Bekti Cahyo Hidayanto, Izzat Aulia Akbar, R. Aditya Rayhan Zanesty
This study focuses on specifically looking at how penetration testing affects the market value of smart contracts. This study uses a web-based IDE to deploy smart contracts, and it performs penetration testing utilizing reentrancy and delegatecall attacks. The targeted smart contract is exposed to potential exploitation as a result of the assaults' successful implementation. This study shows that penetration testing indirectly affects token prices since incorrect parameter selection and successful attacks might cause changes in token prices. The results emphasize how critical it is to find and fix smart contract vulnerabilities in order to reduce risks and potential losses.
This study aims to understand the vulnerabilities faced by enterprises operating on token-based blockchain businesses and the role of legal, due diligence procedures in mitigating such risks. It employed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses method and sourced data from DeFillama, a platform tracking decentralized finance developments, to categorize hacking incidents into five major groups: Ecosystem, Infrastructure, Protocol Logic, Rugpull, and Smart Contract Language. The findings highlight that Infrastructure attacks, mainly through Private Key Compromise, are the most damaging. They cause losses of over 800 million dollars between 2020 and 2023. It necessitates comprehensive and adaptable legal, due diligence strategies focusing on jurisdictional legal frameworks, platform usage terms, regulatory compliance, and potential legal issues. The study underscores the importance of further research to evaluate and enhance the effectiveness of these measures in addressing the unique challenges of blockchain technology, which are crucial for enhancing the resilience and sustainability of blockchain enterprises, thereby promoting global trust in this emerging field.
Present work explores the transformative potential of blockchain technology in cybersecurity.It begins with a fundamental introduction to blockchain's workings, then focuses on its current trends in bolstering cybersecurity, such as identity management and tamper-proof data storage.Real-world examples are used to guide practical implementations in industries like healthcare, finance, and voting.The paper also explores potential developments in the future, such as quantumresistant cryptography, decentralized autonomous organizations, and artificial intelligence integration.The paper concludes by assessing the lasting impact of blockchain on the broader cybersecurity landscape, highlighting its ability to reshape trust paradigms and empower individuals to control their digital identities.
Ariel Burgess, Rhianna Hamilton, Christian Leuprecht
Abstract Inadequate oversight and an inchoate appreciation are giving terrorist groups ready access to transboundary financial transfers by means of virtual currency. This chapter counters the prevailing approach that treats cryptocurrency-enabled crimes, such as terrorism, as monolithic. This chapter demonstrates that terrorist groups are using cryptocurrency and decentralized finance to fundraise and transfer funds in conjunction with the traditional financial system. Since actual case studies are few and data limited, this chapter is a proof of concept: it compares terrorist financing schemes by the Al-Qassam Brigades and Al Qaeda that used virtual assets. The comparison of virtual assets being used finds that standards developed and recommended by the Financial Action Task Force (FATF) are wholly inadequate to contain the proliferation of decentralized finance technology and centralized virtual assets as drivers of the global Illicit International Political Economy (IIPE). FATF recommendations are not sufficiently nuanced, nor are they effective at detecting, disrupting and deterring he nexus of crypto, crime and terror. To make matters worse, FATF members are falling short on implementing even FATF’s inadequate standards. The chapter concludes that FATF needs to: clarify inclusion criteria under the current definition of virtual assets; broaden regulations, improve interagency collaboration, and formulate more nuanced recommendations that are sensitive to crypto-enabled crimes across different criminal activities and criminogenic factors.
Peng Liao, Chaoge Liu, Jie Yin, Zhi Wang · 5 authors
Digital assets have boomed over the past few years with the emergence of Non-fungible Tokens (NFTs). To be specific, the total trading volume of digital assets reached an astounding $55.5 billion in 2022. Nevertheless, numerous security concerns have been raised by the rapid expansion of the NFT ecosystem. NFT holders are exposed to a plethora of scams and traps, putting their digital assets at risk of being lost. However, academic research on NFT security is scarce, and the security issues have aroused rare attention. In this study, the NFT ecological process is comprehensively explored. This process falls into five different stages encompassing the entire lifecycle of NFTs. Subsequently, the security issues regarding the respective stage are elaborated and analyzed in depth. A matrix model is proposed as a novel contribution to the categorization of NFT security issues. Diverse data are collected from social networks, the Ethereum blockchain, and NFT markets to substantiate our claims regarding the severity of security concerns in the NFT ecosystem. From this comprehensive dataset, nine key NFT security issues are identified from the matrix model and then subjected to qualitative and quantitative analysis. This study aims to shed light on the severity of NFT ecosystem security issues. The findings stress the need for increased attention and proactive measures to safeguard the NFT ecosystem.
Non-fungible tokens (NFTs) are unique tokens with various domains, e.g. real estate, metaverse, gaming and public auctions. However, when minted on public blockchains, the underlying blockchain transaction data can be publicly accessible. This instigated transaction data analysis for various purposes, including cryptocurrency price prediction and NFT market analysis. The public data may be considered privacy-sensitive which sets a barrier to the wider adoption of NFTs. In this work, we present that the analysis of the transaction events can describe activities in NFT applications by establishing connections between transactions and thereby, it can identify information that may be privacy-sensitive. This can be useful in developing suitable privacy-enhancing methods for NFTs. We collected transaction data from a blockchain-based game called Planet IX that was built on the Polygon blockchain and used graph visualisation to provide examples for constructed connections.
The fast-paced development of blockchain technology is evident. Yet, the security concerns of smart contracts represent a significant challenge to the stability and dependability of the entire blockchain ecosystem. Conventional smart contract vulnerability detection primarily relies on static analysis tools, which are less efficient and accurate. Although deep learning methods have improved detection efficiency, they are unable to fully utilize the static relationships within contracts. Therefore, we have adopted the advantages of the above two methods, combining feature extraction mode of tools with deep learning techniques. Firstly, we have constructed corresponding feature extraction mode for different vulnerabilities, which are used to extract feature graphs from the source code of smart contracts. Then, the node features in feature graphs are fed into a graph convolutional neural network for training, and the edge features are processed using a method that combines attention mechanism with gated units. Ultimately, the revised node features and edge features are concatenated through a multi-head attention mechanism. The result of the splicing is a global representation of the entire feature graph. Our method was tested on three types of data: Timestamp vulnerabilities, reentrancy vulnerabilities, and access control vulnerabilities, where the F1 score of our method reaches 84.63%, 92.55%, and 61.36%. The results indicate that our method surpasses most others in detecting smart contract vulnerabilities.
Peter Ince, Xiapu Luo, Jiangshan Yu, Joseph K. Liu · 5 authors
In this paper, we test the hypothesis that although OpenAI's GPT-4 performs well generally, we can fine-tune open-source models to outperform GPT-4 in smart contract vulnerability detection. We fine-tune two models from Meta's Code Llama and a dataset of 17k prompts, Detect Llama - Foundation and Detect Llama - Instruct, and we also fine-tune OpenAI's GPT-3.5 Turbo model (GPT-3.5FT). We then evaluate these models, plus a random baseline, on a testset we develop against GPT-4, and GPT-4 Turbo's, detection of eight vulnerabilities from the dataset and the two top identified vulnerabilities - and their weighted F1 scores. We find that for binary classification (i.e., is this smart contract vulnerable?), our two best-performing models, GPT-3.5FT and Detect Llama - Foundation, achieve F1 scores of $0.776$ and $0.68$, outperforming both GPT-4 and GPT-4 Turbo, $0.66$ and $0.675$. For the evaluation against individual vulnerability identification, our top two models, GPT-3.5FT and Detect Llama - Foundation, both significantly outperformed GPT-4 and GPT-4 Turbo in both weighted F1 for all vulnerabilities ($0.61$ and $0.56$ respectively against GPT-4's $0.218$ and GPT-4 Turbo's $0.243$) and weighted F1 for the top two identified vulnerabilities ($0.719$ for GPT-3.5FT, $0.674$ for Detect Llama - Foundation against GPT-4's $0.363$ and GPT-4 Turbo's $0.429$).
Digital trends like blockchain have led to cryptocurrency payments becoming popular in e-commerce. While cryptocurrencies have benefited users, they have also attracted criminals who use them to commit cyberattacks and harm security. In this research paper, we present an analysis of the following factors that can strongly influence the development of the cryptocurrency environment and be associated with cryptocurrency-related crime at the national level: GDP, digital development, e-commerce market size, the level of mass adoption of cryptocurrency, the level of national cybersecurity, and fraud in cryptocurrency crime for selected countries worldwide. By applying correspondence analysis, we constructed visually intuitive models based on assessments from the global data and business intelligence platform and official statistical reports. We have established a fairly strong positive correlation between fraud in cryptocurrency crime and digital development, e-commerce market size, and the level of mass adoption of cryptocurrency; a fairly strong negative correlation between the level of fraud in cryptocurrency crime and the level of cybersecurity in a specific country; a fairly strong positive correlation between the level of mass adoption of cryptocurrency and the level of cybersecurity. The proposed models give decision-makers a clear understanding of the key factors in cryptocurrency that pose a high risk of related crime.
This paper presents an ongoing study of a novel attack surface generator tool for smart contracts developed in Solidity. The tool leverages a rule-based engine and ChatGPT API for security analysis. The rule-based engine provides numerical values and key variables and functions for further analysis, while ChatGPT handles complex queries. However, ChatGPT may generate similar responses for more general questions, irrespective of the given contract code. The tool combines both approaches to identify and mitigate potential security vulnerabilities in Solidity-based smart contracts. The effectiveness of the tool is evaluated on real-world smart contracts, and its potential for detecting and preventing common attack vectors is demonstrated.
Sayyed Usman Ahmed, Abutalha Danish, Nesar Ahmad, Tameem Ahmad
The rise in legislation and the need for task automation systems has resulted in an amplified requirement for software development. This is aimed at improving the accuracy and efficiency of reading and interpreting laws in legal activities, allowing for enhanced precision and swiftness. Currently, there is a need for analysts to interpret written legislation and then encode it into computer programs, which often leads to errors. As cryptocurrencies gain popularity, there is growing interest in utilizing Blockchain technology in the legal field. Specifically, smart contracts can be used to integrate business rules into laws and automate blockchain management. However, the process of writing fast and high-quality code can be improved by leveraging artificial intelligence based techniques such as natural language processing (NLP) to help practitioners. Despite reviewing the current state-of-the-art, there is a lack of existing work that combines smart contracts and NLP in the context of legislation analysis. This study work generates intelligent code from legislation analysis, utilizing NLP and Blockchain for this purpose. In this research work a pilot prototype for smart contract generation is developed and initial code samples are presented. This work demonstrates a promising results with 96% accuracy in Name Entity Recognition (NER) and also highlights the importance of smart contract generation through NLP.