With the increasing popularity of cryptocurrencies and blockchain technologies, smart contracts have become a prominent feature in developing decentralized applications. However, these smart contracts are susceptible to vulnerabilities that hackers can exploit, resulting in significant financial losses. In response to this growing concern, various initiatives have emerged. Notably, the Smart Contract Weakness Classification (SWC) list plays an important role in raising awareness and understanding of smart contract weaknesses. However, the SWC list lacks maintenance and has not been updated with new vulnerabilities since 2020. To address this gap, this paper introduces the Smart Contract Weakness Enumeration (SWE), a comprehensive and practical vulnerability list up until 2023. We collect 273 vulnerability descriptions from 86 top conference papers and journal papers, employing the open card-sorting method to deduplicate and categorize these descriptions. This process results in the identification of 40 common contract weaknesses, which are further classified into 20 sub-research fields through thorough discussion and analysis. The SWE provides a systematic and comprehensive list of smart contract vulnerabilities, covering existing and emerging vulnerabilities in the last few years. Moreover, the SWE is a scalable and continuously iterative program. We propose two update mechanisms for the maintenance of the SWE. Regular updates involve the inclusion of new vulnerabilities from future top papers, while irregular updates enable individuals to report new weaknesses for review and potential addition to the SWE.
M. L. Dhore, Soham Ratnaparkhi, Rohan Sasne, Om Surase · 5 authors
Social media has revolutionized global communication, business contracts, and the diffusion of ideas. However, there are several potential drawbacks to this, including the spread of false information, data breaches, identity fraud, effective content monitoring, and digital piracy. Using blockchain protocols and Web3 philosophies, it is possible to protect data privacy, data security, and fraudulent identities. By replacing traditional email/name-password authentication with Metamask authentication, user privacy is strengthened. Storing application media on the Ethereum blockchain, a proof-of-concept for application data can be established, thereby preventing data breaches. According to our research results, blockchain technology has the potential to provide tamper resistance, traceability, and transparency. As a result, this proposed research provides a social media platform that is truly decentralized and built on a network, enhancing its users' privacy.
Tiffany Tien Nee Pragasam, John V. Thomas, V. Maria Anu, Subhashini Radhakrishnan
Cryptocurrencies are rapidly growing and are increasingly accepted by major commercial vendors. However, along with their rising popularity, they have also become the go-to currency for illicit activities driven by the anonymity they provide. Cryptocurrencies such as the one on the Ethereum blockchain provide a way for entities to hide their real-world identities behind pseudonyms, also known as addresses. Hence, the purpose of this work is to uncover the level of anonymity in Ethereum by investigating multiclass classification models for Externally Owned Accounts (EOAs) of Ethereum. The researchers aim to achieve this by examining patterns of transaction activity associated with these addresses. Using a labelled Ethereum address dataset from Kaggle and the Ethereum crypto dataset by Google BigQuery, an address profiles dataset was compiled based on the transaction history of the addresses. The compiled dataset, consisting of 4371 samples, was used to tune and evaluate the Random Forest, Gradient Boosting and XGBoost classifier for predicting the category of the addresses. The best-performing model found for the problem was the XGBoost classifier, achieving an accuracy of 75.3% with a macro-averaged F1-Score of 0.689. Following closely was the Random Forest classifier, with an accuracy of 73.7% and a macro-averaged F1-Score of 0.641. Gradient Boosting came in last with 73% accuracy and a macro-averaged F1-Score of 0.659. Owing to the data limitations in this study, the overall scores of the best model were weaker in comparison to similar research, with the exception of precision, which scored slightly higher. Nevertheless, the results proved that it is possible to predict the category of an Ethereum wallet address such as Phish/Hack, Scamming, Exchange and ICO wallets based on its transaction behaviour.
Fake products are items that are marketed and sold as genuine, high-quality products but are counterfeit or low-quality knockoffs. These products are often designed to closely mimic the appearance and branding of the genuine product to deceive consumers into thinking they are purchasing the real thing. Fake products can range from clothing and accessories to electronics and other goods and can be found in a variety of settings, including online marketplaces and brick-and-mortar stores. Blockchain technology can be used to help detect fake products in a few different ways. One of the most common ways is through the use of smart contracts, which are self-executing contracts with the terms of the agreement between buyer and seller being directly written into lines of code. This allows for a high level of transparency and traceability in supply chain transactions, making it easier to identify and prevent the sale of fake products and the use of unique product identifiers, such as serial numbers or QR codes, that are recorded on the blockchain. This allows consumers to easily verify the authenticity of a product by scanning the code and checking it against the information recorded on the blockchain. In this study, we will use smart contracts to detect fake products and will evaluate based on Gas cost and ethers used for each implementation.
Along with the rapid technological and commercial innovation on the e-commerce platforms, there are an increasing number of frauds that bring great harm to these platforms. Many frauds are conducted by organized groups of fraudsters for higher efficiency and lower costs, which are also known as group-based frauds. Despite the high concealment and strong destructiveness of group-based fraud, there is no existing research work that can thoroughly exploit the information within the transaction networks of e-commerce platforms for group-based fraud detection. In this work, we analyze and summarize the characteristics of group-based frauds, based on which we propose a novel end-to-end semi-supervised Group-based Fraud Detection Network (GFDN) to support such fraud detection in real-world applications. Experimental results on large-scale e-commerce datasets from Taobao and Bitcoin trading datasets show the superior effectiveness and efficiency of our proposed model for group-based fraud detection on bipartite graphs.
Security in the blockchain has become a topic of concern because of the recent developments in the field. One of the most common cyberattacks is the so-called phishing attack, wherein the attacker tricks the miner into adding a malicious block to the chain under genuine conditions to avoid detection and potentially destroy the entire blockchain. The current attempts at detection include the consensus protocol; however, it fails when a genuine miner tries to add a new block to the blockchain. Zero-trust policies have started making the rounds in the field as they ensure the complete detection of phishing attempts; however, they are still in the process of deployment, which may take a significant amount of time. A more accurate measure of phishing detection involves machine-learning models that use specific features to automate the entire process of classifying an attempt as either a phishing attempt or a safe attempt. This paper highlights several models that may give safe results and help eradicate blockchain phishing attempts.
Blockchain establishes security and trust in mobile ad hoc networks (MANETs). Due to the decentralized and opportunistic communication characteristics of MANETs, hashgraph consensus is more applicable to the MANET-based blockchain. Sharding scales the consensus further through disjoint nodes in multiple shards simultaneously updating ledgers. However, the dynamic addition and deletion of nodes in a shard pose challenges regarding robustness and efficiency. Particularly, the shard is vulnerable to Sybil attacks and targeted attacks, and dishonest gossip reduces the efficiency of hashgraph consensus. Therefore, we proposed a behavior-based sharding hashgraph scheme. First, dishonest behaviors of nodes are recorded in a decentralized blacklist. Gossip information is sent to a reliable neighbor, and gossip information from another reliable neighbor is received. Second, a tree-assisted inter-sharding consensus is proposed to prevent Sybil attacks. The combination of shard recovery and reconfiguration based on node state is devised to prevent targeted attacks. Finally, we conducted the performance evaluation including security analysis and experimental evaluation to reveal the security and efficiency of the proposed scheme.
Ruochen Fang, Xinghua Sun, Jiyun Qiu, Jingjing Liu
Blockchain, as a type of distributed ledger technology, is well-suited for the distribution, sharing, certification, and tracing of information. Therefore, DApps implemented on blockchain have been utilized in various industries, where businesses utilize DApps to achieve reliable information flow and certification across enterprises or within an enterprise. However, DApps are limited by the constraints of the blockchain architecture, which results in issues such as poor performance, limited scalability, difficult maintenance and management, and high development costs. As a result, it is difficult for DApps to replace traditional database models in enterprises. In order to address this issue, we conducted an analysis of the shortcomings of DApps and proposed a novel blockchain service framework based on ordered Hash tree architecture, which provides a consistent and reliable solution for data management in DApps. Our work, through analysis, is capable of resolving or improving the challenges faced by DApps and holds practical applications value.
M. K. Ghosh, Dyuti Ghosh, Raju Halder, Joydeep Chandra
The recent surge of Ethereum in prominence has made it an attractive target for various kinds of crypto-crime. Phishing scams, for example, are an increasingly prevalent cybercrime in which malicious users attempt to steal funds from a user's crypto wallet. This research investigates the effects of network architectural features as well as the temporal aspects of user activities on the performance of detecting phishing users on the Ethereum transaction network. We employ traditional machine learning algorithms to evaluate our model on real-world Ethereum transaction data. The experimental results demonstrate that our proposed features identify phishing accounts efficiently and outperform the baseline models by 4% in Recall, and 5% in F1-score.
Community detection is widely used in social networks to uncover groups of related vertices (nodes). In cryptocurrency transaction networks, community detection can help identify users that are most related to known illegal users. However, there are challenges in applying community detection in cryptocurrency transaction networks: (1) the use of pseudonymous addresses that are not directly linked to personal information make it difficult to interpret the detected communities; (2) on Bitcoin, a user usually owns multiple Bitcoin addresses, and nodes in transaction networks do not always represent users. Existing works on cluster analysis on Bitcoin transaction networks focus on addressing the later using different heuristics to cluster addresses that are controlled by the same user. This research focuses on illegal community detection containing one or more illegal Bitcoin addresses. We first investigate the structure of Bitcoin transaction networks and suitable community detection methods, then collect a set of illegal addresses and use them to label the detected communities. The results show that 0.06% of communities from daily transaction networks contain one or more illegal addresses when 2,313,344 illegal addresses are used to label the communities. The results also show that distance-based clustering methods and other methods depending on them, such as network representation learning, are not suitable for Bitcoin transaction networks while community quality optimization and label-propagation-based methods are the most suitable.
Yu Pan, Zhichao Xu, Levi Taiji Li, Yunhe Yang · 5 authors
Smart contract and DApp users are taking great risks, as they do not obtain necessary knowledge that can help them avoid using vulnera- ble and malicious contract code. In this paper, we develop a novel system Tx2TXT that can automatically create security-centric textual descriptions directly from smart contract bytecode. To capture the security aspect of financial applications, we formally define a funds transfer graph to model critical funds flows in smart contracts. To ensure the expressiveness and conciseness of the descriptions de- rived from these graphs, we employ a GCN-based model to identify security-related condition statements and selectively add them to our graph models. To convert low-level bytecode instructions to human- readable textual scripts, we leverage robust API signatures to recover bytecode semantics. We have evaluated Tx2TXT on 890 well-labeled vulnerable, malicious and safe contracts where developer-crafted descriptions are available. Our results have shown that Tx2TXT out- performs state-of-the-art solutions and can effectively help end users avoid risky contracts
The Internet of Things (IoT) has become a focus of information infrastructure development in recent years. The smart blockchain can provide various solutions for trust, security, and privacy (TSP) challenges to protect IoT data, and smart contracts are the foundation of blockchain intelligence, and greatly enhance the ability of smart blockchain to solve TSP problems. So, the security of smart contracts must be addressed. We propose an efficient smart contract vulnerability detector to improve the safety of smart contracts. It comprises a graph extraction method and a complete vulnerability detection process. The graph extraction method consists of vulnerability pattern extraction and a graph generation process. The vulnerability detection process first uses the approximate graph matching algorithm to select representative SCGraphs from the data set to build vulnerability SCGraph libraries. Second, determine whether the contract contains vulnerabilities by calculating the similarity between the SCGraphs generated from the contracts to be detected and the SCGraphs in the vulnerability library. Experiments show that our approach achieves an inspiring high detection rate and is the fastest among existing vulnerability detection tools, which indicates that it can provide good vulnerability detection for smart contracts.
In recent years, Ethereum has become a hotspot for criminal activities such as phishing scams that seriously compromise Ethereum transaction security. However, existing methods cannot accurately model Ethereum transaction data and make full use of the temporal structure information and basic account features. In this paper, we propose an Ethereum phishing detection framework based on temporal motif features. By designing a sampling method, we convert labeled Ethereum addresses into multi-directed transaction subgraphs with time and amount to avoid losing structure and attribute information. To learn representations for subgraphs, we define and extract the temporal motif features and general transaction features. Extensive experiments on Support Vector Machine, Random Forest, Logistic Regression, and XGBoost demonstrate that our method significantly outperforms all baselines and provides an effective phishing scams detection for Ethereum.
Smart contracts have driven the development of blockchain technology, but their security vulnerabilities pose numerous problems for blockchain applications.The existing smart contract vulnerability detection methods based on deep learning are not comprehensive in detecting vulnerability categories, have low accuracy, and are limited to binary classification tasks. This paper proposes a smart contract vulnerability detection model called SCGRU combining CNN and bidirectional gating recurrent unit-attention mechanism (BiGRU-Attention) for Ethereum smart contracts to solve these problems. The model transforms the standardized data into word vectors representation of smart contracts with semantic information through the Word2Vec word embedding module. The feature extraction module takes the word vector as input. It uses CNN and BiGRU training to extract high-level abstract features and sequence features of the smart contract respectively. Following the BiGRU feature extraction, an attention mechanism is introduced to highlight the key features related to vulnerabilities of the smart contract code. The features extracted by CNN are concatenated with the features extracted by BiGRU-Attention as the input to the vulnerability classification module. The softmax function normalizes the vulnerability classification module to complete the detection of vulnerabilities in Ethereum smart contracts. The experiments in this paper show that SCGRU has a high accuracy rate of vulnerability detection on the current public dataset. Moreover, SCGRU can identify all categories of smart contract vulnerabilities in the dataset with an average accuracy rate of 92.64%, among which the precision of Infinite Loop vulnerability detection is 99.06%.
Today, more than 4 billion people use social media globally now, and this trend is growing year over year with significant implications for privacy. Verification and authentication are highly difficult tasks because of extensive usage of social media-based global news. Several researches have introduced the use of Distributed ledger technology (Blockchain) in social media to address these limitations. The most well-known decentralized method used today is blockchain technology, which has been taken into consideration when creating the next generation of decentralized social platforms. This article also performs a systematic study and provides a summary of how fake news spreads in the real world, how it spreads in a decentralized system, and how the rumour block strategy functions. This article also covers a number of difficulties in implementing Blockchain in social media fake environments and suggests alternate approaches for implementation and further study.
Since the invention and popularisation of blockchain technology, we have seen a recent surge of attacks targeting cryptocurrency infrastructure. Alongside this, botnet malware has become a staple within threat actors’ toolkits, and have often been used to target a wide range of devices. This paper explores the threats that a custom built botnet poses when used to target cryptocurrency mining software. The botnet within this project is developed in the programming language Golang, due to its effective networking and utilisation in the malware development sector. The targets of the attack will be a cryptocurrency miner, and for ethical reasons a proof-of-concept miner will be used for testing. For evaluation purposes a fully virtualised network is used, with practical exploitation taking place to evaluate some metrics of performance for the botnet. With these metrics, the potential threats posed are then explored, with the main attack vector discovered being defined as “forced pooling”. Through this attack vector we show how this unique threat facilitates a variety of different attacks, both on and off chain including a “51% attack” and password cracking; exploring how a potential distributed supercomputer can be used as an attack tool.
With the popularity of Non-Fungible Tokens (NFTs), NFTs have become a new target of phishing attacks, posing a significant threat to the NFT trading ecosystem. There has been growing anecdotal evidence that new means of NFT phishing attacks have emerged in Ethereum ecosystem. Most of the existing research focus on detecting phishing scam accounts for native cryptocurrency on the blockchain, but there is a lack of research in the area of phishing attacks of emerging NFTs. Although a few studies have recently started to focus on the analysis and detection of NFT phishing attacks, NFT phishing attack means are diverse and little has been done to understand these various types of NFT phishing attacks. To the best of our knowledge, we are the first to conduct case retrospective analysis and measurement study of real-world historical NFT phishing attacks on Ethereum. By manually analyzing the existing scams reported by Chainabuse, we classify NFT phishing attacks into four patterns. For each pattern, we further investigate the tricks and working principles of them. Based on 469 NFT phishing accounts collected up until October 2022 from multiple channels, we perform a measurement study of on-chain transaction data crawled from Etherscan to characterizing NFT phishing scams by analyzing the modus operandi and preferences of NFT phishing scammers, as well as economic impacts and whereabouts of stolen NFTs. We classify NFT phishing transactions into one of the four patterns by log parsing and transaction record parsing. We find these phishing accounts stole 19,514 NFTs for a total profit of 8,858.431 ETH (around 18.57 million dollars). We also observe that scammers remain highly active in the last two years and favor certain categories and series of NFTs, accompanied with signs of gang theft.
Web3Recommend is a decentralized Social Recommender System implementation that enables Web3 Platforms on Android to generate recommendations that balance trust and relevance. Generating recommendations in decentralized networks is a non-trivial problem because these networks lack a global perspective due to the absence of a central authority. Further, decentralized networks are prone to Sybil Attacks in which a single malicious user can generate multiple fake or Sybil identities. Web3Recommend relies on a novel graph-based content recommendation design inspired by GraphJet, a recommendation system used in Twitter enhanced with MeritRank, a decentralized reputation scheme that provides Sybil-resistance to the system. By adding MeritRank's decay parameters to the vanilla Social Recommender Systems' personalized SALSA graph algorithm, we can provide theoretical guarantees against Sybil Attacks in the generated recommendations. Similar to GraphJet, we focus on generating real-time recommendations by only acting on recent interactions in the social network, allowing us to cater temporally contextual recommendations while keeping a tight bound on the memory usage in resource-constrained devices, allowing for a seamless user experience. As a proof-of-concept, we integrate our system with MusicDAO, an open-source Web3 music-sharing platform, to generate personalized, real-time recommendations. Thus, we provide the first Sybil-resistant Social Recommender System, allowing real-time recommendations beyond classic user-based collaborative filtering. The system is also rigorously tested with extensive unit and integration tests. Further, our experiments demonstrate the trust-relevance balance of recommendations against multiple adversarial strategies in a test network generated using data from real music platforms.
Millions of contracts deployed onto Ethereum provide various services that can be invoked. For this purpose, blockchain users need to know and specify the function signature of a callee, which includes its function id and the parameter types. Function signatures are crucial in several applications, such as recognizing the services that contracts provide. In this poster, we propose a novel solution that leverages how functions are handled by Ethereum virtual machine (EVM) to automatically recover function signatures from contract bytecode, without the need of source code and function signature databases. The extensive experimental results show that our solution outperforms all existing tools, achieving an unprecedented 98.7% accuracy within 0.074 seconds. We further demonstrate the usefulness of our solution in attack detection, fuzzing and reverse engineering of contract bytecode.
The traditional decentralised supply chains are facing challenges to meet the increasing demands for openness, transparency, trust and efficiency. As a result, blockchain-based decentralised supply chains are emerging. However, how to identify and discover various services in a decentralised supply chain remains an unsolved issue. This paper presents a new framework for modelling and discovering services in decentralised supply chain systems. In the framework, W3C Decentralised Identifier (DID) is adopted to describe service attributes to meet different business and technical requirements for a supply chain service. While blockchain is used for publishing and storing DID, a graphic-database-based service repository is proposed to organize these DID strings in a natural way as a graph for better service discovery. An Ethereum-based prototype is implemented as a proof of concept to demonstrate its feasibility and usefulness.
Web3 is a blockchain-powered web evolution. In many situations, Web3 smart contracts require data from outside their applications (off-chain data) via APIs to function as designed. Existing APIs in Web3 facing the most common and critical risks originate through access control vulnerabilities (i.e., Broken Object Level Authorization, Broken Function Level Authorization, and Broken Authentication). Such vulnerabilities during runtime cannot be spotted during the development and testing phases of a Web3 application that integrates APIs. Continuous monitoring is the key to proactive hunting access control attacks, which are not attainable through manual monitoring. In this paper, we design a real-time automated security monitoring approach named the access behavior learning (ABL) model for early detection and prevention of access control attacks before they could cause any damage. In two steps, the ABL approach predicts an attacker's access behavior in response to environmental behavior. First, it verifies the API providers and oracle by defining authentication schemes using OpenAPI Specification (OAS) standard to identify the API endpoints to endorse authenticity. In addition, it validates the oracle-level authentication security schemes for approving authentication. Second, it scans metadata for the current access record and compares it with the previous access records, such as location, application id, and API key, to form a baseline that determines authentication. Using this baseline, ABL determines legitimate application access based on both factors for identifying its authentication. ABL approach retains API security by designing an efficient correlation to enable complex off-chain computation by predicting API access attacks. The ABL approach is evaluated against different Web3 applications with varying levels of access control vulnerabilities where applied for early attack detection and prevention. Compared to traditional manual detection processes, the ABL approach offers early automated detection and prevention of attacks during runtime, which results in enhanced security measures and reduces the risk of potential threats.