The blockchain-powered decentralized applications and systems have been widely deployed in recent years. The decentralization feature promises users anonymity, security, and non-censorship, which is especially welcomed in the areas of decentralized finance and digital assets. From the perspective of most common users, a decentralized ecosystem means every service follows the principle of decentralization. However, we find that the services in a decentralized ecosystem still may contain centralized components or scenarios, like third-party SDKs and privileged operations, which violate the promise of decentralization and may cause a series of centralized security risks. In this work, we systematically study the centralized security risks existing in decentralized ecosystems. Specifically, we identify seven centralized security risks in the deployment of two typical decentralized services – crypto wallets and DApps, such as anonymity loss and overpowered owner. Also, to measure these risks in the wild, we designed an automated detection tool called Naga and carried out large-scale experiments. Based on the measurement of 28 Ethereum crypto wallets (Android version) and 110,506 on-chain smart contracts, the result shows that the centralized security risks are widespread. Up to 96.4% of wallets and 83.5% of contracts exist at least one security risk, including 260 well-known tokens with a total market cap of over $98 billion.
Web3, based on blockchain technology, is the evolving next generation Internet of value. Massive active applications on Web3, e.g. DeFi and NFT, usually rely on blockchain transactions to achieve value transfer as well as complex and diverse custom logic and intentions. Various risky or illegal behaviors such as financial fraud, hacking, money laundering are currently rampant in the blockchain ecosystem, and it is thus important to understand the intent behind the pseudonymous transactions. To reveal the intent of transactions, much effort has been devoted to extracting some particular transaction semantics through specific expert experiences. However, the limitations of existing methods in terms of effectiveness and generalization make it difficult to extract diverse transaction semantics in the rapidly growing and evolving Web3 ecosystem. In this paper, we propose the Motif-based Transaction Semantics representation method (MoTS), which can capture the transaction semantic information in the real-time transaction data workflow. To the best of our knowledge, MoTS is the first general semantic extraction method in Web3 blockchain ecosystem. Experimental results show that MoTS can effectively distinguish different transaction semantics in real-time, and can be used for various downstream tasks, giving new insights to understand the Web3 blockchain ecosystem. Our codes are available at https://github.com/wuzhy1ng/MoTS.
Yu Gai, Liyi Zhou, Kaihua Qin, Dawn Song · 5 authors
This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, BlockGPT, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System. Unlike traditional methods, BlockGPT is designed to offer an unrestricted search space and does not rely on predefined rules or patterns, enabling it to detect a broader range of anomalies. We demonstrate the effectiveness of BlockGPT through its use as an anomaly detection tool for Ethereum transactions. In our experiments, it effectively identifies abnormal transactions among a dataset of 68M transactions and has a batched throughput of 2284 transactions per second on average. Our results show that, BlockGPT identifies abnormal transactions by ranking 49 out of 124 attacks among the top-3 most abnormal transactions interacting with their victim contracts. This work makes contributions to the field of blockchain transaction analysis by introducing a custom data encoding compatible with the transformer architecture, a domain-specific tokenization technique, and a tree encoding method specifically crafted for the Ethereum Virtual Machine (EVM) trace representation.
Recent years have witnessed explosive growth in blockchain smart contract applications. As smart contracts become increasingly popular and carry trillion dollars worth of digital assets, they become more of an appealing target for attackers, who have exploited vulnerabilities in smart contracts to cause catastrophic economic losses. Notwithstanding a proliferation of work that has been developed to detect an impressive list of vulnerabilities, the bad randomness vulnerability is overlooked by many existing tools. In this paper, we make the first attempt to provide a systematic analysis of random numbers in Ethereum smart contracts, by investigating the principles behind pseudo-random number generation and organizing them into a taxonomy. We also lucubrate various attacks against bad random numbers and group them into four categories. Furthermore, we present RNVulDet - a tool that incorporates taint analysis techniques to automatically identify bad randomness vulnerabilities and detect corresponding attack transactions. To extensively verify the effectiveness of RNVulDet, we construct three new datasets: i) 34 well-known contracts that are reported to possess bad randomness vulnerabilities, ii) 214 popular contracts that have been rigorously audited before launch and are regarded as free of bad randomness vulnerabilities, and iii) a dataset consisting of 47,668 smart contracts and 49,951 suspicious transactions. We compare RNVulDet with three state-of-the-art smart contract vulnerability detectors, and our tool significantly outperforms them. Meanwhile, RNVulDet spends 2.98s per contract on average, in most cases orders-of-magnitude faster than other tools. RNVulDet successfully reveals 44,264 attack transactions. Our implementation and datasets are released, hoping to inspire others.
Text mining was used to examine the academic publications on blockchain technology and cybersecurity that were published in huge digital libraries. Automated text mining methods like topic modeling and key word extraction are utilized in this literature study to extract topics from a vast corpus of literature. This article emphasizes the cross-disciplinary character of blockchain technology in the context of cybersecurity. The outcomes also show the risks and security holes that emerge as blockchain technology matures. Nevertheless, the investigation this article also outlines research gaps in the area of computer security and recommends research directions for future work that will be necessary to create safe blockchain platforms.
Nowadays we are seeing that the merchandise (product) we are buying can have (20-25) % chances that it can be fictitious merchandise. And this also affects the sales of the company. This paper discusses an application called "Fictitious Merchandise Detection Using Blockchain" to avoid the situation of Fake Products. Blockchain is a decentralized distributed ledger, any updating cannot be a part of this ledger. Blockchain consists of blocks that have their own hash value produced by an algorithm known as SHA-512 or SHA-256. This is an independent ledger I.e., it does not depend upon third parties. So here we are using a QR code scanner that will scan the QR code provided by the user then, it will match that QR code with the blockchain database. If it is matched, a popup message will be generated "Concrete Merchandise" otherwise "Fictitious Merchandise" will be generated as a popup message.
As the first blockchain platform to support smart contracts, Ethereum has gained popularity and breeds various cybercrimes. Many phishing accounts on Ethereum take advantage of the blockchain’s anonymity to participate in illegal acts. To this end, to solve the transaction security problem caused by phishing accounts on Ethereum, this brief proposes a network embedding-based phishing account detection model. Firstly, we crawl the history of transactions from both labeled phishing and non-phishing accounts and use a new method to build these transactions as a transaction network, where each transaction edge is accompanied by additional transaction information for all source nodes of the target node. Then we propose a new random walk-based network embedding algorithm named bias2vec to obtain the embeddings of nodes as the feature inputs. Finally, we classify the accounts into phishing and non-phishing ones by different classifiers such as lightGBM and XGBoost. Experiments show that our proposed phishing account detection model achieves effective detection performance under different classifiers.
D. Palanikkumar, G Arun, R Arunadevi, S. Gayathri · 5 authors
Human lives now include a significant amount of social media usage. Social media is used to create communities, strengthen bonds, and stay in touch with distant friends. A single server, which performs all significant processing, serves as the hub of a centralized system. Thus, a centralized server becomes an easy target for hackers. Decentralized social networks can provide a more secure environment where users may exercise more privacy control through distribution of information processing across many machines. This study proposes a system where the Web3 Library is used to implement the decentralized network. This provides a social graph with all devices in the network. The Ethers library provides functionalities to engage the Ethereum framework. This way an OSN (Online Social Network) service based on blockchain is created and its decentralized operations are performed. Due to a decentralized autonomous organization that is designed for user autonomy, users can democratically self-manage the OSN.
Khaleel Ahmad, Laura Ricci, Fabrizio Baiardi, Sobiya Arsheen
Blockchain is a disruptive technology and incredibly popular nowadays based on decentralized ledger technology. It is a tampered-proof technology that saves the transaction data permanently in a distributed ledger with an immutable time-stamped series record of data, and it is built on the idea of a peer-to-peer network. Blockchain efficiently creates trust between people and machines. It provides new approaches and solutions that cater to the business demands oriented to the fourth industrial revolution. Healthcare is one of the key research use case of blockchain wherein health records are required to be electronic for e-governance. In this paper, we propose the blockchain based Vaccine Intelligent Network for pregnant women, included vaccines covered under the Universal Immunization Program. Our solution is based on the Hyperledger Fabric framework to develop the Electronic Immunization Record of vaccinated pregnant women. The proposed system transforms the immunization record from paper to a reliable digital platforms that will benefit all nation citizens and further reduce anomalies.
This paper presents the development of a web application, which aims to provide a platform for white paper authors to upload and have their documents reviewed by industry experts and scholars. The web app will utilize Ethereum block chain technology to provide security and authenticity to the uploaded white papers, which will be converted into non-fungible tokens to ensure their uniqueness. The authors will have the ability to self-upload their white papers onto a secured IPFS (Inter Planetary File System) database and use ERC721 (Ethereum Request for Comments) protocols to mint them as non-fungible tokens. In addition, the web app will allow white paper authors to receive crowdfunded support from users holding ETH in their web3 wallets. With our unique authentication system utilizing decentralized techniques, the Paper Publication Portal ensures that only verified authors can publish their work, enhancing both the security and credibility of the platform.
In this work, we provide a comprehensive survey of smart contract upgradability patterns using proxies. A primary characteristic of smart contracts on the Ethereum blockchain is that they are immutable once implemented, no changes can be made. Taking human error into account, as well as technology improvements and newly discovered vulnerabilities, there has been a need to upgrade these smart contracts, which may hold enormous amounts of Ether and hence become the target of attacks. Several such attacks have caused tremendous losses in the past, as well as millions of dollars in Ether which has been locked away in broken contracts. Thus far we have collected many upgradable proxy patterns and studied their features to build a comprehensive catalog of patterns. We present a summary of these upgradable proxy patterns which we collected and studied. We scraped the source code for approximately 100000 verified contracts from Etherscan.io, the most popular block explorer for Ethereum, out of which we extracted around 64k unique files - most containing multiple contracts. We have begun to automate the analysis of these contracts using the popular static analysis tool Slither, while at the same time implementing much more robust detection of upgradable proxies using this framework. Comparing the results of the original implementation to our own, we have found that approximately 70 percent of the contracts which were initially flagged as upgradeable proxies are false positives which we have eliminated.
As various forms of fraud proliferate on Ethereum, it is imperative to safeguard against these malicious activities to protect susceptible users from being victimized. While current studies solely rely on graph-based fraud detection approaches, it is argued that they may not be well-suited for dealing with highly repetitive, skew-distributed and heterogeneous Ethereum transactions. To address these challenges, we propose BERT4ETH, a universal pre-trained Transformer encoder that serves as an account representation extractor for detecting various fraud behaviors on Ethereum. BERT4ETH features the superior modeling capability of Transformer to capture the dynamic sequential patterns inherent in Ethereum transactions, and addresses the challenges of pre-training a BERT model for Ethereum with three practical and effective strategies, namely repetitiveness reduction, skew alleviation and heterogeneity modeling. Our empirical evaluation demonstrates that BERT4ETH outperforms state-of-the-art methods with significant enhancements in terms of the phishing account detection and de-anonymization tasks. The code for BERT4ETH is available at: https://github.com/git-disl/BERT4ETH.
The blockchain 2.0 age, marked by smart contract and Ethereum, has arrived couple years ago. Its technologies have expanded the application scenarios of blockchain technology and driven the boom of decentralized Finance. However, smart contract vulnerabilities and security issues are also emerging one after another. Hackers have exploited these vulnerabilities to cause huge economic losses. In recent years, a large amount of research on the analysis and detection of smart contract vulnerabilities has emerged, but there has been no common detection tool and corresponding test dataset. In this paper, we build GSVD dataset (Generalized Smart Contract Vulnerability Dataset) consisting four offline datasets using smart contracts on two chains, Polygon and BSC: two small Solidity datasets consisting of 153 labeled smart contract source codes, which can be used to test the performance of vulnerability mining tools; two large Solidity datasets consisting of 52,202 un labeled real smart contract source codes that can be used to verify the correctness of various theories and tools under a large number of real data conditions. At the same time, this paper integrates the scripting framework accompanying the GSVD dataset, which can execute a variety of popular automated vulnerability detection tools on top of these datasets and generate analysis results of contracts and potential vulnerabilities. We tested the Minor dataset under GSVD using three tools (Slither, Manticore, Mythril) that are kept up to date and found that the combined use of all tools detected 61.1% of labeled vulnerabilities, of which Mythril has the highest detection rate of 42.6%. It is not difficult to conclude that there`re still ample room for advancement for current smart contract vulnerability mining tools because of their underlying methods. Besides, our dataset can contribute to the ultimate target greatly by providing mining tools plenty real contracts information.
Fernando Richter Vidal, Naghmeh Ivaki, Nuno Laranjeiro
Abstract Smart contracts are nowadays at the core of most blockchain systems. Like all computer programs, smart contracts are subject to the presence of residual faults, including severe security vulnerabilities. However, the key distinction lies in how these vulnerabilities are addressed. In smart contracts, when a vulnerability is identified, the affected contract must be terminated within the blockchain, as due to the immutable nature of blockchains, it is impossible to patch a contract once deployed. In this context, research efforts have been focused on proactively preventing the deployment of smart contracts containing vulnerabilities, mainly through the development of vulnerability detection tools. Along with these efforts, several heterogeneous vulnerability classification schemes appeared (e.g., most notably DASP and SWC). At the time of writing, these are mostly outdated initiatives, even though new smart contract vulnerabilities are consistently uncovered. In this paper, we propose OpenSCV, a new and Open hierarchical taxonomy for Smart Contract vulnerabilities, which is open to community contributions and matches the current state of the practice while being prepared to handle future modifications and evolution. The taxonomy was built based on the analysis of the existing research on vulnerability classification, community-maintained classification schemes, and research on smart contract vulnerability detection. We show how OpenSCV covers the announced detection ability of the current vulnerability detection tools and highlight its usefulness in smart contract vulnerability research. To validate OpenSCV, we performed an expert-based analysis wherein we invited multiple experts engaged in smart contract security research to participate in a questionnaire. The feedback from these experts indicated that the categories in OpenSCV are representative, clear, easily understandable, comprehensive, and highly useful. Regarding the vulnerabilities, the experts confirmed that they are easily understandable.
Cryptocurrencies are popular today even though they do not have a physical form with their high profit rates and increasing usage day by day. However, the volatility of cryptocurrencies is higher than physical currencies. These volatilities change with the effect of social media rather than changes in exchange rates of physical currencies. For this reason, in this study, using Twitter data, one of the most widely used social media tools, real-time analysis on the values of four cryptocurrencies with the highest market value and the change in the estimated success compared to classical approaches were examined. The basic steps of this study: Obtaining Twitter data and financial data, performing sentiment analysis using Twitter data, making predictions on MM-LSTM architecture. The approach is aimed to be a predictive method open to online learning. Various filter steps were applied to remove the effect of bot users on Twitter that could prevent the prediction performance on the created data set, and the effect of the method on accuracy rate was tried to be reduced by eliminating the activity of bot accounts.
Maria Ilaria Lunesu, Roberto Tonelli, Andrea Pinna, Simone Sansoni
Soulbound Tokens were introduced last May by Vitalik Buterin as a new kind of non-fungible, non-transferable token in the Ethereum ecosystem. The main idea behind such tokens is that they are born and die at the same address without ever changing ownership. Because there is typically no one-to-one correspondence between blockchain addresses and people, asserting that such new tokens are associated with a person for life is a strong assertion. Nevertheless, these new tokens promise to envision practical applications related to personal reputation or ownership of specific, non-transferable assets, and their real-world potential applications remain largely unexplored. In this paper, we present a practical application of such tokens, investigating a use case where a real-world problem largely impacting modern life has been exploited: COVID vaccine certification. The approach can easily be extended to other vaccination cases and relies on the use of a DApp where Soulbound Tokens have been implemented. In our scheme, two main actors are involved. The system administrator, represented by a local medical organization, is able to insert into a database the list of vaccines for which certification will be sent, and the citizen, after receiving the vaccination, will be able to receive and visualize the certifications provided by the first actor.
Deluwar Hussen Tanvir, Ruhul Amin, Ashraful Islam, Mohammad Shamsul Islam · 5 authors
The pharmaceutical drug industry faces considerable challenges in supply chain management, particularly in regard to tracking and tracing medications. Counterfeit drugs pose a significant global threat, and existing supply chain management practices often prove insufficient to prevent adulteration. Blockchain technology offers a potential solution to these issues by establishing a decentralized and distributed ecosystem where stakeholders can foster a trustworthy relationship. To address these limitations, we propose a blockchain-based system for tracking drugs in the supply chain, incorporating a reputation mechanism to ensure transparency and accountability among entities. To mitigate the interoperability challenges between blockchain networks, we implement inter-blockchain communication using the burn-to-claim protocol. Hyperledger Fabric is used as the primary blockchain because it ensures confidentiality between multiple organizations, and Quorum is the other blockchain. Our solution prioritizes trust, traceability, transparency, and accountability to deliver safe, authentic medication to consumers.
Kai Wang, Maike Tong, Changhao Wu, Jun Pang · 7 authors
The development of clustering heuristics has demonstrated that Bitcoin is not completely anonymous. Currently, existing clustering heuristics only consider confirmed transactions recorded in the Bitcoin blockchain. However, unconfirmed transactions in the mempool have yet to be utilized to improve the performance of the clustering heuristics. In this paper, we bridge this gap by combining unconfirmed and confirmed transactions for clustering Bitcoin addresses effectively. First, we present a data collection system for capturing unconfirmed transactions. Two case studies are performed to show the presence of user behaviors in unconfirmed transactions not present in confirmed transactions. Next, we apply the state-of-the-art clustering heuristics to unconfirmed transactions, and the clustering results can reduce the number of entities after applying, for example, the co-spend heuristics in confirmed transactions by 2.3%. Finally, we propose three novel clustering heuristics to capture specific behavior patterns in unconfirmed transactions, which further reduce the number of entities after the application of the co-spend heuristics by 9.8%. Our results demonstrate the utility of unconfirmed transactions in address clustering and further shed light on the limitations of anonymity in cryptocurrencies. To the best of our knowledge, this paper is the first to apply the unconfirmed transactions in Bitcoin to cluster addresses.