Smart contracts are widely used on the blockchain to implement complex transactions, such as decentralized applications on Ethereum. Effective vulnerability detection of large-scale smart contracts is critical, as attacks on smart contracts often cause huge economic losses. Since it is difficult to repair and update smart contracts, it is necessary to find the vulnerabilities before they are deployed. However, code analysis, which requires traversal paths, and learning methods, which require many features to be trained, are too time-consuming to detect large-scale on-chain contracts. Learning-based methods will obtain detection models from a feature space compared to code analysis methods such as symbol execution. But the existing features lack the interpretability of the detection results and training model, even worse, the large-scale feature space also affects the efficiency of detection. This paper focuses on improving the detection efficiency by reducing the dimension of the features, combined with expert knowledge. In this paper, a feature extraction model Block-gram is proposed to form low-dimensional knowledge-based features from bytecode. First, the metadata is separated and the runtime code is converted into a sequence of opcodes, which are divided into segments based on some instructions (jumps, etc.). Then, scalable Block-gram features, including 4-dimensional block features and 8-dimensional attribute features, are mined for the learning-based model training. Finally, feature contributions are calculated from SHAP values to measure the relationship between our features and the results of the detection model. In addition, six types of vulnerability labels are made on a dataset containing 33,885 contracts, and these knowledge-based features are evaluated using seven state-of-the-art learning algorithms, which show that the average detection latency speeds up 25× to 650×, compared with the features extracted by N-gram, and also can enhance the interpretability of the detection model.
Pengcheng Zhang, Qifan Yu, Yan Xiao, Hai Dong · 7 authors
With the rising prominence of smart contracts, security attacks targeting them have increased, posing severe threats to their security and intellectual property rights. Existing simplistic datasets hinder effective vulnerability detection, raising security concerns. To address these challenges, we proposeBiAn, a source code level smart contract obfuscation method that generates complex vulnerability test datasets.BiAnprotects contracts by obfuscating data flows, control flows, and code layouts, increasing complexity and making it harder for attackers to discover vulnerabilities. Our experiments with buggy contracts showed an average complexity enhancement of approximately 174% after obfuscation. Decompilers Vandal and Gigahorse had total failure rate increments of 38.8% and 40.5% respectively. Obfuscated contracts also decreased vulnerability detection rates in more than 50% of cases for ten widely-used static analysis detection tools.
In recent years, there has been a significant rise in the popularity of cryptocurrency amongst investors worldwide. One cryptocurrency that has been the forerunner in this new digital age is Satoshi Nakamoto’s Bitcoin. As much as it has augmented in value in the past several years, many issues have emerged as new points of concern surrounding cryptocurrency ransomware orchestrated by scammers. As a result of the growing scandals, one notorious case that has made the most headlines is the Bitcoin Heist. We have found a sizable dataset that traces back to the Bitcoin Heist incident. With the help of data science and machine learning fundamentals, we will explain different methodologies to determine whether transactions are malicious or not based on a given Bitcoin address. In this paper, we will explain cryptocurrency and ransomware and further insights into the machine learning concepts behind this issue through various models such as Adaptive Boosting (AdaBoost), Gradient Boosting, K-Nearest Neighbor (KNN), and Random Forest.
With the advent of decentralised digital currencies powered by blockchain technology, a new era of peer-to-peer transactions has commenced. The rapid growth of the cryptocurrency economy has led to increased use of transaction-enabling wallets, making them a focal point for security risks. As the frequency of wallet-related incidents rises, there is a critical need for a systematic approach to measure and evaluate these attacks, drawing lessons from past incidents to enhance wallet security. In response, we introduce a multi-dimensional design taxonomy for existing and novel wallets with various design decisions. We classify existing industry wallets based on this taxonomy, identify previously occurring vulnerabilities and discuss the security implications of design decisions. We also systematise threats to the wallet mechanism and analyse the adversary's goals, capabilities and required knowledge. We present a multi-layered attack framework and investigate 84 incidents between 2012 and 2024, accounting for $5.4B. Following this, we classify defence implementations for these attacks on the precautionary and remedial axes. We map the mechanism and design decisions to vulnerabilities, attacks, and possible defence methods to discuss various insights.
Open access
5 source records
Blockchain Technology Applications and Security
FinTech, Crowdfunding, Digital Finance
Advanced Steganography and Watermarking Techniques
Information is the key to success in every domain; this statement also applies to cryptocurrencies and blockchain domains. Beginning with Bitcoin back in 2009, which the anonymous Japanese Satoshi Nakamoto launched, blockchain technology emerged. This technology has revolutionized and continues to do so in digital transactions. In addition, this technology led to the further development of other cryptocurrencies that are active at these moments on the market. One class of cryptocurrencies obtained differently from classical bitcoin is those obtained due to web-based mining. The most known coins of this type are Monero, Dash, or Electroneum. This paper aims to analyze the web-based mining process of Monero and the whole process’s security. In addition, we want to explore the performance of the mining processes used in the user’s web browser. Moreover, finally, we aim to research the profitability of coins obtained due to web-browser mining, having as an object of study the cryptocurrency Monero.
Blockchain technology has attracted significant attention in recent years. One of the reasons for this new trend is the introduction of on-chain smart contracts, enabling the implementation of decentralized applications in trustless environments. Given the high amounts handled, smart contracts have become the targets of attacks. Along with its adoption, attacks are perpetrated via criminal smart contracts and vulnerable smart contracts by exploiting vulnerabilities. To thwart these attacks and avoid the exploitation of flaws, several approaches have been explored, such as the identification of vulnerabilities or the verification of models using a formal verification. However, these approaches have failed in solving the blockchain crime problem. This article proposes a new anomaly detection approach based on the behavior of smart contracts in the Ethereum blockchain. This formalism will be based on mathematical principles such as state mutation and an approach to verify the behavior of smart contracts.
Smart contracts are a widely researched topic due to their crucial role in blockchain technology. Ethereum, one of the most popular blockchain platforms, utilizes Solidity code for creating secure and transparent transactions through smart contracts. Etherscan provides an extensive collection of Solidity code for Ethereum smart contracts. However, smart contract vulnerabilities can lead to significant financial losses for contract holders. To address this issue, a comprehensive dataset containing numerous defects was collected from etherscan and smartbug-wild. This paper is Proposed a Mathematical model to effectively detect and analyze all possible vulnerabilities with high accuracy, providing an efficient solution for improving smart contract security and ensuring the integrity and reliability of blockchain transactions.
The increased adoption of smart contracts in many industries has made them an attractive target for cybercriminals, leading to millions of dollars in losses. Thus, deploying smart contracts with detected vulnerabilities (known to developers) are not acceptable, and fixing all the detected vulnerabilities is needed, which incurs high manual labor cost without effective tool support. To fill this need, in this paper, we propose ContractFix, a novel framework that automatically generates security patches for vulnerable smart contracts. ContractFix is a general framework that can incorporate different fix patterns for different types of vulnerabilities. Users can use it as a security fix-it tool that automatically applies patches and verifies the patched contracts before deploying the contracts. To address the unique challenges in fixing smart contract vulnerabilities, given an input smart contract, \tool conducts our proposed ensemble identification based on multiple static verification tools to identify vulnerabilities that are amenable for automatic fix. Then, ContractFix generates patches using template-based fix patterns and conducts program analysis (program dependency computation and pointer analysis) for smart contracts to accurately infer and populate the parameter values for the fix patterns. Finally, ContractFix performs static verification that guarantees the patched contract is free of vulnerabilities. Our evaluations on $144$ real vulnerable contracts demonstrate that \tool can successfully fix $94\%$ of the detected vulnerabilities ($565$ out of $601$) and preserve the expected behaviors of the smart contracts.
Christoph Sendner, Ruisi Zhang, Alexander Hefter, Alexandra Dmitrienko · 5 authors
Due to the immutable and decentralized nature of Ethereum (ETH) platform, smart contracts are prone to security risks that can result in financial loss. While existing machine learning-based vulnerability detection algorithms achieve high accuracy at the contract level, they require developers to manually inspect source code to locate bugs. To this end, we present G-Scan, the first end-to-end fine-grained line-level vulnerability detection system evaluated on the first-of-its-kind real world dataset. G-Scan first converts smart contracts to code graphs in a dependency and hierarchy preserving manner. Next, we train a graph neural network to identify vulnerable nodes and assess security risks. Finally, the code graphs with node vulnerability predictions are mapped back to the smart contracts for line-level localization. We train and evaluate G-Scan on a collected real world smart contracts dataset with line-level annotations on reentrancy vulnerability, one of the most common and severe types of smart contract vulnerabilities. With the well-designed graph representation and high-quality dataset, G-Scan achieves 93.02% F1-score in contract-level vulnerability detection and 93.69% F1-score in line-level vulnerability localization. Additionally, the lightweight graph neural network enables G-Scan to localize vulnerabilities in 6.1k lines of code smart contract within 1.2 seconds.
For a very long time, it has been a difficult task to construct a voting machine system that is both secure and fair, maintaining the confidentiality of the various voting methods that are currently in use while also maintaining the accountability and adaptability of the electrical components. This piece of work presented a procedure for an election in a faraway place that must be secure, deniable, irrevocable, user-friendly, and convenient. As a consequence of this, members of the voting public can vote for their preferred candidate without being required to carry out the procedure in person. Campaigns for the upcoming election will make use of this framework. This system will make use of two different blockchains, both of which will communicate with one another: the Ethereum platform, which is accessible to the general public, and the Quorum blockchain, which is not. The technology of private blockchains will be operated by an autonomous organization. All of these different blockchain technologies send the necessary data to the public blockchain technology, which seems to be able to process a variety of voting data. This framework makes it possible to use encrypted information effectively with the SHA-256 method, thereby protecting both the confidentiality of the information and the knowledge it contains.
Decentralized applications (DApps) consist of multiple smart contracts running on Blockchain. With the increasing popularity of the DApp ecosystem, vulnerabilities in DApps could bring significant impacts such as financial losses. Identifying vulnerabilities in DApps is by no means trivial, as modern DApps consist of complex interactions across multiple contracts. Previous research suffers from either high false positives or false negatives, due to the lack of precise contextual information which is mandatory for confirming smart contract vulnerabilities when analyzing smart contracts.
Yu Pan, Zhichao Xu, Levi Taiji Li, Yunhe Yang · 5 authors
Smart contract and DApp users are taking great risks, as they do not obtain necessary knowledge that can help them avoid using vulnera- ble and malicious contract code. In this paper, we develop a novel system Tx2TXT that can automatically create security-centric textual descriptions directly from smart contract bytecode. To capture the security aspect of financial applications, we formally define a funds transfer graph to model critical funds flows in smart contracts. To ensure the expressiveness and conciseness of the descriptions de- rived from these graphs, we employ a GCN-based model to identify security-related condition statements and selectively add them to our graph models. To convert low-level bytecode instructions to human- readable textual scripts, we leverage robust API signatures to recover bytecode semantics. We have evaluated Tx2TXT on 890 well-labeled vulnerable, malicious and safe contracts where developer-crafted descriptions are available. Our results have shown that Tx2TXT out- performs state-of-the-art solutions and can effectively help end users avoid risky contracts
Smart contract is the building block of blockchain systems that enables automated peer-to-peer transactions and decentralized services. Smart contracts certainly provide a powerful functional surplus for maintaining the consistency of transactions in applications governed by blockchain technology. Smart contracts have become lucrative and profitable targets for attackers because they can hold a large amount of money. Formal verification and symbolic analysis have been employed to combat these destructive scams by analyzing the codes and function calls, yet each scam's vulnerability should be discreetly predefined. In this work, we introduce ADEFGuard, a new anomaly detection framework based on the behavior of smart contracts, as new features. We design a learning and monitoring module to determine fraudulent smart contract behaviors. Our framework is advantageous over basic algorithms in three aspects. First, ADEFGuard provides a unified solution to different genres of scams, relieving the need for code analysis skills. Second, ADEFGuard's inference is orders of magnitude faster than code analysis. Third, experimental results show that ADEFGuard achieves high accuracy (85%), precision (75%) and recall (90%) for malicious contracts and is potentially useful in detecting new malicious behaviors of smart contracts.
In recent years, with the continuous promotion of blockchain technology, the application of smart contracts has shown an explosive growth trend, and smart contract vulnerabilities seriously threaten the ecological security of blockchain. Aiming at the inefficiency of existing smart contract Symbolic Execution vulnerability detection technology, this paper proposes an effective smart contract vulnerability detection method at the source code level. Firstly, we define the critical path. As attackers typically aim to steal or freeze funds, we define the path related to fund transfer as the critical path, and its related instructions are the critical instructions. Then, we constructed a smart contract control flowchart based on Ethereum bytecode and used a constraint solver to solve path constraints and corresponding vulnerability constraints. Detect common smart contract vulnerabilities such as reentrancy, access control, arithmetic vulnerabilities, unchecked low calls, and denial of service. The experimental results show that the proposed scheme has good detection performance, and vulnerability detection was performed on 55 smart contracts containing vulnerabilities in the dataset. Compared with the pre optimized scheme, the precision rate of this scheme has been improved by 7.52%, and the total execution time has been reduced by 34.92%.
Code similarity detection is crucial for conducting security audits on smart contracts. It enables important audit tasks such as vulnerability mining and malicious contract detection based on code similarity. However, as the majority of smart contracts on Ethereum do not share their source code, detecting code similarity based on bytecode is of great significance. This paper proposes a method for self-supervised learning-based bytecode similarity detection, which obtains the control flow graph (CFG) from the bytecode in a symbolic way by simulating the execution of all instructions on the Ethereum Virtual Machine. Similarity detection is then performed at the function level. The proposed method utilizes a self-supervised model to obtain features from the bytecode and combines them with the features obtained from the stack when generating CFG to detect bytecode similarity. Experimental results demonstrate that the proposed method outperforms the baseline in terms of performance.
Smart contracts are the latest extension of decentralized cryptocurrencies, how to patch vulnerable smart contracts in an automated way to combat the intensifying attacks has become an extremely critical task in recent years. However, the optimization of code size and gas overhead by existing patching tools is not enough, and vulnerability types supported by these tools are relatively single. This paper presents EtherEditor, a framework that can directly rewrite the bytecode without the need for high-level language source code. The main goal is to minimize the code size and gas overhead. Meanwhile, EtherEditor can detect and patch 7 vulnerability types in an automated way. To evaluate the effectiveness of EtherEditor, this paper applies EtherEditor to patch contracts in a CVE dataset and a large-scale dataset containing 14107 contracts. Experiment results demonstrate that EtherEditor can effectively fix insecure bytecode. Furthermore, this paper compares EtherEditor with other automatic patching tools, and results show that EtherEditor has better performance, compared with existing tools.
Smart contracts have emerged as one of the most successful applications in the blockchain domain, playing a significant role in various blockchain ecosystems. Inspired by smart contracts, a multitude of cryptographic assets have been created. To standardize these assets, industry standards such as ERC20 (Ethereum Request for Comments 20), ERC721, and ERC1155 have been proposed. In recent years, smart contracts have frequently fallen victim to attacks. Honeypot contracts, disguised as ERC20-compliant tokens, are widely prevalent on the blockchain, enticing victims to make purchases. Such malicious smart contracts exhibiting deceptive behavior are collectively referred to as honeypot tokens. This paper focuses on ERC20-compliant smart contracts and defines six common types of honeypot issues. Building upon advancements in smart contract vulnerability detection, we propose an enhanced symbolic execution-based detection tool called Honeytoken-Detector. We conduct experiments on both contracts known to have similar issues and actual token contracts from the real world. The experimental results demonstrate the effectiveness of our tool in identifying vulnerabilities.
Alexandre Mota, Fei Yang, Cristiano da Silva Teixeira
Nowadays, smart contracts have become increasingly popular and, as with software development in general, testing is the standard method for verifying their correctness. However, smart contracts require a higher level of certainty regarding correctness because they are diffcult to modify once deployed and errors can result in significant financial losses. Therefore, formal verification is essential. In this article, we present our search for a tool capable of formally verifying a real-world smart contract written in a recent version of Solidity.
Since the invention and popularisation of blockchain technology, we have seen a recent surge of attacks targeting cryptocurrency infrastructure. Alongside this, botnet malware has become a staple within threat actors’ toolkits, and have often been used to target a wide range of devices. This paper explores the threats that a custom built botnet poses when used to target cryptocurrency mining software. The botnet within this project is developed in the programming language Golang, due to its effective networking and utilisation in the malware development sector. The targets of the attack will be a cryptocurrency miner, and for ethical reasons a proof-of-concept miner will be used for testing. For evaluation purposes a fully virtualised network is used, with practical exploitation taking place to evaluate some metrics of performance for the botnet. With these metrics, the potential threats posed are then explored, with the main attack vector discovered being defined as “forced pooling”. Through this attack vector we show how this unique threat facilitates a variety of different attacks, both on and off chain including a “51% attack” and password cracking; exploring how a potential distributed supercomputer can be used as an attack tool.
Xueyan Tang, Yuying Du, Alan Lai, Ze Zhang · 5 authors
<title>Abstract</title> This paper aims to explore the application of deep learning in smart contract vulnerabilities detection. Smart contracts are an essential part of blockchain technology and are crucial for developing decentralized applications. However, smart contract vulnerabilities can cause financial losses and system crashes. Static analysis tools are frequently used to detect vulnerabilities in smart contracts, but they often result in false positives and false negatives because of their high reliance on predefined rules and lack of semantic analysis capabilities. Furthermore, these predefined rules quickly become obsolete and fail to adapt or generalize to new data. In contrast, deep learning methods do not require predefined detection rules and can learn the features of vulnerabilities during the training process.In this paper, we introduce a solution called Lighting Cat which is based on deep learning techniques. We trained three deep learning models for detecting vulnerabilities in smart contract: Optimized-CodeBERT, Optimized-LSTM, and Optimized-CNN. To precisely extract vulnerability features, we acquired segments of vulnerable code functions to retain critical vulnerability features. Using the CodeBERT pre-training model for data preprocessing, we could capture the syntax and semantics of the code more accurately, thereby enhancing the performance of vulnerabilities detection. This is particularly significant in the inspection of Solidity Code.To demonstrate the feasibility of our proposed solution, we evaluated its performance using the SolidiFI-benchmark dataset, which consists of 9369 vulnerable contracts injected with vulnerabilities from seven different types. Experimental results showed that, among the Lighting Cat we proposed, Optimized-CodeBERT model surpassed other methods, achieving an f1-score of 93.53%.
Smart contracts play a vital role in the Ethereum ecosystem. Due to the prevalence of kinds of security issues in smart contracts, the smart contract verification is urgently needed, which is the process of matching a smart contract's source code to its on-chain bytecode for gaining mutual trust between smart contract developers and users. Although smart contract verification services are embedded in both popular Ethereum browsers (e.g., Etherscan and Blockscout) and official platforms (i.e., Sourcify), and gain great popularity in the ecosystem, their security and trustworthiness remain unclear. To fill the void, we present the first comprehensive security analysis of smart contract verification services in the wild. By diving into the detailed workflow of existing verifiers, we have summarized the key security properties that should be met, and observed eight types of vulnerabilities that can break the verification. Further, we propose a series of detection and exploitation methods to reveal the presence of vulnerabilities in the most popular services, and uncover 19 exploitable vulnerabilities in total. All the studied smart contract verification services can be abused to help spread malicious smart contracts, and we have already observed the presence of using this kind of tricks for scamming by attackers. It is hence urgent for our community to take actions to detect and mitigate security issues related to smart contract verification, a key component of the Ethereum smart contract ecosystem.
Millions of contracts deployed onto Ethereum provide various services that can be invoked. For this purpose, blockchain users need to know and specify the function signature of a callee, which includes its function id and the parameter types. Function signatures are crucial in several applications, such as recognizing the services that contracts provide. In this poster, we propose a novel solution that leverages how functions are handled by Ethereum virtual machine (EVM) to automatically recover function signatures from contract bytecode, without the need of source code and function signature databases. The extensive experimental results show that our solution outperforms all existing tools, achieving an unprecedented 98.7% accuracy within 0.074 seconds. We further demonstrate the usefulness of our solution in attack detection, fuzzing and reverse engineering of contract bytecode.