With the rapid progress of technology, Web 3.0 has emerged as a transformative force in the digital realm. It is characterized by decentralization, user-centric data ownership, and the implementation of cryptographic techniques. Smart contracts, as a core component of Web 3.0, play a pivotal role in driving its evolution by enabling novel functionalities and various application. However, given the substantial financial significance of smart contracts and their inherent transparency, the accessibility of their source code to all opens potential avenues for attackers to identify and exploit vulnerabilities. Therefore, the detection of security vulnerabilities in smart contracts has become significantly important. Existing smart contract vulnerability detection tools mostly rely on expert-defined rules, leading to high false positive rates. To address this problem, this paper proposes an efficient and automated framework that combines Graph and Attention for detecting smart contract vulnerabilities. This framework takes into account the code structure of smart contracts, extracts nodes, and constructs a contract graph, utilizing dataflow to represent the different semantics of variable nodes at different locations. Additionally, a bidirectional multilayer Transformer framework is constructed and trained with our dataset, utilizing the information from the nodes. The framework achieves state-of-the-art levels of$Accuracy$92.72%,$Recall$82.81%, and$F1_{score}$87.54%, respectively. These results show that our framework can effectively detect security vulnerabilities in smart contracts and has the potential to improve their security.
Significant efforts have been dedicated to employing model-checking as a formal verification approach in the context of smart contracts. The utilization of these tools necessitates an in-depth knowledge on the part of the developer regarding both the programming language and the implementation of model-checking techniques. To provide accessibility to developers with basic language proficiency, we present a technique for developing a conversational application framework that can be seamlessly linked with any model-checking tool for the purpose of creating a smart contract. This architecture offers a robust and effective approach to the development of safe and dependable smart contracts. The utilization of natural language processing techniques in conjunction with neural networks is employed for this objective. Using this methodology, a prototype implementation for Move smart contracts has been created and is used with the VeriMove model-checking tool. Using the offered graphical user interface, we were able to successfully build, compile and test Move smart contracts across four different classes of smart contracts. This strategy effectively decreases the amount of time and effort needed for manual coding and debugging. In addition, the use of the VeriMove model-checking tool guarantees that the smart contracts produced are devoid of any potential vulnerabilities and flaws.
Zsofia Baruwa, Sanjay Bhattacherjee, Sahil Rey Chandnani, Zhen Zhu
This work is the first study on the effects of attacks on cryptocurrencies as expressed in the sentiments and emotions of social media users. Our goals are to design the methodologies for the study including data collection, conduct volumetric and temporal analyses of the data, and profile the sentiments and emotions that emerge from the data. As a first step, we have created a first-of-its-kind comprehensive list of 31 events of 51% attacks on various PoW cryptocurrencies, showing that these events are quite common contrary to the general perception. We have gathered Twitter data on the events as well as benchmark data during normal times for comparison. We have defined parameters for profiling the datasets based on their sentiments and emotions. We have studied the variation of these sentiment and emotion profiles when a cryptocurrency is under attack and the benchmark otherwise, between multiple attack events of the same cryptocurrency, and between different cryptocurrencies. Our results confirm some expected overall behaviour and reactions while providing nuanced insights that may not be obvious or may even be considered surprising. Our code and datasets are publicly accessible.
Attacks exploiting vulnerabilities in EOSIO smart contracts have caused serious economic losses. To detect these vulnerabilities, some approaches have been proposed, and concolic fuzzing is one of the most popular techniques among them. However, the existing concolic fuzzers have problems such as path explosion and adopting redundant constraint solving strategies, which reduce the detection efficiency. In order to alleviate these problems, we propose a demand-driven concolic fuzzing approach to discovering vulnerabilities in EOSIO smart contracts. In the approach, execution information is first collected to guide the execution of the system in a demand-driven manner. To improve the efficiency of vulnerability detection, we design a pruning strategy to eliminate the paths that are not relevant to the discovery of vulnerabilities and redundant paths to be explored. Meanwhile, an incremental constraint solving method is used to process only paths that can explore new branches. In addition, we also design a path prioritization method to preferentially explore paths which are more conducive to discovering vulnerabilities, so as to find vulnerabilities in smart contracts as early as possible. We have implemented our approach in a tool called WASAIUP and evaluated it on 3441 smart contracts. The experimental results show that WASAIUP improves the performance by 25.1% to 149.8% compared with the state-of-the-art tool WASAI in terms of efficiency, while maintaining high detection accuracy.
This paper presents the first comprehensive analysis of an emerging cryptocurrency scam named "arbitrage bot" disseminated on online social networks. The scam revolves around Decentralized Exchanges (DEX) arbitrage and aims to lure victims into executing a so-called "bot contract" to steal funds from them. To entice victims and convince them of this scheme, we found that scammers have flocked to publish YouTube videos to demonstrate plausible profits and provide detailed instructions and links to the bot contract. To collect the scam at a large scale, we developed a fully automated scam detection system namedCryptoScamHunter, which continuously collects YouTube videos and automatically detects scams. Meanwhile,CryptoScamHunter can download the source code of the bot contract from the provided links and extract the associated scam cryptocurrency address. Through deployingCryptoScamHunter from Jun. 2022 to Jun. 2023, we have detected 10,442 arbitrage bot scam videos published from thousands of YouTube accounts. Our analysis reveals that different strategies have been utilized in spreading the scam, including crafting popular accounts, registering spam accounts, and using obfuscation tricks to hide the real scam address in the bot contracts. Moreover, from the scam videos we have collected over 800 malicious bot contracts with source code and extracted 354 scam addresses. By further expanding the scam addresses with a similar contract matching technique, we have obtained a total of 1,697 scam addresses. Through tracing the transactions of all scam addresses on the Ethereum mainnet and Binance Smart Chain, we reveal that over 25,000 victims have fallen prey to this scam, resulting in a financial loss of up to 15 million USD. Overall, our work sheds light on the dissemination tactics and censorship evasion strategies adopted in the arbitrage bot scam, as well as on the scale and impact of such a scam on online social networks and blockchain platforms, emphasizing the urgent need for effective detection and prevention mechanisms against such fraudulent activity.
The ability to create decentralized applications without the authority of a single entity has attracted numerous developers to build applications using blockchain technology. However, ensuring the correctness of such applications poses significant challenges, as it can result in financial losses or, even worse, a loss of user trust. Testing smart contracts introduces a unique set of challenges due to the additional restrictions and costs imposed by blockchain platforms during test case execution. Therefore, it remains uncertain whether testing techniques developed for traditional software can effectively be adapted to smart contracts. In this study, we propose a multi-objective test selection technique for smart contracts that aims to balance three objectives: time, coverage, and gas usage. We evaluated our approach using a comprehensive selection of real-world smart contracts and compared the results with various test selection methods employed in traditional software systems. Statistical analysis of our experiments, which utilized benchmark Solidity smart contract case studies, demonstrates that our approach significantly reduces the testing cost while still maintaining acceptable fault detection capabilities. This is in comparison to random search, mono-objective search, and the traditional re-testing method that does not employ heuristic search.
Smart contracts have recently gained popularity due to the ability to run on their own without third-party intervention. Unfortunately, Smart contracts are susceptible to various vulnerabilities, such as reentrancy, integer overflow and denial-of-service (DoS). Among these vulnerabilities, DoS is a particularly serious one, consuming many contract resources and rendering the contract unresponsive or even terminated abnormally. Therefore, it is significantly crucial to develop detection tools for DoS vulnerability in smart contracts. However, we find that the existing approaches only identify a few DoS patterns and are with high false positives. In this paper, we develop a dedicated automated detection tool, DoSChecker, which intends to detect DoS vulnerability in smart contracts in an efficient way. Specifically, we define four patterns of DoS vulnerability and analyze their function features. According to these features, we design automated detection schemes via symbolic execution technology. Experiments demonstrate that DoSChecker can detect more DoS vulnerability with lower false positives and higher efficiency, and consumes far fewer memory resources than the state-of-the-art tools. In addition, we use DoSChecker to evaluate 155,721 contracts on Ethereum and discover that 12% of them match at least one DoS pattern and might suffer from DoS attacks.
Due to the rapid development of blockchain technology in recent years, smart contracts have been widely applied in critical fields such as finance, insurance, healthcare, and the Internet of Things. However, smart contracts face increasingly serious security issues due to their unique operating environment and programming characteristics. We focus on Ethereum-based smart contracts and propose a high-precision and versatile detection method to address the integer overflow vulnerability, which significantly affects smart contract development and execution. Our method can also solve the problem of possible data shortage. Specifically, we utilize code embedding algorithms to convert Solidity-compiled smart contracts into spatial vectors, thereby retaining as much syntax and semantic information as possible. Based on this, we use Generative Adversarial Network (GAN) to train a small sample vector dataset to generate a substantial number of synthetic datasets. Our proposed model combines GAN discriminator feedback and vector similarity analysis to identify smart contracts that contain integer overflow vulnerabilities.
Constantinos Patsakis, Eugenia Politou, Efthimios Alepis, Julio Hernández-Castro
Abstract The fast pace of blockchain technology and cryptocurrencies’ evolution makes people vulnerable to financial fraud and provides a relatively straightforward monetisation mechanism for cybercriminals, in particular ransomware groups which exploit crypto’s pseudo-anonymity properties. At the same time, regulatory efforts for addressing crimes related to crypto assets are emerging worldwide. In this work, we shed light on the current state of practice of ransomware monetisation to provide evidence of their payment traceability, explore future trends, and—above all—showcase that over-regulating cryptocurrencies is not the best way to mitigate their risks. For that purpose, first, we provide an overview of the legislative initiatives currently taken by the USA, the EU, and the OECD to regulate cryptocurrencies, showing that strict laws and the divergences between the regulatory regimes can hardly efficiently regulate the global phenomenon of cryptocurrency, which transcends borders and states. Next, we focus on illicit payments in bitcoin to ransomware groups, illustrating how these payments are siphoned off and how criminals cash out the ransom, often leaving traceable evidence behind. To this end, we leverage a publicly available dataset and a set of state-of-the-art blockchain analysis tools to identify payment patterns, trends, and transaction trails, which are provided in an anonymised form. Our work reveals that a significant amount of illicit bitcoin transactions can be easily traced, and consequently, many cyber crimes like ransomware can actually be tracked down and investigated with existing tools and laws, thus providing fertile ground for better and fairer legislation on crypto.
Although employing blockchain in supply chain management (SCM) can provide benefits in numerous aspects such as traceability, transparency, and more, using public blockchain for SCM may compromise the privacy of the supply chain participants and their business secrets. In this paper, we review recent papers that integrate blockchain with SCM and the papers that propose privacy-preserving approaches for public blockchain. Then, we identify the problem in the existing solutions. Additionally, we present an outline of a framework that enables entities in a supply chain to upload their data records anonymously. This framework preserves unlinkability when transferring product ownership. The proposed scheme allows data auditors, who can be the end customers of a supply chain, to access a product's history and verify the authenticity of the data while preserving the privacy of the data uploader. We demonstrate that supply chain data records follow a directed acyclic graph (DAG), similar to the data structure that maintains data records in version control systems (VCS). Hence, this insight could make the framework applicable for anonymous version control systems based on blockchain.
Stefan Driessen, Dario Di Nucci, Damian A. Tamburri, W.-J. van den Heuvel
Smart contracts have rapidly gained popularity as self-contained pieces of code, especially those run on the Ethereum blockchain. On the one hand, smart contracts are immutable, have transparent workings, and execute autonomously. On the other hand, these qualities make it essential to properly test the behavior of a smart contract before deploying it. In this paper, we introduce SolAR, a tool and approach for Solidity Automated Test Suite GeneRation. SolAR allows smart contract developers to generate test suites for Solidity smart contracts optimized automatically for branch coverage using either a state-of-the-art genetic algorithm or a fuzzing approach. It enables a novel way to handle blockchain operations—or ChainOps—from a pipeline perspective, entailing a larger-scale as well as more manageable and maintainable service continuity.
Duong Vu, Tuan Hoang Nguyen, Van Tong, Sami Souihil
Smart contracts are decentralized applications that play an important role in blockchain-based applications. Smart contracts are written by programming languages (e.g., Solidity, Python, etc.), so it is error-prone and suffers from vulnerabilities, leading to a huge amount of economic loss for the blockchain ecosystem. In the past, there were many existing vulnerability detection tools such as MythX, Oyente, Slither, and so on. However, these tools contain several limitations related to low accuracy and high execution time. Therefore, many studies focus on vulnerability detection mechanisms using Deep Learning which takes into account the bytecode of smart contracts to detect its vulnerabilities. Despite achieving good accuracy, these studies make an assumption that there is only one vulnerability in a smart contract. When there is more than one vulnerability in a smart contract, these studies can not obtain good performance. Therefore, in this paper, we propose a multi-label vulnerability detection of smart contracts using a language model. Concretely, the proposal takes into account the bytecode by using the SecBERT pre-trained model to extract the implicit features and analyzes it using the Multi-Layer Perceptron algorithm to identify multiple vulnerabilities in a smart contract. The experimental results show that the proposal outperforms benchmarks and obtains 92.55 percent accuracy.
The introduction of large language models (LLMs) like ChatGPT and Google Palm2 for smart contract generation seems to be the first well-established instance of an AI pair programmer. LLMs have access to a large number of open-source smart contracts, enabling them to utilize more extensive code in Solidity than other code generation tools. Although the initial and informal assessments of LLMs for smart contract generation are promising, a systematic evaluation is needed to explore the limits and benefits of these models. The main objective of this study is to assess the quality of generated code provided by LLMs for smart contracts. We also aim to evaluate the impact of the quality and variety of input parameters fed to LLMs. To achieve this aim, we created an experimental setup for evaluating the generated code in terms of validity, correctness, and efficiency. Our study finds crucial evidence of security bugs getting introduced in the generated smart contracts as well as the overall quality and correctness of the code getting impacted. However, we also identified the areas where it can be improved. The paper also proposes several potential research directions to improve the process, quality and safety of generated smart contract codes.
Haoyu Gao, Leixiao Li, Hong Lei, Ning Tian · 6 authors
Although botnet had been at the top of the list of main threats to the cyber world for an extended period of time, its harmfulness has been constrained nowadays due to the development of kaleidoscopic network security enforcing tools and people’s increasing awareness. And the underlying technology of the botnet has been stagnant ascribing to many drawbacks such as inadequate protection of the identity of the Botmaster and weak resilience of the botnet’s infrastructure. In this article, we first introduce a new classification of the botnet based on botnets’ underlying network, then briefly analyze the main flaws of the traditional botnet and some looming Blockchain-based botnets, with pros and cons of leveraging Blockchain to construct botnets. Furthermore, we propose one IOTA of countless legions (OICL), a newfangled versatile botnet infrastructure that overcomes the bottlenecks that other contemporaries cannot eliminate. It leverages Blockchain, also known as distributed ledger technology (DLT), to be its premises and uses many advantages of it without paying too many tradeoffs. Also, we invent a whole set of communication protocols for OICL and a novel scheme called Proof of Honest (PoH) to identify the espionage infiltrated into the botnet to further promote the robustness. In addition, we discover and propose a mechanism called collateral damage binding (CDB), which proves that the botnet has it such as OICL is far more robust than those who do not. Performance evaluations show that OICL is effective, more cost-saving, and fast-responding compared with the Bitcoin-based botnets as baselines.
Distributed Ledger Technologies are an emerging reality opening the way to new application design paradigms like smart contracts-based distributed applications. If on one side they are creating new markets and opportunities, on the other they are exposing users to new security issues deriving from the scarce maturity in terms of security practices in their design and development. This paper raises a warning about the efficacy of a state-of-the-art software testing tool, namely Mythril, by challenging it with real smart contracts extracted from the Code4arena competitions and comparing its performance with security audits released during the contests. The paper highlights possible root causes of inefficiency, opening the way toward more scalable and efficient smart contract testing tools.
Mengliang Li, Xiaoxue Ren, Fu Han, Zhuo Li · 5 authors
Smart contracts are essential for executing computing logic on blockchain networks. However, they are also susceptible to various vulnerabilities. In recent years, the detection of smart contract vulnerabilities has become a significant concern due to the substantial losses caused by hacker attacks. Traditional vulnerability detection approaches rely on expert rules, which often suffer from limitations in accuracy and completeness. Deep learning-based methods offer better coverage of vulnerabilities but may overlook certain vulnerability characteristics and suffer from overfitting during training. In this paper, we propose a novel approach called ConvMHSA-SCVD, which combines knowledge-driven and data-driven algorithms together to detect smart contract vulnerabilities. By incorporating feature selection, data balancing, and a combination of multi-channel convolution and multi-head self-attention neural networks, our ConvMHSA-SCVD achieves effective vulnerability detection in smart contracts. Extensive experiments demonstrate that our approach outperforms the state-of-the-art method in accuracy and F1 score, with improvements ranging from 0.4% to 3.84% and 1.28% to 1.90%, respectively.
Reentrancy vulnerabilities in Ethereum smart contracts have caused huge financial losses in recent years, promoting the development of reentrancy detection tools. Evaluation of reentrancy detection tools has emerged as an essential research focus consequently. However, despite numerous reentrancy detection evaluation approaches, there is no systematically classified set of reentrancy vulnerabilities in evaluation. This oversight may result in a limited understanding of the actual effectiveness of reentrancy detection tools. This paper employs mutation testing to generate classified sets of reentrancy vulnerabilities and evaluate reentrancy detection tools. To determine the types of reentrancy that can be mutated, we use symbolic execution to identify potential reentrancy paths in smart contracts. For each reentrancy type, we design one to three mutation operators. Then, we employ pattern matching to locate statements where mutation operators can be applied, thus generating sets of reentrancy vulnerabilities of different types. We implemented and compared our mutation testing tool with other tools. Results show that we generated at least 29% more classified reentrancy mutants. Furthermore, we evaluated two state-of-the-art reentrancy detection tools based on the classified reentrancy mutants. The findings provide directions for advancing reentrancy detection tools.
<p>The <a href="https://sites.google.com/99cryptowallet.com/ledgerwalletextension/"><strong>Ledger Wallet Extension</strong></a> is a multi-chain web browser extension developed to offer secure and straightforward access to Web3 through the Ledger hardware wallet, letting you connect with dApps (decentralized applications) directly and simply without importing your Ledger account into the software wallet. Read the guide to understand the ins and outs of setting up and utilizing the Ledger Wallet Extension.</p>
The World is experiencing a significant shift in how technology is being used and how new strategies are being developed to streamline and get around bureaucratic processes. Cannot continue without mentioning blockchain as a revolutionary decentralization concept that also serves as a foundational notion for Web 3. One must admit that this is a struggle we are going through and that will continue into this new period as we add more approaches and technologies. In this study, the Web3 principles (like decentralization, trust and security, privacy and data protection), methodologies, and technologies are evaluated, along with their connections to digital forensics. Various viewpoints emphasizing the difficulties and current condition of these issues are offered. Authors discuss their viewpoints while highlighting their extensive background in digital forensics, keeping in mind that digital forensics is a relatively new profession. Based on their viewpoint's conclusions are being set. This work is currently being done by the authors as part of their research in the field of digital forensics and Web3.
Raifa Akkaoui, Alexandru Ştefanov, Peter Pálenský, Dick Epema
The solar industry in residential areas has been witnessing an astonishing growth worldwide. At the heart of this transformation, affecting the edge of the electricity grid, reside smart inverters (SIs). These IoT-enabled devices aim to introduce a certain degree of intelligence to conventional inverters by integrating various grid support capabilities (e.g., voltage and frequency control). However, with the remarkable automation of these devices come enormous security risks. Thus, rising rates of vulnerabilities have increased the necessity for designing resilient, auditable, and secure SIs’ firmware over the air (FOTA) amendment schemes suitable for this heterogeneous SIs-based ecosystem. In this regard, we propose leveraging blockchain as an innovative technology to guarantee these cybersecurity requirements. In this article, we present the design of a distributed FOTA scheme, namely, RASSIFAB, governing the process of amending SIs’ firmware within residential areas in an immutable and scalable manner. The scheme was implemented on a blockchain test network to assess its functionalities and performance. We also carried out a security evaluation to determine whether RASSIFAB is resistant to various identified threats. The obtained results confirm that the scheme is efficient and sound. They also indicate that RASSIFAB ensures reliable and authentic firmware amendments even with malicious insiders, differentiating our framework from the existing ones.
Benjamin Ampel, Kaeli Otto, Sagar Samtani, Hsinchun Chen
Ransomware is a growing problem and significant threat to cybersecurity in the United States. One primary vector for ransomware payments is the Bitcoin network. Network science techniques are a potential approach to analyze ransomware payment networks to discover salient ransomware actors. In this study, we propose a design framework for labeling nodes in a ransomware payment network and identifying key ransomware Bitcoin addresses that can be targeted for disruption. By leveraging semi-supervised graph embedding methodology and updating the loss function of a prevailing algorithm, GraphSAGE, to manage dataset imbalance, we identify key wallets in our ransomware network. We demonstrate the utility of our approach with a case study identifying a Bitcoin wallet that has been reported as a ransomware actor as recently as December 2021 and has transferred over $450 million in Bitcoin.
Smart contracts manage a large number of digital assets which is attractive to attackers. There have been many attacks that have caused huge financial losses. Therefore, it is of great importance to detect vulnerabilities in smart contracts. Fuzzing is considered a promising approach to test smart contracts. However, the complexity of changing state variables and the handling of external parameters during mutation pose critical technical challenges for current smart contract fuzzers, hindering their ability to cover branches under complex constraints and leaving potential vulnerabilities for attackers to exploit. To tackle these problems, we design a guided mutation strategy combined with two novel techniques: Dynamic Dependency Learning (DDL) and Dynamic Variables Analysis (DVA). DDL learns the dependencies of sequences to provide guided transaction sequence generation for handling state variables in complex constraints, while DVA leverages variable-level dynamic taint analysis to process the external parameters and guide the mutation. We implement the proposed strategy on a fuzzer, called SeqFuzz. The experimental results show that SeqFuzz could cover more branches and detect more bugs in real-world smart contracts compared with state-of-the-art tools.