Nominative signatures allow us to indicate who can verify a signature, and they can be employed to construct a non-transferable signature verification system that prevents the signature verification by a third party in unexpected situations. For example, this system can prevent IOU/loan certificate verification in unexpected situations. However, nominative signatures themselves do not allow the verifier to check whether the funds will be transferred in the future or have been transferred.It would be desirable to verify the fact simultaneously when the system involves a certain money transfer such as cryptocurrencies/cryptoassets. In this paper, we propose a smart contract-based non-transferable signature verification system using nominative signatures. We pay attention to the fact that the invisibility, which is a security requirement to be held for nominative signatures, allows us to publish nominative signatures on the blockchain. Our system can verify whether a money transfer actually will take place, in addition to indicating who can verify a signature. We transform the Hanaoka-Schuldt nominative signature scheme (ACNS 2011, IEICE Trans. 2016) which is constructed over a symmetric pairing to a scheme constructed over an asymmetric pairing, and evaluate the gas cost when a smart contract runs the verification algorithm of the modified Hanaoka-Schuldt nominative signature scheme.
Nikola Vukić, Veljko Petrović, Дину Драган, Dušan Gajić
Traditionally, smart contract auditing has been conducted using analysis tools and manual review processes. However, these tools often struggle to detect complex vulnerabilities and novel attack vectors. Advancements in Large Language Models (LLMs) have introduced new possibilities for enhancing smart contract audits by using their contextual understanding and reasoning capabilities. This paper provides a review of existing LLM-based smart contract auditing tools. We analyze key methodologies, strengths, and limitations of six such tools. While LLM-based tools demonstrate significant potential in detecting complex vulnerabilities, challenges such as false positives and token length limitations persist. Our comparative evaluation highlights performance differences, showcasing the potential of LLMs to complement traditional auditing tools. Finally, we discuss current challenges and future directions for improving LLM-based auditing, aiming to enhance security in blockchain ecosystems.
The explosive growth of Non-Fungible Tokens (NFTs) has revolutionized digital ownership by enabling the creation, exchange, and monetization of unique assets on blockchain networks. However, this surge in popularity has also given rise to a disturbing trend: the emergence of rug pulls - fraudulent schemes where developers exploit trust and smart contract privileges to drain user funds or invalidate asset ownership. Central to many of these scams are hidden backdoors embedded within NFT smart contracts. Unlike unintentional bugs, these backdoors are deliberately coded and often obfuscated to bypass traditional audits and exploit investor confidence. In this paper, we present a large-scale static analysis of 49,940 verified NFT smart contracts using Slither, a static analysis framework, to uncover latent vulnerabilities commonly linked to rug pulls. We introduce a custom risk scoring model that classifies contracts into high, medium, or low risk tiers based on the presence and severity of rug pull indicators. Our dataset was derived from verified contracts on the Ethereum mainnet, and we generate multiple visualizations to highlight red flag clusters, issue prevalence, and co-occurrence of critical vulnerabilities. While we do not perform live exploits, our results reveal how malicious patterns often missed by simple reviews can be surfaced through static analysis at scale. We conclude by offering mitigation strategies for developers, marketplaces, and auditors to enhance smart contract security. By exposing how hidden backdoors manifest in real-world smart contracts, this work contributes a practical foundation for detecting and mitigating NFT rug pulls through scalable automated analysis.
Ensuring software quality in the Web3 ecosystem presents unique challenges due to its decentralized architecture and evolving technical landscape. While international standards such as the SQuaRE (Systems and software Quality Requirements and Evaluation) framework offer structured approaches for quality assurance, they are often perceived as overly theoretical and not directly applicable to blockchain-based applications. This study aims to translate these standards into actionable practices suitable for Web3 environments, thereby supporting compliance and fostering stakeholder trust. Using the Design Science Research methodology, complemented by Lean Startup principles, a practical quality assurance guide was co-developed through collaboration between VOH.CoLAB researchers and the Exeedme project team and inspired by the practical experience in gaming and digital assets trading blockchain-based platforms. The resulting guide includes a structured framework comprising eight testing domains, 16 sub-domains and 108 targeted tests, with the domains addressing critical features of blockchain software, including, functional suitability, integration, security, performance, usability, portability, recoverability and resilience. This work contributes to the operationalization of international quality standards in decentralized technology, promoting more resilient and trustworthy blockchain applications.
Web-based credit card payments require complete disclosure of all payment card details for transaction authorization. The card’s CVV (Card Verification Value) is the secret code that authorizes card not presented transactions. Currently, all payment card details must be shared among various intermediaries involved in processing the transaction. To mitigate the risks associated with fraudulent transactions, industries have adopted security standards such as the PCI DSS. Credit card data confidentiality rests on all involved stakeholders adhering to best security practices, including data communication encryption, and do not misuse the payment information. However, this security posture does not prevent potential credit card data leaks. We propose an alternative method for conducting remote card payments that does not require disclosing the authorization code while ensuring high interoperability with existing payment networks. Our approach demonstrates how designated verifier Zero-Knowledge Proofs (ZKP) enable minimal disclosure of card details, particularly protecting the confidentiality of authorization codes.
Large language models (LLMs) are rapidly evolving into autonomous agents that cooperate across organizational boundaries, enabling joint disaster response, supply-chain optimization, and other tasks that demand decentralized expertise without surrendering data ownership. Yet, cross-domain collaboration shatters the unified trust assumptions behind current alignment and containment techniques. An agent benign in isolation may, when receiving messages from an untrusted peer, leak secrets or violate policy, producing risks driven by emergent multi-agent dynamics rather than classical software bugs. This position paper maps the security agenda for cross-domain multi-agent LLM systems. We introduce seven categories of novel security challenges, for each of which we also present plausible attacks, security evaluation metrics, and future research guidelines.
The chapter focuses on IP rightsIP rights in esports mainly from the perspective of the European Union (EU) and Korean laws. In addition, it also contains an outlook on two increasingly relevant topics in esports and gaming: non-fungible tokens (NFTsNFTs) and the metaversemetaverse.
With the rapid advancement of the digital age, the Internet has become an integral part of daily life. While users benefit from the convenience of online services, they are increasingly confronted with a critical conflict between identity privacy and security. Under traditional authentication mechanisms, malicious actors often exploit the login channel immediately after user registration, leading to the leakage of personal data. To address this issue, this paper proposes an anonymous identity authentication scheme based on non-interactive zero-knowledge proof. By employing ring signatures in combination with non-interactive zero-knowledge proofs, the proposed method ensures both the legitimacy of user identities and the security of the authentication process. Furthermore, the use of national cryptographic algorithms enhances the scheme's resilience against external attacks. Finally, we conduct comparative experiments to evaluate the proposed scheme. The results demonstrate that it provides anonymity, zero-knowledge soundness, resistance to quantum attacks, replay attacks, and double-spending. Additionally, the scheme achieves higher efficiency in signature generation and verification compared to an RSA+SHA-based ring signature authentication approach.
Panagiotis Chatzigiannis, Ke Wang, Sunpreet S. Arora, Mohsen Minaei
Modern Web3 wallets offer hybrid recovery solutions that combine multiple key recovery methods to balance security, availability, and usability. These methods include secret sharing of wallet private keys, encrypted cloud storage, and smart contract-based advanced recovery functionalities. However, such combined approaches can introduce new attack vectors that are not present in standalone recovery solutions. In this work, we propose a formal security analysis frame-work for blockchain/Web3 wallet designs with key or asset recovery functionalities. To assess whether a wallet design is secure, our framework considers several factors, including user availability and responsiveness to malicious actions, co-custodianship with external parties, the total value of assets managed by the wallet, and the reputation of the entities chosen by the user to facilitate spending or recovery functionalities. Through probabilistic model checking, our framework identifies the conditions under which a wallet design remains secure. We also include two examples of Web3 wallet designs with composite recovery mechanisms (inspired by existing designs) to demonstrate the effectiveness of our framework.
Sarthak Gangurde, Ashwini Jadhav, Vijay Gatkal, Mansi More
The rapid advancements in genomics have raised concerns about the privacy of sensitive genetic data. This paper presents Zk-Gene, a Zero-Knowledge Proof (ZKP) framework designed for the secure verification of genetic markers. Zk-Gene ensures that genetic data can be verified without exposing sensitive information, maintaining user privacy while allowing for critical health assessments. We describe the architecture of Zk-Gene, the cryptographic techniques employed, the construction of ZKP circuits for genetic markers, and demonstrate its applicability to genetic testing scenarios. This framework provides an innovative method for safeguarding genetic privacy while enabling essential genetic verifications.
1. Abstract The abstract introduces the growing issue of counterfeit products affecting global supply chains and consumer safety. It states that traditional methods—like barcodes, holograms, and watermarks—are increasingly ineffective due to technological advancements in forgery. To address this, the paper proposes a hybrid authentication framework combining the security of blockchain with the convenience and accessibility of QR codes (smart codes). It summarizes the methodology, highlights real-world examples, and touches on the system’s benefits, including enhanced traceability, consumer trust, and tamper-resistance. The abstract concludes by noting the paper’s focus on methodology, performance evaluation, future scope, and supporting case studies.
In recent years, a new fraud method, namely smart contract honeypots, has emerged on the famous blockchain platform Ethereum. The difference from smart contract vulnerabilities is that the contract honeypot essentially has no vulnerabilities, luring victims to call in a seemingly vulnerable form. However, the victims ultimately cannot obtain the desired benefits and will lose certain funds. Deep learning algorithms are preferred among current contract honeypot detection methods because they can learn more general characteristics and do not rely on expert experience. Most previous works use natural language models to learn the opcodes of contract honeypots but overlook the relevant structural features of the source code. We propose a novel method called the Smart Contract Honey-pot Data Flow Graph, which utilizes a data flow graph to extract the calling relationships of critical source code within contract honeypots and employs a pre-trained model for representation learning. First, contract honeypots generally have a code that transfers money to the calling address, which is critical information for constructing a source code data flow graph. Then, the pre-trained model is used to learn the source code representation and perform downstream classification tasks. The F1-score of our model significantly outperforms the state-of-the-art approaches in the contract honeypot classification task and is close to the highest performance in the detection task. In addition, this model is an end-to-end model that can detect unknown-type contract honeypots.
Ali Al-Mahmood, Sajjad M Al-Hakeem, Mohammed Thakır Mahmood, Ahmed Hussein · 9 authors
Blockchain technology has emerged as a transformative tool for intellectual property (IP) protection, offering decentralized, transparent, and immutable solutions for rights management and security. This research explores how blockchain can address critical challenges in IP protection, including copyright infringement, ownership disputes, and unauthorized content distribution. The study examines the potential of non-fungible tokens (NFTs), smart contracts, and distributed ledger technology (DLT) in enhancing digital rights management and securing creative assets. A systematic review of existing literature and case studies is conducted to assess the effectiveness of blockchain-based IP protection mechanisms. Key findings indicate that blockchain enhances security through cryptographic authentication, provides verifiable ownership records, and enables automated enforcement of IP rights through smart contracts. However, challenges such as legal uncertainties, scalability limitations, and regulatory gaps must be addressed for widespread adoption. The study underscores the need for a standardized regulatory framework and interoperability between blockchain platforms and existing IP laws to ensure robust rights management. The implications of this research extend to creators, businesses, and policymakers seeking innovative solutions for safeguarding digital assets. By integrating blockchain with traditional IP protection systems, a more secure and transparent ecosystem can be established, reducing infringement risks and fostering trust in digital economies. This study contributes to the growing discourse on blockchain-driven IP management and its future potential.
SYMBOLEO is a specification language used formalize legal contracts, analyze properties, and generate smart contracts for Hyperledger Fabric. However, this ecosystem presents challenges, particularly in securing access to contract elements and enabling interactions with Cyber-Physical Systems (CPS), including IoT devices. This thesis aims to develop and validate a tool for converting extended SYMBOLEO specifications into smart contracts, with a focus on security and privacy. The thesis proposes an architecture to integrate smart contracts, Complex Event Processing (CEP), a message broker, and blockchain (Hyperledger Fabric), facilitating CPS interaction. Additionally, a Role-Based Access Control (RBAC) model is proposed, extending SYMBOLEO with RBAC-inspired concepts, forming SYMBOLEOAC, to regulate access and support dynamic contract execution. Existing code generation tools are also extended to exploit SYMBOLEOAC and this new architecture.
Sangharatna Godboley, P. Radha Krishna, Sunkara Sri Harika, Pooja Varnam
We propose and develop a framework for validating smart contracts derived from e-contracts. The goal is to ensure the generated smart contracts fulfil all the conditions outlined in their corresponding e-contracts. By confirming alignment between the smart contracts and their original agreements, this approach enhances trust and reliability in automated contract execution. The proposed framework will systematically compare and validate the terms and clauses of the e-contracts with the logic of the smart contracts. This validation confirms that the agreement is accurately translated into executable code. Automated verification identifies issues between the e-contracts and their smart contract counterparts. This proposed work will solve the problems of gap between legal language and code execution, this framework ensures seamless integration of smart contracts into the existing legal framework.
Pre-deployment testing has become essential to ensure the functional correctness of smart contracts. However, since smart contracts are stateful programs integrating many different functionalities, manually writing test cases to cover all potential usages requires significant effort from developers, leading to insufficient testing and increasing risks in practice. Although several testing techniques for smart contracts have been proposed, they primarily focus on detecting common low-level vulnerabilities such as re-entrancy, rather than generating expressive and function-relevant test cases that can reduce manual testing efforts. To bridge the gap, we propose Solmigrator, an automated technique designed to generate expressive and representative test cases for smart contracts. To our knowledge, Solmigrator is the first migration-based test generation technique for smart contracts, which extracts test cases from real-world usages of on-chain contracts and migrates them to test newly developed smart contracts with similar functionalities. Given a target smart contract to be tested and an on-chain similar source smart contract, Solmigrator first transforms the on-chain usage of the source contract into off-chain executable test cases based on on-chain transaction replay and dependency analysis. It then employs fine-grained static analysis to migrate the augmented test cases from the source to the target smart contract. We built a prototype of Solmigrator and have evaluated it on real-world smart contracts within the two most popular categories, ERC20 and ERC721. Our evaluation results demonstrate that Solmigrator effectively extracts test cases from existing on-chain smart contracts and accurately migrates them across different smart contracts, achieving an average precision of 96.3% and accuracy of 93.6%. Furthermore, the results indicate that these migrated test cases effectively cover common key functionalities of the target smart contracts. This provides promising evidence that real-world usages of existing smart contracts can be transformed into effective test cases for other newly developed smart contracts.
MintMart is a decentralized Web3 platform designed for simplifying the process of buying, selling and creating NFTs (Non Fungible Tokens). Currently there are various existing platforms in the market which have features like transparent transactions, auctions in marketplace etc. However they lack some focus in areas of secure transactions, irregular platform fee and royalty compensation for owners which plays an important role in such platforms. The proposed system is designed with an objective to encounter such problems and make the use of NFT marketplace more seamless for the users. The proposed system uses blockchain technology to confront the existing issues. Royalty compensation distribution becomes easier using smart contracts and libraries like OpenZeppelin which helps in better integration of royalty features using its ERC-721 standard. Also MintMart offers fixed minim MintMart is a decentralized Web3 platform designed for simplifying the process of buying, selling and creating NFTs (Non Fungible Tokens). Currently there are various existing platforms in the market which have features like transparent transactions, auctions in marketplace etc. However they lack some focus in areas of secure transactions, irregular platform fee and royalty compensation for owners which plays an important role in such platforms. The proposed system is designed with an objective to encounter such problems and make the use of NFT marketplace more seamless for the users. The proposed system uses blockchain technology to confront the existing issues. Royalty compensation distribution becomes easier using smart contracts and libraries like OpenZeppelin which helps in better integration of royalty features using its ERC-721 standard. Also MintMart offers fixed minimal platform fee making it more accessible for users The proposed system can successfully support multiple digital formats like images, videos etc. and has also achieved cross chain compatibility allowing users to interact with various blockchain networks. MintMart plans to expand its features in the near future. These include personalized recommendations, live bidding for NFTs on the marketplace, etc., thus aiming to increase user engagement. The proposed system can successfully support multiple digital formats like images, videos, etc., and has also achieved cross-chain compatibility, allowing users to interact with various blockchain networks. MintMart plans to expand its features in the near future. These include personalized recommendations, live bidding for NFTs on the marketplace, etc., thus aiming to increase user engagement.
Kai Ma, Ningyu He, Jintao Huang, B. X. Zhang · 6 authors
Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Token (NFT) ecosystem, there are indications that cybersquatting tactics have evolved from targeting domain names to NFTs. This paper presents the first in-depth measurement study of NFT cybersquatting. By analyzing over 220K NFT collections with over 150M NFT tokens, we have identified 8,019 cybersquatting NFT collections targeting 654 popular NFT projects. Through systematic analysis, we discover and characterize seven distinct squatting tactics employed by scammers. We further conduct a comprehensive measurement study of these cybersquatting NFT collections, examining their metadata, associated digital asset content, and social media status. Our analysis reveals that these NFT cybersquatting activities have resulted in a significant financial impact, with over 670K victims affected by these scams, leading to a total financial exploitation of $59.26 million. Our findings demonstrate the urgency to identify and prevent NFT squatting abuses.
Gulshan Kumar, Rahul Saha, Mauro Conti, William J. Buchanan
Smart contracts are integral to decentralized systems like blockchains and enable the automation of processes through programmable conditions. However, their immutability, once deployed, poses challenges when addressing errors or bugs. Existing solutions, such as proxy contracts, facilitate upgrades while preserving application integrity. Yet, proxy contracts bring issues such as storage constraints and proxy selector clashes - along with complex inheritance management. This paper introduces a novel upgradeable smart contract framework with version control, named ”decentraLized vErsion control and updAte manaGement in upgrAdeable smart coNtracts (LEAGAN).” LEAGAN is the first decentralized updatable smart contract framework that employs data separation with Incremental Hash (IH) and Revision Control System (RCS). It updates multiple contract versions without starting anew for each update, and reduces time complexity, and where RCS optimizes space utilization through differentiated version control. LEAGAN also introduces the first status contract in upgradeable smart contracts, and which reduces overhead while maintaining immutability. In Ethereum Virtual Machine (EVM) experiments, LEAGAN shows 40% better space utilization, 30% improved time complexity, and 25% lower gas consumption compared to state-of-the-art models. It thus stands as a promising solution for enhancing blockchain system efficiency.
Smart contracts are a secure and trustworthy application that plays a vital role in decentralized applications in various fields such as insurance,the internet, and gaming. However, in recent years, smart contract security breaches have occurred frequently, and due to their financial properties, they have caused huge economic losses, such as the most famous security incident "The DAO" which caused a loss of over $60 million in Ethereum. This has drawn a lot of attention from all sides. Writing a secure smart contract is now a critical issue. This paper focuses on Ether smart contracts and explains the main components of Ether, smart contract architecture and mechanism. The environment used in this paper is the Ethernet environment, using remix online compilation platform and Solidity language, according to the four security events of American Chain, The DAO, Parity and KotET, the principles of integer overflow attack, reentrant attack, access control attack and denial of service attack are studied and analyzed accordingly, and the scenarios of these vulnerabilities are reproduced, and the measures to prevent them are given. Finally, preventive measures are given. In addition, the principles of short address attack, early transaction attack and privileged function exposure attack are also introduced in detail, and security measures are proposed. As vulnerabilities continue to emerge, their classification will also evolve. The analysis and research of the current vulnerabilities are also to lay a solid foundation for avoiding more vulnerabilities.
The peak of monthly trade volume of NFT (non-fungible token) has reached${\$}$4.95 billion USD in August 2023, which shows the hot trend and the potential significance of NFT. However, the smart contract responsible for managing NFT may contain defects, which can be exploited by attackers to cause severe damage to victims. We take the first step to systematically analyze three kinds of defects on NFT contracts, namely fragile NFT binding, non-compliant implementation, and implanted backdoor. In particular, we proposeEmerium, the first extensible detection framework for capturing these defects by inspecting the bytecode of smart contracts. We conduct extensive experiments to evaluateEmerium, and the experimental results show that it can detect the aforementioned defects with 0.83 and 0.89 F-measure for ERC-721 contracts and ERC-1155 contracts, respectively. ApplyingEmeriumto 87,839 ERC-721 and 9,808 ERC1155 NFT contracts of real world, we uncover 44,863,255 defects of fragile NFT binding, 1,373 defects of non-compliant implementation, and 105 defects of backdoor (also with a new CVE).
A Decentralized Identifier (DID) empowers an entity to prove control over a unique and self-issued identifier without relying on any identity provider. The public key material for the proof is encoded into an associated DID document (DDO). This is preferable shared via a distributed ledger because it guarantees algorithmically that everyone has access to the latest state of any tamper-proof DDO but only the entities in control of a DID are able to update theirs. Yet, it is possible to grant deputies the authority to update the DDO on behalf of the DID owner. However, the DID specification leaves largely open on how authorizations over a DDO are managed and enforced among multiple deputies. This article investigates what it means to govern a DID and discusses various forms of how a DID can be controlled by potentially more than one entity. It also presents a prototype of a DID-conform identifier management system where a selected set of governance policies are deployed as Smart Contracts. The article highlights the critical role of governance for the trustworthy and flexible deployment of ledger-anchored DIDs across various domains.