This paper introduces a methodology for software vulnerability detection that combines structural and semantic analysis through software metrics and topic modelling. We evaluate the approach using smart contracts as a case study, focusing on their structural properties and the presence of known security vulnerabilities. We identify the most relevant metrics for vulnerability detection, evaluate multiple machine learning classifiers for both binary and multi-label classification, and improve classification performance by integrating topic modelling techniques. Our analysis shows that metrics such as cyclomatic complexity, nesting depth, and function calls are strongly associated with vulnerability presence. Using these metrics, the Random Forest classifier achieved strong performance in binary classification (AUC: 0.982, accuracy: 0.977, F1-score: 0.808) and multi-label classification (AUC: 0.951, accuracy: 0.729, F1-score: 0.839). The addition of topic modelling using Non-Negative Matrix Factorization further improved results, increasing the F1-score to 0.881. The evaluation is conducted on Ethereum smart contracts written in Solidity.
Machine Learning (ML) models are increasingly deployed to detect fraudulent activities in Ethereum, where phishing and scamming attacks pose serious security risks. Despite their promise, these models remain susceptible to adversarial manipulations. In this article, we present a comprehensive evaluation of ML-based Ethereum phishing detectors under a spectrum of adversarial perturbations. Our study examines multiple classifiers, including Random Forest, Decision Tree, K-Nearest Neighbors, Graph Neural Networks, and XGBoost, against rule-based, gradient-based, and black-box adversarial attacks. We conduct detailed feature-level analyses to identify transaction attributes most vulnerable to manipulation, and we evaluate the comparative robustness of classifiers under both targeted and untargeted attack scenarios. To strengthen model resilience, we assess mitigation techniques such as adversarial training and randomized smoothing, demonstrating their effectiveness in improving robustness without significant performance degradation.
George Chidera Akor, Love Allen Chijioke Ahakonye, Jae Min Lee, D. Kim
The increasing use of AI-powered tools for smart contract security audits presents a critical challenge: ensuring the integrity and provenance of audit reports. Traditional methods lack cryptographic guarantees linking audit outputs to specific AI models and source code, creating vulnerabilities to tampering and misattribution. To address this, we propose ProvAuditChain, a gas-efficient, hybrid on-chain/off-chain framework that records immutable provenance of AI-driven audit reports on Layer 2 blockchain networks. ProvAuditChain utilizes lightweight smart contracts to securely anchor cryptographically signed audit report hashes on-chain, while storing the complete reports on decentralized IPFS storage. We deploy the system on the Arbitrum Sepolia testnet and benchmark gas consumption, latency, and throughput across 600 audit cycles. Our results demonstrate a stable average gas cost of approximately 173,000 per audit, equivalent to roughly $0.05 USD, alongside a throughput of nearly six audits per minute. These findings confirm the practical viability of ProvAuditChain for integration into automated CI/CD pipelines, providing a scalable foundation for trustworthy AI accountability in decentralized ecosystems.
Smart contracts have emerged as key components within decentralized environments, enabling the automation of transactions through self-executing programs. While these innovations offer significant advantages, they also present potential drawbacks if the smart contract code is not carefully designed and implemented. This paper investigates the capability of large language models (LLMs) to detect OWASP-inspired vulnerabilities in smart contracts beyond the Ethereum Virtual Machine (EVM) ecosystem, focusing specifically on Solana and Algorand. Given the lack of labeled datasets for non-EVM platforms, we design a synthetic dataset of annotated smart contract snippets in Rust (for Solana) and PyTeal (for Algorand), structured around a vulnerability taxonomy derived from OWASP. We evaluate LLMs under three configurations: prompt engineering, fine-tuning, and a hybrid of both, comparing their performance on different vulnerability categories. Experimental results show that prompt engineering achieves general robustness, while fine-tuning improves precision and recall on less semantically rich languages such as TEAL. Additionally, we analyze how the architectural differences of Solana and Algorand influence the manifestation and detectability of vulnerabilities, offering platform-specific mappings that highlight limitations in existing security tooling. Our findings suggest that LLM-based approaches are viable for static vulnerability detection in smart contracts, provided domain-specific data and categorization are integrated into training pipelines.
José Luis Sampietro Saquicela, Leandro Alexander Bermúdez Herrera, Raúl Clemente Ulloa de Souza, Jaime Rafael Bastidas Heredia · 6 authors
Smart contracts are self-executing digital agreements deployed on blockchain platforms, where ensuring security is crucial due to their immutable nature. Understanding token-level semantics plays a key role in identifying potential vulnerabilities in these contracts. However, existing methods often rely on rule-based or syntax-level analysis, which struggle to capture the deeper semantic patterns that lead to complex vulnerabilities. To address these limitations, this study proposes a framework called Fine-Tuning CodeBERT (FTC-BERT), which integrates CodeBERT's pretrained transformer capabilities with task-specific fine-tuning to automatically detect and highlight vulnerabilities in smart contract Integrated Development Environments (IDEs). This method analyzes token-level semantics, enabling precise detection and contextual understanding of vulnerabilities. Developers can use this framework directly within IDEs for real-time vulnerability alerts and suggestions. Experimental results demonstrate that FTC-BERT significantly improves detection accuracy and recall over traditional methods, offering an efficient, automated, and semantic-aware solution for smart contract vulnerability detection.
Ziyang Liu, Kenneth MacKenzie, Roman Kireev, Michael Peyton Jones · 6 authors
The Cardano blockchain is the first to use proof of stake, offers native support for multiple currencies and is evolving toward a distributed governance model. It supports smart contracts through Plutus, a language based on System Fω with recursion. About half a dozen languages compile into Plutus, the first of which is Plinth (formerly Plutus Tx) — a language that reuses a subset of the Haskell syntax, and has been in commercial use since 2021.
The evolution of 5G and emerging 6G networks has introduced unprecedented opportunities for connectivity, but also expanded the attack surface for Distributed Denial of Service (DDoS) amplification attacks. Service-Based Architecture (SBA), network slicing, and massive IoT (mMTC) environments create new vectors for reflection and amplification, making conventional defenses inadequate. This paper proposes a novel layered defense framework that integrates edge filtering, AI-driven anomaly detection, slice isolation, cloud scrubbing, and quantum-safe cryptography to mitigate DDoS amplification attacks in 5G/6G environments. The framework is theoretically modeled through equations for amplification, mitigation efficiency, resilience, and defense cost, and evaluated experimentally using simulated signaling floods, IoT-driven amplification, slice-targeted floods, and hybrid attacks. Performance was measured using detection rate, false alarm rate, service availability, resilience score, and resource overhead. Two algorithms—pseudonymous authentication with zero-knowledge proof (ZKP) and layered mitigation orchestration—were implemented to operationalize the defense strategy. The results demonstrate that the proposed framework achieves a detection accuracy of 95–97%, reduces false positives to 2%, and maintains a service availability of over 85% under prolonged amplification attacks. It scales efficiently in scenarios with up to 10,000 simulated IoT devices, retaining 70–80% throughput, and maintains URLLC latency below 10 ms, outperforming baseline defenses (firewalls, scrubbing, and AI-only) and state-of-the-art defenses from the literature. These findings validate the framework as a scalable, efficient, and future-ready solution for mitigating amplification attacks in 5G/6G networks, with strong alignment with 3GPP, GSMA, and NIST post-quantum standards.
Open access
Advanced Malware Detection Techniques
Network Security and Intrusion Detection
Physical Unclonable Functions (PUFs) and Hardware Security
Blockchain technology has created a major transformation in the digital world with features such as decentralization, security, transparency, and traceability. Emerging with Nakamoto's introduction of Bitcoin in 2009, this technology finds applications in various sectors, primarily finance, supply chain, healthcare, and public services. The fundamental principles of blockchain are based on elements such as hashing, distributed ledger technology (DLT), and consensus mechanisms. Innovative technologies such as smart contracts and side chains increase the potential of this system. Cryptocurrencies are an application area of blockchain technology and come across different types such as bitcoin, altcoins, and NFTs. APIs facilitate software development processes and enable integrating systems with blockchain. In the investigative phases, blockchain traceability provides a significant advantage in solving crimes like crypto fraud. This study aims to automate the manual tracking of crypto-related criminal transactions by implementing an algorithm based on the FIFO principle.
The unique International Mobile Equipment Identity (IMEI) number is essential for identifying mobile devices and blacklisting stolen ones within networks. Current solutions are limited to local blacklists and lack a global mechanism for information exchange among operators. Efforts by the Global System for Mobile Communications Association (GSMA) to implement a common blacklist have been constrained by costs, resulting in fragmented and ineffective IMEI management systems. To address these challenges, we have developed a blockchain-based framework that uses the decentralized consensus and tamper-proof nature of distributed ledger technology to enable a unified and globally accessible IMEI blacklist. The framework is implemented on a permissioned blockchain deployed on the Sepolia testnet, utilizing the Proof of Authority (PoA) consensus mechanism to ensure fast and secure validation in a multi-stakeholder environment. Our solution includes a Decentralized Application (DApp) for user interaction, with smart contracts deployed using a Web3 wallet and connected via the Alchemy API to enable efficient communication between the front end and blockchain. Smart contracts automate device status verification, theft reporting, and transaction recording, enhancing transparency, accountability, and security in mobile device management. To validate IMEI numbers, the system uses the Luhn algorithm, a widely accepted checksum method. The framework also collaborates with law enforcement and insurance companies to improve theft verification and claims processing. Experimental results demonstrate the framework's scalability, achieving low latency of under 1 second at transaction rates up to 1,000 TPS and reducing transaction processing time by 30% compared to a traditional centralized database-based system. Performance outcomes were validated through 30 independent test runs to account for variability, underscoring the framework's robustness and potential for widespread adoption. These results set a new standard for global mobile device security through industry-wide collaboration.
With the advent of Web3, there has been an unprecedented number of smart contracts being executed on decentralized networks like Bitcoin and Ethereum. While recent studies offer vulnerability detection frameworks and mitigation recommendations, little research addresses the pipeline from vulnerability detection to meaningful patch generation. We introduce VulnPatch, a generalized smart contract auditing and patching framework that employs multiple, fine-tuned LLM agents with distinct roles: detecting vulnerable functions, explaining their causes, and generating patched code. We have demonstrated empirically that having these sub-tasks delegated to different agents significantly improves performance across these sub-tasks rather than having one single agent that will handle all the tasks together. VulnPatch operates in three stages: first, fine-tuning the LLM on vulnerable and safe Solidity contracts; second, pinpointing vulnerability causes; and third, producing a report detailing vulnerable code and corresponding patches. Compared to state-of-the-art LLMs, VulnPatch achieves $\mathbf{9 3. 3 \%}$ accuracy and F1 score, generating reports for 84.44% of vulnerabilities, with explanations and patches showing $90 \%$ sound reasoning and $84 \%$ patch validity.
With the development of science and technology, the Internet of Things (IoT) had been integrated into the daily life of people. That makes the security of IoT a necessity and gains more attention. The Device authentication is an important issue in the security of IoT. In this paper, we propose a device authentication scheme based on both Physically Unclonable Function (PUF) and zero-knowledge proof. The proposed mutual authentication scheme reduces the memory load on the server and provides both data integrity and confidentiality during the authenticating process. We verify the proposed device authentication algorithm on the IoT platform Raspberry Pi using SRAM-PUF. The experimental results reveal that the proposed device authentication scheme is novel for IoT. It can resist brute force attack, replay attack, man-in-the-middle attack, machine learning attacks, and etc.
Physical Unclonable Functions (PUFs) and Hardware Security
Bug reproduction is becoming an important task in the security analysis of Solidity smart contracts. By simulating attacks, developers and auditors can better understand how a vulnerability is triggered in practice. To reproduce a bug, one often needs to define an attacker contract and a specific sequence of interactions that exploit the vulnerability. However, in smart contracts, there are rarely automated tools that can generate such contracts and sequences and validate their correctness. Existing security tools, such as formal verifiers, are effective at detecting bugs, but they are not designed for bug reproduction. They often omit execution traces or produce incomplete ones. Moreover, their reports rarely reflect the behaviour patterns of attacker contracts. This gap motivates our work. We propose VeriExploit, a framework that combines formal methods and large language models to automatically generate, validate, and refine reproduction contracts and execution steps. Given a vulnerable contract and its counterexample, VeriExploit produces a contract that re-triggers the same bug and outputs a concrete trace showing how the exploit works. Experiments show that VeriExploit is effective at automating bug reproduction, achieving a success rate of 85.60% on our benchmark dataset.
Smart contracts power a vast array of blockchain applications, securing billions of dollars on decentralized finance, but their immutable nature turns every vulnerability into a permanent exploitable liability. Although automated security tools can efficiently detect many issues, their high false positive rates and lack of trust still require manual audits, which are costly and introduce deployment delays. In this paper, we present an end to end AI augmented auditing framework that leverages a multi-agent pipeline for comprehensive vulnerability detection and automated exploit generation. First, we review existing approaches such as static analysis, fuzzing, symbolic execution, formal verification, and machine learning methods, highlighting their strengths, limitations, and real world deployment experience. Building on this survey, we introduce a multi agent architecture composed of a Distributor Agent, an Attack Planner Agent, an Exploit Generator Agent, and an Audit Report Generator Agent. The pipeline ingests smart contract source code, documen-tation, and test suites to outline stepwise attack strategies and synthesize ready to compile Solidity exploit code. Exploits are compiled and validated in a containerized environment, enabling automated verification of attack effectiveness. We outline a validation strategy for future work, more specifically, applying the pipeline to capture the flag challenges and online bug bounty platforms, and we describe plans for prompt fine tuning, retrieval augmented generation, and formal verification integration to further enhance detection accuracy and exploit reliability. Our proposed framework promises a more comprehensive, scalable, and cost effective approach to smart contract security verification.
Omar Jarkas, Ryan K. L. Ko, Naipeng Dong, Redowan Mahmud
Integrity verification and attestation are critical in containerized environments, where traditional Linux Integrity Measurement Architecture (IMA) falls short due to its lack of container-specific contextualization. These gaps undermine container autonomy, escalate privacy risks, and impede granular integrity checks. Addressing these challenges, this paper introduces the Virtual IMA (VIMA), a novel framework that refines Linux IMA’s principles to support containerized settings. Using nested Merkle trees, VIMA’s Two-Tree Architecture (2TA) enables detailed integrity assessments across system-wide monolithic trees and individual container trees. Integrating Merkle and zero-knowledge (ZK) proofs establishes VIMA as a secure, privacy-preserving verification and attestation solution. Our comparative analysis and initial prototype testing reveal that VIMA significantly improves upon traditional IMA with minimal performance overhead, offering substantial scope for optimization.
Ethereum smart contracts hold tens of billions of USD in DeFi and NFTs, yet comprehensive security analysis remains difficult due to unverified code, proxy-based architectures, and the reliance on manual inspection of complex execution traces. Existing approaches fall into two main categories: anomaly transaction detection, which flags suspicious transactions but offers limited insight into specific attack strategies hidden in execution traces inside transactions, and code vulnerability detection, which cannot analyze unverified contracts and struggles to show how identified flaws are exploited in real incidents. As a result, analysts must still manually align transaction traces with contract code to reconstruct attack scenarios and conduct forensics. To address this gap, TraceLLM is proposed as a framework that leverages LLMs to integrate execution trace-level detection with decompiled contract code. We introduce a new anomaly execution path identification algorithm and an LLM-refined decompile tool to identify vulnerable functions and provide explicit attack paths to LLM. TraceLLM establishes the first benchmark for joint trace and contract code-driven security analysis. For comparison, proxy baselines are created by jointly transmitting the results of three representative code analysis along with raw traces to LLM. TraceLLM identifies attacker and victim addresses with 85.19\% precision and produces automated reports with 70.37\% factual precision across 27 cases with ground truth expert reports, achieving 25.93\% higher accuracy than the best baseline. Moreover, across 148 real-world Ethereum incidents, TraceLLM automatically generates reports with 66.22\% expert-verified accuracy, demonstrating strong generalizability.
With the shift from Centralized Finance (CeFi) to Decentralized Finance (DeFi), financial transactions have become trustless and self-executing through blockchain platforms, creating new opportunities while exposing the ecosystem to significant fraud risks. However, due to the lack of centralized oversight and the vulnerabilities in the blockchain platforms, DeFi transactions still face several security challenges, including fraud, identity theft, insider threats, and data breaches. Various methods, including regulatory frameworks, machine learning (ML), and deep learning (DL) techniques, are employed to detect these threats, particularly fraud, in DeFi transactions. Although these approaches help identify fraudulent activities, they face challenges related to accuracy and zero-day attacks due to insufficient data and the complexity of emergingfraud patterns. This study presents a novel approach for detecting and profiling fraud attacks, including zero-day ones in DeFi transactions, thereby eliminating the reliance on wallet transaction history, a limitation that previous research has heavily depended on. The proposed approach leverages two key components: a novel analyzer named DeFiTransLyzer (V1.0) and an Advanced Genetic Algorithm (AGA) for fraud transaction profiling. DeFiTransLyzer extracts 79 features from transaction and wallet data. At the same time, the AGA incorporates advanced techniques, including Penalized Fitness Evaluation, Elite Retention Strategy, Dynamic Mutation Rate, and dynamic generation, to create precise fraud profiles. By focusing solely on transaction features, the model ensures that all fraudulent activities, including zero-day ones, initiated within the first transaction of a new account can be effectively detected, without relying on prior wallet activity. To address the scarcity of comprehensive validation datasets, we introduce BCCCDeFiFraudTrans-2025, which comprises 1,026,867 annotated Ethereum transaction samples from the DeFi ecosystem. Additionally, the study establishes two taxonomies for systematic classification, covering the literature on fraud detection and profiling methods. Experimental results demonstrate that the proposed method achieves superior accuracy, precision, and efficiency while offering interpretability through its profiling mechanism. These promising outcomes highlight the potential of AGA profiling to enhance the detection and identification of fraudulent activities, including zero-day ones within DeFi transactions, contributing to the security and resilience of blockchainbased financial systems.
Ziwei Li, Jiajing Wu, Zhiying Wu, D. Tan · 9 authors
Smart contracts are self-executing computer programs on blockchains. With the development of blockchain technology, the number of smart contracts has grown rapidly, as has the concern for their security. Regrettably, inconsistencies between the logic implemented in the code and the intentions described in the comments, known as Code–Comment Inconsistencies (CCI), are frequently present in some smart contracts. These inconsistencies can mislead readers in understanding the contract code and, in severe cases, may lead to vulnerabilities and economic losses. Existing learning-based methods are not tailored for smart contract languages, overlook the issue of insufficient context information caused by comment references and nested intentions, and rely on large-scale labeled data; whereas rule-based methods struggle to accommodate the flexibility with which developers express intentions, often resulting in false positives. To tackle the challenges posed by insufficient context information and the scarcity of labeled data, we introduce CCIHunter, a tool designed to detect CCIs in smart contracts. CCIHunter addresses the issue of insufficient context information during data modeling and incorporates a two-stage pre-training process that does not depend on labeled data to enhance its detection capabilities. Specifically, CCIHunter enhances comments based on templates and models code as a heterogeneous graph based on function calls. It utilizes CodeBERT and UniMp to generate embeddings for comments and code, respectively, and then calculates the similarity between these two embeddings. Consistency is judged by combining code embeddings, comment embeddings, and similarity scores. Notably, CCIHunter undergoes a two-stage pre-training that includes contrastive learning and mutation analysis, aiming to improve its ability to bridge the gap between code and comments and to focus on code elements at different granularities. Experimental results demonstrate that CCIHunter achieves a precision of 0.95, a recall of 0.90, and an F1 score of 0.93, outperforming existing tools.
Youwei Huang, Jianwen Li, Bin Hu, Sen Fang · 6 authors
Malicious developer intents in smart contracts constitute significant security threats to decentralized applications, leading to substantial economic losses. Prior work introduced SmartIntentNN, a deep learning model for detecting unsafe developer intents. By combining the Universal Sentence Encoder, a K-means clustering-based intent highlighting mechanism, and a Bidirectional Long Short-Term Memory (BiLSTM) network, the model achieved an F1 score of 0.8633 on an evaluation set of 10,000 real-world smart contracts across ten distinct intent categories. This paper presents SmartIntentV2 (Smart Contract Intent Neural Network Version 2). The primary enhancement is the integration of a BERT-based pre-trained programming language model, which we domain-adaptively pre-train on a dataset of 16,000 real-world smart contracts using a Masked Language Modeling objective. SmartIntentV2 retains the BiLSTM-based multi-label classification network for intent detection. On the same evaluation set of 10,000 smart contracts, it achieves superior performance with an accuracy of 0.9789, precision of 0.9090, recall of 0.9476, and an F1 score of 0.9279, substantially outperforming its predecessor and other baseline models. Notably, SmartIntentV2 also delivers a 65.5% relative improvement in F1 score over GPT-4.1 on this specialized task. These results establish SmartIntentV2 as a new state-of-the-art model for smart contract intent detection.
The Ethereum platform is booming with growing richness and variety in decentralized finance (DeFi) products. However, this progress comes with sophisticated threats, such as sandwich attacks, where attackers exploit the openness and certainty of blockchain technology to manipulate market prices and secure illegal financial rewards through a strategically planned series of transactions. The existing sandwich attack detection methods are ineffective at detecting multi-token transactions and fail to identify multi-token sandwich attacks. To tackle this challenge, this study improves the original detector’s algorithm to identify both traditional single-token and multi-token sandwich attacks. The enhanced system is not only responsive and accurate but also capable of detecting and alerting potential multi-token sandwich attacks. It has been successfully integrated with the go-Ethereum client (Geth). The system is performance-optimized with an average processing time of 0.81 seconds per block and an accuracy rate of 96.17%. The response time for detecting new blocks in real-time is usually no more than 4 seconds, with most between 2 and 3 seconds, which meets practical application requirements. By carefully analyzing the transaction data flow, this system is not only able to identify the traditional front-running attack and sandwich attack, but also extends to multi-currency complex attack strategies. The core innovation lies in the system’s ability to accurately detect and provide early warnings of multi-token sandwich attacks through real-time analysis of in-block transactions, all while maintaining the overall operational efficiency of the node.
Hash functions are fundamental components in both cryptographic and non-cryptographic systems, supporting secure authentication, data integrity, fingerprinting, and indexing. While the Ascon family, selected by the National Institute of Standards and Technology (NIST) in 2023 for lightweight cryptography, has been extensively evaluated in its authenticated encryption mode, its hashing and extendable-output variants, namely Ascon-Hash256, Ascon-XOF128, and Ascon-CXOF128, have not received the same level of empirical attention. This paper presents a structured benchmarking study of these hash variants using both the SMHasher framework and custom Python-based simulation environments. SMHasher is used to evaluate statistical and structural robustness under constrained, patterned, and low-entropy input conditions, while Python-based experiments assess application-specific performance in Bloom filter-based replay detection at the network edge, Merkle tree aggregation for blockchain transaction integrity, lightweight device fingerprinting for IoT identity management, and tamper-evident logging for distributed ledgers. We compare the performance of Ascon hashes with widely used cryptographic functions such as SHA3 and BLAKE2s, as well as high-speed non-cryptographic hashes including MurmurHash3 and xxHash. We assess avalanche behavior, diffusion consistency, output bias, and keyset sensitivity while also examining Ascon-XOF's variable-length output capabilities relative to SHAKE for applications such as domain-separated hashing and lightweight key derivation. Experimental results indicate that Ascon hash functions offer strong diffusion, low statistical bias, and competitive performance across both cryptographic and application-specific domains. These properties make them well suited for deployment in resource-constrained systems, including Internet of Things (IoT) devices, blockchain indexing frameworks, and probabilistic authentication architectures. This study provides the first comprehensive empirical evaluation of Ascon hashing modes and offers new insights into their potential as lightweight, structurally resilient alternatives to established hash functions.
Blockchain address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history, which aims to deceive victims and lure them into mistakenly transferring funds to the attacker. Recent works have shown that millions of Ethereum users were targeted and lost over 100 million US dollars. Ethereum crypto wallets, serving users in browsing transaction history and initiating transactions to transfer funds, play a central role in deploying countermeasures to mitigate the address poisoning attack. However, whether they have done so remains an open question. To fill the research void, in this paper, we design experiments to simulate address poisoning attacks and systematically evaluate the usability and security of 53 popular Ethereum crypto wallets. Our evaluation shows that there exist communication failures between 12 wallets and their transaction activity provider, which renders them unable to download the users' transaction history. Besides, our evaluation also shows that 16 wallets pose a high risk to their users due to displaying fake token phishing transfers. Moreover, our further analysis suggests that most wallets rely on transaction activity providers to filter out phishing transfers. However, their phishing detection capability varies. Finally, we found that only three wallets throw an explicit warning message when users attempt to transfer to the phishing address, implying a significant gap within the broader Ethereum crypto wallet community in protecting users from address poisoning attacks. Overall, our work shows that more efforts are needed by the Ethereum crypto wallet developer community to achieve the highest usability and security standard. Our bug reports have been acknowledged by the developer community, who are currently developing mitigation solutions.