Recent advances in Vector Oblivious Linear Evaluation (VOLE) protocols have enabled constant-round, fast, and scalable (designated-verifier) zero-knowledge proofs, significantly reducing prover computational cost. Existing protocols, such as QuickSilver [CCS'21] and LPZKv2 [CCS'22], achieve efficiency with prover costs of 4 multiplications in the extension field per AND gate for Boolean circuits, with one multiplication requiring a O (k log k) -bit operation where k== 128 is the security parameter, and 3–4 field multiplications per multiplication gate for arithmetic circuits over a large field. We introduce JesseQ, a suite of two VOLE-based protocols: JQv1 and JQv2, which advance state of the art. JQv1 requires only 2 scalar multiplications in an extension field per AND gate for Boolean circuits, with one scalar needing a$O(\kappa)$bit operation, and 2 field multiplications per multiplication gate for arithmetic circuits over a large field. In terms of communication costs, JQv1 needs just 1 field element per gate. JQv2 further reduces communication costs by half at the cost of doubling the prover's computation. Experiments show that, compared to the current state of the art, both JQv1 and JQv2 achieve at least 3.9× improvement in the online phase for Boolean circuits. For large field circuits, JQv1 has a similar performance, while JQv2 offers a 1.3× improvement. Additionally, both JQv1 and JQv2 maintain the same communication cost as the current state of the art. No-tably, on the cheapest AWS instances, JQv1 can prove 9.2 tril-lion AND gates (or 5.8 trillion multiplication gates over a 61-bit field) for just one US dollar. JesseQ excels in applications like inner products, matrix multiplication, and lattice problems, delivering 40% – 200% performance improvements compared to QuickSilver. Additionally, JesseQ integrates seamlessly with the sublinear Batchman framework [CCS'23], enabling further efficiency gains for batched disjunctive statements.
Luca Ruschioni, Robert Shuttleworth, Rumyana Neykova, Barbara Re · 5 authors
Solidity is the predominant programming language for blockchain-based smart contracts, and its characteristics pose significant challenges for code analysis and maintenance. Traditional software analysis approaches, while effective for conventional programming languages, often fail to address Solidity-specific features such as gas optimization and security constraints. This paper introduces micro-patterns - recurring, small-scale design structures that capture key behavioral and structural peculiarities specific to a language - for Solidity language and demonstrates their value in understanding smart contract development practices. We identified 18 distinct micro-patterns organized in five categories (Security, Functional, Optimization, Interaction, and Feedback), detailing their characteristics to enable automated detection. To validate this proposal, we analyzed a dataset of 23258 smart contracts from five popular blockchains (Ethereum, Polygon, Arbitrum, Fantom and Optimism). Our analysis reveals widespread adoption of micro-patterns, with 99% of contracts implementing at least one pattern and an average of 2.76 patterns per contract. The Storage Saver pattern showed the highest adoption (84.62% mean coverage), while security patterns demonstrated platform-specific adoption rates. Statistical analysis revealed significant platform-specific differences in pattern adoption, particularly in Borrower, Implementer, and Storage Optimization patterns.
With the rapid advancement of blockchain technology, smart contracts have enabled the implementation of increasingly complex functionalities. However, ensuring the security of smart contracts remains a persistent challenge across the stages of development, compilation, and execution. Vulnerabilities within smart contracts not only undermine the security of individual applications but also pose significant risks to the broader blockchain ecosystem, as demonstrated by the growing frequency of attacks since 2016, resulting in substantial financial losses. This paper provides a comprehensive analysis of key security risks in Ethereum smart contracts, specifically those written in Solidity and executed on the Ethereum Virtual Machine (EVM). We focus on two prevalent and critical vulnerability types (reentrancy and integer overflow) by examining their underlying mechanisms, replicating attack scenarios, and assessing effective countermeasures.
Large language models (LLMs) excel at generating code from natural language instructions, yet they often lack an understanding of security vulnerabilities. This limitation makes it difficult for LLMs to avoid security risks in generated code, particularly in high-security programming tasks such as smart contract development for blockchain. Researchers have attempted to enhance the vulnerability awareness of these models by training them to differentiate between vulnerable and fixed code snippets. However, this approach relies heavily on manually labeled vulnerability data, which is only available for popular languages like Python and C++. For low-resource languages like Solidity, used in smart contracts, large-scale annotated datasets are scarce and difficult to obtain. To address this challenge, we introduce CodeBC, a code generation model specifically designed for generating secure smart contracts in blockchain. CodeBC employs a three-stage fine-tuning approach based on CodeLlama, distinguishing itself from previous methods by not relying on pairwise vulnerability location annotations. Instead, it leverages vulnerability and security tags to teach the model the differences between vulnerable and secure code. During the inference phase, the model leverages security tags to generate secure and robust code. Experimental results demonstrate that CodeBC outperforms baseline models in terms of BLEU, CodeBLEU, and compilation pass rates, while significantly reducing vulnerability rates. These findings validate the effectiveness and cost-efficiency of our three-stage fine-tuning strategy, making CodeBC a promising solution for generating secure smart contract code.
With the booming development of blockchain, it has gradually gained wide attention in the Internet of Things (IoT), finance, and other fields. However, due to the shared nature of blockchain ledgers among multiple users, sensitive user information, such as transaction amounts and private agreements, can be easily exposed. This poses significant privacy concerns for blockchain users. To address this issue, we propose TrustChain, a high-performance smart contract model based on the Trusted Execution Environment (TEE). TrustChain aims to safeguard the privacy of smart contract codes and user data by leveraging the secure execution environment provided by the TEE. Specifically, we introduce the TEE to run the smart contract with security and privacy without introducing a heavyweight cryptographic algorithm, thus improving the performance of the system. When running smart contracts, the operate nodes equipped with TEE ensure that the Operating System (OS) of the node itself cannot access the data within the TEE. This isolation effectively separates the sensitive information of the smart contract from the external environment. Furthermore, we introduce Verifiable Random Functions (VRFs) to randomly choose the operate nodes to prevent collusion attacks, further improving the security of the model. The graph ledger, based on the Directed Acyclic Graph (DAG), is used to adapt to the high-performance characteristics of a smart contract system based on the TEE. Finally, we simulate the scheme in TrustZone and demonstrate the feasibility of TrustChain through a series of experiments and analyses. The analysis and experimental results demonstrate that our solution exhibits excellent privacy protection performance and achieves higher throughput compared to traditional smart contracts. • We have introduced TrustChain, a smart contract model based on TEE, to ensure the privacy and security of smart contracts. • VRFs are proposed to randomly select operate nodes, preventing collusion and enhancing defense against malicious attacks. • The redesigned consensus mechanism limits blockchain storage to smart contract outputs, preventing leakage of sensitive information. • We enhanced smart contract performance by integrating a DAG-based ledger with TEE's low-latency execution.
The proposed research presents a theoretical investigation into the integration of zero-knowledge proofs (ZKP) within autonomous defense architectures, establishing rigorous mathematical foundations for privacy-preserving security verification in next-generation cybersecurity systems. This study addresses fundamental theoretical challenges in autonomous security verification by developing novel mathematical constructs that enable privacy-preserving proof generation and verification while maintaining formal security guarantees. The research methodology encompasses the development of formal mathematical models for non-interactive zero-knowledge proof systems optimized for autonomous verification environments. These models extend existing theoretical frameworks by introducing novel constructs for proof composition and verification in distributed systems, with particular emphasis on formal security properties including completeness, soundness, and zero-knowledge characteristics.
Gerardo Iuliano, Luigi Allocca, Matteo Cicalese, Dario Di Nucci
The security of smart contracts is critical in blockchain systems, where even minor vulnerabilities can lead to substantial financial losses. Researchers proposed several vulnerability detection tools evaluated using existing benchmarks. However, most benchmarks are outdated and focus on a narrow set of vulnerabilities. This work evaluates whether mutation seeding can effectively inject vulnerabilities into Solidity-based smart contracts and whether state-of-the-art static analysis tools can detect the injected flaws. We aim to automatically inject vulnerabilities into smart contracts to generate large and wide benchmarks. We propose MuSe, a tool to generate vulnerable smart contracts by leveraging pattern-based mutation operators to inject six vulnerability types into real-world smart contracts. We analyzed these vulnerable smart contracts using Slither, a static analysis tool, to determine its capacity to identify them and assess their validity. The results show that each vulnerability has a different injection rate. Not all smart contracts can exhibit some vulnerabilities because they lack the prerequisites for injection. Furthermore, static analysis tools fail to detect all vulnerabilities injected using pattern-based mutations, underscoring the need for enhancements in static analyzers and demonstrating that benchmarks generated by mutation seeding tools can improve the evaluation of detection tools.
Fernando Castillo, Jonathan Heiss, Sebastian Werner, Stefan Tai
Blockchain and distributed ledger technologies (DLTs) facilitate decentralized computations across trust boundaries. However, ensuring complex computations with low gas fees and confidentiality remains challenging. Recent advances in Confidential Computing -- leveraging hardware-based Trusted Execution Environments (TEEs) -- and Proof-carrying Data -- employing cryptographic Zero-Knowledge Virtual Machines (zkVMs) -- hold promise for secure, privacy-preserving off-chain and layer-2 computations. On the other side, a homogeneous reliance on a single technology, such as TEEs or zkVMs, is impractical for decentralized environments with heterogeneous computational requirements. This paper introduces the Trusted Compute Unit (TCU), a unifying framework that enables composable and interoperable verifiable computations across heterogeneous technologies. Our approach allows decentralized applications (dApps) to flexibly offload complex computations to TCUs, obtaining proof of correctness. These proofs can be anchored on-chain for automated dApp interactions, while ensuring confidentiality of input data, and integrity of output data. We demonstrate how TCUs can support a prominent blockchain use case, such as federated learning. By enabling secure off-chain interactions without incurring on-chain confirmation delays or gas fees, TCUs significantly improve system performance and scalability. Experimental insights and performance evaluations confirm the feasibility and practicality of this unified approach, advancing the state of the art in verifiable off-chain services for the blockchain ecosystem.
Xinyao Xu, Ziyu Mao, Jianzhong Su, Xingwei Lin · 7 authors
The rapid growth of decentralized applications, while revolutionizing financial transactions, has created an attractive target for malicious attacks.Existing approaches to detecting attacks often rely on predefined rules or simplistic and overly-specialized models, which lack the flexibility to handle the wide spectrum of diverse and dynamically changing attack types.To address this challenge, we present a general and extensible framework, MoE (Monitoring Ethereum), that leverages runtime verification to detect a wide range of attacks on Ethereum.MoE features an expressive attack modeling language, based on Metric First-order Temporal Logic (MFOTL), that can formalize a wide range of attacks.We integrate a novel semantic lifting approach that extracts system behaviors relevant for various attacks, which can be analyzed using the monitoring tool MonPoly.Furthermore, we also equip MoE with quantitative capabilities to evaluate the similarity between a transaction and an attack formula to enhance its performance in identifying attacks, including near-miss attacks.We carry out extensive experiments with MoE on a labeled benchmark and a large-scale dataset containing over one million transactions.On the labeled benchmark, MoE successfully detects 92.0% attacks and achieves a 45.0% higher recall rate than competing state-of-the-art tool.MoE finds 3,319 attacks with 95.4% precision on the large dataset.Furthermore, MoE uses quantitative analysis to uncover 8% additional attacks.Finally, the average time for * Xinyao Xu and Ziyu Mao contributed equally.
Ensuring the authenticity and integrity of products in a supply chain while maintaining privacy is a significant challenge. Traditional blockchain-based verification systems often expose sensitive information, such as location, batch ID, and manufacturer identity. To address this, we propose a zk-Rollup-based privacy-preserving identity and transaction verification system that leverages Zero-Knowledge Proofs (ZKPs) to ensure trust without revealing confidential data. Our architecture includes a producer and a manufacturer, where the producer generates verifiable proofs of product origin, and the manufacturer appends metadata such as manufacturing date and expiry. A centralized server aggregates producer and manufacturer data, generating zk-SNARK proofs for each transaction. The system employs zk-Rollups for efficient transaction batching, significantly reducing on-chain gas fees and improving scalability. Additionally, all data is end-to-end encrypted using SHA-256, ensuring robust security. Users and third parties can verify proof validity using a QR code-based authentication mechanism, which queries the server endpoint without exposing private details. Performance evaluations demonstrate significant improvements in proof generation time, verification latency, and cost efficiency. Our proposed solution enables secure and scalable supply chain verification, preserving privacy while maintaining transparency and trust. The results indicate that zk-Rollups reduce gas fees by a factor of 10x, making the system feasible for real-world applications. Future work will focus on further optimizing proof generation and exploring decentralized identity solutions for enhanced security.
Smart contracts power decentralized financial (DeFi) services but are vulnerable to security exploits that can lead to significant financial losses. Existing security measures often fail to adequately protect these contracts due to the composability of DeFi protocols and the increasing sophistication of attacks. Through a large-scale empirical study of historical transactions from the 37 hacked DeFi protocols, we discovered that while benign transactions typically exhibit a limited number of unique control flows, in stark contrast, attack transactions consistently introduce novel, previously unobserved control flows. Building on these insights, we developed CrossGuard, a novel framework that enforces control flow integrity onchain to secure smart contracts. Crucially, CrossGuard does not require prior knowledge of specific hacks. Instead, configured only once at deployment, it enforces control flow whitelisting policies and applies simplification heuristics at runtime. This approach monitors and prevents potential attacks by reverting all transactions that do not adhere to the established control flow whitelisting rules. Our evaluation demonstrates that CrossGuard effectively blocks 35 of the 37 analyzed attacks when configured only once at contract deployment, maintaining a low false positive rate of 0.26% and minimal additional gas costs. These results underscore the efficacy of applying control flow integrity to smart contracts, significantly enhancing security beyond traditional methods and addressing the evolving threat landscape in the DeFi ecosystem.
Smart contracts deployed on blockchain platforms are vulnerable to various security vulnerabilities. However, only a small number of Ethereum contracts have released their source code, so vulnerability detection at the bytecode level is crucial. This paper introduces SmartBugBert, a novel approach that combines BERT-based deep learning with control flow graph (CFG) analysis to detect vulnerabilities directly from bytecode. Our method first decompiles smart contract bytecode into optimized opcode sequences, extracts semantic features using TF-IDF, constructs control flow graphs to capture execution logic, and isolates vulnerable CFG fragments for targeted analysis. By integrating both semantic and structural information through a fine-tuned BERT model and LightGBM classifier, our approach effectively identifies four critical vulnerability types: transaction-ordering, access control, self-destruct, and timestamp dependency vulnerabilities. Experimental evaluation on 6,157 Ethereum smart contracts demonstrates that SmartBugBert achieves 90.62% precision, 91.76% recall, and 91.19% F1-score, significantly outperforming existing detection methods. Ablation studies confirm that the combination of semantic features with CFG information substantially enhances detection performance. Furthermore, our approach maintains efficient detection speed (0.14 seconds per contract), making it practical for large-scale vulnerability assessment.
This paper presents the translation of regulatory smart contracts written in RegLang into MedTiny, a component-based modeling language tailored for the development and verification of reliable systems. RegLang, a domain-specific language for embedding regulatory requirements in smart contracts, is limited by its users' expertise in smart contract development and formal verification. To address this, we propose an automated code generation method that translates RegLang contracts into MedTiny, enabling domain experts to utilize MedTiny's verification capabilities and modular system architecture. By leveraging MedTiny's toolchain and SMT solvers, we detect redundancies and conflicts in regulations early in the development cycle, helping domain experts avoid introducing unintended behaviors. This approach not only preserves the original specifications of RegLang contracts but also improves overall system reliability by integrating comprehensive verification capabilities. A case study illustrates the practical benefits of this translation, supporting complex rule-based contract management and mitigating the risks associated with regulatory changes.
Traditional Supervisory Control and Data Acquisition (SCADA) are prone to cyber attacks which makes it difficult in keeping data secure. As the traditional architecture relies on centralized storage, which makes them vulnerable to unauthorized access and manipulation. To tackle these security concerns, the study demostrates the integration of blockchain technology and Bulletproof, a zero-knowledge range proof technique into SCADA systems to securely store aggregated sensor value proof in the ledger. The study uses Hyperledger fabric, creating a transparent and tamper-proof record for audits and providing a more secure and trustworthy system. This approach reduces storage and computational overhead while ensuring that data remains private and within valid ranges without exposing sensitive details. By combining blockchain with zero-knowledge range proofs, the proposed solution enhances both security and efficiency in SCADA systems. It ensures that sensor data remains protected from tampering while keeping blockchain resources optimized. This makes industrial systems more secure, reliable, and ready for the future of automation.
Smart contracts are small programs that run autonomously on the blockchain, using it as their persistent memory. The predominant platform for smart contracts is the Ethereum VM (EVM). In EVM smart contracts, a problem with significant applications is to identify data structures (in blockchain state, a.k.a. "storage"), given only the deployed smart contract code. The problem has been highly challenging and has often been considered nearly impossible to address satisfactorily. (For reference, the latest state-of-the-art research tool fails to recover nearly all complex data structures and scales to under 50% of contracts.) Much of the complication is that the main on-chain data structures (mappings and arrays) have their locations derived dynamically through code execution. We propose sophisticated static analysis techniques to solve the identification of on-chain data structures with extremely high fidelity and completeness. Our analysis scales nearly universally and recovers deep data structures. Our techniques are able to identify the exact types of data structures with 98.6% precision and at least 92.6% recall, compared to a state-of-the-art tool managing 80.8% and 68.2% respectively. Strikingly, the analysis is often more complete than the storage description that the compiler itself produces, with full access to the source code.
With the rapid development of blockchain technology, P2P networks are facing increasing security threats, among which Eclipse attacks, as a type of network isolation attack, have seriously affected the normal operation of the network and the integrity of data. To address this challenge, this study implements node authentication and dynamic reputation evaluation by leveraging a dynamic hash computation mechanism that integrates challenge strings, node identifiers, and the latest active time, ensuring the uniqueness of node identities and the authenticity of operations. Based on a dynamic hash chain behavior evaluation mechanism, node behaviors are quantified across three dimensions: integrity, consistency, and temporal consistency, enabling precise identification of anomalous nodes. Furthermore, a network prevention repository framework is proposed, which dynamically adjusts the trust index of nodes by combining historical behavior with real-time data, effectively detecting and defending against stealthy Eclipse attacks. In addition, extensive testing on both Bitcoin and Ethereum platforms has shown that the method proposed in this study not only can effectively coexist on these two platforms, but also significantly improves the security and stability of the network, effectively reducing the occurrence of Eclipse attacks.
In recent years, the Ethereum platform has witnessed a proliferation of smart contracts, accompanied by exponential growth in total value locked (TVL). High-TVL smart contracts often require complex numerical computations, particularly in mathematical financial models used by many decentralized applications (DApps). Improper calculations can introduce numerical defects, posing potential security risks. Existing research primarily focuses on traditional numerical defects like integer overflow, and there is currently a lack of systematic research and effective detection methods targeting new types of numerical defects. In this paper, we identify five new types of numerical defects through the analysis of 1,199 audit reports by utilizing the open card method. Each defect is defined and illustrated with a code example to highlight its features and potential consequences. We also propose NumScout, a symbolic execution-based tool designed to detect these five defects. Specifically, the tool combines information from source code and bytecode, analyzing key operations such as comparisons and transfers, to effectively locate defects and report them based on predefined detection patterns. Furthermore, NumScout uses a large language model (LLM) to prune functions which are unrelated to numerical operations. This step allows symbolic execution to quickly enter the target function and improve runtime speed by 28.4%. We run NumScout on 6,617 real-world contracts and evaluated its performance based on manually labeled results. We find that 1,774 contracts contained at least one of the five defects, and the tool achieved an overall precision of 89.7%.
K. Praveen Kumar, B. Pruthviraj, K. S. Reddy, S Sushruth · 6 authors
Fake certificates have always been a menace in sectors such as education, professional affiliations, and in legal documents. However, there are so many drive-in graduation certificates because the anti-forging measures are not sound. Universities provide educational certificates, which are essential documents. A blockchain based digital certificate system is presented to eradicating counterfeit certificates. Blockchain is a distributed ledger technology that revolutionized certificate verification, authentication, and fraud prevention with the advent of blockchain-based digital certificates. The innate features of blockchain technology such as immutability, transparency and decentralization enable storing of the digital certificate data on a ledger of blockchain. Each certificate is represented as a separate token on the blockchain, making sure that it is real. The design takes care of both the issues: the decentralized nature helps reduce breaches and unauthorized access to data, while the cryptographic nature ensures that data is encrypted. In this paper, we define the implementation of validations for a blockchain based digital certificates. The methodology provides hash value using SHA-256 and then it compares hash value with blockchain hash. Our approach is leans on smart contracts and our own encryption method to construct a blockchain based scoped credit validation system.
Decentralized smart contracts enable trustless collaboration but suffer from limited privacy and scalability, which hinders broader adoption. Trusted Execution Environment (TEE) based off-chain execution frameworks offer a promising solution to both issues. Although TEE-based frameworks have made significant progress, prior work has yet to fully explore contract interoperability, a critical foundation for building complex real-world decentralized applications. This paper identifies the key challenges impeding such interoperability and presents practical solutions. Based on these insights, we introduce RaceTEE, a novel framework that leverages off-chain TEE-enabled nodes to efficiently execute confidential, long-lived smart contracts with interactions of arbitrary complexity among contracts. We implement a RaceTEE prototype using Intel SGX, integrate it with Ethereum, and release it as open source. Evaluation across diverse use cases demonstrates its practicality and effectiveness.
The Zero Trust (ZT) model is pivotal in enhancing the security of distributed systems by emphasizing rigorous identity verification, granular access control (AC), and continuous monitoring. To address the complexity and scalability challenges of modern distributed systems, we propose a blockchain-based dynamic access control scheme (DACS) as a practical solution for implementing ZT principles. This framework dynamically manages access control lists (ACLs) and enforces policies through smart contracts. In the DACS framework, each blockchain node maintains an object list specifying access permissions within its ACL and incorporates a minimum trust metric (TM) threshold to evaluate access requests. The TM assigned to each node reflects its trustworthiness. To further enhance security, the framework includes security awareness, enabling the dynamic assessment of the risk factor (RF), which reflects the operational risk level. The TM of access-requesting nodes is updated at runtime based on their behavior, with penalties imposed for malicious actions according to the prevailing RF. Access control policies are dynamically adjusted, mitigating risks posed by potentially untrustworthy users with valid credentials. Implemented and tested on the Ethereum blockchain, the proposed DACS framework demonstrates its efficiency and effectiveness in securing distributed systems.
In the realm of smart contract security, smart contracts can be instrumented with simple safety properties to enhance their security. However, these instrumentable safety properties are limited and fail to block certain types of hacks. This limitation primarily stems from the Ethereum Virtual Machine’s (EVM) inability to allow a smart contract to access the complete transaction trace in real-time. On the other hand, transaction malice detection methods can leverage properties of complete transaction traces to identify hacks with high accuracy. To bridge this gap, we propose modifications to both the EVM and Ethereum clients, enabling smart contracts to access the complete transaction trace and define and validate complex transaction trace properties in real-time without affecting traditional EVM execution. We use past-time linear temporal logic (PLTL) to express transaction trace properties, showcasing that most existing detection metrics can be expressed using PLTL.