The industrial market continuously needs reliable solutions to secure autonomous systems. Especially as these systems become more complex and interconnected, reliable security solutions are becoming increasingly important. One promising solution to tackle this challenge is using smart contracts designed to meet contractual conditions, avoid malicious errors, secure exchanges, and minimize the need for reliable intermediaries. However, smart contracts are immutable. Moreover, there are different smart contract execution architectures (namely Order-Execute and Execute-Order-Validate) that have different throughputs. In this study, we developed an evaluation model for assessing the security of reliable smart contract execution. We then developed a realistic smart contract enabled IoT energy case study. Finally, we simulate the developed case study to evaluate several smart contract security vulnerabilities reported in the literature. Our results show that the Execute-Order-Validate architecture is more promising regarding reliability and security.
Ozan Solmaz, Lioba Heimbach, Yann Vonlanthen, Roger Wattenhofer
Layer 2 rollups are rapidly absorbing DeFi activity, securing over $40 billion and accounting for nearly half of Ethereum's DEX volume by Q1 2025, yet their MEV dynamics remain understudied. We address this gap by defining and quantifying optimistic MEV, a form of speculative, on-chain MEV whose detection and execution logic reside largely on-chain in smart contracts. As a result of their speculative nature and lack of off-chain opportunity verification, optimistic MEV transactions frequently decide not to execute any trades. In this work, we focus on cyclic arbitrage, which we find is predominantly executed as optimistic MEV on Layer 2s. Using our multi-stage identification pipeline on Arbitrum, Base, and Optimism, we show that in Q1 2025, transactions from cyclic arbitrage contracts account for over 50% of on-chain gas on Base and Optimism and 7% on Arbitrum, driven mainly by "interaction" probes (on-chain computations searching for arbitrage). This speculative probing indicates that cyclic arbitrage on Layer 2s is predominantly executed as optimistic MEV and contributes to generally keeping blocks on Base and Optimism persistently full. Despite consuming over half of on-chain gas, these optimistic MEV transactions pay less than one quarter of total gas fees. Cross-network comparison reveals divergent success rates, differing patterns of code reuse, and sensitivity to varying sequencer ordering and block production times. Finally, OLS regressions link optimistic MEV trade count to ETH volatility, retail trading activity, and DEX aggregator usage. Together, these findings show that optimistic MEV has become a major source of persistent spam-like transaction activity on Layer 2s, dominating blockspace with low-value probes and reshaping the composition of on-chain activity.
Decentralized finance (DeFi) protocols are crypto projects developed on the blockchain to manage digital assets. Attacks on DeFi have been frequent and have resulted in losses exceeding $80 billion. Current tools detect and locate possible vulnerabilities in contracts by analyzing the state changes that may occur during malicious events. However, this victim-only approaches seldom possess the capability to cover the attacker’s interaction intention logic. Furthermore, only a minuscule percentage of DeFi protocols experience attacks in real-world scenarios, which poses a significant challenge for these detection tools to demonstrate practical effectiveness. In this paper, we propose DeFiTail, thefirstframework that utilizes deep learning technology for access control and flash loan exploit detection. Through feeding the cross-contract static data flow, DeFiTail automatically learns the attack logic in real-world malicious events that occur on DeFi protocols, capturing the threat patterns between attacker and victim contracts. Since the DeFi protocol events involve interactions with multi-account transactions, the execution path with external and internal transactions requires to be unified. Moreover, to mitigate the impact of mistakes in Control Flow Graph (CFG) connections, DeFiTail validates the data path by employing the symbolic execution stack. Furthermore, we feed the data paths through our model to achieve the inspection of DeFi protocols. Comparative experiment results indicate that DeFiTail achieves the highest accuracy, with 98.39% in access control and 97.43% in flash loan exploits. DeFiTail also demonstrates an enhanced capability to detect malicious contracts, identifying 86.67% accuracy from the CVE dataset. By monitoring existing contracts, we identified five distinct categories of vulnerabilities: repetition abuse, unsafe unintended exploitation, signature violated exploitation, insecure interfaces exploitation, and unrestricted token transfer.
Dakai Kang, Junchao Chen, Tien Tuan Anh Dinh, Mohammad Sadoghi
The rise of cryptocurrencies like Bitcoin and Ethereum has driven interest in blockchain database technology, with smart contracts enabling the growth of decentralized finance (DeFi). However, research has shown that adversaries exploit transaction ordering to extract profits through attacks like front-running, sandwich attacks, and liquidation manipulation. This issue affects blockchains where block proposers have full control over transaction ordering. To address this, a more fair transaction ordering mechanism is essential. Existing fairness protocols, such as Pompe and Themis, operate on leader-based consensus protocols, which not only suffer from low throughput caused by the single-leader bottleneck, but also allow adversarial block proposers to manipulate transaction ordering. To address these limitations, we propose a new framework, FairDAG, that runs fairness protocols on top of DAG-based consensus protocols. FairDAG improves protocol performance in both throughput and fairness quality by leveraging the multi-proposer design and validity property of DAG-based consensus protocols. We conducted a comprehensive analytical and experimental evaluation of two FairDAG variants - FairDAG-AB and FairDAG-RL. Our results demonstrate that FairDAG outperforms prior fairness protocols in both throughput and fairness quality.
The increasing adoption of smart contracts on Ethereum and similar blockchain platforms has brought new security concerns, particularly regarding code-level vulnerabilities and unauthorized intrusions. This paper introduces a hybrid framework for intrusion detection in Ethereum smart contracts, leveraging cryptographic modeling and discrete mathematical structures. The framework formalizes contract behavior using graph theory and logic-based models to detect deviations from predefined secure states. Cryptographic primitives such as hash functions and digital signatures ensure data integrity and transactional authenticity. A temporal logic-based formal verification mechanism validates execution paths, while an embedded intrusion detection module enables realtime monitoring and automatic threat response. Experimental evaluation on Ethereum testnets demonstrates enhanced accuracy in identifying reentrancy attacks, access control violations, and state inconsistencies. The results affirm the effectiveness of discrete structures and cryptographic techniques in strengthening the security and reliability of decentralized applications.
Web3 applications, such as on-chain gaming, require unbiased and publicly verifiable randomness that can be obtained quickly and cost-effectively whenever needed. Existing services, such as those based on Verifiable Random Functions (VRF), incur network delays and high fees due to their highly interactive nature. FlexiRand [CCS 2023] addressed these problems by hiding the output of the VRF and using that as a seed to derive many randomnesses locally. These randomnesses are instantly available for usage. However, these randomnesses can not be verified independently (or instantly) without disclosing the seed, leaving scope for malicious actors to cheat. To solve this problem, we introduce a new notion, called instantly-verifiable VRF (iVRF), which enables the generation of many randomnesses from one VRF output seed, such that each of them is verifiable independently - this enables the solution to generate randomnesses, such that they are and also . To instantiate we propose a generic construction called InstaRand - it combines any (possibly distributed) VRF at the server's end with another VRF at the client's end to construct an iVRF. Our specific instantiation uses the BLS-based GLOW-DVRF [Euro S&P 2021] at the server's end and the DDH-based VRF of Goldberg et al. [RFC 2023] at the client's end. We use the universal composability framework to analyze the security. Moreover, due to its generality, InstaRand can be instantiated with any post-quantum secure VRF to yield a post-quantum secure iVRF. Our experiments demonstrate that our instantiation of InstaRand is . The client incurs a cost to generate the seed (server's VRF output) by querying the GLOW-dVRF servers once. Once the seed is set up, the client locally generates the pseudorandom value on demand in , avoiding the client-server round-trip delay. Each value can be independently verified in . This yields a improvement in terms of output generation and improvement in verification cost over existing solutions.
Christos Karapapas, Iakovos Pittaras, George C. Polyzos, Constantinos Patsakis
The InterPlanetary File System~(IPFS) offers a decentralized approach to file storage and sharing, promising resilience and efficiency while also realizing the Web3 paradigm. Simultaneously, the offered anonymity raises significant questions about potential misuse. In this study, we explore methods that malicious actors can exploit IPFS to upload and disseminate harmful content while remaining anonymous. We evaluate the role of pinning services and public gateways, identifying their capabilities and limitations in maintaining content availability. Using scripts, we systematically test the behavior of these services by uploading malicious files. Our analysis reveals that pinning services and public gateways lack mechanisms to assess or restrict the propagation of malicious content.
With the growing integration of cloud computing and the increasing adoption of Internet-of-Things (IoT) devices, ensuring the integrity and privacy of data has become critical in digital systems. Data integrity is fundamental to maintain the completeness and reliability of data throughout the data lifecycle. Its importance is particularly evident in domains such as healthcare, where accurate diagnoses rely on trustworthy data. However, as systems evolve and become more complex, traditional centralised solutions often lack transparency and resilience, while resource-constrained devices make it more difficult to guarantee security and privacy. This thesis addresses these challenges by proposing a framework that integrates Distributed Ledger Technology (DLT) to support privacy-preserving data sharing and strengthen trust among system stakeholders. Based on this framework, an architecture was designed with three main modules: a middleware integrator for service interoperability, an authorisation manager for fine-grained access control, and a data integrity validator leveraging metadata anchored on a distributed ledger to ensure compliance with the General Data Protection Regulation. A proof of concept was designed and implemented using IoT devices, healthcare data, and low-resource hardware. Experimental results demonstrate that the proposed solution enables efficient data sharing and integrity validation with minimal overhead on the system. The DLT layer validated the integrity of shared data through a metadata model while preserving user privacy. Furthermore, the access control mechanism supported scalable and granular authorisation policies, and the middleware facilitated interoperability across heterogeneous stakeholders. This work contributes to new insights into the security of digital systems and provides responsible entities with a trustworthy approach for sharing data among diverse entities.
Jan 1, 2025·Proceedings of the 4th International Conference on Information Technology, Civil Innovation, Science, and Management, ICITSM 2025, 28-29 April 2025, Tiruchengode, Tamil Nadu, India, Part I
G. Sowmya Bala, P. S. G. Aruna Sri, Satyanarayana Korada, Suneel Gone
Traditional ticketing systems are at risk of fraud, counterfeiting, and issues concerning scalability. In this research, we investigate the application of blockchain technology towards the revolutionary concept of event tickets. We analyze how fundamental attributes of blockchain technology, such as
Muhammad Rashid, Imran Rasool, Nazir Ahmad Zafar, Hamra Afzaal
Ethereum 2.0 stands out as a progressive decentralized blockchain platform, drawing attention for its security, scalability, and flexibility. Central to Ethereum 2.0 is the Beacon Chain, serving as the cornerstone managing validator rewards, penalties, attestations, and slashing mechanisms. Rewards and Penalties Mechanism (RPM) is of particular importance within the Beacon Chain as it includes validator balances based on their attestation behavior. Despite the critical role of RPM in maintaining the reliability and security of the Beacon Chain, the absence of formal verification work employing model checking is notable. Therefore, this research endeavors to fill this gap by employing formal verification technique to assess the RPM’s behavior concerning Friendly Finality Gadget (FFG) attestations. Utilizing Process Meta Language (PROMELA), a formal model of the RPM is specified, encompassing safety and liveness properties crucial for its robust functioning. The properties, including invalid attestation, integrity, fairness, availability, failure to attest, and inactivity imposition, are formalized through Linear Temporal Logic (LTL). Subsequently, the formal model alongside the specified properties is subjected to verification using the SPIN model checker. The properties are analyzed with respect to verification time, states visited, and memory usage. The outcome of this research contributes to a rigorous analysis of the RPM’s behavior. This work not only enhances an understanding of Beacon Chain’s operational dynamics but also underscores the importance of formal verification in ensuring the reliability and security of blockchain protocols.
This research provides a detailed analysis of multi-factor authentication (MFA) in Zero-Trust Architecture (ZTA).It focused the discussion on current practices and critical challenges encountered, sharing some insights into the future direction by finding "gaps.""The field of Cyber security is a constantly changing environment.From the beginning of "trust but verify," it has gradually changed to "always verify, never trust."In this case, MFA becomes a key and effective measure to enhance confidentiality in ZTA.ZTA requires that all entities within the system must verify their identities on an ongoing basis, often using MFA.With the widespread use of telecommuting, cloud services, and the Internet of Things, the demand for identity authentication is also increasing.The MFA uses multiple authentication steps to enhance security and trust in the system.However, implementing and applying MFA in the ZTA environment has not been smooth sailing.Some schemes directly affect the popularity of MFA in their implementation, such as poor user experience, complex integration, and poor scalability.The author first reviewed some of the existing MFA programs to get to the root cause and try to fix the problem.By analyzing these typical cases, best practices are found, and strategies for improvement are proposed.The aim is to promote a balance between ease of use and security in MFA.Finally, through literature review and case studies, as well as the exploration of emerging technologies such as adaptive MFA and zero-knowledge proof, The author explore some new approaches to improve the ease and efficiency of MFA in ZTA systems.
Hamra Afzaal, Nazir Ahmad Zafar, Aqsa Tehseen, Shaheen Kousar
Ethereum 2.0 Beacon Chain has adopted the Proof of Stake (PoS) consensus mechanism to significantly advance the security, scalability, and decentralization of blockchain technology. It has played an integral role in organizing validator operations and addressing scalability issues. The Beacon Chain’s rewards and penalty system incentivizes honest behavior and penalizes dishonest actors inside the network. Ensuring the correctness of this mechanism is paramount for guaranteeing the system’s integrity. Therefore, this work formally verifies the rewards and penalty mechanism in the Beacon Chain using model checking, a formal methods-based technique. The formal specification of the rewards and penalties processes and several other epoch operations are described using the Communicating Sequential Programs (CSP#) language. The properties for rewards and penalties procedures are specified with Linear Temporal Logic (LTL). The Process Analysis Toolkit (PAT) model checker is utilized for verifying the formal model against the properties. The PAT model checker takes the specified formal model as input and determines whether the properties are satisfied or violated. The properties are examined in terms of verification time, visited states, total transitions, and memory utilization.
In the network layer of the Ethereum network, the Discv5 protocol is introduced to improve the node discovery process and enhance resistance to common P2P network attacks such as Sybil Attacks, Partition Attacks, and Eclipse Attacks. However, the practical effectiveness of the new security mechanisms introduced by the Discv5 protocol has not been evaluated through engineering assessments. In this paper, we identify inconsistencies between the design and implementation of the Discv5 protocol and propose a new attack pattern: the Leveraging Service Diversity (LSD) Attack. The LSD Attack targets networks where different services are indiscriminately mixed. Through detailed measurements of the Consensus Layer (CL) discovery network, we evaluate the impact of the LSD Attack on newly joined network nodes and on the services of honest nodes within the network. Our experiments demonstrate significant deviations between the Discv5 protocol’s current implementation and its original design, which can lead to a substantial reduction in the network’s security under the influence of service diversity. This study contributes to a deeper understanding of the security implications of the Discv5 protocol and highlights the need for further evaluation and improvement of the network layer protocols in Ethereum.
This research study aims to develop a blockchain-based ticketing system to solve the problem of counterfeiting tickets and scalping. With the help of blockchain, the event ticketing system of various events such as concerts, festivals, and exhibitions would be secure, tamper proof. The proposed method uses ERC 721 NFT tokens which makes the token unique and non-fungible. Traditional ticketing systems face challenges like counterfeit tickets and price hike in the secondary market which affects transparency, attendees' trust gets lost, and event organizers get affected. To solve this problem, the proposed method mainly focuses on the resale market, that is the secondary market. ERC 721 is used to make tickets unique, which makes them secure and resistant to tampering. In the secondary market, the ticket is transferred between the users, that is the linking of tickets to wallet addresses gets changed. It enhances traceability of the tickets. In the secondary market, there would be a price cap for the tickets and when the ticket is sold royalty would be given to the event organizer too. The objective is to create a secure ticketing solution and ensure good resale practices. The proposed method indicates that this approach could significantly enhance the security and fairness of ticketing processes, benefiting both event organizers and attendees.
Yibin Yang, David Heath, Carmit Hazay, Vladimir Kolesnikov · 5 authors
We explore Zero-Knowledge Proofs (ZKPs) of statements expressed as programs written in high-level languages, e.g., C or assembly. At the core of executing such programs in ZK is the repeated evaluation of a CPU step, achieved by branching over the CPU's instruction set. This approach is general and covers traversal-execution of a program's control flow graph (CFG): here CPU instructions are straight-line program fragments (of various sizes) associated with the CFG nodes. This highlights the usefulness of ZK CPUs with a large number of instructions of varying sizes.
The frequent security incidents of contracts indicate a pressing need to ensure contract security from deployment to running stages, but the state-of-the-art (SOTA) analysis methods cannot work well for three requirements.(i) Identify contract defective code snippets, while generating exploit call sequences to help developers fix them.(ii) Monitor abnormal call behaviors, especially for multiple continuous transactions.(iii) Validate numerous unexploitable detection results automatically because manual verification is labor-intensive.To tackle these problems, we propose SymX, a symbolic executionbased security analysis art accounting for contract development and running stages.The experiment results demonstrate that it can accurately identify 90.22% of contracts and 98.04% of call transactions, as well as validate misreports as intended, which is superior to SOTAs, thereby protecting contracts better during the contract lifecycle.Currently, SymX is available at https://github.com/Secbrain/SymX.