Blockchain Papers

Zhenzhou Tian, Fanfan Wang, Yanping Chen, Lingwei Chen

No abstract is available for this record.

Lokendra Vishwakarma, Amritesh Kumar, Jeevan Madugunda, Debasis Das

Finance is the backbone of any organization or government. The government's financial health relies heavily on managing its FinTech applications. In the current FinTech system, user financial information is stored centrally. In the centralized system, the information security risks are high. Thus, a decentralized system is required for better security, trust and safety management in the FinTech information system. Blockchain is a decentralized technology that can solve the issues of traditional FinTech applications like banking. In the blockchain, consensus protocols are responsible for maintaining a consistent copy of the blockchain at each node of the blockchain network. However, these protocols are not suitable for regular currency transactions due to high latency and low throughput. Therefore, to achieve reliability, low latency, and high throughput, we have introduced a new protocol called FinBlock. In FinBlock, the pipeline concept is introduced in blockchain to increase the transaction throughput. Additionally, the number of message broadcasts is also reduced, which further improves the latency. Moreover, FinBlock achieves a speedup of 3 with respect to traditional practical byzantine fault tolerance (PBFT) consensus protocol. The result showed that FinBlock achieved better transaction processing time, transaction throughput, and message count than the traditional PBFT, even with hundreds of nodes in the network with reduced message complexity.

Maneesha Gunathilaka, Sandareka Wickramanayake, H. M. N. Dilum Bandara

No abstract is available for this record.

Che Wang, Yue Li, Jianbo Gao, Ke Wang · 7 authors

The open-source nature of smart contracts provides the facility for developers to clone contracts and introduces the risk of vulnerability proliferation as well. Despite intensive research on smart contract clone detection in recent years, existing techniques are still unsatisfactory in detecting Solana smart contracts. To fill this gap, in this paper, we designed a clone detection tool SolaSim for Solana smart contracts and conducted an empirical study to understand the code reuse in the Solana ecosystem. Specifically, SolaSim is based on the semantic metadata extractor and the similarity checker. For each contract, the semantic metadata extractor generates an instruction-level weighted Attributed Control Flow Graph (ACFG) and its semantic metadata (i.e., a combination of high-level semantic and structure information) based on Rust Mid-level Intermediate Representation. The similarity checker adopts a combinatorial optimization algorithm to compute the statistical similarity of a pair of contracts. The evaluation results demonstrated the effectiveness of SolaSim in identifying clones with 94.3% accuracy and it can identify up to Type-3 clone level. Notably, we found there are over 50% clone ratios in the Solana smart contracts ecosystem, in which most of them are cloned from famous open-sourced projects.

Yuan Huang, Xiaoyuan Wu, Quanqi Wang, Z. Qian · 7 authors

Although smart contracts are immutable once they are deployed, the reality is that they need upgrades to fix bugs or add new features. Nowadays, there are a few upgrade methods in Ethereum, some of which can change the contract without changing the contract address that users interact with. This upgrade way increases potential danger and results in users' distrust, because it may secretly change the function of the contract and cause users financial loss. We examine two of these upgrade methods, i.e., proxy pattern and metamorphic contract. For the proxy pattern, we propose a bytecode-based method for detecting these upgradeable contracts, which achieves a 99.37% F1-score. We use the bytecode-based method to detect the contracts in the first 12 million blocks of Ethereum and find 126,500 upgradeable contracts. For the metamorphic contracts, we employ an Ethereum replay tool to replay the transactions and find the metamorphic contracts according to the SELFDESTRUCT and CREATE2 instructions. We find that 64.3% of the contracts upgraded using this way are malicious MEV bots. Finally, we summarize the reasons for smart contract upgrades and make development recommendations.

Yepeng Ding, Arthur Gervais, Roger Wattenhofer, Hiroyuki Satō

Decentralized finance (DeFi) is revolutionizing the traditional centralized finance paradigm with its attractive features such as high availability, transparency, and tamper-proofing. However, attacks targeting DeFi services have severely damaged the DeFi market, as evidenced by our investigation of 80 real-world DeFi incidents from 2017 to 2022. Existing methods, based on symbolic execution, model checking, semantic analysis, and fuzzing, fall short in identifying the most DeFi vulnerability types. To address the deficiency, we propose Context-Sensitive Concolic Verification (CSCV), a method of automating the DeFi vulnerability finding based on user-defined properties formulated in temporal logic. CSCV builds and optimizes contexts to guide verification processes that dynamically construct context-carrying transition systems in tandem with concolic executions. Furthermore, we demonstrate the effectiveness of CSCV through experiments on real-world DeFi services and qualitative comparison. The experiment results show that our CSCV prototype successfully detects 76.25% of the vulnerabilities from the investigated incidents with an average time of 253.06 seconds.

Rijnard van Tonder

Smart contract development presents additional challenges beyond traditional software workflows, e.g., locally in IDEs. For smart contract developers to understand and trust code execution, they need to write and use software libraries with a comprehensible code representation---i.e., source code. However, blockchains do not typically store the original source code of smart contracts, but a condensed bytecode representation. Thus, when developers consult smart contract source code, they need to be sure that it corresponds to the same bytecode on the blockchain. Depending on available developer tools, this process can be ad-hoc, cumbersome, or opaque. In this paper we present our design and implementation of a new tool that serves to verify Move smart contract source code against its bytecode representation on the Sui blockchain. We demonstrate the user-facing shift where developers now benefit from seeing source code in their browser instead of bytecode. We further highlight future features and research directions that verified source availability brings to smart contract developer experience.

Long He, Xiangfu Zhao, Yichen Wang

Symbolic execution is a frequently used method for vulnerability detection in smart contracts. However, existing tools face limitations with the constraint solving and may cause the "path explosion" problem. This costs too much time and may lead to False-Negative (FN) of detection results. In this work, we propose ParSE, a novel approach that leverages Parallel and Simplified symbolic Execution to improve both detection efficiency and the number of True-Positive (TP). We inject ParSE into two widely used symbolic execution tools, Oyente and Mythril, for detecting vulnerabilities in smart contracts. Experimental results show that ParSE accelerates to 9.33x and 5.30x for Oyente and Mythril, respectively. Moreover, tools based on ParSE improve the detection number of TP.

Pedro Delgado‐Pérez, Ignacio Meléndez‐Lapi, Juan Boubeta-­Puig

Abstract Smart contracts (SC) are programs embodying certain business logic stored on a blockchain network like Ethereum. The execution of transactions on SC has a cost, measured in gas units, that depends on the low‐level operations performed. Therefore, a poor choice of high‐level language constructs could lead to overcharging users for their transactions. Thus, a testing process focused on possible deviations of the gas used in diverse scenarios could provide substantial global savings. This paper presents a gas‐centered mutation testing approach for taking care of the gas consumed by Solidity SCs. This approach can be useful to improve the test quality to detect gas‐related problems, reason about performance issues that only manifest in certain situations, and identify alternative more optimal implementations. We define and implement several mutation operators specifically designed to perturb gas consumption while preserving contract semantics in general. Our experiments using several real‐world SCs show the feasibility of the technique, with some mutants reproducing meaningful differences in the consumption and exposing some gas limits not tight enough in historic transactions. Therefore, our approach is shown to be a good ally to prevent the appearance of gas‐related issues and lays the groundwork for researchers seeking to improve performance testing practices.

Zhijie Zhong, Zibin Zheng, Hong‐Ning Dai, Qing Xue · 6 authors

As an essential component in Ethereum and other blockchains, token assets have been interacted with by diverse smart contracts. Effective permission policies of smart contracts must prevent token assets from being manipulated by unauthorized adversaries. Recent efforts have studied the accessibility of privileged functions or state variables to unauthorized users. However, little attention is paid to how publicly accessible functions of smart contracts can be manipulated by adversaries to steal users' digital assets. This attack is mainly caused by the permission re-delegation (PRD) vulnerability. In this work, we propose PrettySmart, a bytecode-level Permission re-delegation vulnerability detector for Smart contracts. Our study begins with an empirical study on 0.43 million open-source smart contracts, revealing that five types of widely-used permission constraints dominate 98% of the studied contracts. Accordingly, we propose a mechanism to infer these permission constraints, as well as an algorithm to identify constraints that can be bypassed by unauthorized adversaries. Based on the identification of permission constraints, we propose to detect whether adversaries could manipulate the privileged token management functionalities of smart contracts. The experimental results on real-world datasets demonstrate the effectiveness of the proposed PrettySmart, which achieves the highest precision score and detects 118 new PRD vulnerabilities.

Umamaheswari Rajasekaran, A. Malini, Vandana Sharma

With the rise of social media and high technology utilisation by different age groups, the digital structure arrangement has also changed from being simple node links to the interconnected complex networks. A digital mesh has been introduced with multiple consumers, interconnected webs, cloud storage, ubiquitous applications, and large data sets. These vast sets of networks can be connected to billions of things from devices to sensors and people to autonomous agents as per the requirements providing various services and information. Blockchain technology has automated payments by encouraging cryptocurrencies and introducing a shared and distributed ledger where data, logs, and transactions can be held in a decentralised manner with a more trusted and secure platform. This paper briefs the basic idea that digital mesh is leading the technology rise and how various applications, devices, services, and objects integrate artificial intelligence in them to automate and process the traditional human activities. Further, an overview of some basic features of blockchain is presented along with benefits of its integration with artificial intelligence.

Tudor Andreica, Adrian Musuroi, Alfred Anistoroaei, Camil Jichici · 5 authors

The development of Intrusion Detection Systems (IDS) for in-vehicle buses has gained a lot of momentum in recent years as the number of reported vulnerabilities and the degree of interconnectivity for modern vehicles are on the rise. Since intrusion detection is resource consuming, it can be performed on computationally capable Android head units that are now present inside vehicles. Moreover, these units are connected to the internet, which enables the use of more complex algorithms that run in cloud environments. In this work we develop one such approach: an IDS that consists of a locally installed copy, running on head units, and a centralized instance of it that runs in the cloud and monitors traffic for groups of similar vehicles. Additionally, the centralized instance is part of a cloud service for intrusion detection which is continuously updated with the most recent types of attacks. The classification results of the cloud-based service are further analyzed by an incident response team which confirms the presence of known attacks, analyzes new types of attacks and assesses their impact. The output of this activity is stored on the Blockchain as ISO/SAE 21434 compliant reports, ensuring the transparency and traceability of the reported incidents.

Sujin Han, Jungwon Kim, Sung-Ju Lee, Insu Yun

Decentralized Finance (DeFi) enables many novel applications that were impossible in traditional finances. However, it also introduces new types of vulnerabilities. An example of such vulnerabilities is a composability bug between token contracts and Decentralized Exchange (DEX) that follows the Constant Product Market Maker (CPMM) model. This type of bug, which we refer to as CPMM composability bug, originates from issues in token contracts that make them incompatible with CPMMs, thereby endangering other tokens within the CPMM ecosystem. Since 2022, 23 exploits of such kind have resulted in a total loss of 2.2M USD. BlockSec, a smart contract auditing company, reported that 138 exploits of such kind occurred just in February 2023. In this paper, we propose CPMMX , a tool that automatically detects CPMM composability bugs across entire blockchains. To achieve such scalability, we first formalized CPMM composability bugs and found that these bugs can be induced by breaking two safety invariants. Based on this finding, we designed CPMMX equipped with a two-step approach, called shallow-then-deep search. In more detail, it first uses shallow search to find transactions that break the invariants. Then, it uses deep search to refine these transactions, making them profitable for the attacker. We evaluated CPMMX against five baselines on two public datasets and one synthetic dataset. In our evaluation, CPMMX detected 2.5x to 1.5x more vulnerabilities compared to baseline methods. It also analyzed contracts significantly faster, achieving higher F1 scores than the baselines. Additionally, we applied CPMMX to all contracts on the latest blocks of the Ethereum and Binance networks and discovered 26 new exploits that can result in 15.7K USD profit in total.

Biagio Boi, Christian Esposito, Jung Taek Seo

Hardware-based solutions are becoming more and more popular as a result of the increased need for practical and safe authentication methods. However, one of the key challenges in these systems is the lack of a robust mechanism to revoke compromised credentials effectively. The Ethereum Attestation Service (EAS), which uses the blockchain-based Ethereum platform to create a decentralized, tamper-resistant infrastructure for credential attestation and revocation, is presented in this article as a novel solution to this critical issue. By combining the transparency and immutability of blockchain technology with smart contracts and cryptographic techniques, the EAS enables secure and auditable management of certificates. The conducted study investigates the limitations of existing revocation methods of password-less mechanisms and proposes the EAS as a viable alternative. In the design phase, the paper demonstrates the system's efficiency in handling attestation requests, verifying attestations, and securely managing revocations. EAS excels in providing reliable revocation, thereby reducing the risks associated with compromised hardware-based passwordless systems. Moreover, this research explores the benefits of EAS-based revocation within the IoT context, where Physically Unclonable Functions (PUFs) face similar challenges as HSMs. Experimental results, obtained in a testnet environment, reveal reduced authentication times, making this solution suitable for real-time scenarios as well.

Anıl Elakaş, Hasan Sözer, Ilgın Şafak, Kübra Kalkan

Abstract The purpose of this study is to identify and classify studies published on software testing techniques applied to blockchain systems. Previously published reviews in related areas have a narrow focus and/or do not follow a systematic review protocol. We conducted a systematic mapping based on an initial selection of 1025 studies. A rigorous selection process resulted in a final pool of 17 primary studies. These studies are categorized with respect to the employed testing methods, considered quality attributes, and functionality. We observe that most of the publications focus on testing functional correctness or security, whereas the testing of runtime performance attracts less attention. Existing approaches mostly employ fuzz testing or mutation testing. Search-based testing is usually combined with these techniques. The application of model-based testing is rare. The adaptability of fuzz testing and model-based testing techniques to changing blockchain platforms and languages remains a concern. On the other hand, performance and scalability issues are noted for search-based techniques and mutation testing. The use and integration of multiple testing techniques also stand out as a viable research direction.

Hiroki Watanabe, Kohei Ichihara, Takumi Aita

The blockchain ecosystem, particularly with the rise of Web3 and Non-Fungible Tokens (NFTs), has experienced a significant increase in users and applications. However, this expansion is challenged by the need to connect early adopters with a wider user base. A notable difficulty in this process is the complex interfaces of blockchain wallets, which can be daunting for those familiar with traditional payment methods. To address this issue, the category of "embedded wallets" has emerged as a promising solution. These wallets are seamlessly integrated into the front-end of decentralized applications (Dapps), simplifying the onboarding process for users and making access more widely available. However, our insights indicate that this simplification introduces a trade-off between ease of use and security. Embedded wallets lack transparency and auditability, leading to obscured transactions by the front end and a pronounced risk of fraud and phishing attacks. This paper proposes a new protocol to enhance the security of embedded wallets. Our VELLET protocol introduces a wallet verifier that can match the audit trail of embedded wallets on smart contracts, incorporating a process to verify authenticity and integrity. In the implementation architecture of the VELLET protocol, we suggest using the Text Record feature of the Ethereum Name Service (ENS), known as a decentralized domain name service, to serve as a repository for managing the audit trails of smart contracts. This approach has been demonstrated to reduce the necessity for new smart contract development and operational costs, proving cost-effective through a proof-of-concept. This protocol is a vital step in reducing security risks associated with embedded wallets, ensuring their convenience does not undermine user security and trust.

Archana B, Adithya Baragi S, K. N. Anusha, Jeevan Basri B S · 5 authors

Evidence management is crucial in the field of forensic science. Evidence obtained from a crime scene is important in solving the case and delivering justice to the victim involved. Hence, protecting the integrity of the evidence throughout the process is of prime importance. Chain of Custody (CoC) is the process which maintains the integrity of the evidence using Blockchain Technology. Inability to maintain the chain of custody will make the evidence inadmissible in court, eventually leading to the case dismissal. Digitalization of forensic evidence management system is a need of time as it is an environment friendly model. Blockchain are digitally distributed ledgers of transactions signed cryptographically in chronological order that are sorted into blocks and is completely open to anyone in the blockchain network. Present study aims to create a framework and further propose an algorithm to implement blockchain technology to digitalize forensic evidence management system and maintain Chain of Custody

Prof. MSR Prasad

The rapid proliferation of AI-generated “deepfake” images, audio, and video is eroding public trust in digital media and amplifying risks to elections, markets, journalism, and personal safety. While AI detection models have improved, they face an adversarial “cat-and-mouse” problem and often struggle to generalize across manipulation methods and compression regimes. This manuscript proposes and analyzes a hybrid, end-to-end approach that couples upstream provenance and authenticity signals—anchored via open standards (e.g., C2PA Content Credentials) and decentralized ledgers—with downstream AI detection and moderation. The pipeline captures and signs media at source; binds verifiable, tamper-evident metadata; anchors cryptographic hashes on a public or consortium blockchain; stores originals off-chain with content addressing (e.g., IPFS/Filecoin); and fuses these trust signals with model-based detectors and policy engines at distribution edges. We situate the proposal within current regulation (e.g., EU AI Act transparency duties) and state-of-the-art methods (e.g., watermarking such as SynthID, Stable Signature, and Tree-Ring; deepfake detectors trained on DFDC and FaceForensics++), highlighting both strengths and known attack vectors against watermarking that motivate layered defenses. A simulation-based evaluation illustrates that combining provenance signals with video-level transformer detectors can raise F1 from 0.85 to 0.92 while cutting false positives by ~41% in a balanced test set, primarily by rejecting credential-mismatched or hash-divergent media before expensive model inference. We further discuss privacy-preserving verification using W3C Verifiable Credentials (VC 2.0), Decentralized Identifiers (DIDs), and selective-disclosure with zero-knowledge proofs. The findings make a practical case for “trust by design” built on open standards, decentralized integrity proofs, and robust AI detection, implemented as a policy-aware defense-in-depth stack for platforms and newsrooms.

Pengcheng Xia, Yanhui Guo, Zhaowen Lin, Jun Wu · 11 authors

Cryptocurrency wallets, acting as fundamental infrastructure to the blockchain ecosystem, have seen significant user growth, particularly among browser-based wallets (i.e., browser extensions). However, this expansion accompanies security challenges, making these wallets prime targets for malicious activities. Despite a substantial user base, there is not only a significant gap in comprehensive security analysis but also a pressing need for specialized tools that can aid developers in reducing vulnerabilities during the development process. To fill the void, we present a comprehensive security analysis of browser-based wallets in this paper, along with the development of an automated tool designed for this purpose. We first compile a taxonomy of security vulnerabilities resident in cryptocurrency wallets by harvesting historical security reports. Based on this, we design WALLETRADAR, an automated detection framework that can accurately identify security issues based on static and dynamic analysis. Evaluation of 96 popular browser-based wallets shows WALLETRADAR's effectiveness, by successfully automating the detection process in 90% of these wallets with high precision. This evaluation has led to the discovery of 116 security vulnerabilities corresponding to 70 wallets. By the time of this paper, we have received confirmations of 10 vulnerabilities from 8 wallet developers, with over $2,000 bug bounties. Further, we observed that 12 wallet developers have silently fixed 16 vulnerabilities after our disclosure. WALLETRADAR can effectively automate the identification of security risks in cryptocurrency wallets, thereby enhancing software development quality and safety in the blockchain ecosystem.

Iuon‐Chang Lin, Pai-Ching Tseng, Pin-Hsiang Chen, Shean-Juinn Chiou

: In the realm of data management, data preservation stands as a critical undertaking aimed at preserving and upholding the integrity of data. Regardless of whether it concerns personal or enterprise data, the detrimental effects of malicious alterations implemented by attackers cannot be overlooked. Particularly in conventional industrial control environments, the prevalent practice involves the transmission of data from sensors to databases for storage purposes. However, it is essential to recognize that this process exposes the data to various vulnerabilities. Thus, to ensure the long-term security and reliability of the data, it becomes imperative to implement robust data preservation strategies within these industrial control systems. However, the reliance of these databases on physical hard disks introduces inherent vulnerabilities, including the potential for data loss due to disk damage or targeted malicious attacks. Consequently, it becomes imperative to prioritize the implementation of robust data preservation measures. These measures are crucial in mitigating the risk of disruptions and protecting critical data from compromise. By establishing effective data backup systems, employing advanced security protocols, and implementing proactive monitoring mechanisms, organizations can bolster their data preservation capabilities and safeguard against potential threats to data integrity and availability. As a result, many enterprises opt to store their data with third-party providers to ensure data integrity. However, this approach carries inherent risks. If the third-party service experiences an attack or if the data is tampered with, it becomes challenging to verify the integrity of the data. To address these concerns and ensure data preservation within the context of the Internet of Things (IoT), a growing number of individuals are integrating IoT with Distributed Ledger Technology (DLT). By leveraging DLT, the integrity of data can be ensured, reducing reliance on centralized third-party storage and enhancing security in the IoT ecosystem. In this article, IOTA is the DLT, which employs Directed Acyclic Graph (DAG) to store transaction information. Compared to Ethereum or other blockchain technologies, IOTA offers notable advantages in terms of transaction verification speed, making it highly suitable for real-time IoT environments. However, the conventional transmission path from sensors to IOTA nodes entails a complex route, involving multiple hardware devices before reaching the intended destination. This complexity poses challenges in ensuring data integrity during transmission and introduces vulnerabilities such as man-in-the-middle attacks or SQL injection attacks. To address these issues, we propose a method to streamline the transmission path between sensors and IOTA, specifically tailored for industrial fields with numerous IoT devices. Our approach involves preprocessing the data stored on the server using our method before uploading, ensuring data confidentiality, and leveraging IOTA to guarantee data integrity. To achieve the shortest path between IoT and DLT nodes, it becomes necessary to establish IOTA nodes on lower-level devices, such as Raspberry Pi or IoT controllers. By simplifying the transmission path, we can reduce the potential for tampering and enhance overall data security. Implementing our proposed method enables the assurance of data confidentiality and integrity during both transmission and storage on the server, strengthening the trustworthiness of the IoT, and IOTA integration.

Wei Peng, Xiang Li, Jianyu Niu, Xiaokuan Zhang · 5 authors

Public cloud platforms have employed Trusted Execution Environment (TEE) technology to provide confidential computing services. However, applications running on cloud TEEs are susceptible to rollback or forking attacks. Their states can be rolled back to an outdated version or split into multiple conflicting versions, violating state continuity. Existing solutions against these attacks either rely on centralized trust assumption (e.g., trusted server) or have limited performance (e.g., tens of state updates per second). In this paper, we introduce Narrator-Pro (an upgrade to the original Narrator), a secure and practical distributed system that utilizes blockchain technology and TEEs to provide high-performance state continuity protection for TEE applications in the cloud. Specifically, we use the blockchain to initialize the system, which lays down the decentralized trust base with minimal interaction overhead. Meanwhile, we leverage the distributed system composed of TEEs to provide fast and unlimited state updates. We have implemented a proof-of-concept of Narrator-Pro in Intel SGX and conducted extensive evaluations in both the WAN and the LAN. Our results show that in a LAN environment with 5 nodes, Narrator-Pro can support around 8k state updates per second with a latency of 3.58ms. This performance is 30x higher than ROTE and 70× higher than using a TPM counter.

Pooja Kumari, Ankit Kumar Jain, Arpit Seth, Raghav

No abstract is available for this record.

Qiang Han, Lu Wang, Haoyu Zhang, Leyi Shi · 5 authors

No abstract is available for this record.

Haiyue Chen, Xiangfu Zhao, Yichen Wang, Zixian Zhen

Abstract Ethereum smart contracts are a special type of computer programs. Once deployed on the blockchain, they cannot be modified. This presents a significant challenge to the security of smart contracts. Previous research has proposed static and dynamic detection tools to identify vulnerabilities in smart contracts. These tools check contract vulnerabilities based on predefined rules, and the accuracy of detection strongly depends on the design of the rules. However, the constant emergence of new vulnerability types and strategies for vulnerability protection leads to numerous false positives and false negatives by tools. To address this problem, we analyze the characteristics of vulnerabilities in smart contracts and the corresponding protection strategies. We convert the contracts' bytecode into an intermediate representation to extract semantic information of the contracts. Based on this semantic information, we establish a set of detection rules based on semantic facts and implement a vulnerability detection tool SafeCheck using static program analysis methods. The tool is used to detect six common types of vulnerabilities in smart contracts. We have extensively evaluated SafeCheck on real Ethereum smart contracts and compared it to other tools. The experimental results show that SafeCheck performs better in smart contract vulnerability detection compared to other typical tools, with a high F‐measure (up to 83.1%) for its entire dataset.