Smart contracts are computer programs running on blockchains to implement Decentralized Applications. The absence of contract specifications hinders routine tasks, such as contract understanding and testing. In this work, we propose a specification mining approach to infer contract specifications from past transaction histories. Our approach derives high-level behavioral automata of function invocations, accompanied by program invariants statistically inferred from the transaction histories. We implemented our approach as tool SMCON and evaluated it on eleven well-studied Azure benchmark smart contracts and six popular real-world DApp smart contracts. The experiments show that SMCON mines reasonably accurate specifications that can be used to enhance symbolic analysis of smart contracts achieving higher code coverage and up to 56 % speedup, and facilitate DApp developers in maintaining high-quality documentation and test suites.
The advent of large language models (LLMs) has marked a significant milestone in the realm of artificial intelligence, with their capabilities often matching or surpassing human expertise in various domains. Among these achievements, their adeptness in translation tasks stands out, closely mimicking the intricate and preliminary processes undertaken by human translators to ensure the fidelity and quality of the translated content. Despite the advancements in utilizing LLMs for translating programming code across different languages, the domain of smart contract translation, particularly into languages not previously encountered by the LLM, remains largely unexplored. In our research, we present a pioneering approach, SolMover, which harnesses the synergy of two distinct LLMs within a unified framework. This framework is designed to grasp coding principles and apply this understanding to the translation of code into an unfamiliar language. Our study delves into the capacity of LLMs to mimic human learning processes, offering an in-depth evaluation of our methodology for converting smart contracts written in Solidity to Move, a language with limited resources. The framework employs one LLM to decipher coding conventions for the new language, creating a blueprint for the second LLM, which, lacking planning abilities, possesses coding expertise. The empirical evidence from our experiments suggests that SolMover substantially enhances performance compared to gpt-3.5-turbo-1106, and achieves superior results over competitors such as Palm2 and Mixtral-8x7B-Instruct. Additionally, our analysis highlights the efficacy of our bug mitigation strategy in elevating code quality across all models, even outside the SolMover framework.
With the continuous development of blockchain technology, smart contracts have found widespread application in various fields of production and daily life. However, as the number of smart contracts increases, so do the economic losses caused by vulnerabilities in these contracts. Consequently, ensuring the security of smart contracts has become a topic of great concern. Unfortunately, existing techniques for detecting smart contract vulnerabilities are insufficient. These detection methods heavily rely on fixed expert rules, leading to low detection accuracy and time-consuming processes as the complexity of smart contracts increases. A smart contract vulnerability detection methodology named SCVD-SA is proposed in this paper to address this issue. This model utilizes a hybrid deep learning approach and incorporates a self-attention mechanism. By combining Word2Vec word embeddings with various deep learning models, the model can extract features effectively. The introduction of a self-attention mechanism further enhances the model's ability to assign greater weights to more important features. Ultimately, these features are utilized for smart contract vulnerability detection. The proposed SCVD-SA method has been extensively evaluated on the public dataset SmartBugs Dataset-Wild, and the results demonstrate its superiority over several of the latest smart contract vulnerability detection methods in terms of detection effectiveness and stability. The detection accuracy for Callstack deep attack vulnerability and timestamp dependency vulnerability reaches 91.65% and 94.68%, respectively. Moreover, the detection accuracy for integer overflow vulnerabilities has also significantly improved, reaching 93.39%. Notably, SCVD-SA surpasses existing state-of-the-art models by 3.65% in detecting the widely studied reentrancy vulnerabilities.
N, Jeba, S Anas, S Anuragav, R. Abhishek · 5 authors
Innovative solution for addressing the challenges in the legal records management system through a blockchain-based eVault platform. Our objective is to create a secure, transparent, and accessible ecosystem that caters to the needs of all stakeholders, including lawyers, judges, clients, and registrars. First and foremost, our solution is built on a robust blockchain platform like Ethereum harnessing the power of smart contracts to manage access, permissions, and transactions effectively. This ensures the utmost security and transparency in every interaction within the system. To make our eVault system user-friendly, we've developed intuitive interfaces for all stakeholders. Lawyers, judges, clients, and even registrars can effortlessly upload and retrieve legal documents, track changes, and share information within the platform. But that's not all; we've gone a step further by incorporating a document creation and saving feature within our app and website. This feature allows users to generate and securely store legal documents, streamlining the entire documentation process.
Smart contract code summarization is crucial for efficient maintenance and vulnerability mitigation. While many studies use Large Language Models (LLMs) for summarization, their performance still falls short compared to fine-tuned models like CodeT5+ and CodeBERT. Some approaches combine LLMs with data flow analysis but fail to fully capture the hierarchy and control structures of the code, leading to information loss and degraded summarization quality. We propose SCLA, an LLM-based method that enhances summarization by integrating a Control Flow Graph (CFG) and semantic facts from the code's control flow into a semantically enriched prompt. SCLA uses a control flow extraction algorithm to derive control flows from semantic nodes in the Abstract Syntax Tree (AST) and constructs the corresponding CFG. Code semantic facts refer to both explicit and implicit information within the AST that is relevant to smart contracts. This method enables LLMs to better capture the structural and contextual dependencies of the code. We validate the effectiveness of SCLA through comprehensive experiments on a dataset of 40,000 real-world smart contracts. The experiment shows that SCLA significantly improves summarization quality, outperforming the SOTA baselines with improvements of 26.7%, 23.2%, 16.7%, and 14.7% in BLEU-4, METEOR, ROUGE-L, and BLEURT scores, respectively.
The use of Smart Contracts and Blockchains has experienced a significant rise, leading to the automation of various financial and corporate operations. However, the occurrence of flaws and vulnerabilities in smart contracts has resulted in significant financial losses, raising concerns about their security. It is crucial to enhance the maintenance and reliability of smart contract codes. To detect the clones and bugs in a smart contract, in this paper, we propose a deep learning based model that learns the embedding as a continuous numeric-valued vector for each smart contract. Our approach involves five steps. First, we divide the smart contract Solidity program into streams along with their corresponding structural information. Second, we tokenize the textual data of the smart contract and create a corpus. Third, we employ the BERT word embedding model on the smart contract’s tokens corpus to learn feature representation for each token, generating a fixed-length vector of size 768. Fourth, we compute the embedding of each smart contract by considering the weighted sum of tokens within the contract. Finally, to measure clone similarity, we use hierarchical clustering on the feature vectors of smart contracts. The experimental results obtained using our approach on 22,000 Ethereum blockchain Solidity contracts show a clone ratio of 92.14%, and a precision of 93% in detecting clone-related bugs, representing significantly higher accuracy compared to conventional algorithms.
The smart agreement is one of the most utilized makes use of blockchain and an important issue of the blockchain ecosystem. The blockchain-based totally credit device suffers from common smart contract safety troubles, which additionally reason for big monetary losses. As an end result, smart contract’s security and dependability are of exquisite interest to researchers from all over the international. First, the use of the three levels of this survey—the Solidity code layer, the EVM execution layer, and the Block dependency layer—not unusual kinds and standard instances of smart contract vulnerabilities are explained. The nation of the artwork on this difficulty is likewise evaluated, and the existing equivalents are divided into five companies: formal verification, symbolic execution, fuzzing detection, intermediate illustration, and deep getting to know.
The previous smart contract code comment (SCC) generation approaches can be divided into two categories: fine-tuning paradigm-based approaches and information retrieval-based approaches. However, for the fine-tuning paradigm-based approaches, the performance may be limited by the quality of the gathered dataset for the downstream task and they may have knowledge-forgetting issues. While for the information retrieval-based approaches, it is difficult for them to generate high-quality comments if similar code does not exist in the historical repository. Therefore we want to utilize the domain knowledge related to SCC generation in large language models (LLMs) to alleviate the disadvantages of these two types of approaches. In this study, we propose an approach SCCLLM based on LLMs and in-context learning. Specifically, in the demonstration selection phase, SCCLLM retrieves the top-k code snippets from the historical corpus by considering syntax, semantics, and lexical information. In the in-context learning phase, SCCLLM utilizes the retrieved code snippets as demonstrations, which can help to utilize the related knowledge for this task. We select a large corpus from a smart contract community Etherscan.io as our experimental subject. Extensive experimental results show the effectiveness of SCCLLM when compared with baselines in automatic evaluation and human evaluation.
Jinyao Zhu, Xiaofei Xing, Guojun Wang, Peiqiang Li
Ethereum is a blockchain platform that allows developers to create smart contracts. Smart contracts are programs that can automatically execute and handle cryptocurrency funds. However, over a hundred thousand new smart contracts are deployed every day and inevitably contain vulnerabilities due to programming errors. Once deployed, smart contracts cannot be fixed or changed, leaving funds at risk. To mitigate it, we use deep learning to detect vulnerabilities in smart contracts. First, we create our own dataset of labeled smart contracts based on opcode sequences, since few smart contract codes and labeled datasets are publicly available. We collect opcode sequences by replaying real-world transactions from the Ethereum Mainnet in our fully synchronized node while we leverage a plugin called "SODA" to label opcode sequences with vulnerability classes. Second, after data collection, we preprocess the data by removing duplicate opcode sequences, normalizing the sequences to the same length, and converting them into vectors. Finally, to detect vulnerabilities in smart contracts, we train a deep classification model using LSTM neural networks. Our model achieved an average accuracy of 82.63% and an F1-score of 79.74% across seven types of vulnerabilities, which is important for securing funds and logic in smart contracts.
Distributed argumentation technology is a computational approach incorporating argumentation reasoning mechanisms within multi-agent systems. For the formal foundations of distributed argumentation technology, in this thesis, we conduct a principle-based analysis of structured argumentation as well as abstract multi-agent and abstract bipolar argumentation. The results of the principle-based approach of these theories provide an overview and guideline for further applications of the theories. Moreover, in this thesis we explore distributed argumentation technology using distributed ledgers. We envision an Intelligent Human-input-based Blockchain Oracle (IHiBO), an artificial intelligence tool for storing argumentation reasoning. We propose a decentralized and secure architecture for conducting decision-making, addressing key concerns of trust, transparency, and immutability. We model fund management with agent argumentation in IHiBO and analyze its compliance with European fund management legal frameworks. We illustrate how bipolar argumentation balances pros and cons in legal reasoning in a legal divorce case, and how the strength of arguments in natural language can be represented in structured arguments. Finally, we discuss how distributed argumentation technology can be used to advance risk management, regulatory compliance of distributed ledgers for financial securities, and dialogue techniques.
Identity theft is one of the fastest-growing forms of cybercrime, driven by large-scale data breaches, phishing, and increasingly sophisticated impersonation attacks. Traditional identity verification methods such as passwords, PINs, and physical documents have proven inadequate in ensuring security at scale. Artificial Intelligence (AI) has emerged as a transformative enabler of next-generation identity verification by leveraging multimodal techniques, including facial recognition, voice biometrics, and document authentication. The paper discusses how AI- based verification systems can be used to prevent identity theft and how the system is used in real-time adaptive, and frictionless authentication over high-stakes areas, including banking, healthcare, e-commerce, and government services. We introduce a multi-layered verification system that combines the facial, voice and document verification modules in a single decision layer to minimize the false positives and negative but enhances the system resistance to spoofing and adversarial attacks. Practical implementations, advantages and governance are described using case studies of financial institutions, e-commerce websites and national identity programs. Nevertheless, there are still obstacles, such as demographic bias, privacy risks, adversarial vulnerability and lack of a coherent regulatory framework that makes it difficult to achieve mass adoption. In the future, we will address future directions in the area of decentralized identity, federated learning, zero-knowledge proofs, explainable AI, and international regulatory alignment. These innovations will work towards building trust, fairness and interoperability in digital identity ecosystems. Finally, this paper shows that AI-based identity verification is not merely a technological breakthrough but one of the essential needs to protect individuals, organizations, and governments against identity theft during the digital age.
Sihao Hu, Tiansheng Huang, Fatih İlhan, Selim Furkan Tekin · 5 authors
This paper provides a systematic analysis of the opportunities, challenges, and potential solutions of harnessing Large Language Models (LLMs) such as GPT-4 to dig out vulnerabilities within smart contracts based on our ongoing research. For the task of smart contract vulnerability detection, achieving practical usability hinges on identifying as many true vulnerabilities as possible while minimizing the number of false positives. Nonetheless, our empirical study reveals contradictory yet interesting findings: generating more answers with higher randomness largely boosts the likelihood of producing a correct answer but inevitably leads to a higher number of false positives. To mitigate this tension, we propose an adversarial framework dubbed GPTLens that breaks the conventional one-stage detection into two synergistic stages $-$ generation and discrimination, for progressive detection and refinement, wherein the LLM plays dual roles, i.e., auditor and critic, respectively. The goal of auditor is to yield a broad spectrum of vulnerabilities with the hope of encompassing the correct answer, whereas the goal of critic that evaluates the validity of identified vulnerabilities is to minimize the number of false positives. Experimental results and illustrative examples demonstrate that auditor and critic work together harmoniously to yield pronounced improvements over the conventional one-stage detection. GPTLens is intuitive, strategic, and entirely LLM-driven without relying on specialist expertise in smart contracts, showcasing its methodical generality and potential to detect a broad spectrum of vulnerabilities. Our code is available at: https://github.com/git-disl/GPTLens.
Chong Chen, Jianzhong Su, Jiachi Chen, Yanlin Wang · 10 authors
With the development of blockchain technology, smart contracts have become an important component of blockchain applications. Despite their crucial role, the development of smart contracts may introduce vulnerabilities and potentially lead to severe consequences, such as financial losses. Meanwhile, large language models, represented by ChatGPT, have gained great attention, showcasing great capabilities in code analysis tasks. In this article, we presented an empirical study to investigate the performance of ChatGPT in identifying smart contract vulnerabilities. Initially, we evaluated ChatGPT’s effectiveness using a publicly available smart contract dataset. Our findings discover that while ChatGPT achieves a high recall rate, its precision in pinpointing smart contract vulnerabilities is limited. Furthermore, ChatGPT’s performance varies when detecting different vulnerability types. We delved into the root causes for the false positives generated by ChatGPT, and categorized them into four groups. Second, by comparing ChatGPT with other state-of-the-art smart contract vulnerability detection tools, we found that ChatGPT’s F-score is lower than others for 3 out of the 7 vulnerabilities. In the case of the remaining 4 vulnerabilities, ChatGPT exhibits a slight advantage over these tools. Finally, we analyzed the limitation of ChatGPT in smart contract vulnerability detection, revealing that the robustness of ChatGPT in this field needs to be improved from two aspects: its uncertainty in answering questions; and the limited length of the detected code. In general, our research provides insights into the strengths and weaknesses of employing large language models, specifically ChatGPT, for the detection of smart contract vulnerabilities.
To address the problems of low detection accuracy of traditional smart contract vulnerability detection schemes and single vulnerability type detection of deep learning-based schemes, this paper proposes a smart contract vulnerability detection scheme based on TextCNN and attention mechanism. Firstly, word embedding is used to obtain the word vector representation of operation codes, and then the word vectors are input into TextCNN to extract sequential features. An attention mechanism is used to assign different weights to different features to highlight key features. Finally, normalization processing is carried out through activation functions to implement detection and recognition of smart contract vulnerabilities. The paper collected and screened 3735 valid smart contracts and used these contracts for model experiments and evaluation. The experimental results show that compared with deep learning models and traditional tools, the scheme proposed in the paper has certain improvements in terms of accuracy, precision, recall and Fl score, and can accurately identify 5 types of smart contract vulnerabilities with an accuracy of 99.20%.
Pursuing “intelligent justice” necessitates an impartial, productive, and technologically driven methodology for judicial determinations. This scholarly composition proposes a framework that harnesses Artificial Intelligence (AI) innovations such as Natural Language Processing (NLP), ChatGPT, ontological alignment, and the semantic web, in conjunction with blockchain and privacy techniques, to examine, deduce, and proffer recommendations for the administration of justice. Specifically, through the integration of blockchain technology, the system affords a secure and transparent infrastructure for the management of legal documentation and transactions while preserving data confidentiality. Privacy approaches, including differential privacy and homomorphic encryption techniques, are further employed to safeguard sensitive data and uphold discretion. The advantages of the suggested framework encompass heightened efficiency and expediency, diminished error propensity, a more uniform approach to judicial determinations, and augmented security and privacy. Additionally, by utilizing explainable AI methodologies, the ethical and legal ramifications of deploying intelligent algorithms and blockchain technologies within the legal domain are scrupulously contemplated, ensuring a secure, efficient, and transparent justice system that concurrently protects sensitive information upholds privacy.
Large Language Models (LLMs) could be a useful tool for lawyers. However, empirical research on their effectiveness in conducting legal tasks is scant. We study securities cases involving cryptocurrencies as one of numerous contexts where AI could support the legal process, studying GPT-3.5's legal reasoning and ChatGPT's legal drafting capabilities. We examine whether a) GPT-3.5 can accurately determine which laws are potentially being violated from a fact pattern, and b) whether there is a difference in juror decision-making based on complaints written by a lawyer compared to ChatGPT. We feed fact patterns from real-life cases to GPT-3.5 and evaluate its ability to determine correct potential violations from the scenario and exclude spurious violations. Second, we had mock jurors assess complaints written by ChatGPT and lawyers. GPT-3.5's legal reasoning skills proved weak, though we expect improvement in future models, particularly given the violations it suggested tended to be correct (it merely missed additional, correct violations). ChatGPT performed better at legal drafting, and jurors' decisions were not statistically significantly associated with the author of the document upon which they based their decisions. Because GPT-3.5 cannot satisfactorily conduct legal reasoning tasks, it would be unlikely to be able to help lawyers in a meaningful way at this stage. However, ChatGPT's drafting skills (though, perhaps, still inferior to lawyers) could assist lawyers in providing legal services. Our research is the first to systematically study an LLM's legal drafting and reasoning capabilities in litigation, as well as in securities law and cryptocurrency-related misconduct.
Pengcheng Fang, Zhenhua Zou, Xusheng Xiao, Zhuotao Liu
Embracing software-driven smart contracts to fulfill legal agreements is a promising direction for digital transformation in the legal sector. Existing solutions mostly consider smart contracts as simple add-ons, without leveraging the programmability of smart contracts to realize complex semantics of legal agreements. In this paper, we propose iSyn, the first end-to-end system that synthesizes smart contracts to fulfill the semantics of financial legal agreements, with minimal human interventions. The design of iSyn centers around a novel intermediate representation (SmartIR) that closes the gap between the natural language sentences and smart contract statements. Specifically, iSyn includes a synergistic pipeline that unifies multiple NLP-techniques to accurately construct SmartIR instances given legal agreements, and performs template-based synthesis based on the SmartIR instances to synthesize smart contracts. We also design a validation framework to verify the correctness and detect known vulnerabilities of the synthesized smart contracts.We evaluate iSyn using legal agreements centering around financial transactions. The results show that iSyn-synthesized smart contracts are syntactically similar and semantically correct (or within a few edits), compared with the “ground truth” smart contracts manually developed by inspecting the legal agreements.