Ethereum is the dominant blockchain ecosystem capable of executing Turing-complete smart contracts. Rollups gained significant traction as the primary layer 2 (L2) solution meant to bring horizontal scalability to the main Ethereum network (L1). A core component of any rollup is the sequencer, which creates new L2 blocks to be submitted in rollup batches to L1. In most of the current rollup architectures, this component is centralised. As a result, these designs are prone to inconspicuous censorship practices by the sequencer. Trusted execution environments (TEEs) can guarantee the integrity of various sequencer components, which is instrumental in addressing censorship. However, the reaction of the system design to censorship attempts depends on where a TEE is integrated and which components it protects. In particular, this reaction is limited in the case of a monolithic TEE-protected sequencer design. Proposer-Builder Separation (PBS) is a non-monolithic paradigm adopted on L1, which separates the production of blocks from proposing them for inclusion in the blockchain. Recently, PBS has been considered for integration with L2 sequencers, with an impact on alleviating censorship. In this paper, we explore the design space of TEE-integrating PBS and non-PBS sequencer variants. First, we introduce a formal framework for the censorship actions that captures the specificity of the L2 sequencer. Then, we analyse to what extent the different designs address these censorship actions. Our main contribution is a novel design variation that allows for a precise observation of censored transactions. In the presence of TEEs, in a PBS setting, we demonstrate this precise observability, which is necessary to enable resilience to censorship.
Daniel Commey, Bin Mai, Sena Hounsinou, Garth V. Crosby
This paper reviews the role of blockchain technology in enhancing the security of Internet of Things (IoT) systems and maintaining data integrity. We address the increased vulnerabilities and broader attack surface resulting from the integration of blockchain and IoT. The review emphasizes the potential of technologies like zero-knowledge proofs (ZKP) and post-quantum cryptography (PQC) to mitigate these security challenges. Additionally, we explore how game theory, machine learning, and cyber deception strengthen the defense of blockchain-based IoT systems against various threats. The paper also identifies open research areas, emphasizing the need for continued exploration to advance these fields. An additional contribution of this study is introducing a conceptual framework incorporating these technologies, laying the groundwork for developing advanced security solutions within the blockchain-enhanced IoT ecosystem.
Smart contracts are computer programs running on blockchains to automate the transaction execution between users. The absence of contract specifications poses a real challenge to the correctness verification of smart contracts. Program invariants are properties that are always preserved throughout the execution, which characterize an important aspect of the program behaviors. In this paper, we propose a novel invariant generation framework, INVCON+, for Solidity smart contracts. INVCON+ extends the existing invariant detector, InvCon, to automatically produce verified contract invariants based on both dynamic inference and static verification. Unlike INVCON+, InvCon only produces likely invariants, which have a high probability to hold, yet are still not verified against the contract code. Particularly, INVCON+ is able to infer more expressive invariants that capture richer semantic relations of contract code. We evaluate INVCON+ on 361 ERC20 and 10 ERC721 real-world contracts, as well as common ERC20 vulnerability benchmarks. The experimental results indicate that INVCON+ efficiently produces high-quality invariant specifications, achieving a recall of 80%, which can be used to secure smart contracts from 17 types of common vulnerabilities.
Samson Kahsay Gebresilassie, Joseph Rafferty, Mamun Abu-Tair, Aftab Ali · 6 authors
The Internet of Things (IoT) is a technology paradigm that has transformed several domains including manufacturing, agriculture, healthcare, power grids, travel, and retail. Despite the enormous advantages that IoT offers to organizations and transforming individuals’ everyday lives in a wide range of domains, it comes with potential cyber risks that can negatively impact, harm, or damage them. Security is the most challenging issue in IoT systems due to insecure devices, inadequate IDMS, lack of data security and privacy, lack of trust, lack of risk analysis on network traffic, various vulnerabilities and attacks, lack of physical security, and many other risk factors. Although several security architectures have been developed, they fail to properly and fully address these IoT security challenges and an urgent demand awaits for a robust IoT security architecture. Thus, this work investigates state-of-the-art solutions and proposes a holistic novel IoT security architecture called SHIELD: Secure Holistic IoT Environment with Ledger-based Defense with core security capabilities of decentralized Identity Management System (IDMS), Network Traffic Monitoring, Analysis, and dataset generation, deep learning-based Intrusion Detection System (IDS), and Distributed Ledger Technology (DLT)-based Trust Management System (TMS). The proposed architecture is qualitatively compared with existing solutions using key features like a single point of failure, risk/attack-aware, trust, real-time traffic behavior monitoring, up-to-date dataset, cross-platform functionality, and availability among others. As a result of this comparison, SHIELD architecture provides a holistic and robust solution with multiple core security features to overcome some of the key security challenges IoT environment.
The fast-paced development of blockchain technology is evident. Yet, the security concerns of smart contracts represent a significant challenge to the stability and dependability of the entire blockchain ecosystem. Conventional smart contract vulnerability detection primarily relies on static analysis tools, which are less efficient and accurate. Although deep learning methods have improved detection efficiency, they are unable to fully utilize the static relationships within contracts. Therefore, we have adopted the advantages of the above two methods, combining feature extraction mode of tools with deep learning techniques. Firstly, we have constructed corresponding feature extraction mode for different vulnerabilities, which are used to extract feature graphs from the source code of smart contracts. Then, the node features in feature graphs are fed into a graph convolutional neural network for training, and the edge features are processed using a method that combines attention mechanism with gated units. Ultimately, the revised node features and edge features are concatenated through a multi-head attention mechanism. The result of the splicing is a global representation of the entire feature graph. Our method was tested on three types of data: Timestamp vulnerabilities, reentrancy vulnerabilities, and access control vulnerabilities, where the F1 score of our method reaches 84.63%, 92.55%, and 61.36%. The results indicate that our method surpasses most others in detecting smart contract vulnerabilities.
Τα πρόσφατα επιτεύγματα στην τεχνολογία της πληροφορίας, καθώς επίσης και η αυξανόμενη χρήση των ψηφιακών υπηρεσιών στην καθημερινότητα, έχουν δημιουργήσει ένα μεγάλο αριθμό από έξυπνες και αλληλένδετες συσκευές για διάφορα οικοσυστήματα του Διαδίκτυο των Πραγμάτων (ΔτΠ), όπως το έξυπνο σπίτι, τις μεταφορές, την υγειονομική περίθαλψη, κ.α. Η μετάδοση της κρίσιμης πληροφορίας στο Διαδίκτυο, χωρίς την ανάγκη της ανθρώπινης παρέμβασης, παρέχει ανεξαρτησία και ανέσεις στους χρήστες των συσκευών του ΔτΠ, αλλά επίσης κάνει το οικοσύστημα αυτό ευάλωτο σε έναν αυξανόμενο αριθμό από παράνομες ενέργειες καθώς δημιουργεί έναν ολόκληρο νέο κόσμο από ευκαιρίες σε επιτιθέμενους. Μια λύση βασιζόμενη σε Συστήματα Ανίχνευσης Εισβολών (ΣΑΕ) θα μπορούσε να αυξήσει την ανθεκτικότητα ενός δικτύου ενάντια σε επιθέσεις, καθώς μπορεί να ανιχνεύσει κακόβουλη δραστηριότητα, να παρακολουθήσει τις συσκευές του ΔτΠ υπό επίθεση, αλλά επίσης και να καταγράψει τις κακόβουλες ενέργειες με ειδοποιήσεις ασφαλείας. Για την ανίχνευση και αντιμετώπιση την περίπλοκων και μεγάλης-κλίμακας επιθέσεων σε συσκευές του ΔτΠ, μπορεί να δημιουργηθεί ένα Συνεργατικό Συστήμα Ανίχνευσης Εισβολών (ΣΣΑΕ) στο οποίο θα ανταλλάσσονται οι ειδοποιήσεις ασφαλείας μεταξύ των ΣΑΕ κόμβων. Παρόλα αυτά, για την επίτευξη υψηλού επιπέδου ασφαλείας σε ένα ΣΣΑΕ θα πρέπει να υπάρχει αμοιβαία εμπιστοσύνη στο ΣΣΑΕ δίκτυο για την λήψη πληροφοριών μόνο από αξιόπιστους κόμβους, καθώς κάποιοι εξ’ αυτών μπορεί να γίνουν κακόβουλοι, με σκοπό να μειώσουν το επίπεδο ασφαλείας του δικτύου. Συνεπώς, είναι απαραίτητο κάθε ΣΣΑΕ κόμβος να παρακολουθεί συνεχόμενα την συμπεριφορά των υπολοίπων και να υπολογίζει έναν βαθμό αξιοπιστίας σύμφωνα με τη συμπεριφορά τους. Εκτός όμως από τους συνεργατικούς κόμβους, ένας ΣΣΑΕ κόμβος πρέπει επίσης να παρακολουθεί και την εισερχόμενη κίνηση στο δίκτυο και να αξιολογεί την αξιοπιστία των συσκευών του ΔτΠ. Παρόλα αυτά, ακόμα και με την ανάπτυξη ενός ΣΣΑΕ, είναι εφικτό να συμβούν επιθέσεις στο οικοσύστημα του ΔτΠ, με την ανίχνευσή τους να απαιτεί σφοδρή ανάλυση δεδομένων και υπολογιστική νοημοσύνη, καθώς οι περισσότερες εξ’ αυτών μπορεί να είναι εκλεπτυσμένες και δόλιες, κάτι που σημαίνει ότι, εφόσον εκτελεστούν, μπορούν να τροποποιήσουν την οποιαδήποτε πληροφορία που θα μπορούσε να χρησιμοποιηθεί ως ψηφιακό αποδεικτικό στοιχείο. Με αυτόν τον αυξανόμενο αριθμό από επιθέσεις, ένας νέος επιστημονικός χώρος, που ονομάζεται “Εγκληματολογία του ΔτΠ” δημιουργήθηκε ως ένας κλάδος της Εγκληματολογίας με επίκεντρο την διερεύνηση των κυβερνο-επιθέσεων σε ένα οικοσύστημα του ΔτΠ. Κληρονομώντας τους περιορισμούς της ψηφιακής Εγκληματολογίας η πιστοποίηση και η ακεραιότητα των ψηφιακών αποδεικτικών στοιχείων, καθώς επίσης και η διατήρηση της προστασίας των προσωπικών δεδομένων αποτελούν κάποιους από τους κύριους παράγοντες που επηρεάζουν τη διαδικασία της διερεύνησης των ψηφιακών αποδεικτικών στοιχείων του ΔτΠ. Οι μηχανισμοί κατανεμημένων μητρώων έχουν πρόσφατα αναπτυχθεί με προφανή εφαρμογή το ΔτΠ, ενισχύοντας σημαντικά την ασφάλεια των κατανεμημένων δικτύων παρέχοντας καινοτόμες λύσεις, οι οποίες μπορούν να διατηρήσουν την προστασία των προσωπικών δεδομένων ενός χρήστη μιας έξυπνης συσκευής. Συνεπώς, οι κύριες ιδιότητες των μηχανισμών κατανεμημένων μητρώων, όπως η διαλειτουργικότητα, η αποκέντρωση και η ασφάλεια μπορούν να προσφέρουν ευεργετικά χαρακτηριστικά σε κάθε μια από τις προαναφερθείς περιοχές ενδιαφέροντος. Προς αυτή την κατεύθυνση, η τεχνολογία κατανεμημένων μητρώων δύναται να ενσωματωθεί σε ένα ΣΣΑΕ και να αποφέρει επιπρόσθετη ασφάλεια. Ακόμα και στην περίπτωση που ένα οικοσύστημα του ΔτΠ είναι υπό επίθεση, τα ψηφιακά αποδεικτικά στοιχεία που την αφορούν, να μπορούν να αποθηκευτούν κατανεμημένα και με ασφαλή τρόπο. Επομένως, τα ευεργετικά χαρακτηριστικά των μηχανισμών κατανεμημένων μητρώων συσχετίζονται άμεσα με μια ψηφιακή έρευνα αποδεικτικών στοιχείων, η οποία είναι εφικτό να γίνει με διαφανή τρόπο, καθώς το χρονολογικό ιστορικό χειρισμού των αποδεικτικών στοιχείων καταγράφεται. Μια αρχιτεκτονική, η οποία θα εξάγει ψηφιακά αποδεικτικά στοιχεία από το οικοσύστημα του ΔτΠ, με τη βοήθεια των μηχανισμών των κατανεμημένων μητρώων, όπου στη βάση της θα έχει αναπτυχθεί ένα ΣΣΑΕ, καθώς επίσης και ένα σύστημα διαχείρισης εμπιστοσύνης, θα μπορούσε να αντιμετωπίσει πολλές επιθέσεις σε συσκευές του ΔτΠ και να μειώσει τους παράγοντες που επηρεάζουν την διερεύνηση ψηφιακών αποδεικτικών στοιχείων. Η παρούσα διδακτορική διατριβή αρχικά προτείνει ένα πλαίσιο ανάλυσης καταλληλότητας των μηχανισμών κατανεμημένων μητρώων στο οικοσύστημα του ΔτΠ, με εφαρμογή σε ένα μεγάλο πλήθος από αλγόριθμους συναίνεσης και πλατφόρμες κατανεμημένων μητρώων, ώστε να οριστεί η ικανότητά τους να αντιμετωπίσουν τις πιο κρίσιμες προκλήσεις του ΔτΠ, με καίρια περιοχή αναφοράς το έξυπνο σπίτι. Βασικές αρχιτεκτονικές πτυχές των μηχανισμών κατανεμημένων μητρώων, όπως το λογισμικό της πλατφόρμας και οι ρυθμίσεις του δικτύου, οι αλγόριθμοι συναίνεσης, καθώς επίσης και η ασφάλεια των έξυπνων συμβολαίων, εξετάζονται σε αυτό το πλαίσιο σχετικά με την ικανότητά τους να αντιμετωπίσουν ένα μεγάλο πλήθος από κοινές απειλές του ΔτΠ και των μηχανισμών κατανεμημένων μητρώων, να προσφέρουν βελτιωμένες δυνατότητες προστασίας προσωπικών δεδομένων, και να εξασφαλίσουν επαρκή επίπεδα επιδόσεων όταν επεξεργάζονται μεγάλο όγκο δεδομένων. Έπειτα, προτείνεται μια ολιστική διαδικασία για την διερεύνηση ψηφιακών αποδεικτικών στοιχείων τα οποία εξάγονται από το ΔτΠ, έχοντας ένα σημείο αναφοράς έναντι του οποίου πρότυπα ενσωμάτωσης της τεχνολογίας κατανεμημένων μητρώων και βέλτιστες πρακτικές έχουν ταυτοποιηθεί ώστε να δημιουργηθεί μια νέα, ευρέως αποδεκτή και επεκτάσιμη αρχιτεκτονική. Η τεχνολογία κατανεμημένων μητρώων έχει ενσωματωθεί με την προτεινόμενη διαδικασία εξαγωγής ψηφιακών αποδεικτικών στοιχείων από το ΔτΠ, για να αντιμετωπίσει τις παραπάνω προκλήσεις και να αξιολογήσει την συνολική προτεινόμενη λύση δίνοντας ιδιαίτερη έμφαση σε βελτιώσεις και σε απόδοση. Η προτεινόμενη πλατφόρμα, η οποία βασίζεται στην τεχνολογία MEC, έχει υλοποιηθεί σε έναν μηχανισμό κατανεμημένων μητρώων, ο οποίος ονομάζεται Hyperledger Fabric, και σε ένα εικονικό περιβάλλον, παρέχοντας ένα ρεαλιστικό οικοσύστημα έξυπνου σπιτιού. Μια ενδελεχής υλοποίηση διεξήχθη, με πραγματικές κυβερνο-επιθέσεις για τη δημιουργία ψηφιακών αποδεικτικών στοιχείων σε υψηλούς ρυθμούς, ώστε να δοκιμαστεί η αντοχή της πλατφόρμας κατανεμημένων μητρώων σε υψηλό φορτίο. Ένα νέο σύστημα διαχείρισης εμπιστοσύνης προτάθηκε για την προστασία της ακεραιότητας της πληροφορίας που ανταλλάσσεται μεταξύ των ΣΣΑΕ κόμβων. Η μοντελοποίηση της αξιοπιστίας των κόμβων επιτρέπει την στάθμιση διαφορετικής βαρύτητας στην πιο πρόσφατη συμπεριφορά τους, ώστε να γίνεται αναπροσαρμογή του μοντέλου αξιοπιστίας σύμφωνα με την κάθε αλλαγή της. Τα πειραματικά αποτελέσματα δείχνουν ότι η προτεινόμενη πλατφόρμα μπορεί να παρέχει υψηλή απόδοση, υπερβολικά χαμηλή καθυστέρηση, και μηδέν ποσοστά σφαλμάτων κατά τη λειτουργία του μηχανισμού κατανεμημένων μητρώων.
Abstract Blockchain, as a secure distributed ledger technology, has received extensive attention from academia and industry for its decentralization, comparability and traceability. This paper proposes a method for verifying data security on blockchain, and a cryptographic uploading and retrieval scheme is combined with IOTA blockchain technology. In this way, an IoT data storage and sharing model is designed to combine blockchain with IPFS. In this paper, it is found that there is a certain delay in operating on Fabric and IOTA compared to the scenarios that do not use blockchain. But Fabric has better performance in upload and download performance than IOTA. In the proposed scheme in this paper, the uploading time is stabilized between 0.8 and 1.2, and the retrieval time is stabilized between 0.43s and 0.76s, which has superior data uploading and retrieval performance than Scheme 1. Furthermore, the time to generate a key for a 50MB file is only around 1800ms, and for a 50MB file split into 6KB blocks, the time to generate a secret key is only around 36s. In this paper, when the file size reaches 5MB, the computational overhead of encryption and decryption is about 1315ms and 1283ms, respectively, and the time overhead of data consistency validation is only about 1095ms when the data block is cut into 6KB for a file of 5MB, indicating that this paper’s scheme has a lower time overhead in the generation of the secret key, encryption and decryption, and the data consistency validation. In summary, the above experiments verify the security and applicability of this paper’s scheme in data storage and verification.
Dongze Li, Kejia Zhang, Shiwei Li, Gang Du · 5 authors
As decentralized finance (DeFi) grows and decentralized exchanges (DEXs) expand, the security of Ethereum smart contracts and blockchain transactions is receiving increasing scholarly attention. The ERC20 token standard has facilitated the emergence of numerous honeypot contracts, which deceive traders by allowing token purchases but blocking withdrawals. This study proposes a lightweight honeypot contract detection system integrated into the go-Ethereum client (Geth). Unlike previous work, our detector does not rely on contract interaction records or source code provided by contract creators. Instead, our approach performs static data flow analysis on contract bytecode to identify honeypot mechanisms. By focusing exclusively on the control flow of the ERC20 Transfer method, our system achieves faster detection than full-contract analysis methods, with an average processing time of 9.74 milliseconds per contract. Experiments on both known honeypot contracts and real-world token contracts demonstrate the effectiveness of our approach in detecting malicious ERC20 contracts.
Kainat Ansar, Mansoor Ahmed, Markus Helfert, Jungsuk Kim
In cybersecurity, personal data breaches have become one of the significant issues. This fact indicates that data breaches require unique detection systems, techniques, and solutions, which necessitate the potential to facilitate precise and quick data breach detection. Various research works on data breach detection and related areas in dealing with this problem have been proposed. Several survey studies have been conducted to comprehend insider data breaches better. However, these works did not examine techniques related to blockchain and innovative smart contract technologies to detect data breaches. In this survey, we examine blockchain-based data breach detection mechanisms developed so far to deal with data breach detection. We compare blockchain-based data breach detection techniques based on type, platform, smart contracts, consensus algorithm language/tool, and evaluation measures. We also present a taxonomy of contemporary data breach types. We conclude our study by outlining existing methodologies’ issues, offering ideas for overcoming those challenges, and pointing the way forward.
Christoph Sendner, Lukas Petzi, Jasper Stang, Alexandra Dmitrienko
Ethereum smart contracts, which are autonomous decentralized applications on the blockchain that manage assets often exceeding millions of dollars, have become primary targets for cyberattacks. In 2023 alone, such vulnerabilities led to substantial financial losses exceeding a billion of US dollars. To counter these threats, various tools have been developed by academic and commercial entities to detect and mitigate vulnerabilities in smart contracts. Our study investigates the gap between the effectiveness of existing security scanners and the vulnerabilities that still persist in practice. We compiled four distinct datasets for this analysis. The first dataset comprises 77,219 source codes extracted directly from the blockchain, while the second includes over 4 million bytecodes obtained from Ethereum Mainnet and testnets. The other two datasets consist of nearly 14,000 manually annotated smart contracts and 373 smart contracts verified through audits, providing a foundation for a rigorous ground truth analysis on bytecode and source code. Using the unlabeled datasets, we conducted a comprehensive quantitative evaluation of 17 vulnerability scanners, revealing considerable discrepancies in their findings. Our analysis of the ground truth datasets indicated poor performance across all the tools we tested. This study unveils the reasons for poor performance and underscores that the current state of the art for smart contract security falls short in effectively addressing open problems, highlighting that the challenge of effectively detecting vulnerabilities remains a significant and unresolved issue.
Nowadays, the Internet of Things (IoT) has become immensely popular in various fields like healthcare, smart cities, and industrial automation. IoT networks are expanding rapidly, including different IoT devices with limited capabilities in terms of power and storage which make the IoT security a crucial issue. IoT Network Intrusion Detection System is one of the most famous solutions that used to identify different types of attack and extract their features (e.g. IP addresses of attackers). The IP address is a valuable feature that can identify malicious traffic of an attacker who attempts to access the IoT network. However, IoT Network Intrusion Detection Systems has different limitations: centralization and scalability which easily allow attackers to access the IoT network. Accordingly, this paper aims to address these issues by proposing a novel collaborative framework called Blockchain-based Collaborative Intrusion Detection Systems (BC-IDSs) that utilizes Blockchain technology to connect several IDSs. The BC-IDSs framework (1) creates a list of malicious IP addresses using IDSs; (2) utilizes Blockchain to share and store the Blacklist; (3) creates a function for duplication check in the Blockchain layer. Further, the implementation of a proof of concept for BC-IDSs framework is presented by using Ethereum Blockchain simulators. Compared to previous works, this paper discusses several types of performance metrics that prove BC-IDSs is able to secure IoT networks. BC-IDSs also increases the scalability by 50% when compared to one of the previous defence work.
IoT-based remote health monitoring is a promising technology to support patients who are unable to travel to medical facilities. Due to the sensitivity of health data, it is important to secure it against all possible threats. While a great deal of work has been done to secure IoT device-cloud communication and health records on the cloud, insider attacks remain a significant challenge. Malicious insiders may tamper, steal or change patients’ health data, which results in a loss of patient trust in these systems. Audit logs in the cloud, which may point to illegal data access, may also be erased or forged by malicious insiders as they tend to have technical knowledge and privileged access to the system. Thus, in this work, we propose a Cloud Access Security Broker (CASB) model that (a) logs every action performed on user data and (b) secures those logs by placing them in a private blockchain that is viewable by the data owners (i.e., patients). Patients can query the blockchain, track their data’s movement, and be alerted if their data has been accessed by an administrator or moved outside the cloud storage. In this work, we practically implement a web application that receives health data from patients, a CASB that securely stores the records in the cloud, and integrate a private blockchain that immediately logs all actions happening in the backend of the web application and CASB. We evaluate the system’s security and performance under varying numbers of patients and actions.
In the domain of software testing, the generation of test cases is a critical process for detecting system errors and bugs. However, automated test case generation for smart contracts often encounters challenges related to automation, vulnerability diversity, and coverage. This paper presents a novel method, the self-adaptive learning Genetic Algorithm (self-adaptive learning GA), designed to address these issues. Our research methodology incorporates several construction models, namely the Control Dependence Graph (CDG), Control Flow Graph (CFG), and Application Binary Interface (ABI). Initially, the ABI model provides essential information for generating and executing test cases. The CFG model subsequently visualizes potential execution paths through the functions of smart contracts. Ultimately, the CDG model identifies potential vulnerabilities in smart contracts. Using these models, our method enhances automatic test case generation in smart contracts by improving coverage and reducing execution time. We selected a variety of smart contracts from the Decentralized Finance (DeFi) ecosystem for data collection and comparative analysis. The experimental results show superior performance rates, with an average code coverage rate of 98.1%, a total of 3500 vulnerabilities detected, a vulnerability detection rate of 98.7%, a false positive rate of 1.3%, a recall of 98.2%, precision of 98.8%, a path uniqueness rate of 96.4%, false negative rate of 3.5%, an execution time of 25 s, and test case generation time of 16 s. In conclusion, our proposed approach demonstrates a significant improvement over existing methods for test case generation by providing a promising solution for the robustness of smart contracts and security enhancement in the DeFi ecosystem.
Shengqiang Zeng, Ruhuang Chen, Hongwei Zhang, Jinsong Wang
With the emergence of technologies like web3.0, smart contracts have witnessed a flourishing development trend. However, the threat posed by contract vulnerabilities hinders the progress in this field. Traditional vulnerability detection tools have lost their effectiveness due to the unique code and function characteristics of smart contracts. Consequently, a novel approach utilizing deep learning for intelligent contract vulnerability detection has emerged. Nevertheless, the current solutions still face bottlenecks in terms of accuracy and efficiency, primarily due to the scarcity of labeled vulnerability samples. To address these challenges, this paper proposes an efficient intelligent contract vulnerability detection approach called SCVulBERT, based on Bidirectional Encoder Representation from Transformers (BERT). The proposed approach leverages transfer learning and utilizes rich prior knowledge for training to ensure the model’s effectiveness in a scarce supervised sample environment. Furthermore, to enhance tokenization efficiency, a specialized tokenizer called SCVulTokenizer is designed to transform contract code into parameters recognizable by neural networks. The proposed approach utilizes the BERT network architecture to extract more precise and efficient features from the context, thereby achieving accurate and efficient vulnerability detection. Experimental comparisons demonstrate that the proposed approach outperforms existing solutions in the context of scarce supervised samples, exhibiting significant improvements in accuracy, precision, recall, and F1-score metrics. Specifically, regarding vulnerability detection for reentrancy, timestamp, and delegate call, the F1-scores achieved by the proposed approach show respective improvements of 13.71%, 13.14%, and 7.7% compared to the state-of-the-art solutions.
With the emergence of Web3, decentralized network protocol technologies have been vigorously developed. As a pioneer for decentralized real-time communication systems, Matrix is an open standard based on a federation specification protocol. Anyone can set up a self-hosted homeserver to participate in the global Matrix network and communicate with others in chat rooms. In this paper, we conduct the first in-depth measurement and exploratory research on Matrix’s ecosystem and security. We designed and implemented several investigation techniques to empirically delve into Matrix federation from various aspects (homeservers, rooms, and users). In the end, we identified a number of interesting findings and potential vulnerabilities, including anti-decentralization phenomena, cybersecurity threats in homeservers, and the confidentiality of encrypted rooms being compromised.