haojia hong, Duan Jia, Wei Ren, Xi Liu · 5 authors
Proxy contracts support logic upgradeability and deployment reuse in decentralized application (DApp). However, the use of proxy mechanisms also introduces new security risks. Although prior work has explored the security of proxy contracts, most prior approaches either depend on source code or fail to handle complex proxy storage layouts at the bytecode level, reducing their applicability to real-world closed-source contracts. In this paper, we propose ProxyLens, a bytecode-level vulnerability detection framework tailored for Ethereum proxy contracts. Without requiring source code, ProxyLens integrates storage structure modeling, proxy pattern recognition, and vulnerability detection. It features (1) a slot recovery mechanism based on symbolic execution and taint analysis for precise variable layout inference, (2) a proxy identification and delegate slot tracing module for accurate proxy architecture recognition, and (3) a semantic-driven vulnerability detection engine that works independently of function names. Experiments show that ProxyLens significantly outperforms existing tools in storage slot recovery (F1 = 96.4%), variable type inference (accuracy = 63.0%), proxy pattern recognition (accuracy > 90% across multiple patterns), and vulnerability detection (e.g., function selector collision F1 = 98.77%, storage collision F1 = 79.50%). As a supplementary contribution, we have publicly released the prototype of ProxyLens.
The internet was architected on a 128-character encoding that systematically excluded billions of speakers of Arabic, Chinese, Persian, Turkish, Hindi, and every other non-Latin script. Two interlocking standards broke that constraint: Unicode — the universal map of every human character to a unique codepoint — and Punycode (RFC 3492), which translates Unicode into ASCII-compatible encodings the legacy Domain Name System can process. The emergence of Handshake (HNS), a decentralised proof-of-work naming blockchain, extends this capability into Web3 without any central gatekeeper. Handshake allows any individual to auction, own, and resolve top-level domains in any script — including emoji — through sovereign cryptographic ownership.
Tato práce se zabývá integrací protokolu zkLogin do aplikace Web3, aby se uživatel mohl přihlásit pomocí účtu OpenID Connect místo správy seed phrase. Práce vysvětluje princip zkLogin, porovnává jej s jinými přístupy k autentizaci ve Web3 a implementuje prototyp pro Sui a Ethereum. Větev pro Sui používá nativní podporu zkLogin, zatímco větev pro Ethereum používá Groth16 důkaz, chytrý účet, registr JWK a ERC-4337. Jednoduchý lending scénář ověřuje opakované změny on-chain stavu po přihlášení. Výsledky ukazují, že zkLogin může zjednodušit onboarding a omezit přímé zveřejnění vazby mezi účtem Web2 a on-chain adresou, ale prototyp stále závisí na poskytovateli identity, salt service, proving infrastruktuře a správě veřejných klíčů.
In Ethereum, DevP2P is the fundamental network-layer protocol set that supports consensus mechanisms, transaction propagation and smart contract execution. Due to the importance of DevP2P, its bugs can be exploited by the attacker to cause security problems like denial of service, leading to property loss on Ethereum. However, existing blockchain testing approaches focus on the bug detection of consensus and application layers, causing many serious DevP2P bugs to be missed. In fact, detecting DevP2P bugs has some key challenges, including how to generate effective inputs and how to detect complex bugs. This paper designs D2PFuzz, the first network-layer differential fuzzing approach of bug detection for Ethereum. It consists of two key techniques: (1) aquery-based fuzzing strategythat dynamically generates valid DevP2P messages according to network, chain and node state changes; and (2) amulti-node differential checking methodthat identifies important differences of DevP2P response messages from multiple nodes in the same blockchain to detect semantic bugs. We have evaluated D2PFuzz on five open-source and popular Ethereum node implementations, including Geth, Erigon, Reth, Besu and Nethermind. D2PFuzz in total finds 15 unique bugs, 12 of which are previously unknown. Compared to two state-of-the-art blockchain testing approaches including LOKI and Hive, D2PFuzz improves testing coverage by 3.7x and 21.6x, respectively, and finds 13 bugs missed by these approaches.
Nadia van Niekerk, Brink van der Merwe, Louwrens Labuschagne
In the rapidly evolving realm of blockchain technology, the pursuit of enhanced privacy, security, and scalability has propelled the exploration of cryptographic innovations. Zero-Knowledge Proofs (ZKPs) have emerged as a pivotal solution, addressing diverse challenges across decentralized applications and cryptographic systems. However, the intricate mathematical foundations of ZKPs can pose a barrier to widespread adoption. To bridge this gap, a spectrum of ZKP tools has been developed, abstracting mathematical complexities and enabling developers with varying levels of expertise to incorporate ZKPs into their projects. The exploration of the 5 W’s – Who, What, When, Where, and Why – guides developers in selecting ZKP tools aligned with their specific needs and understanding. This paper serves as a vital resource for developers entering the dynamic landscape of ZKP development. By answering crucial questions and providing nuanced insights into ZKP tools, it empowers developers to navigate this intricate domain effectively. As ZKP technology continues to evolve, our findings contribute to the ongoing dialogue surrounding its implementation, utilization and the ever-adapting toolkit shaping the future of cryptographic innovation. This paper employs a Mining Software Repositories (MSR) approach to unravel insights from the expansive landscape of ZKP development. By delving into GitHub repositories, we categorize author archetypes, discuss ZKP proof constructions, identify phases of tool development, explore the level of understanding required and examine the correlation between tool types and application purposes. Through a metrics-driven analysis, we unveil patterns in tool popularity, development trends, and historical perspectives, offering a comprehensive understanding of the ZKP tooling ecosystem.
Abstract This paper revisits Virgo, a well-known transparent zero-knowledge proof system that has been used in many subsequent studies. Through our analysis, we uncover previously overlooked limitations and several exploitable security vulnerabilities within Virgo’s zkVPD protocol design and implementation. We subsequently address these issues and improve Virgo’s zkVPD protocol. Our improvements feature simplified but more efficient VPD and zkVPD algorithms, offering enhanced support for computations over binary fields and their extension fields.
P. Chinnasamy, R. Shashidhar Reddy, Y. Lohith Kiran, D. Prathap Reddy · 5 authors
In the age of using technology to work together remotely, the inability to share files in a secure manner is a problem often faced since many online sharing options available do not have good protection on their sharing options and do not safeguard against unauthorized use of the files. This paper presents a secure file sharing portal that has end to end encryption and user-based access controls and that works inside a web browser. The system uses the Web Crypto API interface to provide local encryption on the user’s devices using the AES-GCM encryption algorithm, so that the user’s plaintext documents do not leave the device. A separate layer of protection exists in the system. It is not enough for a user to just receive the encrypted file. The user has to receive a decryption key that the sender has to share through a separate channel. Access is for members only which requires sender approval and we have features like secure QR code share, session monitoring, digital certificates for identity proof and policy enforcement for compliance. Also, we have a "Secure Space" module which is for ephemeral work groups that has in space chat, multi user invites, controlled key exchange and one click revocation which in turn puts power back in the users’ hands. We combined zero knowledge structure with audit able workflows to present a privacy first, scalable and easy to use solution. Also, we show how we used modern web tech to create a trusted setting for sensitive file share which at the same time does not sacrifice ease of use or performance.
Xiangke Zhang, Chunxiao Ye, Ning Wang, Jelly Gan · 5 authors
With the growth of Ethereum, smart contracts have become a core component of blockchain platforms. However, the widespread adoption of smart contracts raises security concerns, as their immutability and interaction with digital assets make them attractive targets for attackers. Existing detection methods often struggle to address emerging, complex attack vectors and to accurately identify specific vulnerability types. We present SimSecLLM, an auditing framework grounded in code similarity that anchors LLM reasoning to vetted secure code snippets. The framework first builds a reference corpus containing more than 35,000 distinct security-vetted functions collected from 150 widely used libraries. For each smart contract under audit, it analyzes internal functions and their call relationships, establishes a detection order via topological sorting, and incorporates callee context. It then retrieves the closest secure exemplar from the curated reference corpus, extracts code-level modifications through comparison, and leverages a fine-tuned LLM in the detection stage to reason over these changes in order to assess whether they introduce vulnerabilities and to identify their potential types. SimSecLLM was evaluated on the DAppSCAN-source dataset with 3,527 function-level samples across seven types of vulnerabilities, demonstrating superior performance over existing methods with an accuracy of 93.1 % and an F1score of 87.1 %. A case study on the Redacted Cartel vulnerability illustrates that similarity-guided analysis effectively reveals security-critical code modifications, thereby supporting the identification of vulnerability root causes.
In the case of upgrading smart contracts on blockchain systems, it is essential to consider the continuity of upgrades and subsequent maintenance. In practice, upgrade operations often introduce new vulnerabilities. Existing static analysis tools usually only scan a single version and are unable to capture the correlation between code changes and emerging risks. To address this, we propose an Upgradeable Smart Contract Security Analyzer, USCSA, which uses Abstract Syntax Tree (AST) difference analysis to assess risks associated with the upgrade process and utilizes large language models (LLMs) for assisted reasoning to achieve high-confidence vulnerability attribution. We collected and analyzed 3,546 cases of vulnerabilities in upgradeable contracts, covering common vulnerability categories such as reentrancy, access control flaws, and integer overflow. Experimental results show that USCSA achieves a precision of 92.26%, a recall of 89.67%, and an F1-score of 90.95% in detecting upgrade-induced vulnerabilities. As a result, USCSA provides a significant advantage to improve the security and integrity of upgradeable smart contracts, offering a novel and efficient solution for security auditing on blockchain applications.
Yan Liu, Diandong Liu, Yongyi Han, Qianying Yang · 6 authors
Smart contracts are central to decentralized applications, enabling automated execution and eliminating intermediaries. However, once deployed on the blockchain, they become immutable, making them susceptible to significant security vulnerabilities that could lead to financial losses and data breaches. Despite advancements in static analysis and symbolic execution for vulnerability detection, these methods remain limited in dynamic environments and large-scale contracts. Recently, large language models (LLMs) have shown potential in code analysis and vulnerability detection, but given concerns over the security of large models, there is an urgent need for evaluations of open-source LLMs to guide their deployment and application. This study aims to assess the performance of state-of-the-art open-source LLMs in detecting smart contract vulnerabilities. Using the Smartbugs dataset, we evaluate four prominent models-OpenAI’s gpt-oss 20B and 120B, Qwen3 235B, and DeepSeek R1 671B. The study focuses on three main areas: 1) evaluating the effectiveness of these models in detecting various vulnerabilities; 2) comparing them with existing detection tools; and 3) analyzing their limitations and potential for future development. The main contributions of this study include the first comprehensive evaluation of open-source LLMs in smart contract vulnerability detection, a detailed comparison with traditional tools, and the release of open experimental methods and data to foster further research in the field. The code used in this study can be found at https://github.com/zumAndenken/Open-Source-LLMSmartContract.
This paper presents LLMBugScanner, a large language model (LLM) based framework for smart contract vulnerability detection using fine-tuning and ensemble learning. Smart contract auditing presents several challenges for LLMs: different pretrained models exhibit varying reasoning abilities, and no single model performs consistently well across all vulnerability types or contract structures. These limitations persist even after fine-tuning individual LLMs. To address these challenges, LLMBugScanner combines domain knowledge adaptation with ensemble reasoning to improve robustness and generalization. Through domain knowledge adaptation, we fine-tune LLMs on complementary datasets to capture both general code semantics and instruction-guided vulnerability reasoning, using parameter-efficient tuning to reduce computational cost. Through ensemble reasoning, we leverage the complementary strengths of multiple LLMs and apply a consensus-based conflict resolution strategy to produce more reliable vulnerability assessments. We conduct extensive experiments across multiple popular LLMs and compare LLMBugScanner with both pretrained and fine-tuned individual models. Results show that LLMBugScanner achieves consistent accuracy improvements and stronger generalization, demonstrating that it provides a principled, cost-effective, and extensible framework for smart contract auditing.
Muhammad Sannan Khaliq, Sium Bin Noor, Subroto Kumar Ghosh, Love Allen Chijioke Ahakonye · 6 authors
Smart contracts are integral to blockchain applications; yet, their immutability creates security vulnerabilities, such as reentrancy and overflow, which can be critically damaging. While detection tools exist, many rely on symbolic execution, graph preprocessing, or binary classification, limiting their efficiency and practicality. This study presents an optimized DeBERTa V3-based transformer model for multilabel detection of smart contract vulnerabilities. The proposed approach operates directly on tokenized Solidity code, leveraging disentangled attention and position embeddings to model semantic patterns. Evaluation on three public datasets achieves up to 100% F1-scores on key vulnerabilities and maintains an average inference latency below 58 ms per smart contract. These results demonstrate the feasibility of integrating high-accuracy, low-latency vulnerability detection into real-time auditing tools, thereby enhancing contract security before deployment.
T J E N N I N G, Kalokhe Omkar Nanabhau, Takale Ram Arjun, Borge Akash Sandip
The proliferation of digital documents and academic credentials in today's interconnected world has created both opportunities and vulnerabilities. Traditional certificate issuance and storage mechanisms are highly susceptible to forgery, duplication, and unauthorized manipulation, undermining the trustworthiness of academic and professional qualifications. To address these challenges, this research proposes a blockchain-based certificate generation and verification system that ensures transparency, immutability, and trust across stakeholders. Leveraging distributed ledger technology, the system securely records certificate metadata and unique identifiers, enabling real-time, tamper-proof validation without reliance on intermediaries. The architecture integrates modern web technologies such as Next.js for frontend and backend services, MongoDB for scalable storage, JWT for authentication, and cryptographic techniques including bcrypt for enhanced security. Additionally, smart contracts deployed on Ethereum/Ganache enable decentralized storage and validation, while certificate data is simultaneously linked with non-fungible tokens (NFTs) to provide verifiable ownership and authenticity. This integration not only eliminates certificate fraud but also facilitates seamless verification across institutions, employers, and regulatory authorities. By combining blockchain's decentralized security with user-friendly web applications, the proposed approach aims to create a globally interoperable, cost-effective, and future-ready framework for academic and professional certification systems.
The main objective of the report is to demonstrate the creation and vulnerability testing of a web3 application for a decentralized system that integrates three key processes – membership management, automatic revenue distribution, and participation in the governance of the organization – within a secure, transparent, and immutable blockchain infrastructure. An analysis is demonstrated to detect and eliminate potential vulnerabilities and integration tests to confirm the correct interaction between the system modules.
Mobile Web3 faces catastrophic retention (< 5%) yielding effective acquisition costs of \$500 - \$1,000 per retained user. Existing solutions force an impossible tradeoff: embedded wallets achieve moderate usability but suffer inherent click-jacking vulnerabilities; app wallets maintain security at the cost of 2 - 3% retention due to download friction and context-switching penalties. We present SecureSign, a PWA-based architecture that adapts desktop browser extension security to mobile via EIP-6963 provider sandboxing. SecureSign isolates dApp execution in iframes within a trusted parent application, achieving click-jacking immunity and transaction integrity while enabling native mobile capabilities (push notifications, home screen installation, zero context-switching). Our drop-in SDK requires no codebase changes for existing Web3 applications. Threat model analysis demonstrates immunity to click-jacking, overlay, and skimming attacks while maintaining wallet interoperability across dApps.
Solana has rapidly evolved into a leading next generation platform for supporting decentralized applications due to its high performance and low transaction costs. Its new contract execution model, which decouples code logic from states, gives rise to new vulnerability threats that can result in significant financial losses for users within the ecosystem. However, existing studies towards detecting vulnerabilities are predominantly tailored for Ethereum smart contracts, which are unsuitable for Solana platform because of the variations in implementation languages and runtime semantics. In this paper, we propose Soleker, a novel approach that leverages learning-based techniques to automatically identifying potential vulnerabilities in Solana smart contract bytecode. More specifically, Soleker captures runtime semantic information from instructions that are associated with blockchain interactions and extracts vulnerability-specific localized features. Then, a prefix-guided graph learning model is introduced to learn and integrate extracted features, enabling effective vulnerability detection. We conduct experiments on a newly constructed contract dataset and the results demonstrate that Soleker significantly outperforms the baseline methods, achieving an average effectiveness improvement of 126.4% and a 335× boost in efficiency.
Web3 applications, built on blockchain technology, manage billions of dollars in digital assets through decentralized applications (dApps) and smart contracts. These systems rely on complex, software supply chains that introduce significant security vulnerabilities. This paper examines the software supply chain security challenges unique to the Web3 ecosystem, where traditional Web2 software supply chain problems intersect with the immutable and high-stakes nature of blockchain technology. We analyze the threat landscape and propose mitigation strategies to strengthen the security posture of Web3 systems.
The Verification and Validation of Certificate Using Blockchain system is designed to provide a secure, transparent, and tamper-proof mechanism for issuing and verifying educational and professional certificates. Traditional verification methods are often prone to forgery, delays, and administrative inefficiencies due to centralized databases and manual validation. This system leverages blockchain technology to store certificate data in an immutable distributed ledger, ensuring authenticity and preventing manipulation. Additionally, the integration of the InterPlanetary File System (IPFS) provides decentralized, lowcost storage for certificates, while an Android-based interface simplifies issuance and verification processes. By enabling decentralized trust, rapid verification, and cross-border accessibility, this system enhances transparency, reduces fraudulent activities, and establishes a reliable digital framework for secure credential management
Access control is a security mechanism designed to ensure that only authorized users can access specific resources. Cross-domain access control involves access to resources across different organizations, institutions, or applications. Traditional access control, however, which handles authentication and authorization separately in centralized environments, faces challenges in identity dispersion, privacy leakage, and diversified permission requirements, failing to adapt to cross-domain scenarios. Thus, there is an urgent need for a new access control mechanism that empowers autonomous control over user identity and resources, addressing the demands for privacy-preserving authentication and flexible authorization in cross-domain scenarios.To address cross-domain access control challenges, we propose POLARIS, a unified and extensible architecture that enables policy-based, verifiable and privacy-preserving access control across different domains. POLARIS features a structured commitment mechanism for reliable, fine-grained, policy-based identity disclosure. It further introduces VPPL, a lightweight policy language that supports issuer-bound evaluation of selectively revealed attributes. A dedicated session-level security mechanism ensures binding between authentication and access, enhancing confidentiality and resilience to replay attacks.We implement a working prototype and conduct comprehensive experiments, demonstrating that POLARIS effectively provides scalable, privacy-preserving, and interoperable access control across heterogeneous domains. Our results highlight the practical viability of POLARIS for enabling secure and privacy-preserving access control in decentralized, cross-domain environments.