Smart contracts are a core component of blockchain-based systems, enabling decentralized applications to autonomously manage assets and enforce program logic. However, vulnerabilities in smart contracts can cause severe financial losses because of their immutability and public accessibility. As a result, analyzing common attack vectors and evaluating static detection techniques before deployment remain critical challenges in blockchain security. This thesis presents an analytical study of high-impact smart contract attack classes and evaluates the effectiveness of AST-based static detection approaches for Ethereum smart contracts. Building on the Aderyn static analysis framework, custom detectors are implemented to analyze structural code patterns that enable reentrancy attacks, authorization bypass vulnerabilities, and unsafe proxy delegation and storage collision risks. Rather than proposing new defensive mechanisms, this work systematically analyzes how known attacks arise from insecure smart contract programming practices and examines how defensive coding patterns can be identified at the source-code level through static analysis. The effectiveness of the analysis is evaluated using vulnerable smart contract implementations and corresponding exploit scenarios developed with the Foundry testing framework. Experimental results show that the implemented detectors successfully identify exploitable vulnerabilities and demonstrate a strong correspondence between attack-enabling code structures and statically detectable patterns, confirming alignment between static analysis findings and real-world attack behavior. This work demonstrates that extensible AST-based static analysis provides a practical foundation for analyzing both smart contract attacks and the defensive patterns intended to mitigate them before deployment.
Pascal Berrang, Mirco Giacobbe, Jacob Swales, Xiao Yang
We introduce a technology to formally verify that a software system satisfies a temporal specification of functional correctness, without revealing the system itself. Our method combines a deductive approach to model checking to obtain a formal certificate of correctness for the system, with zero-knowledge proofs to convince an external verifier that the system -- kept secret -- complies with its specification of correctness -- made public. We consider proof certificates represented as ranking functions, and introduce both an explicit-state and a symbolic scheme for model checking in zero knowledge. Our explicit-state scheme assumes systems represented as transition graphs. We use polynomial commitments to convince the verifier that the public proof certificates correspond to the secret transition relation. Our symbolic scheme assumes systems specified as linear guarded commands and uses piecewise-linear ranking functions. We apply Farkas' lemma to obtain a witness for the validity of the ranking function with public and secret components, and employ sigma protocols for matrix multiplication and range proofs to convince the verifier of the witness's existence. We built a prototype to demonstrate the practical efficacy of our two schemes on linear temporal logic verification examples. Our technology enables formal verification in domains where both the safety and the confidentiality of the system under analysis are critical.
Damiano Di Francesco Maesa, Francesco Donini, Paolo Mori, Laura Ricci
Non-Fungible Tokens (NFTs) are widely used nowadays for managing digital assets in many applications due to their ability to uniquely identify an asset and securely transfer and trace its ownership. Some scenarios require digital assets to be mutable, i.e., users should be allowed to update asset attributes over time, thus introducing possible security issues, since unwanted (or even malicious) updates could significantly decrease assets’ value. While various methods for NFT mutability exist, they often lack integrated, fine-grained, and on-chain enforceable authorisation models. This paper addresses this issue by considering an NFT expansion, named Non-Fungible Mutable Token (NMT), which natively supports the update of the attributes characterising each digital asset while guaranteeing a strict and fine-grained control over such updates. In fact, the NMT approach embeds an on-chain security support based on the Attribute-Based Access Control model within the NMT architecture, aimed at regulating, through access control policies enforcement, the execution of all the update operations defined on digital assets, from new token minting to ownership transfers and attribute updates.We propose a detailed architecture for NMTs and we outline the involved smart contracts structure, including the on-chain access control system. We validate our proposal by implementing it for two common use cases, wearables and digital event tickets in the metaverse, and by conducting an experimental evaluation of the deployment and execution costs. Moreover, we simulated the usage of NMTs over a given time interval to estimate the sustainability of the proposed approach over time.
Tom Sorger, Eric Cornelissen, Aman Kumar Sharma, Javier Ron · 6 authors
Software Bills of Materials (SBOMs) are increasingly mandated by regulators, yet existing sharing mechanisms impose a binary choice between full disclosure and full opacity. This exposes software suppliers to attacks that can be deduced from the SBOM only, such as the presence of a vulnerable dependency. Conversely, software consumers can be fooled by software suppliers who modify or misrepresent published SBOMs. We present zkSBOM, a privacy-preserving SBOM sharing mechanism designed to address these threats. zkSBOM uses zero-knowledge sets to cryptographically commit to the components within an SBOM. Software consumers can query for known vulnerabilities and receive a cryptographic proof confirming whether the artifact described by the SBOM is affected, without revealing any additional SBOM content. We conduct a security analysis of zkSBOM by quantifying expected leakage from inclusion and exclusion proofs. We demonstrate real-world feasibility by applying it to realistic scenarios and evaluating its operation requirements. Our evaluation demonstrates that zkSBOM is a strong, secure, and privacy-preserving mechanism for SBOM sharing, protecting software suppliers and software consumers from one another.
Rongji Huang, Yifeng Ye, Gerui Wang, Mingchao Wan · 8 authors
Due to regulatory compliance and governance management, modern (permissioned) blockchains require flexible endorsement, which allows the endorsement policy for each contract or state object to be individually defined. To enable flexible endorsement, Hyperledger Fabric employs an execute-order-validate (EOV) paradigm, in which transactions first undergo speculative execution and endorsement, and are only then ordered and validated. Meanwhile, most blockchain systems, including the platform targeted in this work (i.e., ChainMaker), still follow a conflict-free order-execute framework. We argue that the EOV paradigm still faces several limitations, notably high abort rates in high-contention workloads such as those in Decentralized Finance (DeFi). To avoid refactoring our system and better suit DeFi applications, we try to integrate flexible endorsement into the classical order-execute architecture and accordingly propose a new framework. The key challenge is to deterministically remove problematic transactions from an ordered list, while preserving censorship resistance and decentralization for the remaining ones. We instantiate this framework on top of Tendermint, a seminal Byzantine fault-tolerant (BFT) protocol adopted in our system, and thereby propose FlexTender. By elegantly embedding endorsements into consensus, FlexTender incurs no additional messaging overhead in the normal case. Empirical evaluation using an Ethereum USDT workload demonstrates that FlexTender achieves up to $10.6\times$ speedup in throughput over an EOV simulation on the same platform.
This research paper explores the critical challenge of verifiable execution integrity in modern cloud and serverless computing platforms. While services like Amazon Web Services Lambda and Google Cloud Functions provide scalable and efficient execution environments, they operate as opaque systems where users cannot verify whether their code is executed correctly or securely. The paper identifies a fundamental trust gap in current cloud architectures and presents a comprehensive threat model covering risks such as hypervisor compromise, malicious insiders, supply chain attacks, and output manipulation. It highlights how existing security certifications and auditing mechanisms fail to provide cryptographic guarantees of correctness. To address this problem, the paper proposes a novel framework called the CodeNet Integrity Layer (CIL). This system integrates multiple advanced technologies, including Trusted Execution Environments (TEEs), Zero-Knowledge Proofs (ZKPs), and blockchain-based audit mechanisms, to create a decentralized and trustless verification model. The framework ensures that computation outputs are provably linked to the correct code and inputs without relying on blind trust in the provider. The proposed solution is evaluated through experimental implementation, demonstrating that strong execution integrity can be achieved with minimal performance overhead, making it practical for real-world deployment. The research contributes to the future of secure, transparent, and trustless cloud computing, particularly for sensitive applications in finance, healthcare, and critical infrastructure.
Miguel Isabel, Enric RodrÃguez-Carbonell, Clara RodrÃguez-Núñez, Albert Rubio
Zero-knowledge proofs (ZKPs) are an emerging technology that has become the solution to efficiently provide security and privacy along with the transparency requirement of blockchains. ZKPs are usually expressed by means of arithmetic circuits and, more generally, systems of polynomial equations in a large prime field (commonly ranging from 64-bit to 256-bit values). An increasing interest to apply formal verification techniques to ensure soundness and completeness properties of ZKP protocols has shown the need of developing powerful SMT solvers able to handle such constraint systems. In this paper we consider the problem of deciding the satisfiability of existentially quantified first-order formulas defined over polynomial equations on a prime field. We present a new DPLL($T$)-based approach in which the theory solver orchestrates several modules with different trade-offs between completeness and efficiency. We have implemented the proposed techniques in a prototype that already shows better results than existing state-of-the-art tools on both benchmarks from the domain of ZKP compiler correctness and new benchmarks coming from the verification of arithmetic circuits for ZKPs. \keywords{SMT \and Finite field \and Polynomials \and Zero-Knowledge Proofs.
Canon² — Trust Layer Research Archive. In deterministic, decentralized computational frameworks, state mutations are immutable, linearly ordered, and rigidly governed by consensus constraints. Reversing or rolling back such state transitions traditionally necessitates revealing the sensitive state artifacts subject to the rollback, fundamentally destroying the cryptographic confidentiality of participant actors. I introduce the Zero-Knowledge State Reversal Protocol (ZK-SRP), a method designed to allow participating deterministic nodes to cryptographically prove the legitimacy, necessity, and validity of a state rollback without disclosing the underlying payloads of the state to any governing validator. I present a framework wherein zero-knowledge succinct non-interactive arguments (SNARKs/STARKs) are bound tightly into deterministic hashing algorithms (specifically SHA3-256) and anchored directly to the Trust Layer Certificate Fabric. In this design, execution nodes issue Reversal Envelopes that contain mathematically verifiable proofs that a specific backward transition maps cleanly onto earlier hash obligations. Through this protocol, the rollback itself becomes deterministic and universally validatable. I outline how this operates within the Lume-V wrapper ecosystem, the DAIGS master taxonomy, and the self-healing mechanisms of Type-4 Synthetic Organisms. I present what is, to my knowledge, the first deterministic privacy-preserving state reversal architecture that guarantees zero state leakage while maintaining general-purpose runtime rollbacks, ensuring that synthetic agents and multi-agent arbitration channels can effectively unspool catastrophic logic errors without breaking strict confidentiality agreements.
Auditing the semantic properties of proprietary data creates a fundamental tension: verification requires transparent access, while proprietary rights demand confidentiality. While Zero-Knowledge Proofs (ZKPs) ensure privacy, they are typically limited to precise algebraic constraints and are ill-suited for verifying qualitative, unstructured properties, such as the logic within a codebase. We propose {\em Agentic Witnessing}, a framework that moves verification from attested execution to {\em attested reasoning}. The system is composed of three agents: a Verifier (who wants to check properties of a dataset), a Prover (who owns the dataset) and an Auditor (that inspects the dataset). The Verifier is allowed to ask a limited number of simple binary true/false questions to the auditor. By isolating an LLM-based Auditor within a Trusted Execution Environment (TEE), the system enables the Verifier to query a Prover's private data via simple Boolean queries, without exposing the raw dataset. The Auditor uses the Model Context Protocol (MCP) to dynamically inspect the target dataset, producing a yes/no verdict accompanied by a cryptographic transcript: a signed hash chain binding the reasoning trace to both the original dataset and the TEE's hardware root of trust. We demonstrate this architecture by automating the artifact evaluation process for 21 peer-reviewed computer science papers with released codebases on GitHub (e.g. Does the codebase implement the system described in the paper?). We verified five high-level properties of these codebases described in the corresponding publications, treating the source code as private. Our results show that TEE-enabled agentic auditing provides a mechanism for privacy-preserving oversight, effectively decoupling qualitative verification from the need for data disclosure.
We prove three impossibility theorems establishing fundamental limits on universal AML compliance in zero-knowledge financial systems. T1 (Completeness Impossibility): no ZK compliance system achieves complete coverage of illicit transactions under rational adversarial behavior. T2 (Oracle Integrity Impossibility): no decentralized oracle network achieves integrity guarantees when state-level adversaries control oracle nodes — cryptographically valid compliance proofs can be semantically false by construction. T3 (Sovereignty Gap Impossibility): no voluntary international compliance framework achieves universal participation when sovereign defection is individually rational. These theorems are not engineering limitations addressable by better cryptography — they are structural properties of the compliance problem under adversarial conditions. Validated empirically against the Tornado Cash OFAC designation (T3) and the Lazarus Group / Ronin Bridge exploit (T2). The theorems characterize the residual attack surface that any compliance architecture must acknowledge and bound rather than claim to eliminate.
The Model State Attestation Framework (MSAF) is the theoretical foundation of the Auburn Governance Stack. It establishes the intellectual authority for why cryptographic AI attestation is necessary, defines the three-tier attestation architecture, surveys over 200 papers from 2022 through 2026 confirming that no existing system composes hardware trust, continuous model health monitoring, and supply chain provenance into a unified attestation artifact, and documents the theoretical ceilings that bound what attestation can and cannot guarantee. The framework addresses a fundamental governance paradox: organizations deploying foundation models into critical infrastructure cannot definitively demonstrate that a specific output was generated by a model version in a compliant internal state. Current governance artifacts including model cards, training logs, and static benchmarks are descriptive rather than prescriptive and fundamentally non-verifiable. MSAF composes three verification tiers into a layered architecture. The first tier provides TEE-backed platform attestation for execution environment integrity, proving the silicon is real and uncompromised. The second tier provides signed continuous metrics for training and inference health monitoring, proving the model is healthy at the moment of inference. The third tier provides selective zero-knowledge proofs for high-value inference verification, enabling verification without exposing proprietary model internals. The composed attestation artifact is mapped to specific evidence requirements across five regulatory frameworks: EU AI Act Articles 11 and 15, FDA Software as a Medical Device Pre-Determined Change Control Plans, Federal Reserve SR 11-7 ongoing monitoring requirements, US Federal Procurement mandates, and AI insurance underwriting. The framework identifies the theoretical ceilings that bound attestation: Rice's theorem establishing the undecidability of semantic properties, the Impossibility Sandwich bounding what verification can achieve between Rice's theorem and Gödel's incompleteness, and TEE physical side-channel vulnerabilities limiting hardware trust guarantees. The honest framing: MSAF provides probabilistic risk reduction and accountability infrastructure, not behavioral safety guarantees. This is analogous to financial auditing, which certifies process compliance without guaranteeing future solvency. The building blocks exist individually. MSAF is the composition that binds them into an enforceable governance architecture. This work was previously hosted on Figshare, where the author maintained a portfolio of 29 publications with minted DOIs and an established ORCID record. The author's Figshare account was disabled without prior notice, without citation of a specific terms violation, and without opportunity for review, rendering all published items and their associated DOIs inaccessible. No communication was provided before or at the time of the disable action. This deposit and associated deposits on Zenodo ensure continued public accessibility of the author's research on institutional infrastructure with appropriate permanence guarantees.
Open access
2 source records
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
This paper present a complete and irreducible formal specification for the SIS-10 safety kernel. The system satisfies totality, invariance, bounded causality, schedulability, feasibility, verifiability, machine-learning safety, compositional closure, and full observability. No additional axioms are required: the specification is dimensionally complete and closed under refinement. The tool is Apache Kafka. Kafka provides an ordered, durable, replayable event log with partitioned total order, replicated storage, and deterministic offsets. We show that Kafka's log semantics satisfy the requirements for totality, observability, compositionality, verifiability, and bounded causality. The resulting system is a closed and provably safe dynamical system. Keywords: safety kernel, formal methods, SIS-10, IEC 61508, Apache Kafka, event sourcing, compositional verification, zero-knowledge proofs, dynamical systems, functional safety.
The widespread deployment of neural networks has raised significant concerns regarding the integrity and privacy of model predictions, especially in malicious environments. Current approaches have explored zero-knowledge proofs for integrity verification. However, they suffer from inefficiency in proving runtime and a lack of rigorous integrity verification for non linear operations. To address these issues, we present a trustwor thy framework for Enhancing Integrity Verification of Convolutional Neural Network predictions (EIV-CNN) in a malicious model, whose key contributions are an efficient optimized sum check protocol and a robust enhanced verification mechanism. Specifically, we first propose an algorithm that enables efficient proving of both batch and collaborative CNN predictions by com bining sumcheck claims of multiple matrix multiplications into one. Moreover, we introduce a non-interactive sumcheck protocol with malicious security (NM-Sumcheck) to serve as a building block for publicly verifying matrix multiplication operations. Furthermore, we introduce a verifiable method for transforming nonlinear operations into matrix operations, enabling their sub sequent evaluation with the NM-Sumcheck protocol. Our EIV CNN provides malicious security, guarantees public verifiability, and preserves model privacy. Empirical results demonstrate that our sumcheck framework achieves constant prover time, verifier time, and proof size. Compared to the state-of-the-art, it achieves up to a 128.56× reduction in prover time, along with significant reductions in communication overhead and enhanced scalability.
Behkish Nassirzadeh, Rui Xi, Karthik Pattabiraman, Vasisht L. Ganesh
Blockchain technologies have experienced rapid adoption across various sectors, including supply chain management, decentralized finance and cross-border payments. With this growth, however, the complexity and security risks of maintaining blockchain integrity and functionality have increased. Addressing these challenges requires a systematic and rigorous organization of knowledge in blockchain security. This paper presents a Systematization of Knowledge (SoK) study based on a structured survey of academic literature, industry reports and real-world case studies. The authors classify vulnerabilities into three layers: system-level, smart contract-level and application-level, analyzing their root causes, real-world prevalence and mitigation tradeoffs. The taxonomy encompasses blockchain-specific threats (e.g. gas-based DoS attacks, MEV) as well as vulnerabilities inherited from distributed systems and software (e.g. Sybil attacks, access control failures). The authors critically evaluate detection and mitigation techniques, including static and dynamic analysis, fuzzing, symbolic execution and formal verification, assessing their precision, recall, scalability and inherent limitations. The authors further review state-of-the-art auditing tools in terms of methodology, adoption and shortcomings. Finally, the authors discuss advanced approaches such as hybrid frameworks that combine AI with program analysis, SMT solvers, and zero-knowledge proofs, outlining how these can address current gaps in scalability, interpretability and runtime verification. Overall, this study systematizes the security landscape of blockchain technologies, synthesizes the limitations of current approaches, and identifies technically actionable future research directions toward building more robust and resilient blockchain systems.
This paper introduces ZKAP (Zero-Knowledge Audit Protocol), a cryptographic protocol in which a machine-learning inference is coupled to a zero-knowledge proof of constraint satisfaction in such a way that the output of the inference cannot be released on any observable channel unless the proof verifies. The protocol rests on two principal technical contributions: The Certified Stack — a composite object that cryptographically binds the model weights, a mandatory bit-integrity policy (integer quantisation), the inference runtime stack and the hardware configuration under a single commitment (RootHash), which is included as a public input to every proof produced by the system. Prove-before-output enforcement — a family of four embodiments (hardware output gate, trusted-execution-environment release path, silicon-level embodiment, syscall-intercepting software runtime) in which the output of the inference is physically blocked from leaving the system until the accompanying proof has verified against the Certified Stack commitment and against a constraint set signed by an external authority. Three supporting mechanisms are described: authority-signed formal constraints with a five-type taxonomy, a per-inference hash chain with external anchoring, and a three-party cryptographic separation of duties. The paper further discusses practical relaxations of the strict release semantics for real-time workloads. A soundness theorem is stated against a polynomial-time adversary controlling the operator of the inference, and regulatory implications for high-risk AI systems under Regulation (EU) 2024/1689 (Artificial Intelligence Act) are discussed. Priority declaration. The inventive mechanisms described in this paper are the subject of Bulgarian patent applications BG/P/2026/114317 (filed 30 March 2026) and PTBG202600000316742 (filed 12 April 2026). This preprint establishes the academic priority of the author, as of the date of the deposit timestamp, over the specific technical constructions described in Sections 3 and 4 of the paper. Access note. This deposit is under embargo until 31 March 2027. During the embargo, metadata (title, abstract, author, keywords, references) are publicly visible; the full text is not publicly accessible. The embargo date coincides with the Paris Convention priority deadline of the underlying Bulgarian patent application BG/P/2026/114317. The DOI assigned at deposit time serves as a timestamp for academic priority purposes, independent of the file's accessibility.
Emerging zero-knowledge proof protocols such as Binius and Binius-FRI operate over towers of binary fields, allowing for ultra-fast polynomial commitments over a base field. Sum-check, a key protocol in algebraic proof systems, is one of the key implementation bottlenecks for Binius and similar protocols. While sum-check is a massively parallel algorithm, GPU acceleration of sum-check has received little attention due to the lack of native GPU support for binary field multiplication. Hence, in this paper, we explore the key issues in existing GPU-based sum-check accelerators and present SumCATS - an efficient GPU implementation for sum-check acceleration. SumCATS leverages two fundamental improvements over the existing solutions. First, it adapts a CPU-based algorithmic improvement to sum-check proving and applies it to GPUs by recognizing the reduction pattern and shared memory optimizations. Secondly, SumCATS reduces the number of global memory accesses by precomputing products of random challenges and using base field operations to reconstruct extension field elements. When these optimizations are combined, SumCATS achieves a significant speedup (1.81× on NVIDIA RTX 3090 Ti, 1.62× on NVIDIA A100) over the baseline GPU implementation (Binius-GPU) for sum-check over binary tower fields. The code and research artifacts for SumCATS design are available at https://github.com/SPIRE-GMU/sum_cats.
Smart contracts extended blockchain functionality beyond simple transactions, powering complex applications like decentralized finance (DeFi). However, this complexity introduces serious security challenges, including price manipulation and inflation attacks. Despite the development of various security tools, the rapid rise in financially motivated exploits continues to pose a significant threat to the blockchain ecosystem. These financially motivated exploits often stem from Monetarily Exploitable Vulnerabilities (MEVuls), which refer to vulnerabilities arising from exploitable implementations in monetary transactions or value-transfer logic. Due to their complexity, intricate chains of function calls, multifaceted logic, and diverse manifestations across different smart contracts, MEVuls are particularly challenging for current security tools to identify. Instead of providing actionable insights, existing tools frequently generate excessive warnings that overwhelm developers without effectively mitigating risks. To address the challenge of recognizing MEVuls, we first formalize MEVuls based on common real-world financial exploits. Then, we introduce FAUDITOR, a specialized fuzzer designed to detect MEVuls in smart contracts. The key insight is that leveraging smart contracts' finance-related interfaces directly exposes critical vulnerabilities, making detection more targeted. We further integrate auditors' reports using NLP to extract valuable insights on exploitation patterns, enabling a more informed search strategy. Additionally, FAUDITOR employs a self-learning mechanism that refines its detection strategies over time, allowing it to improve based on prior fuzzing results. In our evaluation, FAUDITOR impressively reveals 220 zero-day MEVuls. Meanwhile, compared to existing fuzzers, FAUDITOR detects vulnerabilities faster and achieves better instruction coverage.
Smart contracts are critical to blockchain but face significant security challenges, where potential vulnerabilities can lead to financial losses and undermine system trustworthiness. Code obfuscation has emerged as a crucial technique for countering reverse engineering and enhancing contract security. However, existing methods suffer from three major limitations: (1) current bytecode obfuscation methods are primarily designed for traditional programming languages and cannot be directly applied to Solidity; (2) these methods exhibit limited resistance against advanced decompilation tools; and (3) they often result in high gas consumption. To this end, we propose BOSC , a novel bytecode obfuscation method that integrates four obfuscation strategies from both structural and semantic perspectives to enhance obfuscation effectiveness. Specifically, in structural perturbation, we adopt and refine incomplete instruction obfuscation and false branch obfuscation, while in semantic perturbation, we improve and employ instruction reordering obfuscation and flower instruction obfuscation. Experimental results demonstrate that BOSC significantly increases the decompilation failure rate from 6.06% to 96.4%, and raises cyclomatic complexity by 81.83%, providing robust protection against automated attacks. This improvement incurs only a modest additional gas cost of 1,792 gwei , which translates to an approximate expense of 0.33869 USD , thereby achieving a balance between obfuscation effectiveness and economic efficiency.
Rohith Singh, Mr. Charan Singh, Abdul Rashad, Md. Abdur Rasheed · 6 authors
Prompt injection is a foundational security vulnerability in large language models (LLMs) deployed as autonomous agents with tool access and multi-step reasoning capabilities. Existing defenses rely on heuristic filters that fail under obfuscation, indirect injection, and multi-agent propagation. We present a Unified Cryptographic-Control Architecture (UCCA), a principled framework that integrates five complementary guarantees: (1) information-theoretic leakage bounds derived via Fano's inequality, (2) certified robustness via randomized smoothing, (3) token-level rejection via erase-and-check, (4) runtime trajectory enforcement via control barrier functions (CBFs), and (5) verifiable inference via zero-knowledge proofs (ZK-SNARKs). We formally prove that any successful prompt injection attack must simultaneously bypass all five mechanisms, a condition we show has probability at most δ under stated assumptions. We evaluate UCCA on three real LLMs (GPT-4o, Claude 3.5 Sonnet, Mistral-7B) across four established attack benchmarks (INJECAGENT, TensorTrust, PromptBench, HarmBench), achieving attack success rates below 8% while maintaining median latency overhead under 340 ms. Our framework bridges formal security guarantees and deployable system architecture, establishing a foundation for provably secure autonomous AI. • Information-theoretic bounds on system prompt leakage using mutual information and Fano's inequality. • Certified robustness for safety-critical classification through randomized smoothing, where the robustness radius R is determined from output probability gaps. • Token-level rejection guarantees using an erase-and-check procedure capable of detecting adversarial subsets of size ≤ k. • Runtime safety enforcement through control barrier functions (CBFs), ensuring LLM outputs remain within a verified safe set. • Verifiable inference using ZK-SNARKs, allowing cryptographic attestation of model outputs without revealing model weights. • UCCA, a deployable system integrating all five mechanisms, evaluated on real LLMs and standard benchmarks.
Cross-chain bridges are critical for decentralized finance (DeFi) to enable asset interoperability across heterogeneous blockchains. They are based on a complex hybrid architecture that involves on-chain contracts and off-chain relayers. In the recent past, several major attacks exploited vulnerabilities in cross-chain bridges. However, existing analysis tools have limited detection effectiveness as they focus on individual contracts and do not capture the complex interaction chain in cross-chain bridges. In this paper, we present BridgeFuzz, the first fuzzing framework for cross-chain bridge developers capable of detecting vulnerabilities such as balance mismatches, protocol errors, and off-chain denial-of-service bugs. BridgeFuzz is the first step towards bridging the gap between smart contract vulnerability research and the holistic vulnerability analysis of cross-chain bridges.
Permission control vulnerabilities in Non-fungible token (NFT) contracts can result in significant financial losses, as attackers may exploit these weaknesses to gain unauthorized access or circumvent critical permission checks. In this paper, we propose NFTDELTA, a framework that leverages static analysis and multi-view learning to detect permission control vulnerabilities in NFT contracts. Specifically, we extract comprehensive function Control Flow Graph (CFG) information via two views: sequence features (representing execution paths) and graph features (capturing structural control flow). These two views are then integrated to create a unified code representation. We also define three specific categories of permission control vulnerabilities and employ a custom detector to identify defects through multi-view feature similarity analysis. Our evaluation of 795 popular NFT collections identified 241 confirmed permission control vulnerabilities, comprising 214 cases of Bypass Auth Reentrancy, 15 of Weak Auth Validation, and 12 of Loose Permission Management. Manual verification demonstrates the detector's high reliability, achieving an average precision of 97.92% and an F1-score of 81.09%. Furthermore, NFTDELTA demonstrates enhanced efficiency and scalability, proving its effectiveness in securing NFT ecosystems.
Smart contracts are a critical component of blockchain systems. Due to the large amount of digital assets carried by smart contracts, their security is of critical importance. Although numerous tools have been developed for detecting smart contract vulnerability, their effectiveness remains limited, particularly due to the high false positives included in the reported results. Therefore, developers and auditors are often overwhelmed with manually verifying the reported issues. A fundamental reason behind this is that while a reported vulnerability satisfies specific vulnerable patterns, it may not actually be exploitable, either because the vulnerable code cannot be triggered or it does not result in any financial loss. In this paper, we propose V2E, a new framework for validating whether a reported vulnerability is truly exploitable. The core idea of V2E is to automatically generate executable Proof-of-Concept Exploit (PoC for short), and then assess if the vulnerability could be triggered and incur any real damage (i.e., causing financial loss) by the PoC. While LLMs have shown proficiency in PoC generation, achieving our task is by no means trivial. In detail, it is difficult for LLM to: (1) generate and update PoC to trigger a specific vulnerability, (2) evaluate the PoC’s effectiveness to validate exploitable vulnerability. To this end, V2E automates the whole process through a novel combination of PoC generation, validation, and refinement: (1) Firstly, V2E generates targeted PoCs by analyzing potential vulnerability paths. (2) Then, V2E verifies the validity of PoCs through triggerability and profitability analysis. (3) In addition, V2E iteratively refines the generated PoC based on PoC execution feedback, therefore, increasing the chance to confirm the vulnerability. Evaluation on 264 manually labeled contracts shows that V2E outperforms the baseline approach. Particularly, V2E successfully identifies 102 out of 124 exploitable vulnerabilities, achieving a precision of 91.9% and a recall of 82.3%. In addition, it successfully eliminates 71 out of 140 false alarms (50.7%). Besides, V2E effectively enhances the performance of SOTA tools. It reduces the false positive rates of Slither by 76.9%, Mythril by 56.9% and Confuzzius by 65%.
Massimo Bartoletti, Angelo Ferrando, E. Lipparini, Vadim Malvone
Smart contracts deployed on blockchains such as Ethereum routinely manage large amounts of assets, making their security critical. Empirical studies show that real-world attacks often exploit flaws in the business logic of contracts that unfold across multiple transactions, such as liquidity or front-running attacks. Detecting these attacks requires reasoning about expressive temporal properties beyond the capabilities of existing analysis tools. In this paper, we present an automated approach to the formal verification of smart contracts, enabling the specification and verification of complex temporal properties. Our approach provides a fully automated encoding into Lustre -- the specification language supported by the Kind 2 model checker -- of an expressive subset of Solidity contracts and temporal specifications based on first-order Hennessy-Milner Logic. This encoding allows us to leverage Kind 2 to determine whether the contract respects the specification or not. We implement our approach in a toolchain that integrates the translation and verification steps, and we evaluate its effectiveness and performance on a benchmark of smart contracts and temporal properties capturing complex attack scenarios. Our results show that the proposed approach can effectively verify non-trivial temporal properties of smart contracts and detect violations that are beyond the reach of existing analysis tools.
With the help of pact technology, a program that has been developed, the smart contract can take place between two or more entities without any third-party actor. Although smart contracts provide transparency and efficiency, security flaws in smart contracts have resulted in costly attacks, including re-entrancy, integer overflows, and access control violations. Current tools for intelligent contract verification, such as Mythril, Oyente, and Securify, mainly apply symbolic execution, taint analysis, and pattern matching to identify vulnerabilities. However, these tools have many false positives, take a lot of time to execute, and don't scale efficiently with large numbers of contracts. In this context, the paper presents VeriChain. This formal verification framework combines Control Flow Graph (CFG) analysis, symbolic execution, and static analysis to improve vulnerability detection and tackle the challenges above. VeriChain systematically constructs the contract’s Control Flow Graph (CFG), explores CFG execution paths with symbolic execution, and employs a set of rules for performing rule-based static analysis that can uncover vulnerabilities. Using CFG-based dependency tracking, VeriChain achieves enhanced analysis of dependencies among functions and coverage of execution paths, thereby reducing the number of false positives while achieving accurate detection results. The experimental results show that VeriChain obtains 98.3% detection accuracy, higher than Mythril, Oyente, and Securify. Compared to existing tools, VeriChain has a much lower false-positive rate (1 false alarm) and a much faster execution time (Running in only 2.3 seconds). This framework gives a structured security assessment by categorizing the vulnerabilities according to severity and execution traces, ensuring that the smart contracts are accessed under heavy security verification pre-deployment. With its ability to accomplish highly accurate results efficiently whilst providing structured ways to report on security, VeriChain will be an influential component in delivering safe, innovative contract launches to decentralized applications for blockchain developers and security analysts.