Decentralized finance protocols are frequently exploited, creating a demand for fast and reliable repair of vulnerable smart contracts and validation that reflects runtime security. Large language models are an emerging source of patches, yet many evaluations rely on manual checks or self-assessment, which cannot confirm whether attacker profit is actually prevented. We introduce an executable benchmark that replays verified real-world exploits against patched Solidity contracts under a resilient protocol that permits alternate attack paths and controlled state variation. Our framework compiles candidate patches, deploys them on a forked chain, and tests whether the exploit still yields profit. The benchmark covers six test cases drawn from reproducible incidents and is released as open-source. Among the nine evaluated models, GPT-5, GPT-4.1, and Claude Opus 4.1 performed the best, mitigating four of six test cases. Microsoft Phi-4 was the most reliable open-source model, mitigating two of six exploits and producing compilable patches for the remaining cases. No model mitigated the H2O case once resilient checks were enabled, while a simpler access control flaw, BTNFT, was often repaired with minimal edits. Grounding validation in executable exploit replay provides a precise and scalable method to measure whether proposed repairs harden contracts at runtime.
This project develops a blockchain-based web application aimed at verifying pharmaceutical products, a critical step in combating counterfeit drugs. By leveraging Ethereum's Sepolia test network and the power of smart contracts, the system facilitates secure, transparent processes for registering, verifying, and tracking pharmaceutical items. The application combines a PHP-based backend with a JavaScript-powered frontend, seamlessly integrating tools like MetaMask for user authentication and Web3.js to enable blockchain communication. The study underscores the significant advantages blockchain offers over traditional verification methods, particularly in terms of data integrity, transparency, and security. As a result, it meets the CIA triad model's requirements for confidentiality and integrity in information security. The novel features of the project include the use of optimism roll-ups for scalability, two-factor authentication (2FA), and data encryption to address critical challenges often overlooked in similar proposals for blockchainbased authentication systems. The results of the project demonstrate a tangible improvement in supply chain transparency and fraud prevention within the pharmaceutical industry. This work lays a strong foundation for further exploration of decentralised applications, not only in pharmaceutical validation but also across other essential sectors.
B. Thanikaivel, Vishnupriyan. J, Dharma Sastha B., Naveen Akash. V
This paper presents a Smart Contract Based Integrity Verifier framework for web security in APIs. This framework utilizes blockchain technology in order to design a secure mechanism that makes use of cryptographic hashes to verify the credibility of API responses. Smart contracts ensure transparent and tamper-proof scoring while automating security enforcement The approach is relevant because it covers the weaknesses existing in the existing Oauth 2.0 APIs and provides a strong mechanism for data tampering detection and prevention. This is achieved through the implementation of the system on Python Framework and blockchain simulation, hence enabling users to interact with the system and send API responses validated for credibility. The framework ensures$\mathbf{9 8 \%}$verification accuracy rates as compared to the existing security mechanisms for API Credibility Verification. Future work is in integrating into various domains, such as healthcare, finance, supply chain, and IoT.
Public Key Infrastructure (PKI) is foundational to secure digital communication, yet its traditional reliance on centralized Certificate Authorities (CAs) introduces significant risks, costs, and operational bottlenecks. This paper presents a novel, fully decentralized approach to PKI by leveraging the XRP Ledger (XRPL) blockchain for the issuance, storage, retrieval, and revocation of X. 509 certificates. The core methodology stores certificates directly within XRPL transactions using the native Memos field, offering a lightweight, immutable, and cost-effective solution without requiring modifications to the underlying protocol. To enhance certificate lifecycle management and enable native on-chain revocation, we also introduce a complementary approach that uses Non-Fungible Tokens (NFTs) to store certificate data and metadata. NFT-based storage supports features such as instant revocation through burning or flagging, and enables additional transparency and auditability. Certificate retrieval involves querying transaction history or owned NFTs, decoding and reassembling the data if chunked, and validating the reconstructed X. 509 certificate using standard tools. We implement a Python-based web application that exposes RESTful APIs for certificate lifecycle management, secure messaging, and encrypted email, demonstrating seamless integration with existing PKI-aware applications. Our evaluation shows that this architecture drastically reduces operational costs compared to traditional CAs while enhancing transparency, auditability, and resilience. This work demonstrates the feasibility and advantages of blockchain-native PKI, paving the way for scalable, trustminimized, and user-centric digital identity management.
Vivi Andersson, Sofia Bobadilla, Harald Hobbelhagen, Martin Monperrus
Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce PoCo, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. PoCo autonomously generates PoC exploits in an agentic manner by interacting with a set of code-execution tools in a Reason–Act–Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate PoCo on a dataset of 23 real-world vulnerability reports. PoCo consistently outperforms the Zero-shot and Workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides actionable knowledge for the smart contract security community.
Asheshemi Nelson Oghenekevwe, Okoro Akpohrobaro Daniel, Ayeh Blessing Elohor, Ayo Michael Ifioko · 6 authors
Developments of Web 3.0 technologies present vital problems regarding data confidentiality, authentication of users and their privacy in decentralised systems. The traditional multifactor authentication (MFA) systems have been effective when deployed in Web2 environments but have failed in protecting sensitive information in the decentralised environment because they use centralised servers and are also dependent on static security factors. The paper explores the concept of multifactor authentication that is based on blockchain technology as the effective method of improving the use of data confidentiality in Web3. A blockchain-augmented MFA infrastructure was created on the basis of an Ethereum smart contract, decentralised storage, and biometric data that were cryptographically encrypted. Simulation demonstrated significant increases in security relative to conventional MFA systems, a significant drop in the probability of breaching (0.0270 to 0.0040), an improvement in the entropies, a decrease in the likelihood of session hijacking, and limited mutual information leakage. Also, the blockchain-based system becomes more resistant to Man-in-the-Middle (MITM) and phishing attacks, mitigating them by about 60 per cent and 50 per cent success rates, respectively. Whereas the blockchain MFA made some minor sacrifices in latency and computation cost in the course of authentication, such a trade of costs is productive in the Web3 environment where security and data integrity remain of utmost importance. The study could be useful to developers, security practitioners and policymakers who intend to develop more secure, scalable, and user-centric authentication mechanisms in decentralised apps. As a potential improvement, it is suggested that future research should implement the aspect of consensus optimisation and Layer-2 to increase the efficiency and scalability further.
Chong Chen, Jiachi Chen, Lingfeng Bao, David F. Lo · 10 authors
Smart contract vulnerabilities, particularly improper Access Control that allows unauthorized execution of restricted functions, have caused billions of dollars in losses. GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files-these serve as intermediate development artifacts that must be compiled and packaged before deployment. Third-party developers often reference, reuse, or fork code from these repositories during custom development. However, if the referenced code contains vulnerabilities, it can introduce significant security risks. Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories, as they typically require the target contract to be compilable to generate an abstract representation for further analysis. This paper presents TRACE, a tool designed to secure non-compilable smart contract repositories against access control vulnerabilities. TRACE employs LLMs to locate sensitive functions involving critical operations (e.g., transfer) within the contract and subsequently completes function snippets into a fully compilable contract. TRACE constructs a function call graph from the abstract syntax tree (AST) of the completed contract. It uses the control flow graph (CFG) of each function as node information. The nodes of the sensitive functions are then analyzed to detect Access Control vulnerabilities. Experimental results demonstrate that TRACE outperforms state-of-the-art tools on an open-sourced CVE dataset, detecting 14 out of 15 CVEs. In addition, it achieves 89.2% precision on 5,000 recent on-chain contracts, far exceeding the best existing tool at 76.9%. On 83 real-world repositories, TRACE achieves 87.0% precision, significantly surpassing DeepSeek-R1's 14.3%.
Xihan Xiong, Zhipeng Wang, Qin Wang, William Knottenbelt
Decentralized communication is becoming an important use case within Web3. On Ethereum, users can repurpose the transaction input data field to embed natural-language messages, commonly known as Input Data Messages (IDMs). However, as IDMs gain wider adoption, there has been a growing volume of toxic content on-chain. This trend is concerning, as Ethereum provides no protocol-level support for content moderation. We propose two moderation frameworks for Ethereum IDMs: (i) BUILDERMOD, where builders perform semantic checks during block construction; and (ii) USERMOD, where users proactively obtain moderation proofs from external classifiers and embed them in transactions. Our evaluation reveals that BUILDERMOD incurs high block-time overhead, which limits its practicality. In contrast, USERMOD enables lower-latency validation and scales more effectively, making it a more practical approach in moderation-aware Ethereum environments. Our study lays the groundwork for protocol-level content governance in decentralized systems, and we hope it contributes to the development of a decentralized communication environment that is safe, trustworthy, and socially responsible.
This paper presents EMDns, a domain name system based on Ethereum and MongoDB, addressing the centralization, security weaknesses, and privacy issues of the Domain Name System (DNS). EMDns enables automated and decentralized domain management to eliminate SPOF and authority dependence, while resolution is performed via local look-ups with hash comparison to protect privacy against deanonymization attacks. Experimental results show that EMDns maintains resolution efficiency while significantly enhancing security and privacy.
Zilga Heritiana Randriamiarison, Hajarisena Razafimahatratra, Nicolas Raft Razafindrakoto, Yassine Rhazali
A smart contract is a program deployed on a blockchain network and becomes immutable once deployed. Reentrancy bugs are among the most significant vulnerabilities in blockchain technology. Numerous approaches have been proposed to detect and analyze them. However, minimizing reentrancy errors in smart contracts remains a challenge. The aim of this paper is to optimize the handling of reentrancy bugs in smart contracts across different versions of Solidity. It also proposes a new method for syntactic and lexical code detection. Our approach is based on static analysis, and the tool can detect different versions of smart contract code. We used regex to identify external calls in the contract and Control Flow Graph (CFG) to identify the components of the code. A detection algorithm was developed to identify reentrancy vulnerabilities. This approach enhances contract reliability and reduces risk prior to deployment. Our method has been evaluated using True Positive Rate (TPR) and False Positive Rate (FPR) metrics. We tested it on the SmartBugs benchmark suite and contracts from Etherscan. The contracts analyzed include two solidity versions: 0.4.x and 0.8.x. Thanks to the integration of multiple tools, our solution supports testing across different solidity versions.
Bug reproduction is becoming an important task in the security analysis of Solidity smart contracts. By simulating attacks, developers and auditors can better understand how a vulnerability is triggered in practice. To reproduce a bug, one often needs to define an attacker contract and a specific sequence of interactions that exploit the vulnerability. However, in smart contracts, there are rarely automated tools that can generate such contracts and sequences and validate their correctness. Existing security tools, such as formal verifiers, are effective at detecting bugs, but they are not designed for bug reproduction. They often omit execution traces or produce incomplete ones. Moreover, their reports rarely reflect the behaviour patterns of attacker contracts. This gap motivates our work. We propose VeriExploit, a framework that combines formal methods and large language models to automatically generate, validate, and refine reproduction contracts and execution steps. Given a vulnerable contract and its counterexample, VeriExploit produces a contract that re-triggers the same bug and outputs a concrete trace showing how the exploit works. Experiments show that VeriExploit is effective at automating bug reproduction, achieving a success rate of 85.60% on our benchmark dataset.
Smart contracts enable contract terms to be automatically executed and verified on the blockchain, and recent years have witnessed numerous applications of them in areas such as financial institutions and supply chains. The execution logic of a smart contract is closely related to the contract state, and thus the correct and safe execution of the contract depends heavily on the precise control and update of the contract state. However, the contract state update process can have issues. In particular, inconsistent state update issues can arise for reasons such as unsynchronized modifications. Inconsistent state update bugs have been exploited by attackers many times, but existing detection tools still have difficulty in effectively identifying them. This paper conducts the first large-scale empirical study about inconsistent state update vulnerabilities (that is, inconsistent state update bugs that are exploitable) in smart contracts, aiming to shed light for developers, researchers, tool builders, and language or library designers in order to avoid inconsistent state update vulnerabilities. We systematically investigate 116 inconsistent state update vulnerabilities in 352 real-world smart contract projects, summarizing their root causes, fix strategies, and exploitation methods. Our study provides 11 original and important findings, and we also give the implications of our findings. To illustrate the potential benefits of our research, we also develop a proof-of-concept checker based on one of our findings. The checker effectively detects issues in 64 popular GitHub projects, and 19 project owners have confirmed the detected issues at the time of writing. The result demonstrates the usefulness and importance of our findings for avoiding inconsistent state update vulnerabilities in smart contracts.
Smart contracts are important for digital finance, yet they are hard to patch once deployed. Prior work has mainly explored LLMs for smart contract vulnerability detection, leaving end-to-end automated exploit generation (AEG) much less understood. We study that gap with \textsc{ReX}, an execution-grounded framework that links LLM-based exploit synthesis to the Foundry stack for end-to-end generation, compilation, execution, and validation. Five recent LLMs are evaluated across eight common vulnerability classes, supported by a curated dataset of 38{+} real incident PoCs and three automation aids: prompt refactoring, a compiler feedback loop, and templated test harnesses. Results indicate that current frontier LLMs can often produce deterministic PoCs for single-contract vulnerabilities, but remain weak on cross-contract attacks; outcomes depend mainly on the model and bug type, while code structure and prompt tuning contribute less in our setting. The study also surfaces important boundary conditions of LLM-driven AEG, including gaps between oracle-validated exploitability and real-world economic attacks, pointing to the need for stronger defenses and more realistic evaluation.
The introduction of smart contract functionality marks the advent of the blockchain 2.0 era, enabling blockchain technology to support digital currency transactions and complex distributed applications. However, many smart contracts have been found to contain vulnerabilities and errors, leading to the loss of assets within the blockchain. Despite a range of tools that have been developed to identify vulnerabilities in smart contracts at the source code or bytecode level, most rely on a single modality, reducing performance, accuracy, and limited generalization capabilities. This paper proposes a multimodal deep learning approach, MultiCFV, which is designed specifically to analyze and detect erroneous control flow vulnerability, as well as identify code clones in smart contracts. Bytecode is generated from source code to construct control flow graphs, with graph embedding techniques extracting graph features. Abstract syntax trees are used to obtain syntax features, while code comments capture key commentary words and comment features. These three feature vectors are fused to create a database for code inspection, which is used to detect similar code and identify contract vulnerabilities. Experimental results demonstrate our method effectively combines structural, syntactic, and semantic information, improving the accuracy of smart contract vulnerability detection and clone detection.
Z. H. Randriamiarison, H. Razafimahatratra, N. R Razafindrakoto, Yassine Rhazali
Blockchain technology is gaining popularity today, replacing centralized data storage on a central server with a decentralized network of ledgers, thus ensuring secure information exchange. A smart contract is a program written on the blockchain that runs autonomously within the Ethereum virtual machine: a transparent and secure program, but once deployed on the blockchain network, it cannot be modified. Despite its advantage over other technologies, smart contract has become a prime target for hackers, making it difficult for developers to eliminate all vulnerabilities before its deployment. In this paper, we propose a static analysis approach aimed at reducing vulnerabilities in smart contract. Our method builds upon PASO (Parser for Solidity) and MSmart approaches: we developed a test lifecycle model for smart contracts and created a tool based on ANTLR4's G4 grammar. It involves both syntactic and lexical analysis to effectively detect bugs and vulnerabilities in smart contract. To validate our method, we used FDR (False Discovery Rate) and FNR (False Negative Rate) as evaluation metrics, data collected from SmartBugs and Etherscan. We validated our approach compared with MSmart and SmartCheck. We got higher FDR and improved FNR, indicating enhanced detection capabilities. After thorough analysis and extensive testing, our tool has proven to be both specific and high-performing.
The widespread adoption of EOSIO blockchain technology has underscored the critical importance of securing EOSIO smart contracts. Vulnerabilities within these contracts can result in substantial economic losses, making their detection a vital area of research. However, existing methods for detecting vulnerabilities in EOSIO smart contracts predominantly rely on expert-defined rules, which are often susceptible to errors and lack scalability. To address this issue, we propose a vulnerability detection method for the EOSIO platform based on a teacher-student network architecture. This approach specifically focuses on detecting vulnerabilities at the function level. This approach consists of two networks. The teacher network learns both the syntax and semantics of source code and bytecode, while the student network takes bytecode as input. The teacher-student network extracts function-level features by incorporating an MCOAttention mechanism. The student network infers missing bytecode embeddings by learning from the teacher network. By combining the inferred source code and bytecode representations, the method achieves improved accuracy in vulnerability detection. We introduce a cross-modal mutual learning strategy to facilitate knowledge transfer between the teacher and student networks. We evaluated our proposed approach using a dataset comprising smart contracts from the EOSIO platform. Experimental results demonstrate that our method significantly improves accuracy in vulnerability detection.
Blockchain gaming platforms based on Non-Fungible Tokens (NFTs) have vastly grown and provide players with ownership to trade and monetize in-game assets. However, the integrity of NFT transactions in Proof-of-Stake (PoS) systems are prone to security threats due to the possible insertion of malicious blocks. Detection of these blocks is required to keep trust in the ecosystem. The proposed machine learning-based solution included detection of malicious blocks in PoS with focus on the performance of an LSTM Model. Following extensive testing with 3 models of LSTM, 1D CNN and GRU, the model achieved an accuracy of 86.9% making it most effective in regards to early identification of fraudulent transactions. This method augments the security of NFT gaming transactions and thus offers support against several malicious acts occurring in blockchain based ecosystems.
Francesco Salzano, Cosmo Kevin Antenucci, Simone Scalabrino, Giovanni Rosa · 6 authors
Abstract The rapid adoption of blockchain technology highlighted the importance of ensuring the security of smart contracts due to their critical role in automated business logic execution on blockchain platforms. This paper provides an empirical evaluation of automated vulnerability analysis tools specifically designed for Solidity smart contracts. Leveraging the extensive SmartBugs 2.0 framework, which includes 20 analysis tools, we conducted a comprehensive assessment using an annotated dataset of 2,182 instances, manually labeled at the line level with vulnerability labels. Our evaluation highlights the detection effectiveness of these tools in detecting various types of vulnerabilities, as categorized by the DASP TOP 10 taxonomy. We evaluated the efficacy of a Large Language Model-based detection method on two popular datasets. In this case, we obtained inconsistent results with the two datasets, showing unreliable detection when analyzing real-world smart contracts. Our study identifies significant variations in the accuracy and reliability of different tools and demonstrates the advantages of combining multiple detection methods to improve vulnerability identification. We identified a set of 3 tools that, combined, achieve up to 76.78% found vulnerabilities, taking less than one minute to run, on average. This study contributes to the field by releasing the largest dataset of manually analyzed smart contracts with line-level vulnerability annotations and by conducting the largest empirical evaluation of tools to date.
Large Language Models (LLMs) have shown great promise in code analysis and auditing; however, they still struggle with hallucinations and limited context-aware reasoning. We introduce SmartAuditFlow, a novel Plan-Execute framework that enhances smart contract security analysis through dynamic audit planning and structured execution. Unlike conventional LLM-based auditing approaches that follow fixed workflows and predefined steps, SmartAuditFlow dynamically generates and refines audit plans based on the unique characteristics of each smart contract. It continuously adjusts its auditing strategy in response to intermediate LLM outputs and newly detected vulnerabilities, ensuring a more adaptive and precise security assessment. The framework then executes these plans step by step, applying a structured reasoning process to enhance vulnerability detection accuracy while minimizing hallucinations and false positives. To further improve audit precision, SmartAuditFlow integrates iterative prompt optimization and external knowledge sources, such as static analysis tools and Retrieval-Augmented Generation (RAG). This ensures audit decisions are contextually informed and backed by real-world security knowledge, producing comprehensive security reports. Extensive evaluations across multiple benchmarks demonstrate that SmartAuditFlow outperforms existing methods, achieving 100 percent accuracy on common and critical vulnerabilities, 41.2 percent accuracy for comprehensive coverage of known smart contract weaknesses in real-world projects, and successfully identifying all 13 tested CVEs. These results highlight SmartAuditFlow's scalability, cost-effectiveness, and superior adaptability over traditional static analysis tools and contemporary LLM-based approaches, establishing it as a robust solution for automated smart contract auditing.
We present a secure and efficient string-matching platform leveraging zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) to address the challenge of detecting sensitive information leakage while preserving data privacy. Our solution enables organizations to verify whether private strings appear on public platforms without disclosing the strings themselves. To achieve computational efficiency, we integrate a sliding window technique with the Rabin-Karp algorithm and Rabin Fingerprint, enabling hash-based rolling comparisons to detect string matches. This approach significantly reduces time complexity compared to traditional character-by-character comparisons. We implement the proposed system using gnark, a high-performance zk-SNARK library, which generates succinct and verifiable proofs for privacy-preserving string matching. Experimental results demonstrate that our solution achieves strong privacy guarantees while maintaining computational efficiency and scalability. This work highlights the practical applications of zero-knowledge proofs in secure data verification and contributes a scalable method for privacy-preserving string matching.
Rami Almatarneh, Mohammad Aljaidi, Ayoub Alsarhan, Sami Aziz Alshammari · 6 authors
The rapid evolution of Web 4.0, characterized by decentralized systems, real-time data processing, and AI-driven interfaces, presents serious security threats such as SQL injection (SQLi) attacks, adversarial model poisoning, and IoT device spoofing. This paper presents a unified AI-blockchain framework designed to address these vulnerabilities, incorporating bidirectional LSTM networks for SQLi detection, Trimmed Mean aggregation with a reputation system for model poisoning defense, and CNN-based IoT authentication anchored to a decentralized blockchain. Evaluated on the Bitcoin OTC trust network, the framework clearly shows outstanding performance, with SQLi detection achieving 96.2% accuracy (94.8% precision and 92.5% recall), far outperforming traditional rule-based systems such as Snort (82.1% accuracy). The success rate of model poisoning attacks is reduced from 78% (in the absence of defense) to just 12% through the application of Trimmed Mean aggregation and dynamic reputation scoring, while IoT spoofing detection attains a 91.3% F1-score through cosine similarity-based matching of network traffic embeddings. The blockchain layer, which uses Delegated Proof-of-Stake (DPoS) consensus, achieves 1,450 transactions per second (TPS) with a validation latency of only 220 milliseconds, ensuring efficient real-time auditability. Furthermore, user trust scores increased by 48% after implementation (4.3/5 vs. 2.9/5 before implementation), confirming the framework's practical impact. Nevertheless, some limitations still persist, such as the 15% latency overhead due to federated learning and the use of synthetic IoT data, which may limit or reduce the framework's real-world applicability. The proposed combination of AI-based adaptive threat detection and blockchain-based tamper-proof transparency will pave the way for secure, user-focused architectures in Web 4.0, providing a scalable framework to address the evolving cyber threats in decentralized environments.
This project discusses a critical vulnerability related to crypto seed phrases impacting wallets such as Ethereum and Solana. The vulnerability can affect over 24,000 wallets and is crucial for understanding the risks associated with cryptocurrency security. The research has been submitted to several security platforms, including Binance, Solana, and Ethereum for further review. Contact: techokba@gmail.com
Serving as the first touch point for users to the cryptocurrency world, cryptocurrency wallets allow users to manage, receive, and transmit digital assets on blockchain networks and interact with emerging decentralized finance (DeFi) applications. Unfortunately, cryptocurrency wallets have always been the prime targets for attackers, and incidents of wallet breaches have been reported from time to time. Although some recent studies have characterized the vulnerabilities and scams related to wallets, they have generally been characterized in coarse granularity, overlooking potential risks inherent in detailed designs of cryptocurrency wallets, especially from perspectives including user interaction and advanced features. To fill the void, in this paper, we present a fine-grained security analysis on browser-based cryptocurrency wallets. To pinpoint security issues of components in wallets, we design WalletProbe, a mutation-based testing framework based on visual-level oracles. We have identified 13 attack vectors that can be abused by attackers to exploit cryptocurrency wallets and exposed 21 concrete attack strategies. By applying WalletProbe on 39 widely-adopted browser-based wallet extensions, we astonishingly figure out all of them can be abused to steal crypto assets from innocent users. Identified potential attack vectors were reported to wallet developers timely and 26 issues have been patched already. It is, hence, urgent for our community to take action to mitigate threats related to cryptocurrency wallets. We promise to release all code and data to promote the development of the community.
Smart contracts deployed on blockchain platforms are vulnerable to various security vulnerabilities. However, only a small number of Ethereum contracts have released their source code, so vulnerability detection at the bytecode level is crucial. This paper introduces SmartBugBert, a novel approach that combines BERT-based deep learning with control flow graph (CFG) analysis to detect vulnerabilities directly from bytecode. Our method first decompiles smart contract bytecode into optimized opcode sequences, extracts semantic features using TF-IDF, constructs control flow graphs to capture execution logic, and isolates vulnerable CFG fragments for targeted analysis. By integrating both semantic and structural information through a fine-tuned BERT model and LightGBM classifier, our approach effectively identifies four critical vulnerability types: transaction-ordering, access control, self-destruct, and timestamp dependency vulnerabilities. Experimental evaluation on 6,157 Ethereum smart contracts demonstrates that SmartBugBert achieves 90.62% precision, 91.76% recall, and 91.19% F1-score, significantly outperforming existing detection methods. Ablation studies confirm that the combination of semantic features with CFG information substantially enhances detection performance. Furthermore, our approach maintains efficient detection speed (0.14 seconds per contract), making it practical for large-scale vulnerability assessment.