As blockchain ecosystems grow, financially motivated attackers increasingly exploit decentralized finance (DeFi) protocols, causing frequent and severe losses. Unlike conventional cyberattacks, DeFi exploits propagate rapidly due to the transparent and composable nature of smart contracts. We identify a critical pattern, Imitative Attack Cascade: an initial successful exploit is quickly followed by mimicking transactions that reuse attack logic with minor modifications or parameter changes. Our empirical analysis shows that over 69% of DeFi attacks exhibit strong behavioral similarity to earlier incidents, often within hours or days of the initial attack. This exposes a fundamental limitation in current reactive detection. Initial attacks are typically flagged via heuristic alerts (Tornado Cash traces, anomalous nonce usage, exploiter labels), but turning these signals into detection rules requires manual validation and handcrafted trace analysis -- a labor-intensive, slow process that leaves follow-up attacks to spread. Our goal is to ensure that once an attack has been observed, even a single instance, it can be rapidly abstracted into an actionable, generalizable detection rule. We decompose the problem into two challenges: (I) abstracting the semantics of diverse, obscure function signatures, and (II) matching transaction logic in noisy, evasive traces. We leverage two insights: (i) the open-source nature of most DeFi protocols enables high-fidelity semantic classification of function signatures; (ii) contract labels isolate essential logic by filtering irrelevant calls and classifying attack intent. Building on these, we develop GenDetect, which achieves ACC 98%, FPR 1%, FNR 3% and discovers 56 previously unrevealed attacks from the past three years. Source code and dataset: https://github.com/NobodyIsAnonymous/GenDetect_ICSE2026
Phishing attacks pose a significant security issue in Ethereum-based blockchain systems. Existing solutions, like TEGDetector, address these attacks by analysing how transactions evolve over time using Transaction Evolution Graphs (TEGs) constructed via time slicing, followed by a dynamic graph classifier that captures both spatial structure and temporal evolution with learned time coefficients. However, building and managing these graphs across multiple stages makes the overall approach complex and difficult to implement. In this work, we propose E2E-EmbedDetector, a lightweight end-to-end neural classification model that works directly with raw transaction data. The model learns embedding representations for important entities such as From, To, and ContractAddress, and also used two additional numeric features: transactional value and a derived input length. We train and evaluate the model on a balanced dataset of 50,000 Ethereum transaction using an 80/20 stratified split. The model achieves an accuracy of 95.63%, precision of 0.9265, recall of 0.9912, an F1 score of 0.9578, a ROC-AUC score of 0.9915 and a PR-AUC score of 0.9909. These results show that strong phishing can be achieved using a simpler and more practical tabular approach, without relying on complex temporal graph- based networks.
Security vulnerabilities in smart contracts can lead to serious economic losses, while traditional detection methods have limitations in coarse-grained labeling and single graph structure representation. We propose an improved GraphCodeBERT based multi granularity and multi graph fusion smart contract vulnerability detection method. Firstly, propose a vulnerability multi granularity annotation (MA) module that includes file level, function level, and statement level to address the issue of fine-grained annotation. Secondly, based on the data flow graph encoded by GraphCodeBERT, further design a multi graph fusion representation learning (MGRL) strategy. This strategy integrates control flow graph and function call graph, captures code semantics from control dependency and call dependency dimensions through graph attention network and graph convolutional network, to comprehensively enhance the representation capability of complex vulnerabilities. The detection results of four smart contract vulnerabilities show that our method outperforms mainstream methods such as Slither, CodeBERT, Devign, and GraphCodeBERT in accuracy, recall, and F1 score. Especially in sentence level detection tasks, the F1 score reached 81.03%, an increase of 7.31% compared to the baseline, and the false positive rate decreased to 8.15%.
Behkish Nassirzadeh, Rui Xi, Karthik Pattabiraman, Vasisht L. Ganesh
Blockchain technologies have experienced rapid adoption across various sectors, including supply chain management, decentralized finance and cross-border payments. With this growth, however, the complexity and security risks of maintaining blockchain integrity and functionality have increased. Addressing these challenges requires a systematic and rigorous organization of knowledge in blockchain security. This paper presents a Systematization of Knowledge (SoK) study based on a structured survey of academic literature, industry reports and real-world case studies. The authors classify vulnerabilities into three layers: system-level, smart contract-level and application-level, analyzing their root causes, real-world prevalence and mitigation tradeoffs. The taxonomy encompasses blockchain-specific threats (e.g. gas-based DoS attacks, MEV) as well as vulnerabilities inherited from distributed systems and software (e.g. Sybil attacks, access control failures). The authors critically evaluate detection and mitigation techniques, including static and dynamic analysis, fuzzing, symbolic execution and formal verification, assessing their precision, recall, scalability and inherent limitations. The authors further review state-of-the-art auditing tools in terms of methodology, adoption and shortcomings. Finally, the authors discuss advanced approaches such as hybrid frameworks that combine AI with program analysis, SMT solvers, and zero-knowledge proofs, outlining how these can address current gaps in scalability, interpretability and runtime verification. Overall, this study systematizes the security landscape of blockchain technologies, synthesizes the limitations of current approaches, and identifies technically actionable future research directions toward building more robust and resilient blockchain systems.
Apr 22, 2026·2026 International Conference on Recent Advances in Electrical, Electronics, Ubiquitous Communication, and Computational Intelligence (RAEEUCCI)
Most blockchain anomaly detection research is model-centric, focusing on either proposing new models or comparing benchmarks. Very little work addresses how such methods behave when actually deployed. Data ingestion, feature updates, and inference stability are among the practical concerns that usually get ignored. This work targets this: design, implementation, and evaluation of an AutoML-based platform for anomaly detection targeting Ethereum wallets. The emphasis is on operational behavior, rather than algorithmic novelty. The system is an AutoGluon ensemble that is trained offline from historical, labeled data. Each wallet behavior is represented as a fixed-length feature vector. During inference, live blockchain data is fetched through the blockchain API. This data is transformed into features required by the trained model. The predictor then outputs probabilistic risk scores along with feature-level explanations. Feature computation and model inference are treated as separate processes. This separation allows repeated inference without online learning or continuous retraining. The experimental evaluation discusses several deployment-relevant factors, including class imbalance during training and the contribution of different feature groups. It also examines the stability of the risk score under repeated feature recomputation. Results show that imbalance-aware training improves the reliability of detection. They also indicate that anomaly detection depends on the combined effect of multiple behavioral feature categories.
Donghan Chen, Zhihui Lu, Chenchi Luo, J I N Y I Lin · 7 authors
The growth of decentralized finance (DeFi) has been accompanied by an increase in rug pull scams, in which developers misappropriate investors’ funds, rendering the associated tokens worthless. Existing detection methods struggle to capture dynamic on-chain information and provide interpretable risk assessments. This paper presents RugKeeper, a multi-agent framework leveraging large language models for rug pull detection. RugKeeper constructs comprehensive token contexts via a two-step question-driven process and performs multi-path collaborative reasoning, with a Judger Agent validating results to reduce model hallucinations. Evaluations on historical datasets demonstrate that RugKeeper outperforms state-of-the-art methods, achieving 93.55% accuracy, 95.92% F1-score and robust generalization across model backbones. In a real-world sampled dataset from the BNB Chain, 638 previously undetected rug pull tokens were identified. These results highlight the effectiveness of RugKeeper in enhancing DeFi security and supporting risk mitigation.
Ethereum’s active financial ecosystem makes itself become a hotbed of phishing scams. Existing studies construct transaction subgraphs and employ GNNs to identify potential phishing accounts. However, existing detection methods rely on complete historical transaction data, making it difficult to detect scams at an early stage. To address this issue, we propose Ethereum Phishing Scams Early Detection (called EPED) method. First, we combine GCN and GRU to capture accounts’ local structural relations and the temporal evolution of their transactions. Second, we introduce deep reinforcement learning for adaptive optimization of the detection time. The two strategies jointly enable early detection with limited data. Experimental results demonstrate that by using only 4.6 days of transaction data, our method achieves a Recall 4.09% higher than existing methods that rely on the full dataset. This result demonstrates the method’s timeliness and effectiveness.
Introduction The proliferation of dApps is increasing the attack surface for exploitable vulnerabilities in smart contracts, and thus there is a need for verifiable detection methodologies. Methods In this work, we propose a machine learning framework with blockchain integration for explainable and note that “explainable” implies “verifiable” smart contract vulnerability detection. The SmartBugs-curated data was systematically pre-processed with metadata filtering, feature correlation analysis and encoding for model evaluation. Four ensemble learning methods, Random Forest, XGBoost, LightGBM and CatBoost were tested under identical experimental settings for comparison. Results The Random Forest classifier initially achieved the best balance in terms of stability and performance with an accuracy of 87.67%, successfully detecting important vulnerability classes such as re-entrancy, unchecked low-level calls, etc. To enhance the applicability of our blockchain-based machine learning framework for vulnerable smart contract analysis we extend it from the initial 143-contract dataset SmartBugs-Curated to evaluate it on on large-scale set, namely, SmartBugs-Wild which contains 47,398 real-world Ethereum contracts. Based on 29 static contract-level features, unsupervised clustering (k = 4, silhouette score = 0.3735) identifies discrete structural archetypes present in the dataset. Ensemble classifiers (such as XGBoost, CatBoost, Random Forest and LightGBM) can get excellent discriminative performance on these cluster labels: LightGBM achieves 99% accuracy and 0.98918 macro-F1. Discussion The additional results show that the approach scales, is robust and leads to stable models, even if interpretable. After injecting SHAP-based explainability, the interpretability and predictive power of CatBoost became similar to those of Random Forest. In order to guarantee end-to-end trust and traceability of our optimised classifier, this was linked to a blockchain oracle that independently store the outcomes as well as confidence scores for predictions directly onto an Ethereum-compatible ledger through a Vulnerability Registry smart contract. This integration provides the data is immutable, auditable and transparent in reporting.
Detecting vulnerabilities in smart contracts is a critical challenge for blockchain security, as flaws such as reentrancy, timestamp dependence, and infinite loops have resulted in severe financial losses in decentralized systems. Accurate and interpretable detection of these vulnerabilities remains challenging due to the complex semantics of smart contract code. In this study, we propose a multimodal hybrid recurrent framework for smart contract vulnerability detection that integrates sequential and structural code representations. The framework introduces a Selective Subpattern Activation (SSA) mechanism, which highlights vulnerability-indicative code subpatterns during the pattern extraction phase and provides interpretable insights into model predictions. Pattern-based features enhanced by SSA are processed using a Bidirectional Gated Recurrent Unit (BiGRU), while structural features derived from control and data flow representations are modeled using a Bidirectional Long Short-Term Memory (BiLSTM) network. The proposed approach is evaluated on a publicly available Ethereum smart contract dataset using five independent experimental runs, with results reported as averages. The results show that the framework achieves an accuracy of 92.16% and an F1 score of 88.83% for reentrancy vulnerability detection, achieving higher performance compared to baseline deep learning and graph-based models. Ablation experiments are performed to demonstrate the contribution of the SSA mechanism to both detection performance and interpretability.
Smart contracts are critical to blockchain but face significant security challenges, where potential vulnerabilities can lead to financial losses and undermine system trustworthiness. Code obfuscation has emerged as a crucial technique for countering reverse engineering and enhancing contract security. However, existing methods suffer from three major limitations: (1) current bytecode obfuscation methods are primarily designed for traditional programming languages and cannot be directly applied to Solidity; (2) these methods exhibit limited resistance against advanced decompilation tools; and (3) they often result in high gas consumption. To this end, we propose BOSC , a novel bytecode obfuscation method that integrates four obfuscation strategies from both structural and semantic perspectives to enhance obfuscation effectiveness. Specifically, in structural perturbation, we adopt and refine incomplete instruction obfuscation and false branch obfuscation, while in semantic perturbation, we improve and employ instruction reordering obfuscation and flower instruction obfuscation. Experimental results demonstrate that BOSC significantly increases the decompilation failure rate from 6.06% to 96.4%, and raises cyclomatic complexity by 81.83%, providing robust protection against automated attacks. This improvement incurs only a modest additional gas cost of 1,792 gwei , which translates to an approximate expense of 0.33869 USD , thereby achieving a balance between obfuscation effectiveness and economic efficiency.
Permission control vulnerabilities in Non-fungible token (NFT) contracts can result in significant financial losses, as attackers may exploit these weaknesses to gain unauthorized access or circumvent critical permission checks. In this paper, we propose NFTDELTA, a framework that leverages static analysis and multi-view learning to detect permission control vulnerabilities in NFT contracts. Specifically, we extract comprehensive function Control Flow Graph (CFG) information via two views: sequence features (representing execution paths) and graph features (capturing structural control flow). These two views are then integrated to create a unified code representation. We also define three specific categories of permission control vulnerabilities and employ a custom detector to identify defects through multi-view feature similarity analysis. Our evaluation of 795 popular NFT collections identified 241 confirmed permission control vulnerabilities, comprising 214 cases of Bypass Auth Reentrancy, 15 of Weak Auth Validation, and 12 of Loose Permission Management. Manual verification demonstrates the detector's high reliability, achieving an average precision of 97.92% and an F1-score of 81.09%. Furthermore, NFTDELTA demonstrates enhanced efficiency and scalability, proving its effectiveness in securing NFT ecosystems.
Smart contracts are a critical component of blockchain systems. Due to the large amount of digital assets carried by smart contracts, their security is of critical importance. Although numerous tools have been developed for detecting smart contract vulnerability, their effectiveness remains limited, particularly due to the high false positives included in the reported results. Therefore, developers and auditors are often overwhelmed with manually verifying the reported issues. A fundamental reason behind this is that while a reported vulnerability satisfies specific vulnerable patterns, it may not actually be exploitable, either because the vulnerable code cannot be triggered or it does not result in any financial loss. In this paper, we propose V2E, a new framework for validating whether a reported vulnerability is truly exploitable. The core idea of V2E is to automatically generate executable Proof-of-Concept Exploit (PoC for short), and then assess if the vulnerability could be triggered and incur any real damage (i.e., causing financial loss) by the PoC. While LLMs have shown proficiency in PoC generation, achieving our task is by no means trivial. In detail, it is difficult for LLM to: (1) generate and update PoC to trigger a specific vulnerability, (2) evaluate the PoC’s effectiveness to validate exploitable vulnerability. To this end, V2E automates the whole process through a novel combination of PoC generation, validation, and refinement: (1) Firstly, V2E generates targeted PoCs by analyzing potential vulnerability paths. (2) Then, V2E verifies the validity of PoCs through triggerability and profitability analysis. (3) In addition, V2E iteratively refines the generated PoC based on PoC execution feedback, therefore, increasing the chance to confirm the vulnerability. Evaluation on 264 manually labeled contracts shows that V2E outperforms the baseline approach. Particularly, V2E successfully identifies 102 out of 124 exploitable vulnerabilities, achieving a precision of 91.9% and a recall of 82.3%. In addition, it successfully eliminates 71 out of 140 false alarms (50.7%). Besides, V2E effectively enhances the performance of SOTA tools. It reduces the false positive rates of Slither by 76.9%, Mythril by 56.9% and Confuzzius by 65%.
Gregorio Dalia, Tat Luat Nguyen, Andrea Di Sorbo, Corrado Aaron Visaggio · 5 authors
Ethereum smart contracts manage billions in digital assets, and vulnerability detection is critical given the immutability of deployed code and the irreversible nature of transactions. However, existing tools such as Slither rely on rigid, rule-based analysis, and general-purpose language models like ChatGPT often miss rare or context-dependent bugs. To address these limitations, this paper presents BreachT5, an ensemble of two fine-tuned CodeT5+ models designed for multi-label vulnerability detection in Solidity contracts. We first fine-tune a 220M parameter model on over 67,000 real contracts labeled with the Smart Contract Weakness Classification (SWC), revealing intrinsic detection differences across vulnerability types. We then explore the performance of a 770M variant, which improves accuracy on frequent classes but underperforms on rare ones. To balance this trade-off, BreachT5 combines both models via soft voting with per-class thresholds. Our results on the BCCC-SCsVuls2024 dataset show that BreachT5 achieves 0.556 Macro-F1 and 0.612 Micro-F1, outperforming the two standalone models, Slither, and GPT-5 in multi-label vulnerability detection.
Decentralized applications (DApps) represent a paradigm shift in software architecture, leveraging blockchain technology and distributed consensus mechanisms to eliminate single points of failure and centralized control. As the adoption of DApps accelerates across sectors such as finance, supply chain, healthcare, and governance, ensuring their functional correctness and behavioral reliability has become a critical engineering challenge. Unlike traditional software, DApps operate in adversarial, permissionless environments where smart contracts execute autonomously and immutably on distributed nodes, making post-deployment correction extremely costly or impossible. This review systematically examines the landscape of functional testing methodologies tailored for decentralized applications, analyzing their suitability, limitations, and practical applicability in modern DApp development workflows. We survey research spanning smart contract verification, consensus protocol testing, oracle interaction validation, cross-chain interoperability testing, and user-layer functional testing of Web3 interfaces. The review identifies four dominant testing paradigms: (1) unit testing of smart contract functions, (2) integration testing of DApp components, (3) property-based testing using formal specifications, and (4) end-to-end simulation on testnets. Through comparative analysis across 13 seminal studies, we evaluate each approach along dimensions of automation feasibility, coverage depth, gas efficiency awareness, and scalability to complex DApp ecosystems. Our findings indicate that while static analysis and symbolic execution tools such as Mythril, Slither, and Manticore offer strong vulnerability detection, they address security properties more than functional correctness. Conversely, framework-based testing tools like Hardhat, Truffle, and Foundry provide adequate unit-level coverage but struggle with cross-contract orchestration and event-driven logic verification. A critical gap exists in testing oracle-dependent and DAO governance workflows. This review concludes with a synthesis of best practices, open research challenges, and a directional roadmap for developing holistic functional testing frameworks suited to the evolving complexity of decentralized systems.
Wang Yishun, Wenkai Li, Xiaoqi Li, Zongwei Li · 6 authors
Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.
Smart contracts are autonomous systems that execute agreements using code. Their efficiency generated attention from a range of industries. The basis of traditional vulnerability detection techniques, opcode analysis, has limitations in detecting complex vulnerabilities. Our research aims to address these difficulties by developing an automated framework for vulnerability detection, mitigation, and patch deployment. Initially, smart contract data will be collected, followed by a preprocessing step to remove any unnecessary information using lexical analysis and Bidirectional Encoder Representations from Transformers (BERT). Then, the preprocessed data is used to identify the features that are relevant are selected. Following the features being selected, an intellectual engine is used to identify flaws. The intellectual engine that integrates the convolutional neural networks (CNN) and long short-term memory (LSTM) analyzes a subset of preprocessed data for vulnerabilities, with explainable artificial intelligence (XAI) evaluating the importance of each feature to predictions. Our method produces exceptional outcomes with a 99.25% precision, 99.76% accuracy, 99.60% F1-score, and 99.36% recall. Smart contract vulnerability identification, mitigation, and patch generation are improved by the proposed Beluga Crayfish Optimization Algorithm (BCOA) and Crayfish Secretary Bird Optimization Algorithm (CSBOA) together with graph neural networks (GNN). In addition to producing the required fixes, this method offers efficient mitigation techniques. Therefore, it greatly enhances smart contract security and efficiency. In the end, smart contract programs that use this integrated approach are more secure.
Matteo Vaccargiu, Sabrina Aufiero, Silvia Bartolucci, Ronnie de Souza Santos · 6 authors
Labels on platforms such as GitHub support triage and coordination, yet little is known about how well they align with code modifications or how such alignment affects collaboration across contributor experience levels. We present a case study of the Kubernetes project, introducing label-diff congruence - the alignment between pull request labels and modified files - and examining its prevalence, stability, behavioral validation, and relationship to collaboration outcomes across contributor tiers. We analyse 18,020 pull requests (2014--2025) with area labels and complete file diffs, validate alignment through analysis of over one million review comments and label corrections, and test associations with time-to-merge and discussion characteristics using quantile regression and negative binomial models stratified by contributor experience. Congruence is prevalent (46.6\% perfect alignment), stable over years, and routinely maintained (9.2\% of PRs corrected during review). It does not predict merge speed but shapes discussion: among core developers (81\% of the sample), higher congruence predicts quieter reviews (18\% fewer participants), whereas among one-time contributors it predicts more engagement (28\% more participants). Label-diff congruence influences how collaboration unfolds during review, supporting efficiency for experienced developers and visibility for newcomers. For projects with similar labeling conventions, monitoring alignment can help detect coordination friction and provide guidance when labels and code diverge.
Smart contracts have transformed decentralized finance, but flaws in their logic still create major security threats. Most existing vulnerability detection techniques focus on well-supported languages like Solidity, while low-resource counterparts such as Vyper remain largely underexplored due to scarce analysis tools and limited labeled datasets. Training a robust detection model directly on Vyper is particularly challenging, as collecting sufficiently large and diverse Vyper training datasets is difficult in practice. To address this gap, we introduce Sol2Vy, a novel framework that enables cross-language knowledge transfer from Solidity to Vyper, allowing vulnerability detection on Vyper using models trained exclusively on Solidity. This approach eliminates the need for extensive labeled Vyper datasets typically required to build a robust vulnerability detection model. We implement and evaluate Sol2Vy on various critical vulnerability types, including reentrancy, weak randomness, and unchecked transfer. Experimental results show that Sol2Vy, despite being trained exclusively on Solidity, achieves strong detection performance on Vyper contracts and significantly outperforms prior state-of-the-art methods.
Solana is rapidly gaining traction among smart contract developers and users. However, its growing adoption has been accompanied by a series of major security incidents, which have spurred research into automated analysis techniques for Solana smart contracts. Unfortunately, existing approaches do not address the unique and complex account model of Solana. In this paper, we propose SseRex, the first symbolic execution vulnerability detection approach for finding Solana-specific bugs such as missing owner checks, missing signer checks, and missing key checks, as well as arbitrary cross-program invocations. Our evaluation of 8,714 bytecode-only contracts shows that our approach outperforms existing approaches and identifies potential bugs in 467 different contracts. Additionally, we analyzed 120 open-source Solana projects and conducted in-depth case studies on four of them. Our findings reveal that subtle, easily overlooked issues often serve as the root cause of severe exploits, further highlighting the need for specialized analysis tools like SseRex.