Smart contracts are a core component of blockchain-based decentralized systems, but their immutability and financial exposure make software defects particularly costly. Existing analysis tools have improved vulnerability detection, yet most lack integrated remediation capabilities. This paper presents SARMF, a hybrid framework combining static analysis, pattern detection, lightweight machine learning classification, and template-based remediation. The framework is evaluated using SARMF-Bench, a curated dataset designed to support reproducible assessment of detection and first-pass remediation across common vulnerability classes. Results indicate detection performance in the high-80s to low-90s range with balanced precision and recall, while remediation templates reduce manual correction effort by approximately 30–40%. The contribution is a practical research prototype, a benchmark protocol, and an extensible evaluation framework for smart contract security.
Detecting vulnerabilities in smart contracts is challenging due to their complex semantics, structural diversity, and class imbalance. Existing deep learning approaches often treat contracts as plain text, overlooking the rich structural information in Abstract Syntax Trees (ASTs). To address these limitations, we propose SmartContractTransformer-GAN (SCT-GAN), a multi-task transformer-based framework for vulnerability detection and adversarial contract generation. SCT-GAN introduces three key innovations: (1) fusion of source code tokens and AST paths for enhanced semantic and structural modeling, (2) hierarchical detection at contract and line levels, enabling fine-grained identification even with limited context, and (3) a syntax-aware GAN generator-discriminator loop producing realistic and semantically meaningful smart contract code. Evaluation shows that while contract-level detection does not significantly improve the state of the art, line-level detection benefits most from the generative components, leveraging richer latent representations to capture logical patterns in individual lines. SCT-GAN’s modular, memory-efficient design supports large-scale auditing, continual adaptation to emerging vulnerabilities, and synthetic dataset generation for low-data scenarios. Overall, SCT-GAN provides a scalable, interpretable, and generative solution for proactive smart contract security, advancing automated auditing and vulnerability synthesis in blockchain ecosystems.
Frequent security issues with smart contract vulnerabilities have become a pressing challenge in the industry. Conventional program analysis methods lack flexibility and extensibility, leading to high false positive rates. Deep learning approaches are emerging as a new trend to address this issue. Compared to other neural networks, graph convolutional networks can better capture the structural and logical information of smart contracts. However, existing methods do not fully consider the scale-free characteristics of smart contracts and fail to leverage their complex hierarchical structures and semantic information. Therefore, we develop an end-to-end vulnerability detection framework using Riemannian Graph Convolutional Networks (RGCNet). We first construct smart contract graphs that are rich in semantic and structural information. Next, we learn features of the smart contract graph in the Riemannian manifold, thereby better reflecting its actual topology. Simultaneously, the word embedding network extracts semantic features, forming an end-to-end network where modules promote one another. Extensive experiments are conducted on three vulnerabilities using real-world smart contracts. The results show that the proposed approach exhibits superior performance over state-of-the-art methodologies in terms of accuracy, precision, and recall.
Yinhao Xiao, Chih-Chung Liu, Mingshu Cong, Le Yang
DeFi smart-contract vulnerabilities often arise from protocol-level financial semantics rather than syntactic Solidity patterns. Direct LLM prompting can generate plausible patches that compile but leave oracle, vault, lending, or AMM invariants unresolved. We aim to make LLM-based smart-contract repair more reliable by separating patch generation from domain-specific judgment and requiring accepted patches to improve check-visible semantic obligations. We present DeFiSent, a check-guided repair framework. It normalizes contract code, infers protocol roles, routes vulnerability-family checks, emits structured findings and violated invariants, and prompts an LLM with this evidence. Candidate patches are accepted only after compilation, tests, interface preservation, non-increasing semantic severity, and invariant-specific gates. We evaluate DeFiSent on a coverage-aware corpus from DeFiHackLabs, EVMbench, LISA-Bench, SmartBugs Curated, and BCCC-SCsVuls-2024. The DeepSeek campaign contains 40,452 paired tasks and 80,904 model-mode runs, including a 41,332-row code-level shard. On the unified 6,000-task DeepSeek subset, check guidance improves dynamic pass rate from 54.82\% to 79.95\%, semantic-improvement rate from 40.42\% to 53.92\%, and total severity reduction from 8,733 to 24,084. On a 2,000-task SiliconFlow matrix, aggregate semantic-improvement rate increases from 27.0\% to 57.8\%. Structured findings and gate-based validation substantially improve LLM repair behavior for DeFi contracts. DeFiSent does not replace expert auditing, but it provides a reproducible path for aligning LLM-generated patches with financial-semantic proof obligations.
The rapid growth of IoT devices has increased security risks, particularly in firmware updates and device authentication. Traditional approaches are vulnerable to attacks such as unauthorised access and data breaches. This study proposes a blockchain-based framework using smart contracts and a proof-of-authority (PoA) consensus mechanism to ensure secure firmware verification and decentralised authentication. The system leverages distributed ledger technology to enhance integrity, trust, and scalability in IoT environments. Experimental results demonstrate reduced latency, improved throughput, and strong resistance to common cyber threats, making the framework suitable for large-scale IoT deployments.
Recently, extensive research has focused on addressing the unique challenges of smart contract fuzzing. Nevertheless, existing fuzzers still struggle to generate adequate function call arguments that can explore the deep smart contract states. In this paper, we introduce novel classes of argument constraints that capture the inter-argument relationships required to exercise meaningful contract logic. We propose a static analysis algorithm to extract these constraints from Solidity source code. In addition, we design a constraint-aware argument mutation strategy that leverages the identified constraints to guide test case generation for smart contract fuzzing. We implement our approach in a fuzzer named IConFuzz. Our evaluation on realistic benchmarks with integer overflow, suicidal contract, and ether leakage vulnerabilities demonstrates that IConFuzz outperforms state-of-the-art testing tools in both the number of bugs discovered and the speed of bug detection.
Seema C K, Sharan V Talwar, subhash Chandra K R Patel, S. E. R. Sacha Emile R.
The Internet of Things (IoT) presents critical security challenges including device identity spoofing, replay attacks, and data tampering across billions of deployed endpoints. This work presents ZK-IoTChain, a blockchain-enabled security framework that integrates zk-SNARK-based device authentication with Merkle-anchored data integrity in a unified architecture. The proposed system employs a three-layer design consisting of device-side proof generation, on-chain Groth16 verification, and IPFS-based off-chain storage. This architecture ensures privacy-preserving authentication while maintaining scalability and cost efficiency. Experimental evaluation on the Ethereum Sepolia testnet demonstrates a mean proof generation latency of 3.21 seconds and on-chain verification latency of approximately 125 milliseconds, with an average gas cost of 278,400 per authentication. The framework achieves a 99.98% reduction in storage cost compared to full on-chain approaches. Security analysis under the Dolev–Yao adversary model confirms effective mitigation of identity spoofing, replay attacks, data tampering, and man-in-the-middle (MITM) attacks. The results highlight ZK-IoTChain as a practical and efficient solution for secure, scalable, and privacy-preserving IoT ecosystems.
haojia hong, Duan Jia, Wei Ren, Xi Liu · 5 authors
Proxy contracts support logic upgradeability and deployment reuse in decentralized application (DApp). However, the use of proxy mechanisms also introduces new security risks. Although prior work has explored the security of proxy contracts, most prior approaches either depend on source code or fail to handle complex proxy storage layouts at the bytecode level, reducing their applicability to real-world closed-source contracts. In this paper, we propose ProxyLens, a bytecode-level vulnerability detection framework tailored for Ethereum proxy contracts. Without requiring source code, ProxyLens integrates storage structure modeling, proxy pattern recognition, and vulnerability detection. It features (1) a slot recovery mechanism based on symbolic execution and taint analysis for precise variable layout inference, (2) a proxy identification and delegate slot tracing module for accurate proxy architecture recognition, and (3) a semantic-driven vulnerability detection engine that works independently of function names. Experiments show that ProxyLens significantly outperforms existing tools in storage slot recovery (F1 = 96.4%), variable type inference (accuracy = 63.0%), proxy pattern recognition (accuracy > 90% across multiple patterns), and vulnerability detection (e.g., function selector collision F1 = 98.77%, storage collision F1 = 79.50%). As a supplementary contribution, we have publicly released the prototype of ProxyLens.
Muhammad Faruq, Rahmad Abdillah, Nazruddin Safaat H., Pizaini
Smart contract vulnerabilities, particularly reentrancy, have caused hundreds of millions of dollars in losses across the Ethereum ecosystem. While static analysis tools dominate current auditing practice, empirical evaluations have consistently demonstrated their high false negative and false positive rates for reentrancy detection. Dynamic analysis, exemplified by property-based fuzzing with Echidna, offers an alternative by evaluating contracts through actual execution. However, systematic empirical evaluation of dynamic tools under controlled ground-truth conditions remains limited. This study adapts the bug injection methodology, previously applied only to static analysis evaluation, to assess Echidna's effectiveness in detecting reentrancy. A dataset of 50 Solidity contracts was instrumented with oracle properties and injected with two reentrancy variants, single-function and cross-function, producing 100 ground-truth contract variants. Three fuzzing configurations of increasing intensity were evaluated across three metrics: detection rate, activation rate, and average detection time. Results show that Echidna achieved 100% activation but detected only 20% to 42% of injected bugs depending on the configuration and variant. Nearly all detections occurred within the first 25 seconds of each campaign, with no benefit from extended timeouts. These findings reveal a fundamental gap between bug reachability and exploitability confirmation under standard fuzzing conditions.
The growing frequency of malicious attacks on Internet of Things (IoT) devices has rendered conventional approaches with static label-dependent risk assessment models obsolete, especially when coping with unknown and continuo... | Find, read and cite all the research you need on Tech Science Press
In 2025, the largest cryptocurrency heist in history cost Bybit $1.5 billion because of a flaw known as blind signing. Essentially, cryptocurrency wallets ask users to sign transactions that look like gibberish code, so users often approve them based on trust and habit rather than real understanding. Attackers can exploit this by changing transaction details behind the scenes while keeping the on-screen transaction looking correct. In my project, I tackle this vulnerability in an Ethereum multi-signature wallet setting where multiple people must approve the same transaction. I first build a web-based simulation of the Bybit attack to understand how transaction swapping can mislead signers. Next, I implement four safety features across the transaction lifecycle: (1) Metadata validation to show the actual details of the transaction that is being signed, (2) Transaction simulation to preview what will happen to the funds, (3) Backend integrity verification to ensure the signed transaction has not been altered, and (4) Address whitelisting of approved destination addresses. My evaluation results show that these defences add negligible computational overhead, but they increase the time a user spends reviewing and confirming a transaction. To balance security with day-to-day usability, I propose an adaptive security approach that uses all defences for large, infrequent transactions, and a lightweight defence model for small, routine payments.
Reentrancy remains one of the most critical vulnerabilities affecting Ethereum smart contracts. While many existing analysis tools focus on detecting classical single-function reentrancy, more complex forms such as cross-function reentrancy are harder to identify because they depend on execution semantics and interactions between multiple functions. In this work, we study reentrancy at the level of Ethereum Virtual Machine (EVM) execution traces. We extend the TxSpector framework with new Datalog-based detection rules designed to capture cross-function reentrancy patterns. To support this analysis, we also modernize the trace extraction component by adapting it to recent versions of the Ethereum client and updated EVM instructions. The proposed approach is evaluated on real Ethereum on-chain transaction traces. The results show that our method is able to detect cross-function reentrancy behaviors that are not captured by the original TxSpector rules, demonstrating the effectiveness of pattern-based logic detection at the EVM execution level.
We frame Ethereum transactions reverted by invariants-require(<invariant>)/ assert(<invariant>)/if (<invariant>) revert statements in the contract implementation-as a positive signal of active on-chain defenses. Despite their value, the defensive patterns in these transactions remain undiscovered and underutilized in security research. We present Raven, a framework that aligns reverted transactions to the invariant causing the reversion in the smart contract source code, embeds these invariants using our BERT-based fine-tuned model, and clusters them by semantic intent to mine defensive invariant categories on Ethereum. Evaluated on a sample of 20,000 reverted transactions, Raven achieves cohesive and meaningful clusters of transaction-reverting invariants. Manual expert review of the mined 19 semantic clusters uncovers six new invariant categories absent from existing invariant catalogs, including feature toggles, replay prevention, proof/signature verification, counters, caller-provided slippage thresholds, and allow/ban/bot lists. To demonstrate the practical utility of this invariant catalog mining pipeline, we conduct a case study using one of the newly discovered invariant categories as a fuzzing oracle to detect vulnerabilities in a real-world attack. Raven thus can map Ethereum's successful defenses. These invariant categories enable security researchers to develop analysis tools based on data-driven security oracles extracted from the smart contracts' working defenses.
Modern cloud-based AI training relies on extensive telemetry and logs to ensure accountability. While these audit trails enable retrospective inspection, they struggle to address the inherent non-determinism of deep learning. Stochastic operations, such as dropout, create an ambiguity surface where attackers can mask malicious manipulations as natural random variance, granting them plausible deniability. Consequently, existing logging mechanisms cannot verify whether stochastic values were generated and applied honestly without exposing sensitive training data. To close this integrity gap, we introduce Verifiable Dropout, a privacy-preserving mechanism based on zero-knowledge proofs. We treat stochasticity not as an excuse but as a verifiable claim. Our approach binds dropout masks to a deterministic, cryptographically verifiable seed and proves the correct execution of the dropout operation. This design enables users to audit the integrity of stochastic training steps post-hoc, ensuring that randomness was neither biased nor cherry-picked, while strictly preserving the confidentiality of the model and data.
Chibuzor Udokwu, Seyed Amid Moeinzadeh Mirhosseini, Stefan Craß
Smart contracts are deployed and represented as bytecodes in blockchain networks, and these bytecodes are machine-readable codes. Only a small number of deployed smart contracts have their verified human-readable code publicly accessible to blockchain users. To improve the understandability of deployed smart contracts, we explored rule-based classification of smart contracts using iterative integration of fingerprints of relevant function interfaces and keywords. Our classification system included categories for standard contracts such as ERC20, ERC721, and ERC1155, and non-standard contracts like FinDApps, cross-chain, governance, and proxy. To do this, we first identified the core function fingerprints for all ERC token contracts. We then used an adapted header extractor tool to verify that these fingerprints occurred in all of the implemented functions within the bytecode. For the non-standard contracts, we took an iterative approach, identifying contract interfaces and relevant fingerprints for each specific category. To classify these contracts, we created a rule that required at least two occurrences of a relevant fingerprint keyword or interface. This rule was stricter for standard contracts: the 100% occurrence requirement ensures that we only identify compliant token contracts. For non-standard contracts, we required a minimum of two relevant fingerprint occurrences to prevent hash collisions and the unintentional use of keywords. After developing the classifier, we evaluated its performance on sample datasets. The classifier performed very well, achieving an F1 score of over 99% for standard contracts and a solid 93% for non-standard contracts. We also conducted a risk analysis to identify potential vulnerabilities that could reduce the classifier’s performance, including hash collisions, an incomplete rule set, manual verification bottlenecks, outdated data, and semantic misdirection or obfuscation of smart contract functions. To address these risks, we proposed several solutions: continuous monitoring, continuous data crawling, and extended rule refinement. The classifier’s modular design allows for these manual updates to be easily integrated. While semantic-based risks cannot be completely eliminated, symbolic execution can be used to verify the expected behavior of ERC token contract functions with a given set of inputs to identify malicious contracts. Lastly, we applied the classifier on contracts deployed Ethereum main network.
Open access
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Physical Unclonable Functions (PUFs) and Hardware Security
How users adapt after being sandwiched remains unclear; this paper provides an empirical quantification. Using transaction level data from November 2024 to February 2025, enriched with mempool visibility and ZeroMEV labels, we track user outcomes after their n-th public sandwich: (i) reactivation, i.e., the resumption of on-chain activity within a 60-day window, and (ii) first-time adoption of private routing. We refer to users who do not reactivate within this window as churned, and to users experiencing multiple attacks (n>1) as undergoing repeated exposure. Our analysis reveals measurable behavioral adaptation: around 40% of victims migrate to private routing within 60 days, rising to 54% with repeated exposures. Churn peaks at 7.5% after the first sandwich but declines to 1-2%, consistent with survivor bias. In Nov-Dec 2024 we confirm 2,932 private sandwich attacks affecting 3,126 private victim transactions, producing \$409,236 in losses and \$293,786 in attacker profits. A single bot accounts for nearly two-thirds of private frontruns, and private sandwich activity is heavily concentrated on a small set of DEX pools. These results highlight that private routing does not guarantee protection from MEV extraction: while execution failures push users toward private channels, these remain exploitable and highly concentrated, demanding continuous monitoring and protocol-level defenses.