Ethereum Blockchain technology introduced a competitive environment in the financial sector. Consequently, new technologies emerged, such as Smart Contracts (SCs), which preclude code corrections due to their immutable nature. But the incorrect and faulty uploaded SCs led to uninvited penetrations into SCs’ accounts, resulting in considerable customer losses. This SC’s drawback requires tools to test the SCs and paves the way for research on vulnerability detection techniques. Our survey paper comprehensively reviews 41 SC tools and presents the vulnerability detection techniques (VDTs) of the several previously discussed tools by dividing them into general and specific classes. Finally, we also perform a classification of detection techniques to standardize the approaches. Thus, our study will help SC developers and security analysts to streamline the security of SCs and reduce the chances of malicious monetary transfers.
Open access
2 source records
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The phenomenon of crypto money stands before us as a new type of asset that has emerged in parallel with the development of technology in recent years. The asset type in question covers all forms of currency that exist digitally or virtually and uses cryptography to secure transactions. It is possible to list the features of cryptocurrencies as decentralization, anonymity, protection with the blockchain system, fast transaction ability, irreversibility of the transaction, and difficulty in analyzing the code chain of the transactions among others. Since cryptocurrency is a digital asset designed to be used as a means of exchange and especially due to its features such as real-world identities being concealed and value transfer being possible through different methods, it is a tool that has various advantages and disadvantages for those who commit complex crimes such as money laundering and financing of terrorism. There are various difficulties arising from the nature of cryptocurrencies in detecting and revealing crimes in which cryptocurrencies are used, identifying the perpetrators of these crimes, and then ensuring that these perpetrators are convicted with legally obtained evidence. Issues such as decentralization, anonymity, and difficulty in cracking the code are the main reasons for these difficulties. In addition, the inadequacy of national legislation regarding the search and seizure of cryptocurrencies and the knowledge and technical deficiencies of police forces, prosecutors and judges also disrupts the investigation and prosecution processes. However, it is known that through investigations and trials carried out in states such as the United States of America, various European states and Israel, cases in which cryptocurrency was used have been revealed and trials are ongoing. In the context of all these developments, this study will focus on the problem of using cryptocurrencies as a terrorist financing tool. The use of cryptocurrencies for terrorist purposes, and especially to finance terrorist organizations, their members, or actions, is an issue that is increasingly encountered on an international scale and is being tried to be solved. In this context, the study will draw attention to the processes and methods related to the financing of terrorism, the settlement of cryptocurrencies, the acquisition, transfer, and conversion of cryptocurrencies into fiat money, and the issues related to their investigation and prosecution. In the study, the question of how ISIS, HAMAS and Al Haqiqa, organizations included in the terror lists of many countries and judicially recognized as such, use cryptocurrencies in financing terrorism will be discussed, and the current situation in Turkey, possible risks and solution suggestions will be discussed in the light of data available within the scope of research. In addition, the regulations regarding the financing of terrorism and cryptocurrencies in Turkish law will be evaluated all together and an evaluation will be made in the light of international and comparative examples.
Abstract Blockchain smart contracts are codes that can execute and enforce rules for blockchain digital transactions. However, smart contracts may contain numerous subtle vulnerabilities, among which Ponzi vulnerabilities are notable. Existing Ponzi scheme contract detection approaches often rely on machine learning models trained on manually extracted features to achieve satisfactory classification results. Nonetheless, the code of a smart contract potentially harbours elusive semantics and characteristics, which compromises the precision and accuracy of vulnerability detection. Therefore, this paper proposes a method of converting operation codes into sequences to process data to avoid losing unnecessary important information, and uses a one‐dimensional convolutional neural network combined with formal verification. This method is named PZ‐C1DZ3(Ponzi‐Conv1D‐Z3) and is used for Ponzi scheme detection. Four types of machine learning models, namely Conv1D, Conv1D‐LSTM, Conv1D‐MLP, and Conv1D‐transformer, are employed for improvement and comparative validation experiments. Additionally, formal verification tool Z3 solver is utilized to conduct formal security verification on the final model, ensuring its safety. Experimental results demonstrate that the improved Conv1D model outperforms other existing models in terms of detection efficiency and accuracy while also meeting the requirements of formal security verification.
The rapid growth of Decentralized Finance (DeFi) boosts the blockchain ecosystem. At the same time, attacks on DeFi applications (apps) are increasing. However, to the best of our knowledge, existing smart contract vulnerability detection tools cannot directly detect DeFi attacks. That's because they lack the capability to recover and understand high-level DeFi semantics, e.g., a user trades a token pairXandYin a Decentralized EXchange (DEX). In this work, we focus on the detection of two new types of price manipulation attacks. To this end, we propose a platform-independent method to identify high-level DeFi semantics. Specifically, we first construct the Cash Flow Tree (CFT) from a raw transaction and then lifting the low-level semantics to high-level ones, including five advanced DeFi actions. Finally, we use patterns expressed with the recovered DeFi semantics to detect price manipulation attacks. We implemented a prototype namedDeFiRangerthat detected 14zero-daysecurity incidents. These findings were reported to affected parties or/and the community for the first time. Furthermore, the backtest experiment discovered 15 unknown historical security incidents. We further performed an attack analysis to shed light on the root causes of vulnerabilities incurring price manipulation attacks.
With the rapid diffusion of social networks in combination with mobile phones, a new social threat of sextortion has emerged, in which vulnerable young women are essentially blackmailed with their explicit shared multimedia content. The phenomenon of sextortion is now widely studied by psychologists, sociologists, criminologists, etc. The findings have been translated into scattered help from NGOs, specialized law enforcement units, and therapists, who usually do not coordinate their efforts among each other. This paper addresses the gap of lacking coordination systems to effectively and efficiently use modern information technologies that align the efforts of scattered and non-aligned sextortion help organizations. Consequently, this paper not only investigates the goals, incentives, and disincentives for a system design and development that not only governs effectively and efficiently diverse cases of sextortion victims, but also leverages artificial intelligence in a targeted manner. It explores how AI and, in particular, autonomous cognitive entities can improve victim profiles analysis, streamline support mechanisms, and provide intelligent insight into sextortion cases. Furthermore, the paper conceptually studies the extent to which such efforts can be monetized in a sustainable way. Following a novel design methodology for the design of trusted blockchain decentralized applications, the paper presents a set of conceptual requirements and system models based on which it is possible to deduce a best-practice technology stack for rapid implementation deployment.
Shengqiang Zeng, Ruhuang Chen, Hongwei Zhang, Jinsong Wang
With the emergence of technologies like web3.0, smart contracts have witnessed a flourishing development trend. However, the threat posed by contract vulnerabilities hinders the progress in this field. Traditional vulnerability detection tools have lost their effectiveness due to the unique code and function characteristics of smart contracts. Consequently, a novel approach utilizing deep learning for intelligent contract vulnerability detection has emerged. Nevertheless, the current solutions still face bottlenecks in terms of accuracy and efficiency, primarily due to the scarcity of labeled vulnerability samples. To address these challenges, this paper proposes an efficient intelligent contract vulnerability detection approach called SCVulBERT, based on Bidirectional Encoder Representation from Transformers (BERT). The proposed approach leverages transfer learning and utilizes rich prior knowledge for training to ensure the model’s effectiveness in a scarce supervised sample environment. Furthermore, to enhance tokenization efficiency, a specialized tokenizer called SCVulTokenizer is designed to transform contract code into parameters recognizable by neural networks. The proposed approach utilizes the BERT network architecture to extract more precise and efficient features from the context, thereby achieving accurate and efficient vulnerability detection. Experimental comparisons demonstrate that the proposed approach outperforms existing solutions in the context of scarce supervised samples, exhibiting significant improvements in accuracy, precision, recall, and F1-score metrics. Specifically, regarding vulnerability detection for reentrancy, timestamp, and delegate call, the F1-scores achieved by the proposed approach show respective improvements of 13.71%, 13.14%, and 7.7% compared to the state-of-the-art solutions.
Decentralized Autonomous organizations (DAOs) have emerged as blockchain technology evolves beyond cryptocurrencies. Despite being the first project in this ecosystem, The DAO encountered a significant exploit due to inadequate implementation; nevertheless, it still paved the way for future projects. While decentralized autonomous organizations continue to thrive, there is a shortage of academic papers analyzing the associated risks. Therefore, this paper aims to comprehensively examine the current vulnerabilities in these organizations by systematically analyzing past attack incidents. 54 real-world events spanning from 2016 to July 2023 have been collected for identifying and summarizing major attack vectors. The results showcase that flash loan attacks, oracle manipulation, governance takeovers, and reentrancy issues are the critical vulnerabilities within this field. For further protection, this research also provides both general and specific countermeasures against each vulnerability, serving as an evaluation framework for both existing and future projects.
With the continuous evolution of blockchain technology, cryptocurrency platforms such as Ethereum have emerged as centers for digital asset transactions and smart contracts deployment. However, this nascent financial ecosystem also introduces potential money laundering risks. The traditional financial industry has accumulated significant antimoney laundering (AML) experience and technical means for monitoring and detecting money laundering activities. Yet, the adaptability of these established AML algorithms in the context of blockchain remains unclear. This paper aims to investigate the practical adaptability of traditional AML algorithms on Ethereum data through empirical experiments. We gather eight real-world money laundering case datasets collected from Ethereum and conduct experiments using three traditional AML algorithms on these datasets. We evaluate the performance of these algorithms from various angles, including precision, recall, and the distribution of detected accounts' labels in comparison to the original datasets. It turns out algorithms demonstrate distinct performance in diverse money laundering cases, indicating that the adaptability of traditional AML algorithms on Ethereum data presents certain adaptability and limitations. Holoscope's accuracy demonstrates the value of dense subgraph properties in Ethereum money laundering detection, and further research can be conducted based on this model framework combined with the money laundering characteristics of Ethereum. Our study provides valuable insights for strengthening AML mechanisms on blockchain platforms and offers guidance for further research on detecting money laundering accounts in blockchain environments.
The increasement of blockchain applications has brought about many security issues, with smart contract vulnerabilities causing significant financial losses. The majority of current smart contract vulnerability detection methods predominantly rely on static analysis of the source code and predefined expert rules. However, these approaches exhibit certain limitations, characterized by their restricted scalability and lower detection accuracy. Therefore in this paper, we use graph neural networks to perform smart contract vulnerability detection at the bytecode level, aiming to address the aforementioned issues. In particular, we propose a novel detection model. In order to acquire a comprehensive understanding of the dependencies among individual functions within a smart contract, we first construct a Program Dependency Graph(PDG) of functions, extract function-level features using graph neural networks, then augment function-level features using a self-attentive mechanism to learn the dependencies between functions, and finally aggregate function-level features for detecting the vulnerabilities. Our model possesses the capability to identify the subtle nuances in the interactions and interdependencies among different functions, consequently enhancing the precision of vulnerability detection. Experimental results show the performance of the method compared to existing smart contract vulnerability detection methods across multiple evaluation metrics.
This research delves into the dual nature of cryptocurrencies, offering financial opportunities while addressing the surge in digital criminal activities, especially in illegal firearms trafficking. The decentralized nature of blockchain technology presents unique challenges for law enforcement, necessitating innovative approaches to uncover and prevent criminal transactions. The study utilizes advanced data mining, analytics techniques, and machine learning models to analyze transactional graphs of prominent cryptocurrencies, aiming to identify and thwart transactions linked to illegal firearms trafficking.Additionally, the paper provides an overview of the current state of blockchain technology research and introduces the ambitious Ceasefire project. This initiative outlines a systematic approach to combat illegal firearms trading within the cryptocurrency domain, leveraging cutting-edge techniques and strategic partnerships with leading blockchain analysis platforms.By proposing a novel method, this paper enhances the ability to detect illicit firearms trading in cryptocurrencies, specifically focusing on Bitcoin and Ethereum networks. The approach combines predictive modeling with rule-based matching to identify potentially suspicious addresses in both ecosystems. This empowers authorities to track individuals attempting to conceal their transactional activities by transitioning between Bitcoin and Ethereum, thus bolstering efforts to maintain the integrity of decentralized financial systems.
Before deploying smart contracts to Ethereum, a crucial step is to review the contract code for potential security vulnerability. Symbolic execution is currently a prevalent method for detecting vulnerability in smart contracts, but it lacks robust support for arbitrary modifications by owners. Therefore, this paper, leveraging symbolic execution technology, investigates detection methods specifically addressing this type of vulnerability, and presents concrete implementation and experimental validation. In the initial phase, this paper conducts an in-depth study of vulnerable contracts by debugging the source code and Ethereum Virtual Machine (EVM) opcode instructions. The analysis encompasses opcode instructions and the contract’s global state, summarizing vulnerability characteristics, extracting crucial opcode instructions. Subsequently, based on symbolic execution technology, the paper proposes corresponding detection methods. Real-world smart contracts are employed in this study, categorized into a dataset of vulnerable contracts susceptible to attacks and a dataset of normal contracts. Experimental evaluations are conducted to assess the effectiveness and accuracy of the system’s detection capabilities. The results indicate that the system implemented in this paper achieves the intended design goals and enhances the efficiency of vulnerability detection.
As decentralized finance (DeFi) built on blockchain grows rapidly, the security of smart contracts underpinning DeFi has become a major concern due to exploits leading to billions in damages. Although tools exist for automated vulnerability detection in smart contracts, studies show that most vulnerabilities remain undetected. In this work, we propose using fine-tuned large language models (LLMs) for enhanced automated detection of vulnerabilities in smart contracts. We collected over 26,727 labeled smart contract vulnerabilities and fine-tuned the 13B parameter Llama-2 model. Evaluation of 1,000 unseen functions shows promising precision of 31-36% in predicting vulnerability categories. The fine-tuned LLM demonstrates potential as an auxiliary tool to identify vulnerable code and assist auditors. Future work is outlined for improving performance via larger models, higher-quality data, and specialized binary detection models. We present promising preliminary results on integrating LLMs into smart contract analysis and motivate further research at the intersection of LLMs and blockchain security.
Abstract. Due to the transparent nature of blockchain, all transaction information and smart contract code is recorded on the public blockchain. It is easy for existing static analysis tools to analyze and exploit vulnerabilities in smart contract code. To mitigate this risk, we propose HermHD, an automated security enhancement tool that protects smart contracts on the Ethereum network. HermHD employs six obfuscation patterns that can rewrite the bytecode of a smart contract without affecting its functionality. By applying these obfuscation techniques, we aim to prevent reverse static analysis tools from cracking the contract and thereby enhance the security of smart contracts. To validate the effectiveness of HermHD, we conducted experiments on 121 smart contracts from a public dataset. 54The evaluation results demonstrate that all the protected smart contracts are resistant to two popular reverse engineering tools, and the additional gas cost incurred is minimal.
Kai Ma, Jintao Huang, Ningyu He, Zhuo Wang · 5 authors
Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem. To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.
The article is devoted to the study of the problems of investigating crimes of financing terrorism and armed aggression with cryptocurrency, which is relevant considering the attack on Ukraine by the Russian Federation, as well as in connection with the significant spread and use of cryptocurrency for financing both terrorism and armed aggression. The purpose of the article is to study the problems of investigating crimes of cryptocurrency financing of terrorism and armed aggression and finding ways and means of solving problematic issues, because cryptocurrency financing of terrorism and armed aggression is an encroachment on national security. The methods of system analysis and technical- legal analysis, as well as the formal-logical method, were used in the research process. Thanks to this, approaches to understanding the way of committing crimes of the researched category have been determined. The shortcomings in the legal regulation of the circulation and use of cryptocurrency in Ukraine, as well as in the legal regulation of the investigation of crimes related to the illegal acquisition and use of cryptocurrency for criminal purposes, including for the financing of terrorism and armed aggression, are highlighted. Jurisdictional problems of criminal prosecution of persons who committed crimes of this category, their high latency due to the lack of proper legal procedures and methods of investigation, have been determined. The need to create specialized units in law enforcement agencies, whose competence will include the detection and investigation of the specified crimes, their active interaction with the Cyber Police, is substantiated. The attention and necessity of introducing a system of constant monitoring of social networks, the Internet, and media and conducting OSINT-intelligence from open sources with the aim of detecting and stopping such criminal activities, tracking and arresting and eventually seizing cryptocurrency, if such an opportunity is available, was emphasized. Practical recommendations for the investigation of crimes of cryptocurrency financing of terrorism and armed aggression have been formulated. The need for international legal cooperation in this area was emphasized; the need to involve specialists in the field of information technologies, programming, and blockchain engineering in the investigation process in general and in specific investigative actions. The requirements for the recording of evidence in the protocols of investigative (search) actions during the investigation of crimes of this category are formulated, in particular, the need for hashing of files is specified. The practical significance of the study is that the obtained results can be used during the investigation of crimes of the studied category
Udit Agarwal, Vinay Rishiwal, Sudeep Tanwar, Mano Yadav
Abstract In the past few years, cryptocurrency has gained widespread acceptance because of its decentralized nature, quick and secure transactions, and potential for investment and speculation. But the increased popularity has also led to increased cryptocurrency fraud, including scams, phishing attacks, Ponzi schemes, and other criminal activities. Although there is little documentation of cryptocurrency fraud, an in‐depth study is essential to recognize various scams in different cryptocurrencies. To fill this gap, a study investigated cryptocurrency‐related fraud in various cryptocurrencies and provided a taxonomy of crypto‐forensics and forensic blockchain. In addition, we have introduced an architecture that integrates artificial intelligence (AI) and blockchain technologies to investigate and protect against instances of cryptocurrency fraud. The suggested design's effectiveness was evaluated using several machine learning (ML) classification algorithms. The conclusion of the evaluation confirmed that the random forest (RF) classifier performed the best, delivering the highest level of accuracy, that is, 97.5%. Once the ML classifiers detect cryptocurrency fraud, the information is securely stored in the InterPlanetary File System (IPFS); the document's hash is also stored in the blockchain using smart contracts. Law enforcement can leverage blockchain technology to secure access to fraudulent cryptographic transactions. The proposed architecture was tested for bandwidth utilization. Despite the potential benefits of blockchain and crypto‐forensics, several issues and challenges remain, including privacy concerns, standardization, and difficulty identifying fraud between crypto‐currencies. Finally, the paper discusses various problems and challenges in blockchain and crypto forensics to investigate cryptocurrency fraud.
B. Hong, Thắng Lê Đức, Doan Minh Trung, Tuan-Dung Tran · 6 authors
The proliferation of smart contracts on blockchain technology has led to several security vulnerabilities, causing significant financial losses and instability in the contract layer. Existing machine learning-based static analysis tools have limited detection accuracy, even for known vulnerabilities. In this study, we propose a novel deep learning-based model combined with attention mechanisms for identifying security vulnerabilities in smart contracts. Our experiments on two large datasets (SmartBugs Wild and Slither Audited Smart Contracts) demonstrate that our approach successfully achieves a 90% detection accuracy in identifying smart contract reentrancy attacks (e.g. performing better than other existing state-of-the-art deep learning-based approaches). In addition, this work also establishes the practical application of deep learning-based technology in smart contract reentrancy vulnerability detection, which can promote future research in this domain.
Shen Su, Yue Xue, Liansheng Lin, Chao Wang · 9 authors
The burgeoning landscape of blockchain technology has made the security of deployed smart contracts an imperative concern. While existing security measures excel in pre-deployment testing, they fall short in protecting smart contracts once they are deployed, leaving them susceptible to malicious attacks. In this paper, we propose a novel Smart Contract Firewall framework designed to bridge this security gap. Functioning as a dynamic gateway, the framework employs real-time transaction inspection through adaptable filtering rules, enabling the identification and rollback of malicious transactions as they occur. Our empirical analysis demonstrates the framework's efficacy in mitigating a majority of existing vulnerabilities in the deployed smart contracts. Although the added layer of security comes at a cost, we prove that the increased gas expenses could be limited to 30 % -50 % for most transactions. This trade-off, we argue, is a small price to pay for significantly enhanced security.
Le Cong Trinh, Vu Trung Kien, Trinh Minh Hoang, Nguyen Huu Quyen · 7 authors
In this paper, we present a comprehensive approach for efficient vulnerability detection in Ethereum smart contracts using a multimodal deep learning (DL) approach. Our proposed approach combines two levels of features in smart contracts, including source code, bytecode, and utilizes BERT and Bi-LSTM models to extract and analyze the features. The last layer of our multimodal approach is a fully connected layer that predicts the vulnerability in Ethereum smart contracts. We address the limitations of existing deep learning-based vulnerability detection methods for smart contracts, which often rely on a single type of feature or model, resulting in limited accuracy and effectiveness. The experimental results show that our proposed approach achieves superior results compared to existing state-of-the-art methods, demonstrating the effectiveness and potential of multimodal DL approaches in smart contract vulnerability detection.