WebAssembly (Wasm) smart contracts have shown growing popularity across blockchains (e.g., EOSIO and NEAR) recently. Wasm smart contracts have been suffering from various attacks exploiting their vulnerabilities. Even worse, few developers released the source code of their Wasm smart contracts for security review, raising the bar for uncovering vulnerable contracts. Although a few approaches have been proposed to detect vulnerable Wasm smart contracts, they have several major limitations, e.g., low code coverage, low accuracy and lack of scalability, unable to produce exploit payloads, etc. To fill the gap, we design and implement WASAI,a new concolic fuzzer for uncovering vulnerabilities in Wasm smart contract. We conduct extensive experiments to evaluate WASAI,and the results show that it outperforms the state-of-the-art methods. WASAI achieves 2x code coverage than the baselines and surpasses them in detection accuracy, with an F1-measure of 99.2%. Applying WASAI to all deployed smart contracts in the wild, we find that over 707 smart contracts are vulnerable. One Fake EOS vulnerability reported to the EOSIO ecosystem was recently assigned a CVE identifier (CVE-2022-27134).
Smart contract vulnerability can be exploited to cause serious financial loss. While there are many logic-based techniques for detecting vulnerabilities, few have focused on the dynamic stack of the Ethereum virtual machine (EVM) in the process of transactions. This motivates us to raise an intriguing question: What will happen when the dynamic EVM stack meets a transaction for smart contract vulnerability detection? To answer it, we propose a novel data-driven framework, dubbed TxMirror, to detect smart contract vulnerability at the bytecode level by simulating transactions symmetrically. Beyond logic-based wisdom, TxMirror customizes EVM for smart contract vulnerability detection, and stores its dependency between the stack data and logic relation in a new manner, that is, all the data are stored in a double link forest and can index the logic that creates them; it directly inspects customized EVM stack data in a transaction without replaying history transactions repeatedly or recording EVM bytecode-level traces. Furthermore, it extends detection rules defined by user interests, possessing good adaptability for developers. Extensive experiments demonstrate that TxMirror effectively detects attacks and vulnerabilities in unpredictable smart contracts.
Smart contracts are programs running on the blockchain.In recent years, due to the continuous occurrence of smart contract security accidents, how to effectively detect vulnerabilities in smart contracts has received extensive attention.Machine learning-based vulnerability detection techniques have the advantage of not requiring expert rules.However, existing approaches have limitations in identifying vulnerabilities caused by version updates of smart contract compilers.In this paper, we propose OC-Detector, a smart contract vulnerabilities detection approach based on opcode instruction clustering.OC-Detector learns the characteristics of opcode instructions to cluster them and replaces opcode instructions belonging to the same cluster with the cluster number.After that, the similarity is calculated against the contract in the vulnerability database to identify vulnerabilities.Experimental results demonstrate that OC-Detector improves the F 1 value of detecting vulnerabilities from 0.04 to 0.40 compared to DC-Hunter, Securify, SmartCheck, and Osiris.Additionally, compared to DC-Hunter, F 1 value is improved by 0.27 when detecting vulnerabilities in smart contracts compiled by different version compilers.
Web3 is a blockchain-powered web evolution. In many situations, Web3 smart contracts require data from outside their applications (off-chain data) via APIs to function as designed. Existing APIs in Web3 facing the most common and critical risks originate through access control vulnerabilities (i.e., Broken Object Level Authorization, Broken Function Level Authorization, and Broken Authentication). Such vulnerabilities during runtime cannot be spotted during the development and testing phases of a Web3 application that integrates APIs. Continuous monitoring is the key to proactive hunting access control attacks, which are not attainable through manual monitoring. In this paper, we design a real-time automated security monitoring approach named the access behavior learning (ABL) model for early detection and prevention of access control attacks before they could cause any damage. In two steps, the ABL approach predicts an attacker's access behavior in response to environmental behavior. First, it verifies the API providers and oracle by defining authentication schemes using OpenAPI Specification (OAS) standard to identify the API endpoints to endorse authenticity. In addition, it validates the oracle-level authentication security schemes for approving authentication. Second, it scans metadata for the current access record and compares it with the previous access records, such as location, application id, and API key, to form a baseline that determines authentication. Using this baseline, ABL determines legitimate application access based on both factors for identifying its authentication. ABL approach retains API security by designing an efficient correlation to enable complex off-chain computation by predicting API access attacks. The ABL approach is evaluated against different Web3 applications with varying levels of access control vulnerabilities where applied for early attack detection and prevention. Compared to traditional manual detection processes, the ABL approach offers early automated detection and prevention of attacks during runtime, which results in enhanced security measures and reduces the risk of potential threats.
Aiming at the problem of insufficient technology for detecting smart contract vulnerabilities and the lack of improvement of certain detection tools, a method for the expansion and improvement of the internal module of the Mythril method is proposed. Since the technology of detecting vulnerabilities is not yet mature and there are vulnerabilities in smart contracts, vulnerability detection is particularly important. Since the Mythril tool covers the most types of vulnerabilities, its accuracy rate is also the highest. In order to ensure the effect of smart contract vulnerability detection, this paper proposes the expansion and improvement of the internal module of Mythril, which realizes the operation of automatic vulnerability analysis when performing vulnerability detection by improving the operation efficiency and simplifying the operation of smart contract opcodes while analyzing them. The comparison of experimental results shows that the proposed method is more suitable for smart contract vulnerability detection, and the detection accuracy and efficiency are improved, with an average accuracy rate of 94.07%. It performs better in vulnerability detection and provides an effective guarantee for the security and reliability of smart contracts, which has important application value and research significance.
Smart contracts are critical financial instruments, and their security is of utmost importance. However, smart contract programs are difficult to fuzz due to the persistent blockchain state behind all transactions. Mutating sequences of transactions are complex and often lead to a suboptimal exploration for both input and program spaces. In this paper, we introduce a novel snapshot-based fuzzer ItyFuzz for testing smart contracts. In ItyFuzz, instead of storing sequences of transactions and mutating from them, we snapshot states and singleton transactions. To explore interesting states, ItyFuzz introduces a dataflow waypoint mechanism to identify states with more potential momentum. ItyFuzz also incorporates comparison waypoints to prune the space of states. By maintaining snapshots of the states, ItyFuzz can synthesize concrete exploits like reentrancy attacks quickly. Because ItyFuzz has second-level response time to test a smart contract, it can be used for on-chain testing, which has many benefits compared to local development testing. Finally, we evaluate ItyFuzz on real-world smart contracts and some hacked on-chain DeFi projects. ItyFuzz outperforms existing fuzzers in terms of instructional coverage and can find and generate realistic exploits for on-chain projects quickly.
Digital forensics has intelligently evolved into cloud forensics, which protects against cybercrime. However, centralized evidence gathering and maintenance reduces the credibility of digital evidence. This article suggests a unique digital forensic architecture for the Infrastructure as a Service (IaaS) cloud combining rapidly expanding Software Defined Networking (SDN) and Blockchain technologies to address this serious issue. Blockchain helps to store the gathered evidence, which means it is shared among many peers in the proposed forensic architecture. The Secure-Ring-Verification-based Authentication (SRVA) technique is recommended to ensure security from suspicious accounts. The Harmony Search Optimization (HSO) technique helps to produce secret keys that strengthen the cloud environment. Depending on their level of sensitivity, all information is encrypted and kept on a cloud server. Sensitive Aware Deep Elliptic Curve Cryptography (SAD-ECC) method was used for encryption. In the cloud, a piece of information is saved, and the SDN manager creates the blocks and stores the history of that piece of data as metadata. Utilizing Secure Hashing Algorithm-3 (SHA-3), a Merkle Hash Tree is constructed for each block. The proposed technology uses Fuzzy-based Smart Contracts (FSCs) to enable clients to trail their data. At last, evidence analysis is made possible by creating a Logical-Graph of Evidence (LGoE) using data collected through Blockchain. The network simulator-3.26 and java (for cloud and Blockchain) environment are used for experiments. A thorough investigation shows that the suggested forensic architecture exhibits favorable response, evidence insertion, and verification times.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Abstract With the increase of IoT devices generating large amounts of user-sensitive data, improper firmware harms users’ security and privacy. Latest home appliances are integrated with features to assure compatibility with smart home IoT. However, applying complex security mechanisms to IoT is limited by device hardware capabilities, making them vulnerable to attacks. Such attacks have recently become frequent. To address this issue, we developed a secure verification mechanism for firmware released by the device’s manufacturer. We proposed an IoT gateway for secure firmware verification and updating for smart home IoT devices utilizing the IOTA MAM (Masked Authenticated Messaging) protocol and a distributed file system with IPFS (Inter-Planetary File System) protocol. These two communication protocols ensure decentralized communication and firmware file distribution between the IoT device vendor and the IoT end device. The proposed scheme securely shares latest firmware content over IOTA and IPFS networks, performs a secure firmware update on IoT end devices and ensures authenticity and integrity of the firmware. Two types of validation methods were proposed for firmware updating and validation. We implemented the proposed scheme using three entities, Vendor, IoT gateway, and IoT end device. Our system yielded promising results in performing secure automated firmware updates on IoT end devices with very low computational power. The system’s functionality was implemented using IOTA’s MAM run on Raspberry Pi as an IoT gateway along with an ESP8266 Wi-Fi microcontroller, demonstrating the effectiveness of our approach. Our proposed methodology can be used for secure firmware distribution on home IoT applications.
Isaac David, Liyi Zhou, Kaihua Qin, Dawn Song · 6 authors
We investigate the feasibility of employing large language models (LLMs) for conducting the security audit of smart contracts, a traditionally time-consuming and costly process. Our research focuses on the optimization of prompt engineering for enhanced security analysis, and we evaluate the performance and accuracy of LLMs using a benchmark dataset comprising 52 Decentralized Finance (DeFi) smart contracts that have previously been compromised. Our findings reveal that, when applied to vulnerable contracts, both GPT-4 and Claude models correctly identify the vulnerability type in 40% of the cases. However, these models also demonstrate a high false positive rate, necessitating continued involvement from manual auditors. The LLMs tested outperform a random model by 20% in terms of F1-score. To ensure the integrity of our study, we conduct mutation testing on five newly developed and ostensibly secure smart contracts, into which we manually insert two and 15 vulnerabilities each. This testing yielded a remarkable best-case 78.7% true positive rate for the GPT-4-32k model. We tested both, asking the models to perform a binary classification on whether a contract is vulnerable, and a non-binary prompt. We also examined the influence of model temperature variations and context length on the LLM's performance. Despite the potential for many further enhancements, this work lays the groundwork for a more efficient and economical approach to smart contract security audits.
This paper presents a comprehensive analysis of the cryptocurrency free giveaway scam disseminated in a new distribution channel, Twitter lists. To collect and detect the scam in this channel, unlike existing scam detection systems that rely on manual effort, this paper develops a fully automated scam detection system, \textit{GiveawayScamHunter}, to continuously collect lists from Twitter and utilize a Nature-Language-Processing (NLP) model to automatically detect the free giveaway scam and extract the scam cryptocurrency address. By running \textit{GiveawayScamHunter} from June 2022 to June 2023, we detected 95,111 free giveaway scam lists on Twitter that were created by thousands of Twitter accounts. Through analyzing the list creator accounts, our work reveals that scammers have combined different strategies to spread the scam, including compromising popular accounts and creating spam accounts on Twitter. Our analysis result shows that 43.9\% of spam accounts still remain active as of this writing. Furthermore, we collected 327 free giveaway domains and 121 new scam cryptocurrency addresses. By tracking the transactions of the scam cryptocurrency addresses, this work uncovers that over 365 victims have been attacked by the scam, resulting in an estimated financial loss of 872K USD. Overall, this work sheds light on the tactics, scale, and impact of free giveaway scams disseminated on Twitter lists, emphasizing the urgent need for effective detection and prevention mechanisms to protect social media users from such fraudulent activity.
Blockchain is a decentralized, distributed ledger that records transactions between two parties. A blockchain-based software system is a new and innovative approach to software engineering that uses blockchain technology. This approach has several advantages over traditional software engineering approaches, including improved security and transparency. The most common software engineering approaches are waterfall, agile and hybrid models. Each of these has its strengths and weakness. A blockchain-based system has the advantage of being more secure and transparent than any of these approaches. It also can track changes more accurately, which can improve quality control. Blockchain technologies have incredible potential but also have some problems. One problem is security and privacy issues, which brings into question the resilience of existing security and trust mechanisms. The distributed application (dApp) framework for the proposed electronic voting system is built with the help of blockchain technology in this proposal. As a result, fewer crimes has committed against sensitive data during the electoral process because of immutability, transparency and privacy. Ganache, Metamask and hashing algorithms are used to develop the dApp. The paper's strengths lie in its ability to create and analyze threat models for blockchain-enabled-electronic voting systems and to identify the types of threats using Microsoft STRIDE.
Monika di Angelo, Thomas Durieux, João F. Ferreira, Gernot Salzer
Smart contracts are blockchain programs that often handle valuable assets. Writing secure smart contracts is far from trivial, and any vulnerability may lead to significant financial losses. To support developers in identifying and eliminating vulnerabilities, methods and tools for the automated analysis of smart contracts have been proposed. However, the lack of commonly accepted benchmark suites and performance metrics makes it difficult to compare and evaluate such tools. Moreover, the tools are heterogeneous in their interfaces and reports as well as their runtime requirements, and installing several tools is time-consuming. In this paper, we present SmartBugs 2.0, a modular execution framework. It provides a uniform interface to 19 tools aimed at smart contract analysis and accepts both Solidity source code and EVM bytecode as input. After describing its architecture, we highlight the features of the framework. We evaluate the framework via its reception by the community and illustrate its scalability by describing its role in a study involving 3.25 million analyses.
The immutable and trustable characteristics of blockchain enable smart contracts to be applied in various fields. Unfortunately, smart contracts are subject to various vulnerabilities, which are frequently exploited by attackers, causing financial damage to users.In this paper, we study the problem of vulnerable smart contract function locating. We construct a novel Multi-Relational Nested contract Graph (MRNG) to better characterize the rich syntactic and semantic information in the smart contract code, including the relationships between data and instructions. An MRNG represents a smart contract, where each node represents a function in the smart contract and each edge describes the calling relationship between the functions. In addition, we create a Multi-Relational Function Graph (MRFG) for each function, which characterizes the corresponding function code. That is, each function is characterized as an MRFG, which corresponds to a node in the MRNG. Each MRFG uses different types of edges to represent the different control and data relationships between nodes within a function. We also propose a Multi-Relational Nested Graph Convolutional Network (MRN-GCN) to process the MRNG. MRN-GCN first extracts and aggregates features from each MRFG, using the edge-enhanced graph convolution network and self-attention mechanism. The extracted feature vector is then assigned to the corresponding node in the MRNG to obtain a new Featured Contract Graph (FCG) for the smart contract. Graph convolution is used to further extract features from the FCG. Finally, a feed forward network with a Sigmoid function is used to locate the vulnerable functions. Experimental results on the real-world smart contract datasets show that model MRN-GCN can effectively improve the accuracy, precision, recall and F1-score performance of vulnerable smart contract function locating.
With the advancement of smart devices, the operation and communication of smart grids have become increasingly efficient. Many smart devices such as smart meters, smart transformers, and smart grid controllers are already widely used in smart grids. Thus, a series of complex architectures and a series of communication modes have been formed. However, these smart devices will be exposed to various cyber attacks such as distributed denial of service (DDoS) attack and replay attack. This is because they are open and dynamic. Therefore, there are serious security problems in the complex architectures and the communication modes. In this paper, we propose a multi-domain authentication mechanism based on blockchain cooperation to maintain the security of smart devices. In this mechanism, we propose a series of methods and algorithms, which include initialization method based on blockchain cooperative authentication, dynamic change method of intelligent devices and information, cross-domain authentication algorithm, and cross-domain key cooperative algorithm. To demonstrate the security and effectiveness of our proposed mechanism, we analysed its security and conducted a series of simulation experiments. The analysis and simulation experiments show that our proposed approach is secure and effective.
Abdullah Lakhan, Orawit Thinnukool, Tor Morten Groenli, Pattaraporn Khuwuthyakorn
These days, the use of digital healthcare has been growing in practice. Getting remote healthcare services without going to the hospital for essential checkups and reports is easy. It is a cost-saving and time-saving process. However, digital healthcare systems are suffering from security and cyberattacks in practice. Blockchain technology is a promising technology that can process valid and secure remote healthcare data among different clinics. However, ransomware attacks are still complex holes in blockchain technology and prevent many healthcare data transactions during the process on the network. The study presents the new ransomware blockchain efficient framework (RBEF) for digital networks, which can identify transaction ransomware attacks. The objective is to minimize transaction delays and processing costs during ransomware attack detection and processing. The RBEF is designed based on Kotlin, Android, Java, and socket programming on the remote process call. RBEF integrated the cuckoo sandbox static and dynamic analysis application programming interface (API) to handle compile-time and runtime ransomware attacks in digital healthcare networks. Therefore, code-, data-, and service-level ransomware attacks are to be detected in blockchain technology (RBEF). The simulation results show that the RBEF minimizes transaction delays between 4 and 10 min and processing costs by 10% for healthcare data compared to existing public and ransomware efficient blockchain technologies healthcare systems.
Recently, blockchain has become more popular as it fosters trust between untrusting participants. This paper uses blockchain technology to combat the sale of counterfeit products. In today’s global marketplace, fake goods detection is a problem that is becoming more and more significant. The growth of fake products can harm consumers, cause brand reputation damage, and cost real firms money. The usage of blockchain technology is one potential fix for this issue. Blockchain is a distributed ledger technology that makes it possible to trace transactions securely and openly. Blockchain can aid in preventing the creation and sale of counterfeit goods by creating an unchangeable and impenetrable record of the supply chain. Smart contracts can be used in this situation to automate the verification process and make sure that only genuine goods are sold through legitimate channels. This essay will examine the drawbacks and potential advantages of using blockchain technology to identify counterfeit goods.
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Research in Ethereum BlockChain has resulted in the growth of several tools for vulnerability detection. As a typical example, the Vandal tool detects selfdestruct vulnerability.Even though Vandal is a static analysis tool, its approach is also employed by several dynamic analysis tools. There is a need for a different approach for dynamic analysis tools to detect vulnerabilities such as selfdestruct so that dynamic analysis tools can maintain their individuality. This paper uses dynamic analysis to detect the selfdestruct (or self-destructive) vulnerability. Our work balances the developmental pace of the static and dynamic analysis approaches. The novelty of the work presented in this paper is that we use an Ether transfer-based approach and name it as "terminating transfer" to detect the selfdestruct vulnerability using the tool developed by us called "TechyTech".
The growing number of exploits and hacks on the Ethereum blockchain has led to the development of powerful smart contract vulnerability detection tools and the frequent patching of the smart contract’s programming languages (such as Solidity). At the same time, an ever-increasing number of people are interested in blockchain and smart contract-related topics and willing to build and deploy their own Decentralized Applications (dApp). However, learning a new programming language and its best practices as long as how to actually deploy a smart contract on the blockchain is a difficult task even for experienced developers. Recently, ChatGPT, a new user-friendly deep learning tool, has been released to improve the ability of non-skilled users to write high-quality code and in general, to boost the performances of developers in key tasks related to code writing (i.e., writing functions, explaining runtime errors, fixing bugs, etc.). This paper aims to measure the capabilities of ChatGPT in fixing vulnerable smart contracts and to assess the effectiveness of this tool, determining whether it can be a valuable aid for those who want to correct their own smart contract or want to reuse existing ones by first checking their status and eventually fix their vulnerability. In particular, we asked ChatGPT to fix 143 smart contracts with well-known labeled vulnerabilities. We considered a vulnerability as "fixed" if the code corrected by ChatGPT no longer contained the vulnerability (for this purpose, we exploited Slither, one of the state-of-the-art tools for smart contracts vulnerability detection to check the status of the original and the corrected smart contracts). As a result we obtained that ChatGPT was able to fix bugs and vulnerable smart contracts on average the 57.1% of the time with an increase of +1.4% when a description of the bug was provided in addition to the smart contract’s source code.
Due to the exponential growth of IoT devices across diverse applications, it has become essential to secure edge devices against various hardware attacks, such as tampering and cloning. A tampered device with a hardware Trojan can bypass the security measures implemented through the software layers. One of the primary ways to verify the authenticity of a device is by using physically unclonable functions (PUFs) as a unique device fingerprint. During authentication, the PUF response from the edge device is transferred securely and compared with the stored response. This requires a secure communication setup between the edge device and the central server. The fingerprint must also be stored on a server for response matching. However, the potential compromise of the central server will result in the leak of all secret information of the edge devices, and adversaries can exploit it to gain unauthorized access to the IoT network. In this paper, we propose an efficient, secure, and on-demand communication protocol using zero-knowledge proofs (ZKPs) that allow the prover to provide evidence of its secret without revealing that to the verifier. The edge device, acting as the prover, convinces the central server, the verifier, of the unique PUF response stored inside the device without needing the actual storage of PUF responses on the server. The non-interactive characteristic of zk-SNARK, a widely used ZKP protocol in many popular cryptocurrencies such as Zcash, offers better optimization to authentication frequency, communication bandwidth between device and server, and protection of device-specific secret, all of which contribute to constructing our proposed device authentication framework.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
In recent years, applying smart contract to Blockchain-based Service Networks (BSNs) has been considered as one of the most promising solution to boost the integration and adoption of Blockchain in big businesses. However, smart contract are especially vulnerable to attack due to poor coding. Although many existing vulnerability detection tools are restricted by rigorous rules that are defined by the experts in advance, these tools are observed to have a high false positive rate in practice. Thus we propose a vulnerability detection framework for smart contract based on the attention mechanism and data flow. The code of smart contract is transformed to a data flow according to the abstract syntax tree that is built from the code. The data flow we built with smart contract code could represent the relationships of code semantic logic. Source code, data flow, and the tags of smart contract code are used as datasets to mask processing. Then, we construct a bidirectional multi-layer transformer architecture based on the attention mechanism to train our dataset. After training, we can get the label of whether there is a vulnerability in the final smart contract. Finally, the model we proposed reaches state-of-the-art results in the practical experiments of smart contract vulnerability detection with 92.54%, 81.79%, and 86.84% in the results Accuracy, Recall, and F1score, respectively.
In the world of modern technology, ensuring security is a top priority. To address this issue, blockchain technology has emerged as a promising solution by eliminating intermediaries and enhancing security. Cryptocurrencies are the first type of digital assets that have been successfully managed using blockchain technology. In recent years, financial institutions have been increasingly adding cryptocurrencies to their portfolios, leading to widespread adoption and interest among various stakeholders, including the banking sector, government, and individual investors. Cryptocurrency has the potential to become the future global currency, replacing fiat currency. This research project provides a comprehensive overview of the cryptocurrency market, including its origins, key features, price dynamics, market capitalization, and trading volumes. The project also explores important concepts such as Ethereum, smart contracts, tokens, and consensus algorithms that are critical to the functioning of the cryptocurrency market.