppression mechanisms substantially improve robustness.
Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem · 5 authors
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures and provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.
Jinghan Liu, Hui Zhao, Chenyang Lin, Dan Wang · 5 authors
The current security problem of smart contracts is becoming a common concern for researchers and developers. Existing smart contract vulnerability detection methods rely heavily on fixed expert rules, resulting in low detection accuracy. In order to cope with complex and changing smart contract application scenarios, we chose to use graph neural networks to detect vulnerabilities. In this paper, we proposed a vulnerability detection model called ESA based on the enhanced sequential algorithm. During the coding process, the contract function source code is described as a contract graph, which increases the model’s global insight into node features during the learning process and reduces the number of noise nodes unrelated to vulnerabilities while retaining sufficient contextual semantic features. Compared to the cutting-edge methods, our model has significantly improved the accuracy of reentrant and timestamp dependency vulnerabilities, with detection accuracies of 89.09% and 88.49%, respectively.
Smart contract technology facilitates self-executing agreements on the blockchain, eliminating dependency on an external trusted authority. However, smart contracts may expose vulnerabilities that can lead to financial losses and disruptions in decentralized applications. In this work, we evaluate deep learning-based approaches for vulnerability scanning of Ethereum smart contracts. We propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, which performs sequential analysis of Ethereum Virtual Machine (EVM) bytecode and incorporates a sliding window mechanism to overcome input length constraints. To assess VASCOT's detection efficacy, we construct a dataset of 16,469 verified Ethereum contracts deployed in 2022, and annotate it using trace analysis with concrete validation to mitigate false positives. VASCOT's performance is then compared against a state-of-the-art LSTM-based vulnerability detection model on both our dataset and an older public dataset. Our findings highlight the strengths and limitations of each model, providing insights into their detection capabilities and generalizability.
Smart contracts are a core component of blockchain-based decentralized systems, but their immutability and financial exposure make software defects particularly costly. Existing analysis tools have improved vulnerability detection, yet most lack integrated remediation capabilities. This paper presents SARMF, a hybrid framework combining static analysis, pattern detection, lightweight machine learning classification, and template-based remediation. The framework is evaluated using SARMF-Bench, a curated dataset designed to support reproducible assessment of detection and first-pass remediation across common vulnerability classes. Results indicate detection performance in the high-80s to low-90s range with balanced precision and recall, while remediation templates reduce manual correction effort by approximately 30–40%. The contribution is a practical research prototype, a benchmark protocol, and an extensible evaluation framework for smart contract security.
Elvira Albert, Emanuele De Angelis, Marco Di Ianni, Fabio Fioravanti · 5 authors
Testing has become an integral part of the software development process in order to ensure the correct and safe execution of programs. A powerful approach to testing is property-based testing that aims at generating unit tests that verify that a certain property of interest holds. However, smart contracts are also characterized by important non-functional aspects, such as the gas consumption required to execute their functions. Static gas analyzers are able to obtain parametric gas bounds - that soundly over-approximate - the gas consumption of executing each of the public functions within a smart contract. This paper discusses our ideas towards combining both formal methods, property-based testing and gas analysis, in order to generate gas-aware unit tests that can ensure the gas requirements provided by the programmers.
This report studies EvoVuln, a smart contract vulnerability analysis pipeline that represents vulnerability knowledge as a natural-language detection method, refines that knowledge through iterative training, and converts the result into an executable detection plan for downstream contract analysis. The report focuses on the Stage 2 update-acceptance mechanism, which determines whether a candidate knowledge revision should replace the current knowledge state during labelled-data refinement. In the baseline implementation, candidate updates are accepted based only on improvement over the previously misclassified subset. While simple and efficient, this rule may accept revisions that improve local error cases while worsening behaviour on other labelled contracts. To address this limitation, this report investigates a modified acceptance rule that adds full-set validation before acceptance, requiring candidate knowledge to reduce total errors on the full labelled training set. The modified rule was implemented as a localised change at the Stage 2 acceptance point, while the broader pipeline structure was retained. Evaluation was conducted on two selected vulnerability types using matched starting snapshots and repeated full-pipeline runs under both policies. The modified rule consistently accepted fewer candidate updates than the baseline policy, indicating stricter filtering during refinement. It also improved average downstream F1 in both vulnerability types, although the form of improvement differed: for price manipulation, recall increased while precision decreased, whereas for access control, average precision, recall, and F1 all improved. These findings suggest that Stage 2 acceptance is a meaningful design choice in iterative LLM-based vulnerability analysis pipelines. Within the scope of the evaluated cases, adding full-set validation was associated with improved downstream detector performance, although the results should be interpreted cautiously given the limited experimental scope and the pipeline’s sensitivity to LLM-related non-determinism.
This registration documents the creation, structure, and validation workflow of SARMF-Bench, a minimal reproducible benchmark dataset for smart contract vulnerability analysis. SARMF-Bench consists of five intentionally engineered Solidity contracts representing canonical vulnerability classes: Reentrancy, Arithmetic Overflow Behavior, Access Control Weakness, Unchecked External Call, and Denial-of-Service Pattern. Each contract is paired with machine-readable static analysis outputs generated using Slither v0.11.5. The objective of this dataset is to provide a controlled experimental baseline for evaluating static analyzers, symbolic execution engines, fuzzers, and AI-assisted smart contract security tools. All artifacts were created in a controlled Linux environment and validated for reproducibility through consistent detector metadata (impact and confidence levels). No synthetic mutation frameworks or automated vulnerability generators were used. This registration serves as a timestamped, immutable research record documenting dataset structure, methodology, and reproducibility protocol.
Smart contracts are high-stakes software: their immutable, publicly accessible, code may govern assets worth millions, meaning that even minor defects can have severe consequences. The most used techniques to ensure smart contract correctness are testing and formal verification. Testing is almost always employed but is often restricted to unit tests (which often miss edge cases) and has limited coverage, while formal verification can provide strong guarantees but is often costly and complex to apply, demanding substantial time and expertise. Property-based testing bridges this gap by exploring large input spaces and shrinking failures to minimal counterexamples, helping uncover defects early in development. Formal verification can be left to critical features once testing has filtered out common issues. To add to the challenges smart contract developers face, most languages used were not designed with safety and security guarantees built-in. Daml is a smart contract language designed with correctness in mind, featuring a strong static type system, functional programming paradigms, and built-in abstractions for common smart contract patterns. However, Daml currently lacks support for property-based testing, limiting developers' ability to systematically explore input spaces and verify contract properties. This paper introduces Hypothesis2Daml, an open-source library that brings property-based testing to the Daml ecosystem by connecting the Hypothesis testing framework with the Daml JSON API. Hypothesis2Daml enables developers to specify invariants, preconditions, and stateful workflows over realistic ledger interactions, while providing automatic input generation, shrinking, and isolation of ledger state between test cases. The approach is evaluated using a benchmark consisting of eight contracts, three Daml templates, and twenty-eight property-based tests covering happy paths, negative cases, and alternative interaction orders. The results show that property-based testing is feasible for Daml smart contracts, can systematically expose violated properties with minimal counterexamples, and supports effective debugging of realistic, stateful workflows.