The MegaETH blockchain introduces new twists into improving healthcare transactions in efficiency and safety. MegaETH follows the hybrid consensus approach of PoS with BFT for solving some of the big issues in healthcare data management. Its strong encryption and zero-knowledge proof further enable significantly better protection of sensitive patient data, while reducing the risk of data breaches. It manages healthcare transactions fast and reliably, with a remarkable transaction throughput of about 10,000 transactions per second and a block duration of about one minute. Another important virtue of MegaETH architecture is that it uses less energy compared to more conventional Proof of Work systems. The demands of healthcare data are effectively managed with the scalability of the platform, underpinned by layer-2 solutions and sharding. MegaETH also illustrates excellent interoperability, as it will integrate with the existing systems of an institution and strictly abide by the rule of law. Moreover, smart contract executions are rather cheap, which enhances fraud prevention and accelerates administrative processes. The impacts from the adoption of MegaETH will be huge on reducing costs, ensuring data integrity, and finally improving patient care. Among the different options for solving current and future issues in health transaction administration, MegaETH is one of a kind.
Jinwen Liang, Jiannong Cao, Bo Yang, Dongbin Bai · 6 authors
Decentralized Physical Infrastructure Networks (DePIN) represent a paradigm shift in infrastructure deployment and resource coordination, leveraging blockchain and token-based incentives to transform traditional service models. This paper presents a comprehensive survey of DePIN, encompassing its evolution, architecture, open issues, and practical implementation. We begin by tracing the development of DePIN across three key phases: the emergence of fungible tokens, the rise of non-fungible tokens (NFTs), and the shift toward real-world asset tokenization. We highlight representative DePIN projects and propose a unified four-layer architecture comprising the infrastructure, decentralized data, resource control, and application layers, each delivering essential functionality for scalable, interoperable DePIN systems. We then analyze open research challenges within each layer and outline promising future research directions. To demonstrate the viability of our architecture, we present DCEAI, a prototype DePIN platform that enables decentralized LLM inference via edge computing. We evaluate its performance and discuss opportunities for further enhancement. This survey aims to establish a solid foundation for future research and innovation in DePIN ecosystems.
Tuan-Dung Tran, Dinh Khang Nguyen, Quang Trung Do, Van-Hau Pham
Cross-chain bridges, while critical for interoperability in the Web3 ecosystem, have become a primary target for exploits, accounting for over $4.3 billion in losses—nearly 40% of all value stolen in recent years. Existing security paradigms fail to address this threat adequately due to a fundamental trade-off between pre-deployment static analysis and real-time dynamic monitoring. Current security paradigms are trapped in a critical trade-off: pre-deployment static analysis lacks runtime context and suffers from high false-positives, while real-time dynamic monitoring is blind to the underlying source-code vulnerabilities that enable sophisticated attacks. This paper introduces VeriBridge, a novel framework that breaks this impasse. VeriBridge pioneers a synergistic fusion of static intelligence and dynamic graph learning. It enriches real-time transaction graphs with fine-grained vulnerability data extracted from static analysis, providing crucial security context to an unsupervised Graph Autoencoder. By learning a high-fidelity model of normal behavior, VeriBridge detects malicious transactions, including zero-day exploits, as significant deviations from this learned norm, identified by high reconstruction error. Evaluated on a comprehensive dataset of real-world attacks, including the Poly Network and THORchain exploits, VeriBridge achieves a 96% F1-score, demonstrating a new frontier in robust, real-time security for critical blockchain infrastructure.
E. Orestes O’Brien, Breno da Costa Paulo, Ángel Martín, Muhammad Shuaib Siddiqui · 5 authors
Future networks will deliver unprecedented performance, versatility, and efficiency, driven by advancements in automated monitoring and control. As networks evolve into interconnected platforms capable of enabling advanced features, allocating assets, and configuring them via northbound Application Programming Interfaces (APIs), dynamic control over multiple actors and stakeholders becomes essential. At this point, identity management plays a crucial role in overseeing onboarding, administering access, and registering activity to log and account for all operations. This paper compares the Open Common API Framework (CAPIF), based on the European Telecommunications Standards Institute (ETSI) standard, with a novel distributed identity-based approach using Distributed Ledger Technology (DLT). To assess the viability of these solutions, various tests are conducted to evaluate the frameworks’ latency and processing workloads.
Carlos Cardoso, Caio Silva, Alan Veloso, Jeffson Sousa · 5 authors
As Distributed Ledger Technologies (DLTs) mature into production-grade systems, a critical gap emerges between protocol-level benchmarking and application-centric performance testing. While specialized tools like Hyperledger Caliper excel at measuring core on-chain metrics, they are less suited for evaluating the end-to-end performance of applications that interact with the DLT through an intermediary API layer. This paper addresses this gap by proposing a three-tier, API-driven framework that enables mature, general-purpose load testing tools, such as Apache JMeter, to realistically assess a Hyperledger Besu network’s performance from an application’s perspective. The core of our solution is a custom API server that provides essential services like atomic nonce management and dynamic load balancing. Our comparative analysis demonstrates that while Caliper may report higher end-to-end throughput under specific conditions, our framework induces a significantly more substantial and evenly distributed load, revealing a more accurate picture of the network’s true processing capacity. Furthermore, our approach captures API-layer latency—a crucial metric for client-perceived responsiveness—which proved to be an order of magnitude lower than the on-chain finality measured by Caliper. This work validates a reusable architectural pattern for testing DLTs within a realistic application stack, bridging the gap between protocol benchmarking and real-world performance engineering.
The growth of freelancing exposed several drawbacks in the platforms that are now in use, including high service costs, fraud risks, and late payments [1]. A well-designed system architecture is necessary to develop a freelance platform to guarantee scalability, security, and effectiveness. A modular architecture was chosen to give the required flexibility, scalability, and ease of maintenance to overcome these issues. This paper presents the design of a microservices-based architecture for a crypto freelance exchange platform, which uses Domain-Driven Design principles [2]. The architecture is built to support decentralized transactions, smart contract integration, and secure user authentication. It also ensures high availability and fault tolerance. The system uses a multi-layered architecture incorporating PostgreSQL, MongoDB, Redis, and Web3.js. The main components are a web application, KrakenD API Gateway, auth microservice, files microservice, and main microservice for managing transactions, orders, and payments. They are designed to meet critical non-functional requirements such as scalability, security, and maintainability. Each service can be independently deployed, updated, and scaled according to transaction volumes. With an emphasis on security, the platform uses JWT token techniques and multi-factor authentication to authenticate users. Also, the integration of blockchain technology enhances transparency, enabling freelancers and clients to have a trusted record of all transactions and reducing the risk of fraud. The architecture is visualized through UML and C4 model diagrams showing component interactions and service orchestration. This paper also discusses the rationale behind the chosen technologies, security mechanisms, and the benefits of using a modular microservices approach for building a crypto freelance platform.
Sharding has emerged as a critical solution to address the scalability challenges faced by blockchain networks, enabling them to achieve higher transaction throughput, reduced latency, and optimized resource usage. This paper investigates the advancements, methodologies, and adoption potential of sharding in the context of Hedera, a distributed ledger technology known for its unique Gossip about Gossip protocol and asynchronous Byzantine Fault Tolerance (ABFT). We explore various academic and industrial sharding techniques, emphasizing their benefits and trade-offs. Building on these insights, we propose a hybrid sharding solution for Hedera that partitions the network into local and global committees, facilitating efficient cross-shard transactions and ensuring robust security through dynamic reconfiguration. Our analysis highlights significant reductions in storage and communication overhead, improved scalability, and enhanced fault tolerance, demonstrating the feasibility and advantages of integrating sharding into Hedera's architecture.
Real-World Assets (RWAs) serve as a bridge between traditional financial instruments and decentralized infrastructures. By representing assets such as bonds, commodities, and real estate on blockchains, RWAs can extend the scope of decentralized finance. Industry forecasts further indicate rapid growth in tokenized RWAs after 2025, underscoring their potential role in the evolution of digital financial markets. However, in the current multi-chain environment, RWAs face challenges such as repeated authentication across multiple chains and inefficiencies arising from multi-step settlement protocols. To address these issues, we present a cross-chain framework for RWAs that emphasizes identity management, authentication, and cross-chain interaction. The framework integrates Decentralized Identifiers and Verifiable Credentials with customized attributes to support decentralized identification, and incorporates an authentication protocol based on Simplified Payment Verification to avoid redundant verification across chains. Furthermore, this paper adopts a cross-chain channel that supports efficient RWA settlements, and we refine its design so that the channel does not need to be closed immediately after each settlement, thereby reducing on-chain cost. We implement the framework and evaluate its performance via simulations, which confirm its feasibility and demonstrate improvements in efficiency for RWAs in cross-chain settings.
Anthony Sai Richardo, Franz Adeta, Yohan Muliono, Michelle Hamjaya · 5 authors
Web3 airdrops have become a popular way to distribute tokens and raise project awareness, but their objective is frequently abused by bot activities. For example, the 2024 Hamster Kombat project reported detecting over 2.3 million automated bot interactions during its airdrop event. To address the problem, this research compares seven supervised machine learning models for detecting bot activity in Telegram-based Web3 airdrops by analyzing patterns in API requests. A total of 2600 data entries were collected: 1300 from real bot scripts and 1300 manually gathered using Telegram's built-in network tools. Each sample contains technical features such as HTTP request methods, URLs, request headers, and public IP addresses. These were further enriched with indicators of VPN usage, proxy connections, TOR relay presence, and whether the IP address was linked to a hosting provider. The result shows Gaussian Naïve Bayes and the MLP Classifier were the top performers, with$\mathbf{9 4. 4 1 \%}$validation accuracy,$\mathbf{9 4. 0 0 \%}$test accuracy, and 84.56 % accuracy when evaluated on a separate set of new data. These models accurately captured statistical patterns in bot data and complex interactions in human data. The results emphasize the importance of machine learning in securing Web3 token distribution processes.
One major issue associated to microservices architectures is aspects related to data consistency and management of data within such a context. To measure the effect on system integrity, this research paper compares different data consistency models which are, eventual consistency, distributed transactions through Two-Phase Commit (2PC), the Saga pattern. Employing historical data analysis, case studies, and examining the recent technological advancements, the study gives a comparative assessment of various approaches in terms of their capabilities to achieve transaction latencies and throughput and possibility to guarantee consistent results. Based on the results, it is evident that although eventual consistency models provide high scale-out and availability characteristics, the models experience transitory data inconsistency. Consistency is high since data is accessed from, and committed to, multiple databases in a distributed transaction but they have performance penalties. The Saga patterning gives a balanced view but at the same time brings together additional design difficulty. New trends like Distributed Ledger Technology (DLT) as well as new consensus algorithms that can be used to solve problematic approaches like the Raft algorithm give new possibilities for improving consistency of the data but bring their own concerns. The study implies that one must choose the right consistency model depending on the need and performance Degree and the future research can consider the use of the combination of several models along with the improvement of technological solutions to have a better deal with data consistency in microservices.
Security protection of dynamically generated log files requires immediate prevention against alteration, reliability, and compliance of current systems. The research creates a novel framework that integrates blockchain technology with cryptographic hashing methods to establish resistant and immutable log authentication mechanisms. The system dynamically generates log files through Python while saving a cryptographic hash (SHA-256) for verification of file integrity. Security and authentication of these hashes occurs through an Ethereum blockchain smart contract named Sepolia testnet. The framework uses Remix IDE along with Web3.py through Infura to connect into the Ethereum Sepolia testnet for launching smart contracts development. Simulation results demonstrated the system effectiveness by showcasing how logs remain immutable while providing performance data including transaction processing time and gas usage and event output. The research demonstrates how blockchain technology can power real-time log verification systems and suggests foundations for future decentralized security system developments.
The growing integration of microservices exacerbates the mounting concern over privacy and trust caused by frequent data leaks and breaches. These systems are inherently decentralized, making them harder to manage, increasing the attack surface, and complicating trust between independently deployed services. Despite these persistent challenges, trust and authentication are often handled using centralized and stateful methods that require storing extensive state information. Existing so-called stateless authentication methods typically shift state storage from the server to the client side rather than detaching from state dependency. To address this challenge, we propose a lightweight, scalable, and truly stateless authentication approach that is non-idempotent and utilizes self-resetting nested Zero-Knowledge Proofs (ZKPs) to eliminate reliance on past actions. This platform anticipates user intentions and rigorously monitors them, ensuring bidirectional operational integrity while preserving privacy. Specifically, the self-resetting ZKP mechanism leverages the dynamic nature of microservices and incorporates random proof segmentation as a random generator to ensure each request is unique. Our tests using the OpenTelemetry Demo confirm its functionality and the independence between requests. Furthermore, security analysis demonstrates comprehensive security through non-idempotent authentication and the uniqueness of proof segmentation for each request.
Abstract In the context of the IoT platform, the smart home represents a quintessential application scenario. Here, device-to-device (D2D) collaboration serves as the core element of its ecosystem, playing a crucial role in implementing diversified automated execution scenarios that are customized to fulfill user requirements. The progressive integration of edge computing and AI technologies has enhanced the collaboration among heterogeneous devices. Nevertheless, the conventional centralized D2D collaboration authorization decision-making supported by a single IoT Hub violates the Principle of Least Privilege (PoLP), which is a foundational design tenet that has been empirically validated as an optimal engineering practice for enhancing system security and reliability in IoT ecosystems. If there is a trade-off of PoLP violations, it fails to meet the users’ Quality of Experience (QoE). To address this issue, we propose D2DA, a distributed authorization decision-making model for smart home D2D collaboration, which constructs a distributed decision-making consensus network suitable for the edge side of smart homes by leveraging distributed ledger technology. D2DA presents a machine learning algorithm with a time complexity of O ( n ). Through this algorithm, consensus nodes can be efficiently and dynamically selected. Furthermore, D2DA ensures the security of the D2D collaboration process via wallets and hash verification. Extensive experiments conducted on a real-world smart home scenario validate that the decision-making latency of D2DA is on par with that of a single IoT Hub mode. The average latency for verifying the correctness of the newly added execution results is only 0.08% of the system time of D2DA, which is negligible.
S M Mostaq Hossain, Amani Altarawneh, Maanak Gupta
As blockchain technologies are increasingly adopted in enterprise and research domains, the need for secure, scalable, and performance-transparent node infrastructure has become critical. While self-hosted Ethereum nodes offer operational control, they often lack elasticity and require complex maintenance. This paper presents a hybrid, service-oriented architecture for deploying and monitoring Ethereum full nodes using Amazon Managed Blockchain (AMB), integrated with EC2-based observability, IAM-enforced security policies, and reproducible automation via the AWS Cloud Development Kit. Our architecture supports end-to-end observability through custom EC2 scripts leveraging Web3.py and JSON-RPC, collecting over 1,000 real-time data points-including gas utilization, transaction inclusion latency, and mempool dynamics. These metrics are visualized and monitored through AWS CloudWatch, enabling service-level performance tracking and anomaly detection. This cloud-native framework restores low-level observability lost in managed environments while maintaining the operational simplicity of managed services. By bridging the simplicity of AMB with the transparency required for protocol research and enterprise monitoring, this work delivers one of the first reproducible, performance-instrumented Ethereum deployments on AMB. The proposed hybrid architecture enables secure, observable, and reproducible Ethereum node operations in cloud environments, suitable for both research and production use.
Blockchain technologies had a significant impact on many sectors of contemporary society, with virtual currencies being the most prominent example. The introduction of the Ethereum blockchain and its native support for smart contracts, self-enforcing programs that enable trustworthy digital interactions, has broadened the possible adoption contexts. These programs possess unique characteristics, such as code immutability and autonomous execution, which necessitate innovative testing methodologies. Despite their growing adoption, current testing practices and tools for smart contracts lag behind those available for traditional software systems, raising concerns about the reliability of decentralized applications. This dissertation addresses these challenges through three core research objectives. First, it advances mutation testing for Ethereum smart contracts by introducing a practical framework and tool that support Solidity-specific test adequacy assessment and incremental mutation analysis during development. This enables developers to systematically evaluate and improve the fault-detection capabilities of their test suites based on metrics that go beyond simple code coverage. Second, it explores how smart contract auditing practices can benefit from mutation testing by integrating live mutant inspection into code reviews and automating the generation of missing test cases. This contribution enhances the auditors’ ability to identify weaknesses in the test suite and provide actionable feedback to clients. Third, it supports smart contract maintenance activities by proposing a novel capture-replay testing framework and tool for upgradeable contracts. The approach harnesses historical blockchain transactions as tests, allowing developers to detect behavioral inconsistencies introduced by upgrades without the need to manually reconstruct testing scenarios. Through these contributions, the thesis aims to advance the state of smart contract quality assurance, offering both practical frameworks and theoretical insights that enhance the reliability of blockchain-based systems.
Revolutionizing distributed agile software testing, we propose BCTestingPlus, a groundbreaking blockchain-based platform. In the traditional distributed agile software testing lifecycle, software testing has suffered from a lack of trust, traceability, and security in communication and collaboration. Furthermore, developers’ failure to complete unit testing has been a significant bottleneck, causing delays and contributing to project failures. Introducing BCTestingPlus, a transformative blockchain-based architecture engineered to overcome these challenges. This framework integrates blockchain technology to establish an inherently transparent and secure environment for software testing. BCTestingPlus operates on a private Ethereum blockchain network, offering superior control and privacy. By implementing smart contracts on this network, BCTestingPlus ensures secure payment verification and efficient acceptance testing. Crucially, it aligns development and testing teams toward shared objectives and guarantees equitable compensation for their efforts. The experimental results and findings conclusively show that this innovative approach demonstrates that BCTestingPlus significantly enhances transparency, bolsters trust, streamlines coordination, accelerates testing, and secures communication channels for all parties involved in the distributed agile software testing lifecycle. It delivers robust security for both development and testing teams, ultimately transforming the efficiency and reliability of distributed agile software testing.
We present the availability and reproducibility report of the ACM SIGMOD 2025 paper titled ''InTime: Towards Performance Predictability In Byzantine Fault Tolerant Proof-of-Stake Consensus''. Following the instructions provided the authors, we evaluated the artifacts hosted on Github. The reviewers confirmed that the codebase is functional and evaluatable. Reproducibility was straightforward as the authors provided automated scripts that simplified the execution of experiments. Experiments on single machine were reproduced while experiments requiring a large cluster of machines are constrained by limited resource capacity and instructions. Hence, the paper's core claims were partially reproduced.
As financial institutions increasingly migrate their core platforms to microservices-based architectures, the challenge of managing distributed transactions has gained critical importance. Banking APIs typically require atomicity and consistency across multiple services—such as account management, fraud detection, notifications, and audit trails all of which operate independently with isolated data stores. In such an ecosystem, ensuring consistency, performance, and fault tolerance becomes a balancing act that traditional and modern transaction patterns attempt to resolve differently. This paper explores and contrasts two dominant approaches to distributed transaction management: the Two-Phase Commit (2PC) protocol and the Saga Pattern, particularly in the context of mission-critical banking applications. 2PC has long been considered the gold standard for ensuring atomicity and strong consistency in distributed systems. However, its blocking nature, reliance on a centralized coordinator, and vulnerability to network partitions make it less suitable for high-throughput, globally distributed systems common in modern fintech platforms. On the other hand, the Saga Pattern, an eventual consistency model that orchestrates a sequence of local transactions with compensating rollback operations—offers better fault tolerance and non-blocking behavior. Yet, its trade-offs include the complexity of compensating logic, lack of strict ACID guarantees, and potential for data anomalies if not carefully implemented. To ground the discussion in real-world reliability needs, I introduce a chaos engineering-based simulation that demonstrates the behavior of both 2PC and Saga under controlled failure scenarios, such as inter-service latency spikes and partial service outages. We benchmark recovery times, resource locking, system availability, and data reconciliation behavior using a representative banking microservice architecture deployed in a containerized environment. My findings reveal that Saga outperforms 2PC in terms of availability and fault recovery, making it suitable for user-facing, latency-sensitive operations. However, 2PC remains superior for operations demanding immediate consistency and compliance with strict audit requirements, such as core ledger updates. Based on this analysis, we propose a hybrid transaction strategy that applies 2PC to core financial operations and Saga to surrounding auxiliary services, striking a balance between performance and correctness. This study offers practical design insights for architects building resilient, scalable, and regulation-compliant financial systems. It also highlights the need for adaptive orchestration platforms capable of dynamically selecting transaction models based on context and SLA requirements.
Md. Nahidul Islam Opu, Md Shahidul Islam, Sara Rouhani, Shaiful Chowdhury
Blockchain-based software systems are increasingly deployed across diverse domains, yet a systematic understanding of their development challenges remains limited. This paper presents a large-scale empirical study of 497,742 issues mined from 1,209 open-source blockchain projects hosted on GitHub. Employing BERTopic, a transformer-based topic modeling technique, we identify 49 distinct issue topics and organize them hierarchically into 11 major subcategories. Our analysis reveals that both general software development issues and blockchain-specific concerns are nearly equally represented, with Wallet Management and UI Enhancement emerging as the most prominent topics. We further examine the temporal evolution of issue categories and resolution times, finding that Wallet issues not only dominate in frequency but also exhibit the longest resolution time. Conversely, Mechanisms issues are resolved significantly faster. Issue frequency surged after 2016 with the rise of Ethereum and decentralized applications, but started declining after 2022. These findings enhance our understanding of blockchain software maintenance, informing the development of specialized tools and practices to improve robustness and maintainability.
Md. Shariful Islam, Mohammad Saifur Rahman, M. Sohel Rahman
Log management is crucial for ensuring the security, integrity, and compliance of modern information systems. Traditional log management solutions face challenges in achieving tamper-proofing, scalability, and real-time processing in distributed environments. This paper presents a blockchain-based log management framework that addresses these limitations by leveraging blockchain's decentralized, immutable, and transparent features. The framework integrates a hybrid on-chain and off-chain storage model, combining blockchain's integrity guarantees with the scalability of distributed storage solutions like IPFS. Smart contracts automate log validation and access control, while cryptographic techniques ensure privacy and confidentiality. With a focus on real-time log processing, the framework is designed to handle the high-volume log generation typical in large-scale systems, such as data centers and network infrastructure. Performance evaluations demonstrate the framework's scalability, low latency, and ability to manage millions of log entries while maintaining strong security guarantees. Additionally, the paper discusses challenges like blockchain storage overhead and energy consumption, offering insights for enhancing future systems.
Flaviene Scheidt de Cristo, Jorge Augusto Meira, Jean-Philippe Eisenbarth, Radu State
Several distributed systems based on unstructured p2p networks, such as blockchains, rely on underlying protocols to disseminate messages in a fast and reliable way. As the state-of-the-art for message dissemination in blockchains, GossipSub guarantees delivery and resilience against attacks and byzantine faults by scaling pubsub dissemination without exceeding bandwidth or overloading peers. Although GossipSub relies heavily on the way its mesh is constructed, there is little insight into how different configuration parameters impact the overall performance of the system. This study analyzes the relationships between the configuration and the performance of GossipSub from a causal point of view using the concrete case of the XRPL. By employing graphical causal methods to investigate the strength of those connections, this study goes towards the direction of finding the best configuration for GossipSub for different domains, without the need for excessive empirical tests.
Dan Lin, Ziye Zheng, Jiajing Wu, Jingjing Yang · 8 authors
Cross-chain technology enables seamless asset transfer and message-passing within decentralized finance (DeFi) ecosystems, facilitating multi-chain coexistence in the current blockchain environment. However, this development also raises security concerns, as malicious actors exploit cross-chain asset flows to conceal the provenance and destination of assets, thereby facilitating illegal activities such as money laundering. Consequently, the need for cross-chain transaction traceability has become increasingly urgent. Prior research on transaction traceability has predominantly focused on single-chain and centralized finance (CeFi) cross-chain scenarios, overlooking DeFispecific considerations. This paper proposes ABCTRACER, an automated, bi-directional cross-chain transaction tracing tool, specifically designed for DeFi ecosystems. By harnessing transaction event log mining and named entity recognition techniques, ABCTRACER automatically extracts explicit cross-chain cues. These cues are then combined with information retrieval techniques to encode implicit cues. ABCTRACER facilitates the autonomous learning of latent associated information and achieves bidirectional, generalized cross-chain transaction tracing. Our experiments on 12 mainstream cross-chain bridges demonstrate that ABCTRACER attains 91.75% bi-directional traceability (F1 metrics) with self-adaptive capability. Furthermore, we apply ABCTRACER to real-world cross-chain attack transactions and money laundering traceability, thereby bolstering the traceability and blockchain ecological security of DeFi bridging applications.
Smart contracts are fundamental pillars of the blockchain, playing a crucial role in facilitating various business transactions. However, these smart contracts are vulnerable to exploitable bugs that can lead to substantial monetary losses. A recent study reveals that over 80% of these exploitable bugs, which are primarily functional bugs, can evade the detection of current tools. Automatically identifying functional bugs in smart contracts presents challenges from multiple perspectives. The primary issue is the significant gap between understanding the high-level logic of the business model and checking the low-level implementations in smart contracts. Furthermore, identifying deeply rooted functional bugs in smart contracts requires the automated generation of effective detection oracles based on various bug features.To address these challenges, we design and implement PromFuzz, an automated and scalable system to detect functional bugs in smart contracts. In PromFuzz, we first propose a novel Large Language Model (LLM)-driven analysis framework, which leverages a dual-agent prompt engineering strategy to pinpoint potentially vulnerable functions for further scrutiny. We then implement a dual-stage coupling approach, which focuses on generating invariant checkers that leverage logic information extracted from potentially vulnerable functions. Finally, we design a bug-oriented fuzzing engine, which maps the logical information from the high-level business model to the low-level smart contract implementations, and performs the bug-oriented fuzzing on targeted functions. We evaluate PromFuzz from 4 perspectives on 5 ground-truth datasets and compare it with multiple state-of-the-art methods. The results show that PromFuzz achieves 86.96% recall and 93.02% F1-score in detecting functional bugs, marking at least a 50% improvement in both metrics over state-of-the-art methods. Moreover, we perform an in-depth analysis on 10 real-world DeFi projects and detect 30 zero-day bugs. Our further case studies, the risky first deposit bug and the AMM price oracle manipulation bug on real-world DeFi projects, demonstrate the serious risks of the exploitable functional bugs in smart contracts. Up to now, 24 zero-day bugs have been assigned CVE IDs. Our discoveries have safeguarded assets totaling $18.2 billion from potential monetary losses.