Defendr is a tool that scans smart contracts for vulnerabilities. The functionalities of a smart contract and various advantages of the blockchain architecture have resulted in an increase in the number of users in recent years. Smart contracts are commonly used to automate the execution of a contract or function such that all parties can be immediately sure of the outcome, without anyone’s involvement. The consequences of this user boost have resulted in cyber-attacks becoming more prominent. To solve a small part of this major issue, we have developed a smart contract analysis tool which intensively scans the solidity smart contract to find pre-defined vulnerabilities. The scanner works by mapping each section of the user’s contract to the pre-defined vulnerability database. When the vulnerability is detected, it is recorded and further scanning continues until all modules have been checked, then the user is notified with the recorded output. This tool contributes to enhancing the cybersecurity landscape and strengthening the defensive posture. This tool has a great scope and can be updated to cater to a larger set of vulnerabilities in the future with respect to the growing state of the blockchain ecosystem.
Aleksandar Stojanović, Marta Alić, Brigitta Cafuta
Proof-of-Work (PoW) is a consensus mechanism used by some decentralized cryptocurrency systems as the basis of transaction agreement among independent network nodes, without the need for a central authority. It requires computational time and energy to discourage malicious activities such as double spending and manipulation of the distributed ledger. This article provides an overview of the application of PoW from a Decentralized Finance (DeFi) systems perspective and its effectiveness in supporting decentralized transactions and asset management. In addition, recent advances in enhancing scalability and reducing energy consumption are discussed to address concerns regarding the efficiency and sustainability of PoW. Drawing on recent research, this article identifies several basic criteria that can serve as a foundation for understanding and anticipating future trends for the role of PoW within decentralized finance systems.
This study examines the impact of the Financial Stress Index (FSI) and US Equity Market Uncertainty (EMU) on cryptocurrencies. We analyse the short and long-run impact of FSI on prices of the top five cryptos using the Nonlinear ARDL (NARDL) framework to assess the alternative asset suitability of these cryptocurrencies during different financial market stress events. Our analysis finds a statistically significant impact of FSI and EMU on the cryptocurrency returns for both short-run and long-run. While the impact of FSI is asymmetric in the long run, we find that in the short run, the impact is symmetric. Thus, a rise in the FSI has a larger impact on the returns when compared to a fall in the FSI in the long run. The findings across various subperiods suggest that FSI and EMU affect the returns of cryptos differently. While in some periods, we see that a surge in financial stress leads to an increase in returns for some of the cryptos, for others, it leads to a decrease in returns. This indicates that the investors do not have the same preference for all the cryptos during periods of heightened financial stress and they may not be considered equal safe havens. Our results have clear policy implications for investors, regulators, and policymakers.
Smart contracts, integral to blockchain ecosystems, enable decentralized applications to execute predefined operations without intermediaries. Their ability to enforce trustless interactions has made them a core component of platforms such as Ethereum. Vulnerabilities such as numerical overflows, reentrancy attacks, and improper access permissions have led to the loss of millions of dollars throughout the blockchain and smart contract sector. Traditional smart contract auditing techniques such as manual code reviews and formal verification face limitations in scalability, automation, and adaptability to evolving development patterns. As a result, AI-based solutions have emerged as a promising alternative, offering the ability to learn complex patterns, detect subtle flaws, and provide scalable security assurances. This paper examines novel AI-driven techniques for vulnerability detection in smart contracts, focusing on machine learning, deep learning, graph neural networks, and transformer-based models. This paper analyzes how each technique represents code, processes semantic information, and responds to real world vulnerability classes. We also compare their strengths and weaknesses in terms of accuracy, interpretability, computational overhead, and real time applicability. Lastly, it highlights open challenges and future opportunities for advancing this domain.
We introduce the MoveEVM Weakness Classification (MWC) system -- a dedicated vulnerability taxonomy for smart contracts built with Move and executed in EVM-compatible environments. While Move was originally designed to prevent common security flaws via linear resource types and strict ownership, its integration with EVM bytecode introduces novel hybrid vulnerabilities not captured by existing systems like the SWC registry. Our taxonomy spans 37 categorized vulnerability types (MWC-100 to MWC-136) across six semantic frames, addressing issues such as hybrid gas metering, capability misuse, meta-transaction spoofing, and AI-integrated logic. Through analysis of real-world contracts from Aptos and Sui, we demonstrate that current verification tools often miss these hybrid risks. We also explore how formal methods and LLM-based audit agents can operationalize this classification, enabling scalable, logic-aware smart contract auditing. MWC lays the foundation for more secure and verifiable contracts in next-generation blockchain systems. (Shortened Abstract)
Smart contracts are programs that work on blockchain technology and are designed to automatically perform certain operations. Today, smart contracts, especially Ethereum-based ones, are widely used in various fields such as finance, healthcare, supply chain and property management. Unlike traditional contracts, these contracts offer the advantage of executing transactions securely and transparently without the need for any intermediaries. However, due to their security vulnerabilities, they carry the risk of being exploited by malicious attackers. This work proposes a fuzzing-based approach to detect vulnerabilities in smart contracts. The proposed method aims to identify unknown or overlooked potential security vulnerabilities by enabling automatic testing of smart contracts. Within the scope of the study, different fuzzing-based analysis techniques were compared, the advantages and disadvantages of these methods were evaluated. The findings reveal that fuzzing-based testing techniques can be an effective tool in improving the security of smart contracts.
Francesco Salzano, Cosmo Kevin Antenucci, Simone Scalabrino, Giovanni Rosa · 6 authors
Abstract The rapid adoption of blockchain technology highlighted the importance of ensuring the security of smart contracts due to their critical role in automated business logic execution on blockchain platforms. This paper provides an empirical evaluation of automated vulnerability analysis tools specifically designed for Solidity smart contracts. Leveraging the extensive SmartBugs 2.0 framework, which includes 20 analysis tools, we conducted a comprehensive assessment using an annotated dataset of 2,182 instances, manually labeled at the line level with vulnerability labels. Our evaluation highlights the detection effectiveness of these tools in detecting various types of vulnerabilities, as categorized by the DASP TOP 10 taxonomy. We evaluated the efficacy of a Large Language Model-based detection method on two popular datasets. In this case, we obtained inconsistent results with the two datasets, showing unreliable detection when analyzing real-world smart contracts. Our study identifies significant variations in the accuracy and reliability of different tools and demonstrates the advantages of combining multiple detection methods to improve vulnerability identification. We identified a set of 3 tools that, combined, achieve up to 76.78% found vulnerabilities, taking less than one minute to run, on average. This study contributes to the field by releasing the largest dataset of manually analyzed smart contracts with line-level vulnerability annotations and by conducting the largest empirical evaluation of tools to date.
Felipe Mello Fonseca, M.F.S.F. de Moura, Pedro Henrique González, Diogo Mendonça
A Blockchain é uma tecnologia inovadora aplicada em diversas áreas como finanças, gestão de registros, votação eletrônica e jogos. As transações em blockchain são frequentemente executadas por smart contracts, código considerado crítico em termos de segurança. Existem diversas ferramentas que se propõe a identificar vulnerabilidades de forma automatizada em smart contracts, contudo, conforme estudos anteriores mostram, a eficácia nesta tarefa é normalmente baixa. Desse modo, identificar vulnerabilidades de forma automatizada em smart contracts continua sendo um grande desafio. Neste estudo investigamos a evolução de duas importantes ferramentas para detecção de vulnerabilidades em smart contracts: Mythril e Slither, avaliando sua eficácia na identificação de vulnerabilidades e se evoluíram comparadas a uma versão anterior. Para isto, executamos as ferramentas com versões mais rescentes em um conjunto de 69 smart contracts previamente analisados em um estudo anterior. Os resultados foram comparados com as vulnerabilidades já classificadas e submetidos a uma validação manual para aferir sua precisão. Os experimentos demonstram que Mythril apresentou melhorias na redução de falsos positivos, enquanto Slither aprimorou a detecção de falhas relacionadas a Access Control. Contudo, as ferramentas apresentaram limitações na sua evolução para alguns tipos de vulnerabilidades. Esses achados reforçam a necessidade contínua de aprimoramento e avaliação das ferramentas de análise automatizada de segurança em smart contracts.
The evolution of decentralized finance (DeFi) has necessitated the development of highly secure and scalable smart contract frameworks. Traditional smart contract languages often face challenges related to verification, resource consumption, and execution efficiency on blockchain networks. This paper explores a formalized approach to smart contract design, leveraging advanced type systems, higher-order functions, and resource-aware execution models to enhance security and scalability. By integrating formal verification techniques and optimizing onchain computation, this approach mitigates risks such as denial-of-service (DoS) attacks and excessive gas fees while improving interoperability across blockchain ecosystems. The study further examines the implications of these design choices for financial automation, decentralized applications, and broader enterprise adoption of blockchain technology.
Mohan Harish Maturi, Elyson De La Cruz, Santosh Reddy Addula, Akhila Reddy Yadulla · 8 authors
Smart contracts, integral to decentralized applications, are unfortunately plagued by security vulnerabilities. Re-entrancy attacks pose a particularly insidious threat, allowing attackers to exploit subtle interactions within the contract’s code. While traditional detection methods exist, they often struggle with false positives and a lack of transparency, hindering the ability of developers to understand and fix the problems. This research introduces a novel framework that combines the power of Explainable AI (XAI) with a deep learning approach to address these shortcomings. Neural networks utilize the proposed BiLSTMs model to design a framework that detects re-entrancy patterns because they excel at analyzing complex dependencies across the length of smart contract code. The decision to explain models is enhanced through XAI techniques, which improve the entire process. The explanations reveal which code sections from the codebase contribute to vulnerability classification. Combining two detection methods intends to improve re-entrancy vulnerability detection performance while providing rapid remedy recommendations.
"Smart contracts" are software documented on block chains under specific circumstances that control the allocation of assets between individuals. In a smart healthcare supply chain, product traceability is a major issue. Two enabling technologies in the smart healthcare supply chain that ensure product traceability and safeguard against data manipulation are block chain and smart contracts. A smart contract workflow must be developed and carried out in a block-chain-based supply chain in accordance with the input data. This paper has an objective function to meet the entire system as a parallel composition of smart contracts and users this paper analyze the behavior of smart contracts and a core language of programs with an essential set primitive. The experimental results show that the proposed method can accurately detect security vulnerabilities and logic flaws in smart contracts through formal verification and other analysis techniques before smart contracts are deployed.
This comprehensive article examines the transformative impact of cloud computing and artificial intelligence on regulatory compliance and risk management in the financial services sector. It explores how financial institutions are embracing cloud technologies to enhance operational capabilities while navigating an increasingly complex regulatory landscape. The article details how AI-driven solutions are reshaping compliance frameworks through advanced machine learning for fraud detection, natural language processing for regulatory analysis, and enhanced anti-money laundering systems. The article analyzes architectural considerations and implementation strategies for AI-powered compliance frameworks, supported by real-world case studies that demonstrate significant improvements in efficiency and effectiveness. Furthermore, the article investigates emerging technologies poised to further transform regulatory compliance, including federated learning, explainable AI, quantum computing, and solutions for decentralized finance. By examining both the opportunities and challenges of AI-driven compliance, this research provides valuable insights for financial institutions seeking to optimize regulatory compliance while maintaining operational efficiency in cloud environments.
Smart contracts, which automatically execute transactions based on predefined conditions, play a crucial role in asset and money exchanges. Due to their involvement in significant financial transactions, these contracts are attractive targets for hackers, leading to substantial financial losses through exploitable vulnerabilities. While various program analysis methods such as Oyente, Mythril, and Securify have been proposed to address these security concerns, they rely on rule-based patterns that are time-consuming to develop and offer limited coverage. Deep learning methods present an alternative by automatically learning code features to detect vulnerabilities. However, existing approaches face critical challenges, including feature limitations and lack of interpretability. To address these gaps, we propose the interpretable smart contract vulnerability detector, a Graph Isomorphism Network (GIN)-based vulnerability prediction model for smart contracts, enhanced with code subgraph explanations. Our approach identifies and incorporates 43 domain-specific features, augmenting GIN with domain knowledge attention mechanisms to improve vulnerability prediction. In addition, we develop an interpreter called SubgraphV, which provides explanations for vulnerability predictions through interpreted subgraphs. Our model demonstrates superior performance over traditional tools, achieving F1 score improvements from 0.254 to 0.489 on a dataset of 103 smart contract function vulnerabilities. SubgraphV outperforms existing explainability methods like GNNexplainer, PGExplainer, and SubgraphX in pinpointing vulnerabilities, accurately reflecting vulnerability patterns, and enhancing the understanding of vulnerabilities.
The emergence of Decentralized Finance (DeFi) has introduced a paradigm shift in global financial intermediation, challenging traditional banking systems with transparent, algorithm-driven, and blockchain-based financial services. As institutional investors and banks navigate increasingly complex cross-jurisdictional regulatory environments, DeFi presents an opportunity to reimagine asset securitization through decentralized, programmable frameworks. This paper explores the integration of DeFi protocols into institutional asset securitization, focusing on how smart contracts, tokenization, and decentralized liquidity pools can streamline processes, enhance transparency, and reduce reliance on intermediaries across disparate legal and regulatory jurisdictions. At a broader level, the study outlines the limitations of conventional securitization—such as opacity, time lags, and fragmentation—especially in multinational banking ecosystems. It then narrows in on how DeFi tools like automated market makers (AMMs), decentralized exchanges (DEXs), and overcollateralized lending protocols can be adapted to structure, issue, and trade tokenized asset-backed securities (ABS). Particular attention is paid to the challenges of legal enforceability, compliance, and interoperability between blockchain platforms and regulatory frameworks. Case scenarios and pilot initiatives are analyzed to demonstrate the feasibility of decentralized securitization in cross-border finance, including synthetic credit instruments and on-chain risk analytics. The paper further examines how oracles and compliance layers (e.g., KYC/AML-integrated smart contracts) can reconcile DeFi's permissionless nature with institutional governance standards. The findings support a hybrid finance future, where regulated entities harness DeFi infrastructure for secure, compliant, and efficient asset securitization. Policy recommendations are offered to foster collaboration between regulators, financial institutions, and protocol developers in building trust-minimized, scalable, and cross-jurisdictionally aligned financial ecosystems.
Faris Kamil Hasan Mihna, Hazim Akram Sallal, Lobna Abdalhusen Easa Al-Seedi, Hasan Ali Al- Tameemi · 7 authors
The metaverse indicates an ever-evolving digital ecosystem where virtual real estate has now become an asset class. These properties, subject to smart contracts on the blockchain and represent as non-fungible tokens (NFTs), gives rise to new legal and cyber issues due to the decentralized and dematerialized nature of these digital assets .This paper proposes a machine learning approach to classify the digital real estate contracts into Ownership and Lease contracts. The study utilizes a dataset of one thousand digital real estate contracts collected from platforms such as Decentraland and The Sandbox. The dataset also included attributes such as plot size, plot location, transaction value, and contract duration. Preprocessing of data included encoding categorical data, standardization of numerical variables, and UTF-8 encoded text to preserve data quality. Two classification models were used: Logistic Regression and Random Forest. The model's evaluation used accuracy, precision, recall, and F1-score as evaluation criteria. The Random Forest outperformed with a perfect classification score showing that it may have been better suited to dealing with the complexity and dimensionality of the dataset. The outcomes of the study highlight the role AI could play in automating the analysis of contracts, at the same time highlighting that cybersecurity practices are important when working with data. The framework of this study seeks to support the development of a regulatory regime and add further transparency to real estate contracts in the metaverse - as a scalable tool for future digital real estate management.
The Engineering, Procurement, and Construction (EPC) industry faces significant financial management challenges due to the complexity of project financing, milestone-based payments, and multi-stakeholder collaboration. Traditional on-premise ERP financial systems are often inefficient, leading to delays in financial reporting, security vulnerabilities, and regulatory compliance difficulties. This study explores the development of cloud-based financial solutions tailored to the EPC industry, examining the benefits, challenges, and applicability of existing models such as Software as a Service (SaaS), Platform as a Service (PaaS), and Blockchain-based decentralized finance (DeFi). A Hybrid Cloud-Based Financial Framework is proposed, integrating SaaS for accounting, PaaS for customization, and Blockchain for secure transactions. Experimental validation demonstrates that cloud adoption reduces financial processing time by 87.5%, enhances cash flow visibility, improves security, and increases regulatory compliance efficiency by 40%. This paper highlights the importance of AI-driven predictive analytics, automated compliance, and hybrid cloud models in modern EPC finance and proposes strategies for overcoming integration challenges, cybersecurity risks, and workforce adoption barriers. Future research should focus on scaling hybrid cloud solutions globally and integrating AI-powered risk assessment tools.
The rapid evolution of blockchain technology and decentralized finance (DeFi) has significantly disrupted traditional financial services globally. DeFi, by leveraging blockchain, enables financial services without relying on traditional intermediaries such as banks, creating a more inclusive, efficient, and transparent financial ecosystem. The chapter explores blockchain and DeFi's impact on the Indian financial services sector. The purpose is to identify how these technologies are transforming financial products, services, and regulations in India while addressing key issues like financial inclusion, security, and scalability. The research methodology involves a qualitative approach, including an analysis of secondary data, case studies of Indian blockchain startups. The study will also provide insights into the regulatory and institutional changes required to support this transformation. In conclusion, while blockchain and DeFi offer significant promise for the Indian financial sector, their adoption requires overcoming technological, regulatory, and cultural barriers.
With the rapid growth of the NFT market, the security of smart contracts has become crucial. However, existing AI-based detection models for NFT contract vulnerabilities remain limited due to their complexity, while traditional manual methods are time-consuming and costly. This study proposes an AI-driven approach to detect vulnerabilities in NFT smart contracts. We collected 16,527 public smart contract codes, classifying them into five vulnerability categories: Risky Mutable Proxy, ERC-721 Reentrancy, Unlimited Minting, Missing Requirements, and Public Burn. Python-processed data was structured into training/test sets. Using the CART algorithm with Gini coefficient evaluation, we built initial decision trees for feature extraction. A random forest model was implemented to improve robustness through random data/feature sampling and multitree integration. GridSearch hyperparameter tuning further optimized the model, with 3D visualizations demonstrating parameter impacts on vulnerability detection. Results show the random forest model excels in detecting all five vulnerabilities. For example, it identifies Risky Mutable Proxy by analyzing authorization mechanisms and state modifications, while ERC-721 Reentrancy detection relies on external call locations and lock mechanisms. The ensemble approach effectively reduces single-tree overfitting, with stable performance improvements after parameter tuning. This method provides an efficient technical solution for automated NFT contract detection and lays groundwork for scaling AI applications.
Tahrim Hossain, Sheikh Hassan, Faisal Haque Bappy, Muhammad Nur Yanhaona · 6 authors
The emergence of blockchain technology has revolutionized contract execution through the introduction of smart contracts. Ethereum, the leading blockchain platform, leverages smart contracts to power decentralized applications (DApps), enabling transparent and self-executing systems across various domains. While the immutability of smart contracts enhances security and trust, it also poses significant challenges for updates, defect resolution, and adaptation to changing requirements. Existing upgrade mechanisms are complex, resource-intensive, and costly in terms of gas consumption, often compromising security and limiting practical adoption. To address these challenges, we propose FlexiContracts+, a novel scheme that reimagines smart contracts by enabling secure, in-place upgrades on Ethereum while preserving historical data without relying on multiple contracts or extensive pre-deployment planning. FlexiContracts+ enhances security, simplifies development, reduces engineering overhead, and supports adaptable, expandable smart contracts. Comprehensive testing demonstrates that FlexiContracts+ achieves a practical balance between immutability and flexibility, advancing the capabilities of smart contract systems.
José Juan de León, Cenchuan Zhang, Christos - Spyridon Koulouris, Francesca Medda · 5 authors
The growing interest in decentralized finance (DeFi), driven by advancements in blockchain technologies such as Ethereum, highlights the crucial role of smart contracts. However, the inherent openness of blockchains creates an extensive attack surface, exposing participants’ funds to undetected security flaws. In this work we investigated the use of deep reinforcement learning techniques, specifically Deep Q-Network (DQN) and Proximal Policy Optimization (PPO), for detecting and classifying vulnerabilities in smart contracts. This approach utilizes control flow graphs (CFGs) generated through EtherSolve to capture the semantic features of contract bytecode, enabling the reinforcement learning models to recognize patterns and make more accurate predictions. Experimental results from extensive public datasets of smart contracts revealed that the PPO model performs better than DQN and demonstrates effectiveness in identifying unchecked-call vulnerability. The PPO model exhibits more stable and consistent learning patterns and achieves higher overall rewards. This research introduces a machine learning method for enhancing smart contract security, reducing financial risks for users, and contributing to future developments in reinforcement learning applications.
Blockchain technology is revolutionizing various industries through decentralized architecture and secure transaction mechanisms, yet its core application—smart contracts—faces increasingly sophisticated security threats. Recognizing the critical need for enhanced protection in this emerging domain, this paper introduces TPH-Fuzz, a two-phase hybrid fuzzing framework designed to overcome current limitations in vulnerability detection. TPH-Fuzz combines global exploration with local vulnerability targeting. It utilizes dynamic symbolic execution for semantics-aware path analysis and employs data-dependency-based state modeling to generate effective transaction sequences. These methods improve both path exploration and vulnerability detection precision significantly. Experiments on a coverage dataset of 9309 contracts demonstrate an 85% branch coverage on complex contracts, outperforming conventional methods; meanwhile, tests on a vulnerability dataset of 1086 labeled contracts show a detection precision of 89.24% across eight vulnerability categories. The promising results underscore the framework’s potential to transform security auditing practices in the blockchain industry, paving the way for more reliable smart contract development and deployment.
With the increasingly complex blockchain technology environment and emerging security threats, the detection and prevention of vulnerabilities in blockchain smart contracts have become crucial for ensuring the healthy development of blockchain technology and avoiding substantial economic losses. Recently developed vulnerability detection methods for smart contracts suffer from the drawbacks of insufficient feature extraction and inadequate multitask detection. This paper proposes a multifaceted learning model, DLR, based on a dual-loop architecture of meta learning to address these issues by adopting model-agnostic meta-learning techniques. This model employs a syntax analyzer for targeted feature extraction, with graph information used as a supporting tool during the initial stage of feature engineering. Combined with an improved optimizer algorithm in the inner loop, the model can effectively learn and adjust based on the specific requirements of each task. In the outer loop, the model achieves efficient learning rate adjustment for multi-task learning by integrating the adaptive learning rate of the Adam optimizer with a global adjustment using simulated annealing strategy, thereby enhancing performance across diverse tasks. Experimental results demonstrate significant improvements in detection accuracy over state-of-the-art methods for three types of vulnerabilities, with our method achieving detection accuracies of 94.40%, 93.36%, and 94.33% for reentrancy, timestamp dependence, and integer overflow vulnerabilities, respectively.
Ilham Qasse, Isra M. Ali, Nafisa Ahmed, Mohammad Hamdaqa · 5 authors
The immutability of smart contracts on blockchain platforms like Ethereum promotes security and trustworthiness but presents challenges for updates, bug fixes, or adding new features post-deployment. These limitations can lead to vulnerabilities and outdated functionality, impeding the evolution and maintenance of decentralized applications. Despite various upgrade mechanisms proposed in academic research and industry, a comprehensive analysis of their trade-offs and practical implications is lacking. This study aims to systematically identify, classify, and evaluate existing smart contract upgrade mechanisms, bridging the gap between theoretical concepts and practical implementations. It introduces standardized terminology and evaluates the trade-offs of different approaches using software quality attributes. We conducted a Multivocal Literature Review (MLR) to analyze upgrade mechanisms from both academic research and industry practice. We first establish a unified definition of smart contract upgradeability and identify core components essential for understanding the upgrade process. Based on this definition, we classify existing methods into full upgrade and partial upgrade approaches, introducing standardized terminology to harmonize the diverse terms used in the literature. We then characterize each approach and assess its benefits and limitations using software quality attributes such as complexity, flexibility, security, and usability. The analysis highlights significant trade-offs among upgrade mechanisms, providing valuable insights into the benefits and limitations of each approach. These findings guide developers and researchers in selecting mechanisms tailored to specific project requirements.