Due to the inherent immutability of blockchain technology, smart contract updates require their deployment at new addresses rather than modifying existing ones, thus fragmenting version histories and creating critical blind spots for analyses. Indeed, for example, this fragmentation severely hinders security researchers ability to track vulnerability lifecycles across contract versions. While platforms like Etherscan provide detailed information about Ethereum smart contracts, they lack crucial functionality to trace predecessor-successor relationships within smart contract lineages, preventing systematic analysis of how vulnerabilities emerge, propagate, and potentially remain unresolved across versions.To address the challenge of tracing smart contract lineages, we adopt a Design Science Research (DSR) approach and introduce ContractTrace, an automated infrastructure that accurately identifies and links versions of smart contracts into coherent lineages. This tool enables the construction of lineageSet, an up-to-date, open-source dataset specifically designed to support security research on vulnerability, defect or any other property evolution patterns in smart contracts. Through a security-focused case study we demonstrate how ContractTrace reveals previously obscured vulnerability life-cycles within smart contract lineages, tracking whether critical security flaws persist or get resolved across versions. This capability is essential for understanding vulnerability propagation patterns and evaluating the effectiveness of security patches in blockchain environments. In the evaluation phase of our DSR approach, we validated our lineage detection methodology against an alternative approach using Locality-Sensitive Hashing (LSH) to cluster contract versions, confirming the security relevance and accuracy of our technique.
Sepideh HajiHosseinKhani, Arash Habibi Lashkari, Ali Mizani Oskui
With the advent of blockchain networks, there has been a transition from traditional contracts to Smart Contracts (SCs), which are crucial for maintaining trust within these networks. Previous methods for analyzing SCs vulnerabilities typically suffer from a lack of accuracy and effectiveness. Many of them, such as rule-based methods, machine learning techniques , and neural networks , also struggle to detect complex vulnerabilities due to limited data availability. This study introduces a novel approach to detecting, identifying, and profiling SC vulnerabilities, comprising two key components: an updated analyzer named SCsVulLyzer (V2.0) and an advanced Genetic Algorithm (GA) profiling method. The analyzer extracts 240 features across different categories, while the enhanced GA, explicitly designed for profiling SC vulnerabilities, employs techniques such as penalty fitness function, retention of elites, and adaptive mutation rate to create a detailed profile for each vulnerability. Furthermore, due to the lack of comprehensive validation and evaluation datasets with sufficient samples and diverse vulnerabilities, this work introduces a new dataset named BCCC-SCsVul-2024. This dataset consists of 111,897 Solidity source code samples, ensuring the practical validation of the proposed approach. Additionally, three types of taxonomies are established, covering SC literature review, profiling techniques, and feature extraction. These taxonomies offer a systematic classification and analysis of information, enhancing the efficiency of the proposed profiling technique. Our proposed approach demonstrated superior capabilities with higher precision and accuracy through rigorous testing and experimentation. It not only showed excellent results for evaluation parameters but also proved highly efficient in terms of time and space complexity. Moreover, the concept of the profiling technique makes our model highly transparent and explainable. These promising results highlight the potential of GA-based profiling to improve the detection and identification of SC vulnerabilities, contributing to enhanced security in blockchain networks.
This research proposes two data collection methods, Whole Observation Data (WOD) and 7 Days (7D), for identifying rug-pull risks within ERC-20 smart contracts deployed on the Ethereum blockchain. The WOD method offers a comprehensive, long-term analysis of token activity, while the 7D method focuses on a shorter time frame to detect emerging fraudulent behaviors. Through rigorous experimentation and evaluation, this research demonstrates both methods' reliability, applicability, and predictive capabilities. The findings contribute to a deeper understanding of rug-pull risks and provide valuable insights for developing robust countermeasures to protect in-vestors and maintain the integrity of the cryptocurrency market.
Piotr Manikowski, Weronika Szymczak-Łączna, Bojan Srbinoski
This article concerns the possibilities of insuring cryptocurrency wallets using various assumptions and characteristics of perfectly insurable risk. The main goal of this article is to examine if and how cryptocurrency wallets risk fulfils the requirements of an ideally insurable risk. The topic of the research is important looking at the newest trends in financial markets and the growing number of cryptocurrency investors. The paper presents authors’ innovative method of approaching a part of cryptocurrency risk to insurance industry. Authors analysed requirements of an insurable risk and applied these requirements to a specific risk, i.e. the cryptocurrency wallet risk to further check if it is possible to insure such a risk. By introducing and defining cryptocurrency wallet risk, we found an element of cryptocurrencies which shows traits of a non-speculative risk and possibly fulfils insurability characteristics.
Blockchain technology has emerged as a pivotal solution for enhancing security in financial transactions through its decentralized architecture. Traditional financial systems are often vulnerable to fraud, data breaches, and single points of failure due to centralization. Blockchain, with its distributed ledger system, ensures transparency, immutability, and security by verifying transactions across a network of nodes without relying on a central authority. This decentralized approach mitigates the risks associated with centralized databases, such as hacking or unauthorized access. Blockchain’s cryptographic algorithms safeguard transaction integrity and protect sensitive financial information. Smart contracts automate processes, reducing human error and the need for intermediaries, thereby increasing efficiency while lowering operational costs. Despite its benefits, challenges remain, including scalability issues, regulatory hurdles, and energy consumption. As blockchain technology continues to evolve, it holds the potential to revolutionize financial transactions, offering a robust, secure, and transparent framework for future financial systems. This paper explores the mechanisms behind blockchain security and its impact on modern financial infrastructures.
The immutability of blockchain systems makes the security of smart contracts particularly critical. This study presents SELLM, a novel smart contract vulnerability detection tool that integrates symbolic execution with large language models. SELLM leverages symbolic execution to identify vulnerability-prone paths, extracting control flow data, call sequences, and variable constraints, which are then structured into optimized prompts for LLM analysis. Experimental results using the SmartBugs dataset demonstrate that SELLM substantially outperforms baseline methods in terms of precision and recall, achieving a recall of 90.5% and precision of 89.4% with GPT-4o, particularly excelling in detecting vulnerabilities like arithmetic overflow, bad randomness, and reentrancy.
This paper proposes a cutting-edge vulnerability detection method for smart contracts, combining Transformer-based embeddings and Graph Neural Networks (GNNs). Critical opcodes are identified and dynamically weighted using attention mechanisms, enhancing feature representation. The GNN captures both relational patterns and critical opcode characteristics, enabling robust detection of vulnerabilities. Experimental results show significant improvements in F1-scores for both binary and multi-class detection tasks, outperforming traditional models like LightGBM. This approach leverages modern AI advancements to address challenges in accuracy and generalization, providing a scalable and effective solution for smart contract analysis.
Smart Contracts (SCs) handle transactions in the Ethereum blockchain worth\nmillions of United States dollars, making them a lucrative target for attackers\nseeking to exploit vulnerabilities and steal funds. The Ethereum community has\ndeveloped a rich set of tools to detect vulnerabilities in SCs, including\nreentrancy (RE) and unhandled exceptions (UX). A dataset of SCs labelled with\nvulnerabilities is needed to evaluate the tools' efficacy. Existing SC datasets\nwith labelled vulnerabilities have limitations, such as covering only a limited\nrange of vulnerability scenarios and containing incorrect labels. As a result,\nthere is a lack of a standardized dataset to compare the performances of these\ntools. SCRUBD aims to fill this gap. We present a dataset of real-world SCs and\nsynthesized SCs labelled with RE and UX. The real-world SC dataset is labelled\nthrough crowdsourcing, followed by manual inspection by an expert, and covers\nboth RE and UX vulnerabilities. On the other hand, the synthesized dataset is\ncarefully crafted to cover various RE scenarios only. Using SCRUBD we compared\nthe performance of six popular vulnerability detection tools. Based on our\nstudy, we found that Slither outperforms other tools on a crowdsourced dataset\nin detecting RE vulnerabilities, while Sailfish outperforms other tools on a\nmanually synthesized dataset for detecting RE. For UX vulnerabilities, Slither\noutperforms all other tools.\n
Mohideen AbdulKader M, Kalaichelvi Nallusamy, Jebamalar, Zulaiha Maryam M
In the field of financial technology, the creation of an automated decision system for the decentralized execution of stock market operations is a noteworthy development. The challenges of the generic approach, such as transparency, security, and efficiency in stock trading, are effectively solved with the help of predicting analytics combined with smart contracts based on blockchain technology. In this research, a Blockchain Smart Contract Adoption with Quaternion Generative Adversarial Networks, (BSCA-QGAN), is presented for decentralized stock market prediction over Yahoo Finance data. The first pre-processing is data cleaning and normalization of data collected and then feature extraction is done by the Spike Driven Transformer (SDT) which is the integration of Transformers and Spiking Neural Networks. Also, the Quaternion Generative Adversarial Networks (QGANs) forecast the stock prices whereby time series with built-in quaternion math is modelled. The QGAN's hyperparameters are optimized using the White Shark Optimizer (WSO). An automated decision system for decentralized stock markets is integrated with blockchain smart contracts. The system achieved 99.72% prediction accuracy and minimal memory usage of 10MB.
Mohamed A. Saleh, Ahmed M. Eassa, Yasmine M. Ragab
Financial restatements pose a significant problem for companies and stakeholders. Accurate financial information is therefore critical to decision making, and preventing restatements is vital to maintaining the confidence of shareholders, investors, and other stakeholders. In this paper, a quantitative study utilizing a survey to determine the causes and consequences of the financial restatements applied to the Egyptian context. Based on the survey’s results, a proposed architecture was presented to detect and prevent financial restatements using blockchain-based smart contracts. The proposed architecture is implemented based on Remix - Ethereum IDE, with a consortium blockchain, and it consists of three layers, which are the presentation layer, detection and prevention layer, and blockchain layer. All layers are integrated using APIs to detect and prevent restatement caused by accounting errors, reclassification of accounting items, and intentional misstatement, and to inform all various stakeholders of any detected cases. The proposed implemented architecture is tested by a sample of data collected from some Egyptian list companies. According to testing results, it can work in real environments with an accuracy rate of up to 97.5%. The findings of this study are pertinent to listed companies, shareholders, investors, banks, credit institutions, and other stock market regulators, as financial restatements negatively affect a company’s credibility in its financial reporting. The findings extend both the literature on the role of blockchain technology in preventing financial restatements and the literature on experimentally implementing blockchain technology in the Egyptian context.
Ahsan Adeleke Akoshile, Olamide Jogunola, Mohammad Hammoudeh, Tooska Dargahi
Recent research has exposed significant security vulnerabilities within smart contracts that run on blockchain.Threats, such as, reentrancy attacks, where malicious actors exploit recursive function calls in a smart contract, pose a critical threat.This led to substantial financial losses in organisations.Traditional vulnerability detection methods, largely based on static analysis, showed limitations in effectively identifying reentrancy issues, often yielding high false positive rates and missing complex execution paths.This paper analyses hybrid deep learning models for reentrancy vulnerability detection in Ethereum smart contracts, introducing a unique approach that combines semantic and syntactic feature extraction.Specifically, our approach integrates CodeBERT embeddings for deep semantic insights with pattern-based feature vectors that capture Solidity constructs that are vulnerable to reentrancy attacks.Five hybrid models are evaluated, each selected to provide insights into structural and sequential dependencies within code.Findings highlighted the novelty of using multimodal feature integration in vulnerability detection, with models like Autoencoder-LSTM and CodeBERT-Transformer Encoder achieving high accuracy of 98.3% and 98.01%, respectively, demonstrating the effectiveness of hybrid architectures for capturing complex vulnerability patterns.This comparative study advances the smart contract security field, showcasing each model's strengths and trade-offs, and providing practical guidance for deploying deep learning-based vulnerability detection within blockchain ecosystems.
Wansen Wang, Pu Zhang, Renjie Ji, Wenchao Huang · 6 authors
Some smart contracts violate decentralization principles by defining privileged accounts that manage other users' assets without permission, introducing centralization risks that have caused financial losses. Existing methods, however, face challenges in accurately detecting diverse centralization risks due to their dependence on predefined behavior patterns. In this paper, we propose JANUS, an automated analyzer for Solidity smart contracts that detects financial centralization risks independently of their specific behaviors. JANUS identifies differences between states reached by privileged and ordinary accounts, and analyzes whether these differences are finance-related. Focusing on the impact of risks rather than behaviors, JANUS achieves improved accuracy compared to existing tools and can uncover centralization risks with unknown patterns. To evaluate JANUS's performance, we compare it with other tools using a dataset of 540 contracts. Our evaluation demonstrates that JANUS outperforms representative tools in terms of detection accuracy for financial centralization risks . Additionally, we evaluate JANUS on a real-world dataset of 33,151 contracts, successfully identifying two types of risks that other tools fail to detect. We also prove that the state traversal method and variable summaries, which are used in JANUS to reduce the number of states to be compared, do not introduce false alarms or omissions in detection.
Smart contracts are self-executing programs on blockchain platforms like Ethereum, which have revolutionized decentralized finance by enabling trustless transactions and the operation of decentralized applications. Despite their potential, the security of smart contracts remains a critical concern due to their immutability and transparency, which expose them to malicious actors. Numerous solutions for vulnerability detection have been proposed, but it is still unclear which one is the most effective. This paper presents a systematic literature review that explores vulnerabilities in Ethereum smart contracts, focusing on automated detection tools and benchmark evaluation. We reviewed 3,380 studies from five digital libraries and five major software engineering conferences, applying a structured selection process that resulted in 222 high-quality studies. The key results include a hierarchical taxonomy of 192 vulnerabilities grouped into 13 categories, a comprehensive list of 219 detection tools with corresponding functionalities, methods, and code transformation techniques, a mapping between our taxonomy and the list of tools, and a collection of 133 benchmarks used for tool evaluation. We conclude with a discussion about the insights into the current state of Ethereum smart contract security and directions for future research.
Tamim Hossain, Faisal Haque Bappy, Tarannum Shaila Zaman, Tariqul Islam
This work addresses the critical challenges of upgrading smart contracts, which are vital for trust in automated transactions but difficult to modify once deployed. To address this issue, we propose SEAM, a novel framework that automates the conversion of standard Solidity contracts into upgradable versions using the diamond pattern. SEAM simplifies the upgrade process and addresses two key vulnerabilities: function selector clashes and storage slot collisions. Additionally, the framework provides tools for efficiently deploying, modifying, and managing smart contract lifecycles. By enhancing contract security and reducing the learning curve for developers, SEAM lays a robust foundation for more flexible and maintainable blockchain applications.
Ghassan Adhab Atiyah, Ahmed Ismael Ibrahim, Ahmed Abdulkhudhur Jasim
Purpose This research aims to explore the complexities surrounding smart contracts enforcements in cross-jurisdictional transactions. Design/methodology/approach To achieve the aim of this study, doctrinal legal analysis was adopted. Although the subject is multidisciplinary, the aspect of enforcement in cross-jurisdictional transactions from legislative analysis does not require a technical method to be analysed, hence the adoption of this method. Where relevant legal academic journal articles were sourced and analysed along different legislative frameworks in some jurisdictions under review. To determine the legality of smart contracts, applicable law and court with jurisdiction to enforce blockchain smart contract disputes. Findings It was discovered that there remain fundamental questions regarding jurisdiction, applicable law and enforcement. Due to the problem of a uniform legislation to manage smart contract transactions. Research limitations/implications This study limits itself to the legality of smart contracts within a conflict of laws, and it propels the need for either a choice of domestic legislation for parties to be bound or the adoption of a universal legal framework for all smart contract formation through an international treaty or convention that has a binding effect on contracting parties to a smart contract. Originality/value This study highlights the fact that the key elements of smart contracts within traditional contract requirements as provided in domestic legislation vary across jurisdictions. This variation results not only in conflict of law but also affects enforcement in cases of dispute in the contractual terms.
In the fast-evolving domain of blockchain technology, smart contracts have become instrumental, facilitating billions of dollars in transactions daily. However, the increasing prevalence of smart contract vulnerabilities poses significant risks, potentially undermining trust in this innovative technology. To address these security challenges, our research introduces a novel approach for detecting and mitigating vulnerabilities through a comprehensive analysis of four principal modalities: Solidity source code, bytecode, opcode, and intermediate representations. This multimodal analysis employs a Transformer architecture, VulnFusion, which uniquely integrates these modalities to provide a deeper understanding of both the semantic and syntactical nuances of smart contracts. We propose an interleaving-based data fusion technique that outperforms traditional fusion methods such as concatenation and cross-attention. Experimental evaluations demonstrate that our interleavingbased fusion technique achieves an impressive average F1 score of 89% across source code, opcode, and intermediate representations, demonstrating the effectiveness of our approach.
Wesam Almobaideen, Rashed Alnuman, Tayyab Sajid, Qusai Hasan
Blockchain is a disruptive technology that changed how financial operations and ownership exist over the internet. With the implementation of smart contracts in blockchains, facilitation of transactions without intermediaries is possible and fully automated. Smart contracts allow relatively safe transactions and transfer of ownership, but as with any piece of software, it proved to have vulnerabilities and challenges. Unfortunately, considering that smart contracts hold and facilitate valuable asset and funds transfer, the damage caused by exploitation of these contracts is devastating with billions of dollars’ worth of cryptocurrency and other assets lost or stolen up until now. One attack on Ethereum smart contracts is the Etherlock attack, which exploits bad logic in the code to stall the transaction indefinitely, effectively sealing user funds. In this paper, we propose a high-accuracy Support Vector Machine model for detection of Etherlock vulnerability in Solidity smart contracts. The model is developed into a standalone tool and achieves 98.44% accuracy accompanied with 87% recall using a generated dataset of Smart Contracts from the Ethereum blockchain. Our promising results still show the necessity of more sophisticated accurate detection models for protection of crypto assets on the blockchain.
Software maintenance is crucial as technology rapidly evolves, requiring software to meet new demands and correct errors. Smart contracts, immutable programs on blockchains like Ethereum, face challenges despite their immutability, often needing updates for errors or new features. Smart contracts are upgraded using different patterns, which are not natural because most of them implement upgrades using low-level operations that deviate from their intended use. In other words, these patterns are not natural because upgrades are done by implementing workarounds. Moreover, smart contracts are also susceptible to security vulnerabilities because they may hold large amounts of money. In this paper, upgradability of smart contracts is considered a necessity. For this purpose, a more structured method is proposed by adding high-level features and combining inheritance properties of object-oriented languages. A key component of this method is the gotoContract variable, which allows for the redirection of function calls to upgraded contracts. The proposed method provides a complete upgrade of data and functions in smart contracts. It aims to minimize the effects of upgrades on end users of the smart contracts. Additionally, this natural way of upgrading will help mitigate security risks in the smart contracts by providing a high-level approach to upgrade.
This research has developed the theoretical framework that outlines the application of blockchain and smart contracts for enhancing supply chain transparency. The framework here builds in the concept of decentralization and immutability of the blockchain technology to improve accountability, auditability and responsiveness within supply chains. The framework helps to acquire real-time visibility over different processes, control fraud, increase the accuracy of the data, and optimize several procedures as much as possible by implementing the mentioned smart contacts. When the framework is adopted, the various advantages include the efficiency gain in the processing of different transactions and the increased accuracy in the data handling capacity as well as enhanced compliance to the set standard regulatory compliances. Despite this, questions like scalability of the concept, compatibility issues and synergism of the players in the value web remain problematic. In a broader perspective, this study adds to the current literature on the integration of blockchain technology in managing supply chain and offers all-important pointers to the practising managers.
Smart contracts form the core of Web3 applications. Contracts mediate the transfer of cryptocurrency, making them irresistible targets for hackers. We introduce ASP, a system aimed at easing the construction of provably secure contracts. The Asp system consists of three closely-linked components: a programming language, a defensive compiler, and a proof checker. The language semantics guarantee that Asp contracts are free of commonly exploited vulnerabilities such as arithmetic overflow and reentrancy. The defensive compiler enforces the semantics and translates Asp to Solidity, the most popular contract language. Deductive proofs establish functional correctness and freedom from critical vulnerabilities such as unauthorized access.
Abstract Conditional risk measures and their associated risk contribution measures are commonly employed in finance and actuarial science for evaluating systemic risk and quantifying the effects of risk interactions. This paper introduces various types of contribution ratio measures based on the multivariate conditional value-at-risk (MCoVaR), multivariate conditional expected shortfall (MCoES), and multivariate marginal mean excess (MMME) studied in [34] (Ortega-Jiménez, P., Sordo, M., & Suárez-Llorens, A. (2021). Stochastic orders and multivariate measures of risk contagion. Insurance: Mathematics and Economics , vol. 96, 199–207) and [11] (Das, B., & Fasen-Hartmann, V. (2018). Risk contagion under regular variation and asymptotic tail independence. Journal of Multivariate Analysis 165 (1), 194–215) to assess the relative effects of a single risk when other risks in a group are in distress. The properties of these contribution risk measures are examined, and sufficient conditions for comparing these measures between two sets of random vectors are established using univariate and multivariate stochastic orders and statistically dependent notions. Numerical examples are presented to validate these conditions. Finally, a real dataset from the cryptocurrency market is used to analyze the spillover effects through our proposed contribution measures.