John C. Kolesar, Shan Ali, Timos Antonopoulos, Ružica Piskač
Zero-knowledge (ZK) protocols enable software developers to provide proofs of their programs’ correctness to other parties without revealing the programs themselves. Regular expressions are pervasive in real-world software, and zero-knowledge protocols have been developed in the past for the problem of checking whether an individual string appears in the language of a regular expression, but no existing protocol addresses the more complex PSPACE-complete problem of proving that two regular expressions are equivalent. We introduce Crêpe , the first ZK protocol for encoding regular expression equivalence proofs and also the first ZK protocol to target a PSPACE-complete problem. Crêpe uses a custom calculus of proof rules based on regular expression derivatives and coinduction, and we introduce a sound and complete algorithm for generating proofs in our format. We test Crêpe on a suite of hundreds of regular expression equivalence proofs. Crêpe can validate large proofs in only a few seconds each.
With the rapid development of blockchain technology, P2P networks are facing increasing security threats, among which Eclipse attacks, as a type of network isolation attack, have seriously affected the normal operation of the network and the integrity of data. To address this challenge, this study implements node authentication and dynamic reputation evaluation by leveraging a dynamic hash computation mechanism that integrates challenge strings, node identifiers, and the latest active time, ensuring the uniqueness of node identities and the authenticity of operations. Based on a dynamic hash chain behavior evaluation mechanism, node behaviors are quantified across three dimensions: integrity, consistency, and temporal consistency, enabling precise identification of anomalous nodes. Furthermore, a network prevention repository framework is proposed, which dynamically adjusts the trust index of nodes by combining historical behavior with real-time data, effectively detecting and defending against stealthy Eclipse attacks. In addition, extensive testing on both Bitcoin and Ethereum platforms has shown that the method proposed in this study not only can effectively coexist on these two platforms, but also significantly improves the security and stability of the network, effectively reducing the occurrence of Eclipse attacks.
In recent years, the Ethereum platform has witnessed a proliferation of smart contracts, accompanied by exponential growth in total value locked (TVL). High-TVL smart contracts often require complex numerical computations, particularly in mathematical financial models used by many decentralized applications (DApps). Improper calculations can introduce numerical defects, posing potential security risks. Existing research primarily focuses on traditional numerical defects like integer overflow, and there is currently a lack of systematic research and effective detection methods targeting new types of numerical defects. In this paper, we identify five new types of numerical defects through the analysis of 1,199 audit reports by utilizing the open card method. Each defect is defined and illustrated with a code example to highlight its features and potential consequences. We also propose NumScout, a symbolic execution-based tool designed to detect these five defects. Specifically, the tool combines information from source code and bytecode, analyzing key operations such as comparisons and transfers, to effectively locate defects and report them based on predefined detection patterns. Furthermore, NumScout uses a large language model (LLM) to prune functions which are unrelated to numerical operations. This step allows symbolic execution to quickly enter the target function and improve runtime speed by 28.4%. We run NumScout on 6,617 real-world contracts and evaluated its performance based on manually labeled results. We find that 1,774 contracts contained at least one of the five defects, and the tool achieved an overall precision of 89.7%.
Xingchen Chen, Baizhu Wang, Mengjun Zhang, Yaqin Cao · 5 authors
In recent years, web application development has become more efficient, yet vulnerabilities still pose significant risks. Traditional static and dynamic detection techniques are prone to false positives and negatives, making it challenging for small and medium-sized developers with limited security knowledge to accurately assess the results. To address these challenges, we introduced VulKiller, an automated vulnerability detection tool powered by large language models (LLM). VulKiller leverages static analysis to convert application code into Code Property Graphs (CPG) and utilizes Neo4j to identify high-risk method call chains. By designing structured interactions with ChatGPT, these call chains and corresponding code are transformed into Proofs of Concept (PoCs), which are then parsed into attack payloads and evaluated by a vulnerability monitor for effectiveness. In comparison with traditional tools, VulKiller excels in reducing false positives and negatives. Additionally, in zero-day vulnerability detection experiments, VulKiller identified 12 zero-day vulnerabilities. Our results offer significant encouragement for using LLM to enhance vulnerability detection.
Blockchain systems, such as Bitcoin and Ethereum, have evolved into essential platforms for a variety of applications. Smart contracts are small computer programs that represent a fundamental component of these systems, enabling self-executing tasks ranging from simple operations to complex workflows, all without the need for intermediaries. On Ethereum, smart contracts are permanently stored on-chain, making them immutable and transparent. However, these features also expose them to potential attacks if vulnerabilities exist in their code. To address this concern, the present thesis conducts a security analysis of real-world smart contracts to assess the vulnerability landscape of the Ethereum blockchain over a ten-year period from 2016 to 2025. This analysis leverages an Ethereum archive node, providing access to the full historical state of the blockchain. Using a custom-built vulnerability scanner in combination with established bytecode analysis tools such as Mythril and Oyente, the study focuses on a historical assessment of smart contract security. The system was designed to automatically retrieve bytecode from deployed contracts in a structured manner, perform static analysis, and classify detected issues based on vulnerability categories. The results were processed and visualised in a front-end web application, enabling clear interpretation of the findings. The analysis reveals that vulnerabilities in smart contracts were widespread during Ethereum's early years. In particular, reentrancy issues, call-related issues, and transaction issues were the most prevalent vulnerability categories, while the remaining categories were only detected sporadically. In contrast, the prevalence of such vulnerabilities has significantly declined in recent years, indicating substantial improvements in the overall security posture of Ethereum smart contracts.
This research presents a novel approach to detecting role-based access control vulnerabilities in smart contracts using large language models (LLMs). Smart contracts deployed on blockchain platforms often contain critical security vulnerabilities that can lead to significant financial losses, with improper access control being a common issue. Our methodology combines Abstract Syntax Tree (AST) analysis with strategic context slicing to enable effective vulnerability assessment by LLMs. The system first identifies potentially vulnerable functions through structural analysis, extracts relevant security context, and then leverages LLMs to make the final vulnerability and exploitability determinations. We evaluate our approach using a dataset of 28 smart contracts across five different language models, including GPT-4 and its variants and GPT-o3-mini as well. Results demonstrate strong performance, with the best model achieving 93% accuracy and 100% precision in vulnerability detection. The system not only identifies vulnerable functions but also assesses their practical exploitability, achieving up to 100% accuracy in exploitability determination with GPT-4. The comparative analysis across different models reveals interesting trade-offs between precision and recall, with some models excelling at avoiding false positives while others prioritize catching all vulnerabilities. Our findings suggest that LLMs, when properly guided through context slicing and structured prompting, can effectively reason about complex security properties in smart contracts. This approach offers a promising direction for augmenting traditional static analysis tools with the contextual understanding capabilities of large language models, potentially improving the security of blockchain applications.
The large-scale deployment of Solidity smart contracts on the Ethereum mainnet has increasingly attracted financially-motivated attackers in recent years. A few now-infamous attacks in Ethereum's history includes DAO attack in 2016 (50 million dollars lost), Parity Wallet hack in 2017 (146 million dollars locked), Beautychain's token BEC in 2018 (900 million dollars market value fell to 0), and NFT gaming blockchain breach in 2022 ($600 million in Ether stolen). This paper presents a comprehensive investigation of the use of large language models (LLMs) and their capabilities in detecting OWASP Top Ten vulnerabilities in Solidity. We introduce a novel, class-balanced, structured, and labeled dataset named VulSmart, which we use to benchmark and compare the performance of open-source LLMs such as CodeLlama, Llama2, CodeT5 and Falcon, alongside closed-source models like GPT-3.5 Turbo and GPT-4o Mini. Our proposed SmartVD framework is rigorously tested against these models through extensive automated and manual evaluations, utilizing BLEU and ROUGE metrics to assess the effectiveness of vulnerability detection in smart contracts. We also explore three distinct prompting strategies-zero-shot, few-shot, and chain-of-thought-to evaluate the multi-class classification and generative capabilities of the SmartVD framework. Our findings reveal that SmartVD outperforms its open-source counterparts and even exceeds the performance of closed-source base models like GPT-3.5 and GPT-4 Mini. After fine-tuning, the closed-source models, GPT-3.5 Turbo and GPT-4o Mini, achieved remarkable performance with 99% accuracy in detecting vulnerabilities, 94% in identifying their types, and 98% in determining severity. Notably, SmartVD performs best with the `chain-of-thought' prompting technique, whereas the fine-tuned closed-source models excel with the `zero-shot' prompting approach.
As the field of Web3 continues its rapid expansion, the security of Web3 authentication, often the gateway to various Web3 applications, becomes increasingly crucial. Despite its widespread use as a login method by numerous Web3 applications, the security risks of Web3 authentication have not received much attention. This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages, thereby achieving unauthorized access to the target application. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities. Our evaluation of real-world Web3 applications shows that a staggering 75.8% (22/29) of Web3 authentication deployments are at risk of blind message attacks. In response to this alarming situation, we implemented Web3AuthGuard on the open-source wallet MetaMask to alert users of potential attacks. Our evaluation results show that Web3AuthGuard can successfully raise alerts in 80% of the tested Web3 authentications. We have responsibly reported our findings to vulnerable websites and have been assigned two CVE IDs.
Cryptocurrency wallets, acting as fundamental infrastructure to the blockchain ecosystem, have seen significant user growth, particularly among browser-based wallets (i.e., browser extensions). However, this expansion accompanies security challenges, making these wallets prime targets for malicious activities. Despite a substantial user base, there is not only a significant gap in comprehensive security analysis but also a pressing need for specialized tools that can aid developers in reducing vulnerabilities during the development process. To fill the void, we present a comprehensive security analysis of browser-based wallets in this paper, along with the development of an automated tool designed for this purpose. We first compile a taxonomy of security vulnerabilities resident in cryptocurrency wallets by harvesting historical security reports. Based on this, we design WALLETRADAR, an automated detection framework that can accurately identify security issues based on static and dynamic analysis. Evaluation of 96 popular browser-based wallets shows WALLETRADAR's effectiveness, by successfully automating the detection process in 90% of these wallets with high precision. This evaluation has led to the discovery of 116 security vulnerabilities corresponding to 70 wallets. By the time of this paper, we have received confirmations of 10 vulnerabilities from 8 wallet developers, with over $2,000 bug bounties. Further, we observed that 12 wallet developers have silently fixed 16 vulnerabilities after our disclosure. WALLETRADAR can effectively automate the identification of security risks in cryptocurrency wallets, thereby enhancing software development quality and safety in the blockchain ecosystem.
Once deployed in blockchain, smart contracts become immutable: Attackers can exploit bugs and vulnerabilities in their code that cannot be replaced with a bug-free version. For this reason, the verification of smart contracts before they are deployed in blockchain is important. However, the development of verification tools is not easy, especially if one wants to obtain guarantees by using formal methods. This article describes the development, from scratch, of a static analyzer based on abstract interpretation for the verification of real-world Tezos smart contracts. The analyzer is generic with respect to the property under analysis. This article shows taint analysis as a concrete instantiation of the analyzer, at different levels of precision, to detect untrusted cross-contract invocations.
Joyce Quintino, Carina Oliveira, Rossana M. C. Andrade
The growth of devices in the Internet of Things (IoT) has brought an increase in the amount of data flowing through the network. As a consequence of that, a reliable environment has became essential to avoid security vulnerabilities. In this scenario, Blockchain emerges as a promising technology to enhance IoT security, enabling decentralized, encrypted, and immutable data registration with the consensus of network participants. Smart contracts are self-executing programs distributed in a Blockchain. In IoT applications that use Blockchain, smart contracts can eliminate the need for intermediaries, allowing for more secure and transparent data transfers between involved parties in a decentralized manner. However, smart contracts are subject to security flaws, mainly caused by programming errors and vulnerabilities in the source code, which can result in financial losses or compromise data integrity, posing risks to users’ privacy and security. Therefore, performing tests with different approaches before deployment can expose errors in the smart contract code and reduce security risks. This work then proposes a process, called PERCI, that defines a set of verification steps for smart contracts in IoT applications to detect known vulnerabilities, using a combination of static and dynamic analysis tools before the contract deployment. The combination of static and dynamic analyses is proposed to improve vulnerability detection, providing a more robust solution. For this, the process uses two static analysis tools, Slither and Mythril, and one dynamic analysis tool, Manticore. PERCI is evaluated, firstly, by demosntrating that the combination of the analyses of each tool resulted in more efficient vulnerability detection, providing a more comprehensive and precise verification of the smart contract code. Additionally, this work integrated a smart contract to register and authenticate devices on the Blockchain with an IoT application that shows weather conditions through colors with a smart lamp. The process evaluation demonstrated the feasibility of using combined static and dynamic analyses for more efficient vulnerability detection. Finally, this dissertation is expected to contribute to improving the security and the reliability of IoT applications that use Blockchain.
Mutlu Tahsin Üstündağ, Gizem Yıldız, Mustafa TANRIVERDİ, Togay Seçkin BİRBUDAK
In this study, it is aimed to analyze the articles on Web3 and present the general situation about Web3 to researchers. Within the scope of this purpose, the trends of the studies published on Web3 according to years, the trends of the journals in which they were published, the institutions and countries that contributed the most, the keywords used in the studies, the topics and themes based on the studies, and the distribution of research areas were revealed. The research is based on bibliometric analysis. A total of 280 articles published in WoS and SCOPUS databases were analyzed. WoSViewer and Bibliometrix programs were used in data analysis. The findings were analyzed and interpreted separately in WoS and SCOPUS. As a result of the research, there was a significant increase in studies on Web3 in 2022, and the journals with the highest number of publications in WoS and SCOPUS differ. The countries that contributed the most to Web3 were China, The USA, India, England, Germany. The most cited countries are China, the USA, India, England, Iran and Canada. In general, it can be said that countries and institutions have conducted studies on Web3 by addressing many issues related to Web3. Within the scope of the results, Web3 studies address many different disciplines with many topics. However, there is a need to deepen the studies. The policies, practices and even the laws created by countries on Web3 are important for studies on Web3. Blockchain is one of the most studied topics, but it is understood that there are some hesitations about blockchain security. For this reason, Web3 studies can be conducted to increase blockchain security.
Solana has quickly emerged as a popular platform for building decentralized applications (DApps), such as marketplaces for non-fungible tokens (NFTs). A key reason for its success are Solana's low transaction fees and high performance, which is achieved in part due to its stateless programming model. Although the literature features extensive tooling support for smart contract security, current solutions are largely tailored for the Ethereum Virtual Machine. Unfortunately, the very stateless nature of Solana's execution environment introduces novel attack patterns specific to Solana requiring a rethinking for building vulnerability analysis methods. In this paper, we address this gap and propose FuzzDelSol, the first binary-only coverage-guided fuzzing architecture for Solana smart contracts. FuzzDelSol faithfully models runtime specifics such as smart contract interactions. Moreover, since source code is not available for the large majority of Solana contracts, FuzzDelSol operates on the contract's binary code. Hence, due to the lack of semantic information, we carefully extracted low-level program and state information to develop a diverse set of bug oracles covering all major bug classes in Solana. Our extensive evaluation on 6049 smart contracts shows that FuzzDelSol's bug oracles find bugs with a high precision and recall. To the best of our knowledge, this is the largest evaluation of the security landscape on the Solana mainnet.
O. (Oleksandr) Shmatko, O. (Oleksandr) Matvieiev, I. (Iryna) Mykhailenko
Smart contracts are software programmes that are maintained in a decentralised ledger and perform predefined actions based on specific transactions directed towards them. Smart contracts are often coded using the Solidity programming language, which adheres to a certain structure and grammar. The programming language was specifically designed and implemented for the Ethereum platform. Languages with a well-defined structure are susceptible to certain vulnerabilities, the exploitation of which might result in significant financial ramifications. This study employs a Deep Learning (DL) model for the purpose of identifying vulnerabilities. By employing a selected methodology and accurately defining the structure of input data, it becomes feasible to identify intricate interdependencies among programme variables that harbour vulnerabilities and problems. Through the utilisation of carefully designed experiments, this methodology was examined in order to get a deeper comprehension of the model and enhance its overall efficacy. The model that was constructed utilised the Solidity corpus of smart-contracts as input data to classify vulnerabilities at the string level. The utilisation of the deep learning model enables the detection of vulnerabilities with different levels of complexity in smart contracts.
Context:Smart contracts are prone to numerous security threats due to undisclosed vulnerabilities and code weaknesses. In Ethereum smart contracts, the challenges of timely addressing these code weaknesses highlight the critical need for automated early prediction and prioritization during the code review process. Efficient prioritization is crucial for smart contract security. Objective:Toward this end, our research aims to provide an automated approach, PrAIoritize, for prioritizing and predicting critical code weaknesses in Ethereum smart contracts during the code review process. Method: To do so, we collected smart contract code reviews sourced from Open Source Software (OSS) on GitHub and the Common Vulnerabilities and Exposures (CVE) database. Subsequently, we developed PrAIoritize, an innovative automated prioritization approach. PrAIoritize integrates advanced Large Language Models (LLMs) with sophisticated natural language processing (NLP) techniques. PrAIoritize automates code review labeling by employing a domain-specific lexicon of smart contract weaknesses and their impacts. Following this, feature engineering is conducted for code reviews, and a pre-trained DistilBERT model is utilized for priority classification. Finally, the model is trained and evaluated using code reviews of smart contracts. Results: Our evaluation demonstrates significant improvement over state-of-the-art baselines and commonly used pre-trained models (e.g. T5) for similar classification tasks, with 4.82\%-27.94\% increase in F-measure, precision, and recall. Conclusion: By leveraging PrAIoritize, practitioners can efficiently prioritize smart contract code weaknesses, addressing critical code weaknesses promptly and reducing the time and effort required for manual triage.
Nowadays, Learning Management Systems (LMS) have become increasingly popular, particularly due to the COVID-19 pandemic, offering enhanced effectiveness and efficiency. Online exams have emerged as a critical feature within LMS, serving as a means to evaluate students’ performance and assess their understanding of the course material. These exams play a crucial role in determining students’ eligibility for progression to the next grade or level of study. It is imperative that online exam results meet the standards of reliability and transparency. Any lack of reliability, such as the vulnerability to hacking, can have detrimental effects on students’ overall grades. Traditional online exam systems typically store data in centralized locations like MySQL databases, leaving them susceptible to unauthorized access by malicious individuals who may alter students’ exam results. This paper aims to propose a blockchain-based framework that facilitates the secure and peer-to-peer conduct and evaluation of academic exams. The framework employs hashing techniques to ensure the integrity of the data and utilizes proof of stake mechanisms to enhance security. Blockchain technology has proven to be effective in safeguarding data integrity by virtue of its decentralized data storage approach and the use of cryptographic hashing for every block within the chain. This paper demonstrates how online exams can be developed using blockchain technology, with each question asked and answered being directly stored on the blockchain. To achieve this, we have developed a module that integrates with the Moodle learning management system. Through a comparative analysis of the default centralized storage approach in Moodle, our module modifies the exam results’ storage method, ensuring secure and tamper-proof data storage on the blockchain network. By leveraging the blockchain network, the data associated with exam results is reliably secured, ensuring its integrity, and making it immune to manipulation. Our results indicate that the data stored through the blockchain achieved complete accuracy, with no discrepancies observed when compared to the standard approach employed by the Moodle LMS for storing results. The blockchain network provides a reliable and immutable platform that prevents unauthorized alterations or manipulations of student data. In conclusion, our blockchain-based framework offers a robust solution for enhancing the security and reliability of online exam results. By leveraging the decentralized and tamper-proof nature of blockchain technology, we can ensure the integrity and transparency of student data, ultimately providing a more trustworthy and accurate assessment of their academic performance.
Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu · 8 authors
Smart contracts are prone to various vulnerabilities, leading to substantial financial losses over time. Current analysis tools mainly target vulnerabilities with fixed control or data-flow patterns, such as re-entrancy and integer overflow. However, a recent study on Web3 security bugs revealed that about 80% of these bugs cannot be audited by existing tools due to the lack of domain-specific property description and checking. Given recent advances in Large Language Models (LLMs), it is worth exploring how Generative Pre-training Transformer (GPT) could aid in detecting logicc vulnerabilities. In this paper, we propose GPTScan, the first tool combining GPT with static analysis for smart contract logic vulnerability detection. Instead of relying solely on GPT to identify vulnerabilities, which can lead to high false positives and is limited by GPT's pre-trained knowledge, we utilize GPT as a versatile code understanding tool. By breaking down each logic vulnerability type into scenarios and properties, GPTScan matches candidate vulnerabilities with GPT. To enhance accuracy, GPTScan further instructs GPT to intelligently recognize key variables and statements, which are then validated by static confirmation. Evaluation on diverse datasets with around 400 contract projects and 3K Solidity files shows that GPTScan achieves high precision (over 90%) for token contracts and acceptable precision (57.14%) for large projects like Web3Bugs. It effectively detects ground-truth logic vulnerabilities with a recall of over 70%, including 9 new vulnerabilities missed by human auditors. GPTScan is fast and cost-effective, taking an average of 14.39 seconds and 0.01 USD to scan per thousand lines of Solidity code. Moreover, static confirmation helps GPTScan reduce two-thirds of false positives.
Smart contracts play a vital role in the Ethereum ecosystem. Due to the prevalence of kinds of security issues in smart contracts, the smart contract verification is urgently needed, which is the process of matching a smart contract's source code to its on-chain bytecode for gaining mutual trust between smart contract developers and users. Although smart contract verification services are embedded in both popular Ethereum browsers (e.g., Etherscan and Blockscout) and official platforms (i.e., Sourcify), and gain great popularity in the ecosystem, their security and trustworthiness remain unclear. To fill the void, we present the first comprehensive security analysis of smart contract verification services in the wild. By diving into the detailed workflow of existing verifiers, we have summarized the key security properties that should be met, and observed eight types of vulnerabilities that can break the verification. Further, we propose a series of detection and exploitation methods to reveal the presence of vulnerabilities in the most popular services, and uncover 19 exploitable vulnerabilities in total. All the studied smart contract verification services can be abused to help spread malicious smart contracts, and we have already observed the presence of using this kind of tricks for scamming by attackers. It is hence urgent for our community to take actions to detect and mitigate security issues related to smart contract verification, a key component of the Ethereum smart contract ecosystem.
Sebastian Holler, Sebastian Biewer, Clara Schneidewind
The cryptocurrency Ethereum is the most widely used execution platform for smart contracts. Smart contracts are distributed applications, which govern financial assets and, hence, can implement advanced financial instruments, such as decentralized exchanges or autonomous organizations (DAOs). Their financial nature makes smart contracts an attractive attack target, as demonstrated by numerous exploits on popular contracts resulting in financial damage of millions of dollars. This omnipresent attack hazard motivates the need for sound static analysis tools, which assist smart contract developers in eliminating contract vulnerabilities a priori to deployment. Vulnerability assessment that is sound and insightful for EVM contracts is a formidable challenge because contracts execute low-level bytecode in a largely unknown and potentially hostile execution environment. So far, there exists no provably sound automated analyzer that allows for the verification of security properties based on program dependencies, even though prevalent attack classes fall into this category. In this work, we present HoRStify, the first automated analyzer for dependency properties of Ethereum smart contracts based on sound static analysis. HoRStify grounds its soundness proof on a formal proof framework for static program slicing that we instantiate to the semantics of EVM bytecode. We demonstrate that HoRStify is flexible enough to soundly verify the absence of famous attack classes such as timestamp dependency and, at the same time, performant enough to analyze real-world smart contracts.
In today's world, the storage of data needs a huge amount of space. Meanwhile, cloud and distributed environments provide sufficient storage space for the data. One of the challenging tasks is the privacy prevention of storage data. To overcome the problem of privacy, the blockchain-based database is used to store the data. There are various attacks like denial of service attacks (DoS) and insider attacks that are performed by the adversary to compromise the security of the system. In this chapter, the authors discussed a blockchain-based database, where data are encrypted and stored. The Web API is used as an interface for the storage and sharing of data. Here, they are mainly focused on the SQL injection attack, which is performed by the adversary on Web API. To cope with this problem, they present the case study based on the Snort and Moloch for automated detection of SQL attack, network analysis, and testing of the system.
Blockchain is really trendy these days. A distributed ledger on a peer-to-peer network that is completely open to everyone was the block chain. It is composed of blocks that include hash values and data. Before a new transaction can be added to the block chain, researchers must validate it; this process is called mining. Mining is expensive and requires a lot of processing power. Since the block chain is a peer-to-peer network, the data is maintained in every node. The block chain network has increased to 190GB thanks to the increasing number of transactions that are processed through it. It is a problem because a cheap laptop can only hold so much data. This study developed a revolutionary, less expensive system than the block chain method. We choose web applications as our use case since they are increasingly overtaking all other methods of accessing internet services in popularity. The immutability, data security, and data dissemination features of the block chain were all taken into account. The Merle tree concept provides immutability, hashing was used to achieve security, and an open source data distribution tool is used to spread the data. This paper provides innovative methods for preventing malicious data upload using MIME, cross-site programming, and cross-site request manipulation.