This paper introduces a novel framework for Zero-Knowledge Infrastructure Verification (ZKIV) that combines chaos engineering principles with security operations and zero-knowledge proofs to create a robust infrastructure verification system. By leveraging these technologies within a DevOps context, organizations can validate the integrity and security posture of their infrastructure without revealing sensitive configuration details or credentials. This approach, which we term ChaosSecOps, represents a significant advancement in infrastructure security verification, enabling teams to verify compliance, detect misconfigurations, and identify vulnerabilities without exposing sensitive information. Through a detailed AWS implementation case study, this paper demonstrates how ZKIV can be applied to modern cloud environments to enhance security, streamline compliance verification, and build resilient systems.Executive SummaryThis paper introduces Zero-Knowledge Infrastructure Verification (ZKIV), a novel framework for validating the security and compliance of complex, modern infrastructure (particularly cloud environments like AWS) without exposing sensitive configuration details or credentials. ZKIV achieves this by combining principles from:• Zero-Knowledge Proofs (ZKPs): While full cryptographic ZKPs are discussed, the paper focuses on "functional zero-knowledge" approaches practical for infrastructure. This means proving that security controls are in place and functioning correctly without revealing the underlying configurations themselves. Examples include black-box testing, output-only verification, and attestation.• Chaos Engineering: The deliberate introduction of controlled failures (like misconfigurations or simulated attacks) to test system resilience and the effectiveness of security controls.• Security Operations (SecOps): Continuous monitoring, threat response, and security automation practices.• DevOps: Leveraging automation, continuous integration/continuous delivery (CI/CD), and Infrastructure as Code (IaC). The integration of these disciplines is termed ChaosSecOps. Key Benefits of ZKIV• Enhanced Security: Verification happens without needing to expose sensitive data, reducing the attack surface.• Improved Compliance: Continuous, automated verification ensures ongoing adherence to regulatory and internal security policies (e.g., PCI DSS, SOC 2). Evidence is collected in a zero-knowledge manner.• Reduced Operation Risk: Proactive identification of vulnerabilities and misconfigurations before they can be exploited.• Increased Confidence: Greater assurance in the security posture due to systematic and continuous testing.• Scalability: Verification is automated and can be used across many systems.• Efficiency: Verification can be done faster.ZKIV Framework ComponentsThe framework consists of several key components that work together:• Verification Orchestrator: The central control point for scheduling, executing, and managing verification tests.• Policy Engine: Defines and enforces security and compliance rules (using policy-as-code).• Test Agents: Ephemeral (short-lived) components deployed within the infrastructure to perform black-box testing.• Evidence Collection System: Gathers test results in a way that preserves zero-knowledge (no sensitive data revealed).• Remediation Framework: Automates the fixing of identified security issues.AWS Implementation Case StudyA detailed case study demonstrates ZKIV implementation within a financial services organization using AWS. Key AWS services used include AWS Organizations, Security Hub, Lambda, Step Functions, EventBridge, Systems Manager, S3, and Config. The case study shows practical application of zero-knowledge techniques like:• Least-Privilege IAM Roles: Verification agents have only the permissions needed to check configurations, not to access the data they protect.• Output-Only Verification: Validating database security settings without querying the database itself.• Black-Box Network Testing: Using isolated containers to test network segmentation without accessing internal network configurations.
Cryptocurrency exchange hacks remain a persistent threat, posing significant financial and security risks.The 2025 Bybit hack, resulting in approximately $1.4 billion in losses, is the largest cryptocurrency heist to date, highlighting the vulnerabilities even among leading exchanges.This paper examines the implications of such breaches on market stability, regulatory policies, and investor confidence, particularly within the context of the Trump administration's deregulatory approach to digital assets.The analysis explores the trade-offs between promoting innovation and ensuring robust security frameworks, emphasizing the potential for policy adjustments in light of escalating cyber threats.Additionally, the study reviews historical exchange hacks, demonstrating a pattern of increasing sophistication among malicious actors.The findings suggest that regulatory clarity and enhanced security measures are essential for the long-term stability of the cryptocurrency ecosystem.Future research directions include evaluating global regulatory responses, the role of decentralized exchanges, and the effectiveness of cybersecurity protocols.
<p><strong>This paper contributes to the literature by</strong> presenting a reproducible framework for designing and testing fair on-chain governance systems. It introduces <em>CryptoKen</em>, an Ethereum-based token using quadratic voting to reduce plutocracy and enhance participation in decentralized organizations, achieving high usability (SUS 82.5) and 92% verified test coverage.</p>
Enterprise cybersecurity is undergoing significant transformation due to the widespread adoption of agile development and self-steering teams, particularly in large organizations. Traditionally, cybersecurity governance has been centralized, relying on structured coordination across people, processes, technologies, and compliance mechanisms. However, agile methodologies—marked by decentralized, autonomous teams—have shifted organizational dynamics from hierarchical to distributed models. While this enhances responsiveness and innovation, it also introduces fragmentation in cybersecurity responsibilities, complicating unified decision-making and the enforcement of security controls.This study explores how large agile enterprises can effectively manage cybersecurity, with a specific focus on ransomware threats. Through qualitative interviews with nine cybersecurity professionals from a highly digitalized public organization in the Netherlands, the research identifies two core organizational tensions: (1) balancing agility and cyber security in decision making about security controls and risk management, and (2) balancing operational business requirements with cybersecurity improvement.The first tension stems from the fragmentation of cybersecurity responsibilities across agile teams. Respondents reported weakened accountability, inconsistent policy enforcement, and an over-reliance on tools to bridge communication gaps. These challenges are linked to mechanistic thinking—an outdated organizational mindset that views departments as isolated units. This leads to siloed operations and a narrow focus on technical solutions. To address this, the study advocates for a systems thinking approach, which views organizations as dynamic networks of interdependent elements. Systems thinking emphasizes holistic understanding, collaboration, and feedback loops.A key recommendation is the introduction of boundary spanners—individuals who bridge communication gaps between teams and align local actions with enterprise cybersecurity goals. These roles facilitate cross-team coordination, support unified decision-making, and help integrate cybersecurity efforts across the organization.The second tension involves the misalignment between the steady rhythm of operational teams and the dynamic pace of cybersecurity innovation. Operational teams prioritize stability, while innovation efforts require flexibility and rapid iteration. This mismatch is exacerbated by Out-Group Bias, where teams resist adopting solutions developed externally, leading to inconsistent security practices and delayed implementation of improvements.To overcome these challenges, the study proposes a programmatic approach to cybersecurity improvement. A program, defined as a coordinated set of related projects, ensures strategic alignment, resource allocation, and effective decision-making. The approach incorporates short-cycled project phases—explore, experiment, pilot, and scale—each with clear objectives and standardized methods. This structure accommodates operational constraints while ensuring timely progress and shared ownership.A successful example of this method is found in the Dutch financial sector, where the Partnership for Cyber Security Innovation (PCSI) implemented a four-month cycle with joint steering committees. This setup promoted inclusivity, countered Out-Group Bias, and enhanced cross-organizational cybersecurity awareness.In conclusion, the study underscores the need for systemic thinking and structured program management to align agile practices with robust cybersecurity strategies. By addressing internal tensions and fostering collaboration across teams, organizations can enhance their resilience against complex cyber threats while maintaining the benefits of agility. Future work will involve field-testing these models, including training boundary spanners and implementing short-cycled programs, with a one-year implementation horizon recommended for optimal impact.
Zubaida Rehman, Iqbal Gondal, Hai Dong, Mengmeng Ge · 6 authors
Eclipse attacks, which isolate victim nodes by monopolizing their peer connections, remain a critical threat to Ethereum’s consensus mechanism. To address this, we present a principled framework for detecting Eclipse attacks in Ethereum peer-to-peer networks, grounded in a formal adversarial model. Existing defenses are either ad-hoc or lack provable guarantees, leaving open questions about their reliability under adaptive adversaries. Our work aims to bridge this gap by formally defining eclipse attack detection as a security property. We specify soundness, completeness, and robustness theorems under bounded adversarial drift, and derive formal guarantees within false positive and false negative bounds, resilience to adversarial manipulation, and multi-node compositional reliability. We then instantiate a lightweight detection framework that maps packet-level traffic features to predictions using ensemble classifiers (Random Forest, XGBoost). The system was validated using a controlled Ethereum testbed and extended with CTGAN-generated synthetic traces to emulate networks of up to 100 nodes. Empirical evaluation shows that our framework achieves up to 96% F1-score with sub-second inference latency, well within Ethereum’s 12-second Proof-of-Stake validator time slots. These findings demonstrate that lightweight statistical features, when coupled with formal analysis, enable accurate, efficient, and scalable detection of network-level partitioning attacks. Our work establishes a deployable and theoretically grounded defense foundation for securing modern blockchain systems against eclipse adversaries.
This paper studies the economic feasibility of coordinated majority attacks on the Ethereum blockchain under its Proof-of-Stake consensus mechanism. Focusing on Ethereum’s validator-based finality rules, the paper models a corruptive attack in which validators are induced to deviate from the protocol in exchange for off-chain transfers. Under perfect information, the model derives a bribery cost schedule implying that an attacker must effectively finance just over half of total staked ether to assemble two-thirds of finality power, despite only needing to corrupt a subset of validators at each margin. The paper further shows that, under risk-neutral Bayesian behavior, uncertainty about the attacker’s stake weakly reduces expected bribery costs due to the concavity of the compensation function. The results highlight how Ethereum’s economic security depends critically on slashing design, information structure, and validator fragmentation.
Bu tez çalışması, hasta verilerinin güvenli, şeffaf, rol tabanlı ve gerçek zamanlı paylaşımını sağlamak amacıyla blokzincir teknolojisi ile IoT altyapısını bütünleştiren merkeziyetsiz bir sağlık platformunun tasarımını ve uygulanmasını sunmaktadır. Günümüzde sağlık sektöründe yaşanan veri ihlalleri, yetkisiz erişimler ve merkezi sistemlerdeki güvenlik açıkları, hasta mahremiyetinin korunması ve veri bütünlüğünün sağlanması açısından ciddi riskler oluşturmaktadır. Bu durum, özellikle hastaneler, evde bakım hizmetleri ve gelişmekte olan bölgelerde sağlık verilerinin güvenli bir şekilde yönetilmesini sağlayacak yeni nesil çözümlere duyulan ihtiyacı artırmıştır. Geliştirilen bu platform, geleneksel merkezi veri tabanlarının aksine dağıtık ve manipülasyona karşı dayanıklı bir altyapı sunarak, hem hasta verilerinin toplanmasını hem de bu verilerin güvenli ve kontrollü şekilde paylaşılmasını mümkün kılmaktadır. Sistem mimarisi üç temel katmandan oluşmaktadır: IoT veri toplama katmanı, blokzincir tabanlı güvenlik ve erişim yönetimi katmanı ve web tabanlı kullanıcı platformu. IoT katmanında Raspberry Pi cihazları, sıcaklık, nabız, tansiyon ve oksijen seviyesi gibi kritik sağlık verilerini sensörler aracılığıyla toplayarak blokzincire güvenli bir şekilde iletir. Bu yapı, yalnızca tek bir cihaz değil, gelecekte eklenebilecek farklı IoT cihazları ile genişletilebilecek esnek bir platform olarak tasarlanmıştır. Blokzincir katmanında geliştirilen özel akıllı sözleşmeler, hasta verilerinin değiştirilemez bir şekilde saklanmasını ve sadece yetkilendirilmiş kullanıcıların bu verilere erişebilmesini sağlar. Platform, rol tabanlı bir erişim kontrol mekanizması (Role-Based Access Control) kullanarak doktorlar, hastalar ve sağlık yöneticileri arasında farklı yetki seviyeleri tanımlar. Hastalar, MetaMask gibi dijital cüzdanlar üzerinden sisteme giriş yaparak hangi doktorun kendi verilerine erişebileceğini seçebilir ve diledikleri zaman bu izinleri geri çekebilir. Doktorlar ise yalnızca kendilerine yetki verilmiş hastaların verilerini görüntüleyebilir, böylece veri paylaşımı üzerinde tam bir hasta kontrolü sağlanmış olur. Bu özellik, blokzincir üzerinde uygulanan şifreleme ve akıllı sözleşmeler sayesinde merkezi bir kimlik doğrulama sistemine ihtiyaç duymadan, doğrudan zincir üzerinde güvence altına alınmaktadır. Web tabanlı kullanıcı arayüzü, hem hasta hem de doktor panellerini içeren kapsamlı bir sağlık platformu sunmaktadır. Hasta paneli, kullanıcının kendi sağlık verilerini gerçek zamanlı olarak takip etmesini, paylaşım izinlerini yönetmesini ve veri geçmişini görüntülemesini sağlar. Doktor paneli ise yetkilendirilmiş hastaların verilerini grafiksel olarak sunar, kritik değişimlerde anlık uyarılar gönderir ve tıbbi karar desteği için geçmiş verilere erişim imkânı tanır. Sistem ayrıca aile üyeleri veya farklı sağlık kurumları ile güvenli veri paylaşımını destekleyerek, çok taraflı sağlık ekosistemlerinde veri bütünlüğünü korur. Backend kısmı Python ve Flask ile geliştirilmiş olup, Raspberry Pi cihazının her 10 saniyede bir yeni veri üretip blokzincire göndermesini sağlayarak gerçek zamanlı veri akışını simüle eder. Frontend kısmı ise HTML, CSS ve JavaScript kullanılarak geliştirilmiş, Web3.js ve Ethers.js kütüphaneleri ile Ethereum tabanlı blokzincirle etkileşim sağlanmıştır. Tüm işlemler Ganache test ağı üzerinde dağıtılmış özel bir akıllı sözleşme aracılığıyla gerçekleştirilmiştir. Bu akıllı sözleşme, sadece doktor rolüne sahip kullanıcıların yeni veriler ekleyebilmesine ve mevcut verileri güncelleyebilmesine izin verirken, hastalar ve aile üyeleri yalnızca okuma yetkisine sahip olacak şekilde yapılandırılmıştır. Gerçekleştirilen deneysel testlerde, sistemin veri iletim gecikmesi, işlem onay süresi, arayüz güncelleme hızı, erişim kontrol mekanizmasının güvenliği ve farklı yük senaryoları altında performansı değerlendirilmiştir. Raspberry Pi cihazı tarafından üretilen verilerin blokzincire gönderilmesi ile web arayüzünde görüntülenmesi arasındaki ortalama Δt 2.1 saniye olarak ölçülmüş, minimum gecikme 1.5 saniye, maksimum gecikme ise 3.8 saniye olmuştur. Yetkilendirme testlerinde, doktorlara verilen erişim izinlerinin anında aktif olduğu, izinler geri çekildiğinde ise doktorların artık verilere ulaşamadığı doğrulanmıştır. Bu sonuçlar, platformun sadece güvenli değil, aynı zamanda yüksek performanslı ve hızlı bir veri paylaşım mekanizmasına sahip olduğunu göstermektedir. Sistem mimarisi, blokzincirin değiştirilemez kayıt yapısı sayesinde geçmiş tüm işlemleri şeffaf bir şekilde saklamakta ve veri bütünlüğünü garanti altına almaktadır. Bu özellik, sağlık sektöründe tıbbi kararların doğruluğunu doğrudan etkileyen veri manipülasyonlarını önlemek için kritik önem taşımaktadır. Ayrıca merkezi sunuculara olan bağımlılığın azaltılması, sistemin siber saldırılara ve veri kayıplarına karşı dayanıklılığını artırmaktadır. Gelecekteki çalışmalar kapsamında, sistemin IPFS (InterPlanetary File System) veya benzeri merkeziyetsiz dosya depolama teknolojileri ile entegre edilmesi planlanmaktadır. Böylece büyük boyutlu tıbbi görüntüler veya raporlar blokzincirde sadece referans bilgileriyle saklanacak, veri bütünlüğü korunurken gaz maliyetleri optimize edilecektir. Ek olarak, IoT cihazlarında uçtan uca şifreleme algoritmalarının uygulanması ile veri güvenliği bir adım daha ileri taşınacaktır. Platformun Layer-2 çözümleri veya kamuya açık blokzincirler üzerinde dağıtık olarak konuşlandırılması ile ölçeklenebilirlik ve performans gerçek dünya sağlık ortamlarında test edilerek daha geniş bir kullanıcı tabanına hizmet verebilecek hale getirilecektir. Sonuç olarak, bu çalışma, blokzincir tabanlı IoT sağlık platformlarının sadece veri toplamakla kalmayıp, aynı zamanda güvenli veri paylaşımı, hasta kontrollü erişim yönetimi ve gerçek zamanlı izleme yetenekleriyle merkeziyetsiz dijital sağlık altyapısına güçlü bir katkı sağlayabileceğini göstermektedir. Geliştirilen prototip, düşük maliyetli donanımlar, akıllı sözleşmeler ve rol tabanlı erişim kontrolü sayesinde şeffaf, güvenli ve ölçeklenebilir bir sağlık platformu sunarak, gelecekteki akıllı sağlık sistemlerine öncülük edebilecek niteliktedir. Günümüzde sağlık sistemlerinde yaşanan veri güvenliği ihlalleri ve merkezi veri tabanlarının yetersizliği, hasta bilgilerinin güvenilir bir şekilde yönetilmesini ve paylaşılmasını zorlaştırmaktadır. Özellikle gelişmekte olan ülkelerde düşük maliyetli, erişilebilir ve güvenli çözümlere duyulan ihtiyaç her geçen gün artmaktadır. Bu bağlamda, blokzincir teknolojisi ile IoT altyapısının entegre edilmesi, sağlık verilerinin merkeziyetsiz bir ortamda güvenli şekilde saklanması, paylaşılması ve gerçek zamanlı izlenmesi için güçlü bir çözüm sunmaktadır.
This study evaluates the effectiveness of cybersecurity frameworks in mitigating cyber threats in traditional banking while assessing their applicability to Decentralized Finance (DeFi). Using financial sector reports, cybersecurity incident databases, and DeFi security audits, we analyze compliance with NIST CSF, ISO/IEC 27001, and PCI-DSS alongside factors such as bank size, IT security investments, and regulatory fines to determine their impact on cyber resilience. Logistic regression results indicate that compliance with cybersecurity frameworks reduces cyberattack likelihood (p = 0.0689, marginally significant), while larger institutions face fewer threats (p = 0.0256, statistically significant). However, increased IT security budgets paradoxically correlate with higher attack frequencies (p = 0.0385, statistically significant), suggesting larger attack surfaces may offset security investments. In contrast, DeFi faces disproportionately higher smart contract exploits, flash loan attacks, and oracle manipulation, leading to significantly greater financial losses (F = 216.92, p < 0.001, highly significant) than traditional banking cyber incidents. Regulatory compliance and industry collaboration show promise in reducing attack occurrences, with cyber incidents projected to decline by over 40% by 2029 under stricter enforcement. However, traditional frameworks are insufficient for DeFi’s decentralized structure, necessitating AI-driven threat detection, mandatory smart contract audits, secure oracle mechanisms, and adaptive regulatory frameworks. This study highlights the urgent need for tailored DeFi cybersecurity strategies while reinforcing the effectiveness of compliance-driven models in banking. It provides actionable insights for financial institutions, regulators, and cybersecurity professionals seeking to enhance resilience across centralized and decentralized financial systems.
성신여자대학교/융합보안공학과, Nam-Ryeong Kim, Dong-Ju Ryu, Il-Gu Lee
스마트 컨트랙트의 활용이 증가함에 따라 이를 복제하고 수정하는 과정에서 다양한 보안 문제가 발생하고 있다. 본 연구는 스마트 컨트랙트의 변경 사항을 효과적으로 감지하고 공격 표면을 식별할 수 있는 프레임워크를 제안한다. 제안된 방법론은 AST(Abstract Syntax Tree), CFG(Control Flow Graph), GNN(Graph Neural Network)을 통합적으로 활용하여 코드 구조를 심층 분석한다. 실증 연구로서 Uniswap V2 프로토콜과 이를 기반으로 파생된 프로젝트들의 보안 위험성을 평가하였으며, 특 히 Uranium Finance와 BurgerSwap 사례를 중심으로 코드 유사도 분석과 보안 취약점 진단을 수행하였다. 이를 통해 제안된 분석 체계가 스마트 컨트랙트의 보안 감사에 적용될 가능성을 평가하였다.
The biggest invention of Non-Fungible Tokens System (NFTs), that defines its role digitally using the self-generated concept of proof of ownership, which comes as a result of continues progress and advancement in Blockchain Technology This study aims to provide a comprehensive understanding of NFTs, their foundational technology, and the platforms enabling their trade. It highlights the key challenges of implementing NFT technology, focusing on issues related to ownership, governance, security, privacy, and environmental concerns. The research explores the inherent risks in the evolving NFT ecosystem, offering insights into the nature and scale of these threats. Additionally, it proposes a set of actionable solutions for participants and stakeholders to mitigate these risks. By categorizing core hazards within a simplified taxonomy, this paper identifies key vulnerabilities and outlines strategies for addressing them to enhance the safety and sustainability of the NFT space.
The paper presents the main approaches to the construction of the PKI public key architecture divided into basic, two-level, and multi-level hierarchies. Modern methods of attacks on existing public key infrastructures, protocols for building secure connections of both wired and wireless systems are considered. The basics of the class of attacks on PKI infrastructures are defined, of which the main attention is paid to the most dangerous class of attacks – man-in-the-middle (MITM-attacks). The paper provides models of various classes of MITM attacks, their details and existing methods of reducing the risks of their implementation. Existing examples of successful attacks on enterprises and various organizations that implemented MITM attack models at the application, network, and physical levels of the network interaction model are also given. For the PKI infrastructure, one of the options is its segmentation, which allows to reduce the scope of attacks on the key certification center. The paper also provides an alternative way to protect against MITM attacks using distributed micro ledger technology (DLT) to create a decentralized cryptographic key distribution system (DKMS). The solution is based on the use of micro ledgers (distributed ledger technology – DMLT). Using DMLT to create a DKMS allows protection against additional classes of MITM attacks.
The integration of blockchain technology into automated incident management systems represents a significant advancement in securing and validating system logs and incident records. This article presents a comprehensive article analysis of blockchain's application in incident management, examining its role in creating immutable audit trails and enhancing security controls. Through systematic review of implementation patterns and industry case studies, the article explores how distributed ledger technology addresses traditional challenges in log integrity and incident response validation. The article investigates the architectural frameworks necessary for successful blockchain integration, including considerations for scalability, performance, and regulatory compliance. The findings demonstrate that blockchain-based incident management systems offer enhanced transparency, improved audit capabilities, and robust security measures compared to traditional approaches. Additionally, the article examines emerging patterns in enterprise adoption, implementation challenges, and the synergies between blockchain and other emerging technologies in the incident management landscape. This article contributes to the growing body of knowledge on blockchain applications in enterprise security operations and provides a framework for organizations considering blockchain adoption for their incident management processes. The article concludes with recommendations for implementation and identifies areas for future research in this rapidly evolving field.
This research presents an innovative Blockchain-Based Ticketing System (BBTS) that leverages blockchain technology, smart contracts, and non-fungible tokens (NFTs) to revolutionize the ticketing industry. The architecture comprises a User Interface, Smart Contracts Layer, Blockchain Network, Tokenization Layer, Ticketing Process, and Administrative functionalities. BBTS addresses the pervasive issue of ticket reselling, ensuring fair access to event tickets for all fans and equitable compensation for artists.Through the creation, buying, and reselling of NFT-based tickets, the platform leverages blockchain technology and smart contracts to automate ticket transactions and enhance transparency, effectively mitigating exploitative secondary markets. The system allows for the creation of NFTs associated with artists, preventing scalping and fostering a sustainable and artist-friendly ticketing ecosystem. The main aim of BBTS is to deter ticket reselling practices, ultimately benefiting both fans and artists by ensuring affordable access to events while fostering a fair compensation model. This research demonstrates the potential of blockchain-based ticketing solutions to revolutionize the event industry, establishing a foundation for fair and ethical ticket distribution.
Clement Daah, Amna Qureshi, Irfan Awan, Savas Konur
The financial sector is increasingly facing advanced cyber threats, necessitating a shift from traditional security measures to more dynamic frameworks. This study presents a novel integration of Zero Trust architecture with hybrid access control system and blockchain technology to enhance security in financial institutions. Zero Trust enforces continuous authentication and dynamic access controls, while blockchain secures digital identities and transaction logs through its immutable ledger, ensuring data integrity and non-repudiation. The proposed framework, evaluated using OMNeT++ simulations enhanced by Ethereum-Ganache, shows improved detection accuracy, reduced false positives, and increased resistance to insider threats and other attacks. It also strengthens compliance with regulatory requirements through robust audit trails, providing enhanced protection for sensitive financial data.
André Augusto, Rafael Belchior, Jonas Pfannschmidt, André Vasconcelos · 5 authors
Cross-chain bridges are a type of middleware for blockchain interoperability that supports the transfer of assets and data across blockchains. However, several of these bridges have vulnerabilities that have caused 3.2 billion dollars in losses since May 2021. Some studies have revealed the existence of these vulnerabilities, but there is little quantitative research available, and there are no safeguard mechanisms to protect bridges from such attacks. Furthermore, no studies are available on the practices of cross-chain bridges that can cause financial losses. We propose \toolName~(Cross-Chain Watcher), a modular and extensible logic-driven anomaly detector for cross-chain bridges. It operates in three main phases: (1) decoding events and transactions from multiple blockchains, (2) building logic relations from the extracted data, and (3) evaluating these relations against a set of detection rules. Using \toolName, we analyze data from two previously attacked bridges: the Ronin and Nomad bridges. \toolName~was able to successfully identify the transactions that led to losses of \$611M and \$190M (USD) and surpassed the results obtained by a reputable security firm in the latter. We not only uncover successful attacks, but also reveal other anomalies, such as 37 cross-chain transactions (\CCTX) that these bridges should not have accepted, failed attempts to exploit Nomad, over \$7.8M worth of tokens locked on one chain but never released on Ethereum, and \$200K lost by users due to inadequate interaction with bridges. We provide the first open dataset of 81,000 \CCTXS~across three blockchains, capturing more than \$4.2B in token transfers.
The increasing complexity of data management systems, coupled with the evolving nature of cybersecurity threats, necessitates innovative approaches to ensure data integrity, confidentiality, and availability. This paper explores recent studies on advanced data management strategies and their intersection with cybersecurity practices. Key insights are drawn from the latest research on topics such as distributed ledger technologies, artificial intelligence-driven threat detection, and privacy-preserving data management frameworks. The analysis highlights how these emerging technologies are reshaping the landscape of data management while addressing cybersecurity challenges. Additionally, this paper examines the role of regulation and policy in fostering secure data ecosystems. The findings offer a comprehensive overview of current trends, challenges, and opportunities in the field, with recommendations for future research directions.
Smart contracts have brought new developments to Blockchain technology, quickly finding widespread application in finance, law, and business sectors upon their emergence. However, security vulnerabilities in smart contracts have limited their growth. The existing methods for detecting vulnerabilities in smart contracts primarily focus on Ethereum's Solidity, lacking of vulnerability detection tools based on other smart contract languages such as C/C++. Therefore, this paper investigates the current state of vulnerability detection research for smart contract languages other than Ethereum's Solidity and proposes a vulnerability detection method for C/C++ smart contracts based on intermediate value transformation. This method combines Clang technology with the symbolic execution tool KLEE[l], utilizing the Intermediate Representation (IR) from LLVM (Low Level Virtual Machine) for research, andproduces a detection method capable of identifying eight types of code level vulnerabilities. Finally, it summarizes the current shortcomings of smart contract vulnerability detection methods and future research directions.
Decentralized Autonomous Organizations (DAOs) have emerged as pioneers of decentralized innovation, utilizing smart contracts and blockchain technology to operate autonomously. However, their progress is impeded by persistent security vulnerabilities. In response, we introduce a groundbreaking security solution: Decentralized Autonomous Verification (DAVe). DAVe integrates blockchain-based consensus mechanisms with advanced cryptographic techniques to establish a resilient security framework tailored to the specific requirements of DAOs. Through DAVe implementation, DAOs can effectively mitigate smart contract vulnerabilities, amplify transparency, and cultivate trust among participants. This solution represents a pivotal advancement in fortifying the future of decentralized governance, safeguarding the integrity of DAO operations amidst the ever-evolving landscape of cyber threats.
As an important part of blockchain technology, smart contracts have attracted strong interest from industry and academia. They provide the foundation for implementing various blockchain applications and play a key role in the blockchain ecosystem. However, the frequent occurrence of smart contract vulnerabilities has resulted in significant economic losses and serious damage to the blockchain-based credit system. Currently, the security and reliability of smart contracts have become an emerging research field. Recently, deep learning methods have achieved certain results in mitigating the vulnerability problem of smart contracts, with the BERT model being widely used due to its good performance. However, the existing BERT model solely relies on features extracted from the last layer, leading to incomplete classification features. To address this issue, we propose a multi-layer feature fusion model that can accurately identify smart contract vulnerabilities. Our fusion model integrates features from multiple layers of the BERT model and employs a series of fusion strategies to enhance the comprehensiveness and accuracy of the extracted features. We extensively tested and verified the effectiveness and performance advantages of our proposed multi-layer feature fusion model. Compared to traditional single-layer feature extraction methods, our model demonstrates higher accuracy and a lower false positive rate in identifying smart contract vulnerabilities.
Mike Graf, Ralf Küsters, Daniel Rausch, Simon Egger · 6 authors
Bulletin boards (BB) are important cryptographic building blocks that, at their core, provide a broadcast channel with memory. BBs are widely used within many security protocols, including secure multiparty computation protocols, evoting systems, and electronic auctions. Even though the security of protocols crucially depends on the underlying BB, as also highlighted by recent works, the literature on constructing secure BBs is sparse. The so-far only provably secure BBs requiretrusted components and sometimes also networks without message loss, which makes them unsuitable for applications with particularly high security needs where these assumptions might not always be met. In this work, we fill this gap by leveraging the concepts of accountability and universal composability (UC). More specifically, we propose the first ideal functionality for accountable BBs that formalizes the security requirements of such BBs in UC. We then propose Fabric*BBas a slight extension designed on top of Fabric*, which is a variant of the prominent Hyperledger Fabric distributed ledger protocol, and show that Fabric*BBUC-realizes our ideal BB functionality. This result makes Fabric*BBthe first provably accountable BB, an often desired, but so far not formally proven property for BBs, and also the first BB that has been proven to be secure based only on standard cryptographic assumptions and without requiring trusted BB components or network assumptions. Through an implementation and performance evaluation we show that Fabric*BBis practical for many applications of BBs.
With the rapid development of blockchain technology, smart contracts, as its core component, are widely used in various fields. However, with the increase in the number and complexity of smart contracts, their security has become a key issue. Currently, fuzzy testing is the mainstream dynamic security testing technique in the field of Ethereum smart contracts, generating a large number of test cases and executing them to discover vulnerabilities. However, due to the difficulty in covering the deep branching code of smart contracts, vulnerability detection is not comprehensive enough. In order to solve the problem of the difficulty of deep branch code coverage of smart contracts, this paper proposes a fuzzy testing method for smart contracts based on MDP and simulated annealing algorithm, i.e., VMFUZZ. This method first models the execution process of smart contracts as MDP, and then combines with the simulated annealing algorithm to generate the transaction sequences that are prone to triggering vulnerabilities in order to comprehensively cover the execution situation of the contract. Finally, a large number of new test cases are generated through fuzzy testing to detect vulnerabilities. The experimental results show that VMFUZZ is improved in code coverage compared to ILF and has a higher detection rate in vulnerability detection capability.