Existing smart contract honeypot detection approaches exhibit high false negatives and positives due to (i) their inability to generate transaction sequences triggering order-dependent traps and (ii) their limited code coverage from traditional fuzzing’s random mutations. In this paper, we propose a hybrid fuzzing framework for smart contract honeypot detection based on taint analysis, SCH-Hunter. SCH-Hunter conducts source-code-level feature analysis of smart contracts and extracts data dependency relationships between variables from the generated Control Flow Graph to construct specific transaction sequences for fuzzing. A symbolic execution module is also introduced to resolve complex conditional branches that fuzzing alone fails to penetrate, enabling constraint solving. Furthermore, real-time dynamic taint propagation monitoring is implemented using taint analysis techniques, leveraging taint flow information to optimize seed mutation processes, thereby directing mutation resources toward high-value code regions. Finally, by integrating EVM (Ethereum Virtual Machine) code instrumentation with taint information flow analysis, the framework effectively identifies and detects security-sensitive operations, ultimately generating a comprehensive detection report. Empirical results are as follows. (i) For code coverage, SCH-Hunter performs better than the state-of-art tool, HoneyBadger, achieving higher average code coverage rates on both datasets, surpassing it by 4.79% and 17.41%, respectively. (ii) For detection capabilities, SCH-Hunter is not only roughly on par with HoneyBadger in terms of precision and recall rate but also capable of detecting a wider variety of smart contract honeypot techniques. (iii) For the evaluation of components, we conducted three ablation studies to demonstrate that the proposed modules in SCH-Hunter significantly improve the framework’s detection capability, code coverage, and detection efficiency, respectively.
Jiazhen Gan, Jianzhong Su, Kaixin Lin, Zibin Zheng
Smart contracts are Turing-complete programs that run on blockchain technology, capable of managing on-chain assets according to predefined logic, and become immutable once deployed on the blockchain. In recent years, the value of smart contracts on blockchains, notably Ethereum, has been on the rise. However, the hiding vulnerabilities made the substantial value of smart contracts a target of many hackers, leading to numerous attack incidents. Therefore, vulnerability detection in smart contracts before deployment is essential. Currently, many fuzzers for detecting smart contract vulnerabilities can only identify vulnerabilities based on the execution patterns of the underlying opcodes, overlooking the financial semantic properties of the contracts, which leads to many vulnerabilities being difficult to detect or resulting in a high rate of false positives. To this end, we focus on the financial characteristics of contracts, define contract vulnerability patterns starting from the high-level semantic properties of contracts, and combine fuzzers using evolutionary algorithms and symbolic constraint solving to detect vulnerabilities, culminating in the development of FinanceFuzz . Specifically, FinanceFuzz defines invariant and equivalence properties of finance that contracts should satisfy. Utilizing these properties, FinanceFuzz can generate transaction sequences for testing and identify vulnerable contracts that violate the properties. We conducted experiments on a dataset containing 437 smart contracts from the real world, the experimental results demonstrating that our tool outperforms other state-of-the-art tools in detecting vulnerabilities, achieving higher recall rate without false positive.
Decentralized Autonomous Organizations (DAOs) have emerged as one of the most disruptive innovations in governance, offering new frameworks for collective decision-making, transparency, and accountability in both public and private spheres. Rooted in blockchain technology and powered by smart contracts, DAOs eliminate the need for traditional hierarchical management by enabling rules to be self-enforced and decisions to be executed automatically. This paper examines DAOs as governance mechanisms, tracing their historical development, theoretical underpinnings, and practical implementations across finance, civic engagement, digital cooperatives, and resource management. Through an extensive literature review, comparative case studies, and thematic content analysis, the study highlights DAOs’ potential to reduce agency problems, enhance participatory governance, and ensure auditability through immutable ledgers. However, the analysis also reveals significant challenges, including legal ambiguity, technological vulnerabilities, token-weighted plutocracy, voter apathy, and scalability concerns that hinder their broader application. Results suggest that DAOs function effectively as experimental laboratories of algorithmic governance but are not yet fully equipped to replace traditional governance structures. Instead, hybrid models integrating decentralized decision-making with institutional oversight present the most viable path forward. By critically analyzing DAO case studies such as MakerDAO, ConstitutionDAO, and CityDAO, the study underscores their dual role as governance innovations and socio-political experiments that push the boundaries of trust, coordination, and autonomy in the digital age. The findings position DAOs not only as technological entities but also as frameworks capable of reshaping democratic practices, resource governance, and institutional legitimacy in the 21st century.
As new project upgrading the blockchain industry, novel forms of attack challenges developers to rethink about the design of their innovations. In the growth stage of the development, Decentralized Autonomous Organizations (DAO) introduces different approaches in managing fund through voting in governance tokens. However, relying on tokens as a weight for voting introduces opportunities for hackers to manipulate voting results through flash loan, allowing malicious proposals - fund withdrawal from DAO to hacker's wallet - to execute through the smart contract. In this research, we learned different defense mechanism against the flash loan attack, and their weakness in accessibility that compromise the security of different blockchain projects. Based on our observation, we propose a new defensing structure and apply it with cases.
Decentralized Finance (DeFi) is an emerging paradigm within the blockchain space that aims to revolutionize conventional financial systems by applying blockchain technology. The substantial value of digital assets managed by DeFi protocols makes it a lucrative target for attacks. Despite the human resources and the application of automated tools, frequent attacks still cause significant fund losses to DeFi participants. Existing tools primarily rely on oracles similar to those used in traditional software analysis, making it challenging for them to detect functional bugs specific to the DeFi domain. Since blockchain functions as a distributed ledger system, the foundation of any DeFi protocol is the accurate maintenance of key state variables representing user funds. If these variables are not properly updated or designed to reflect the intended flow of funds, attackers can exploit these flaws to steal assets. From the study of popular DeFi protocols, we observe that, in DeFi systems, to ensure a transaction does not misappropriate someone's fund, the direction of changes (increase or decrease) of values associated with the amount of asset or debt of a user has to adhere to some fairness properties. We propose a concept called fairness bug which allows attackers to gain profit without cost. We propose an inter-procedural and inter-contract static analysis technique that utilizes symbolic execution and an SMT solver to automatically detect fairness bugs in DeFi smart contracts. We have implemented our fairness-checking approach in our tool, named FairChecker. We evaluate our tool on a benchmark of 113 real-world DeFi protocols with 34 fairness bugs. The results show that our tool can detect 32 bugs with a recall of 94.1 % and a precision of 46.4 %, demonstrating its effectiveness.
Pre-deployment testing has become essential to ensure the functional correctness of smart contracts. However, since smart contracts are stateful programs integrating many different functionalities, manually writing test cases to cover all potential usages requires significant effort from developers, leading to insufficient testing and increasing risks in practice. Although several testing techniques for smart contracts have been proposed, they primarily focus on detecting common low-level vulnerabilities such as re-entrancy, rather than generating expressive and function-relevant test cases that can reduce manual testing efforts. To bridge the gap, we propose Solmigrator, an automated technique designed to generate expressive and representative test cases for smart contracts. To our knowledge, Solmigrator is the first migration-based test generation technique for smart contracts, which extracts test cases from real-world usages of on-chain contracts and migrates them to test newly developed smart contracts with similar functionalities. Given a target smart contract to be tested and an on-chain similar source smart contract, Solmigrator first transforms the on-chain usage of the source contract into off-chain executable test cases based on on-chain transaction replay and dependency analysis. It then employs fine-grained static analysis to migrate the augmented test cases from the source to the target smart contract. We built a prototype of Solmigrator and have evaluated it on real-world smart contracts within the two most popular categories, ERC20 and ERC721. Our evaluation results demonstrate that Solmigrator effectively extracts test cases from existing on-chain smart contracts and accurately migrates them across different smart contracts, achieving an average precision of 96.3% and accuracy of 93.6%. Furthermore, the results indicate that these migrated test cases effectively cover common key functionalities of the target smart contracts. This provides promising evidence that real-world usages of existing smart contracts can be transformed into effective test cases for other newly developed smart contracts.
M. Santhiya, S. Arshik, P. Rajendra Prasanth, Vivek Kumar · 5 authors
Traditional voting systems, both paper and electronic, suffer from major security, transparency, and fraud-prevention challenges. Paper ballots are vulnerable to manipulation and logistical concerns, whereas electronic voting machines may be hacked into and manipulated. Centralized systems also create problems of voter anonymity, accessibility, and auditability. VoteBlock, an online voting system built on blockchain technology, takes advantage of the decentralized and immutable features of blockchain. VoteBlock utilizes a distributed ledger to prevent single points of failure, such that no single entity can modify or manage the voting process. Every vote is encrypted and written as a transaction on the blockchain, with real-time verifiability at no cost to voter privacy. Multi-factor authentication is used to protect access and keep unauthorized voting at bay. The open architecture makes it possible for election officials and auditors to validate results cost-effectively and reliably. VoteBlock was prototyped and tested under various conditions to measure performance metrics including transaction speed, network latency, and security scalability. The testing proved that VoteBlock successfully inhibits double voting and tampering with votes, providing an elevated solution that heightens the security, transparency, and credibility of contemporary voting systems.
Blockchain technology has emerged as a secure and decentralized ledger, fundamentally transforming the verification and storage of transactions across various industries. At its core, smart contracts enable automated and trustless execution of agreements, offering immense potential for efficiency and transparency. However, these contracts face significant challenges in verification, security, and standardization, which hinder their adoption in critical applications.This paper investigates these challenges and highlights the role of Formal Methods in enhancing the security, correctness, and reliability of smart contracts. By synthesizing insights from existing research, tools, and approaches, the study provides a comprehensive analysis of the domain. The integration of Formal Methods is proposed as a robust solution for addressing vulnerabilities, ensuring functional correctness, and establishing standardization practices, thereby advancing the practical and secure implementation of smart contracts in blockchain systems.
Ethereum smart contracts enable decentralized applications (dApps) on the blockchain and execution of each transaction on dApps incurs a gas cost (fee). While the gas cost prevents denial-of-service (DoS) attacks and incentivizes miners, unoptimized smart contracts may cause excessive gas waste, resulting in higher transaction costs and reduced scalability. Hence, this paper introduces four novel gas waste detectors integrated into the Slither static analysis framework to identify common gas wastes in Solidity smart contracts, including redundant use of address(this), division by unsigned integers, short constant strings, and unnecessary type casting. We analyzed 397 smart contracts from 53 dApps deployed on Ethereum, uncovering 250 instances of gas waste. Our findings indicate that every dApp analyzed exhibits at least one form of gas waste. Notably, division by unsigned integers emerged as the most prevalent gas waste, while half of the dApps could save gas by optimizing short constant strings. To facilitate further research, the annotated dataset of gas waste instances is available on GitHub.
Debugging and auditing zero-knowledge-compatible smart contracts remains a significant challenge due to the lack of source mapping in compilers such as zkSolc. In this work, we present a preliminary source mapping framework that establishes traceability between Solidity source code, LLVM IR, and zkEVM bytecode within the zkSolc compilation pipeline. Our approach addresses the traceability challenges introduced by non-linear transformations and proof-friendly optimizations in zero-knowledge compilation. To improve the reliability of mappings, we incorporate lightweight consistency checks based on static analysis and structural validation. We evaluate the framework on a dataset of 50 benchmark contracts and 500 real-world zkSync contracts, observing a mapping accuracy of approximately 97.2% for standard Solidity constructs. Expected limitations arise in complex scenarios such as inline assembly and deep inheritance hierarchies. The measured compilation overhead remains modest, at approximately 8.6%. Our initial results suggest that source mapping support in zero-knowledge compilation pipelines is feasible and can benefit debugging, auditing, and development workflows. We hope that this work serves as a foundation for further research and tool development aimed at improving developer experience in zk-Rollup environments.
Tracking the evolution of smart contracts is challenging due to their immutable nature and complex upgrade mechanisms. We introduce EvoChain, a comprehensive framework and dataset designed to track and visualize smart contract evolution. Building upon data from our previous empirical study, EvoChain models contract relationships using a Neo4j graph database and provides an interactive web interface for exploration. The framework consists of a data layer, an API layer, and a user interface layer. EvoChain allows stakeholders to analyze contract histories, upgrade paths, and associated vulnerabilities by leveraging these components. Our dataset encompasses approximately 1.3 million upgradeable proxies and nearly 15,000 historical versions, enhancing transparency and trust in blockchain ecosystems by providing an accessible platform for understanding smart contract evolution.
The peak of monthly trade volume of NFT (non-fungible token) has reached${\$}$4.95 billion USD in August 2023, which shows the hot trend and the potential significance of NFT. However, the smart contract responsible for managing NFT may contain defects, which can be exploited by attackers to cause severe damage to victims. We take the first step to systematically analyze three kinds of defects on NFT contracts, namely fragile NFT binding, non-compliant implementation, and implanted backdoor. In particular, we proposeEmerium, the first extensible detection framework for capturing these defects by inspecting the bytecode of smart contracts. We conduct extensive experiments to evaluateEmerium, and the experimental results show that it can detect the aforementioned defects with 0.83 and 0.89 F-measure for ERC-721 contracts and ERC-1155 contracts, respectively. ApplyingEmeriumto 87,839 ERC-721 and 9,808 ERC1155 NFT contracts of real world, we uncover 44,863,255 defects of fragile NFT binding, 1,373 defects of non-compliant implementation, and 105 defects of backdoor (also with a new CVE).
In today's blockchain landscape, smart contracts are assuming a pivotal role, albeit accompanied by a heightened risk of exploitation by attackers. As smart contracts grow in complexity, vulnerabilities lurking within deeper layers of code become more prevalent. Existing analysis tools primarily focus on data flow and a priori knowledge based on symbolic execution as a test case generation strategy, often falling short in uncovering vulnerabilities nested within intricate conditional statements. To address this challenge, we present ACOFuzz, an advanced fuzzer for Ethereum smart contracts. ACOFuzz employs the ant colony optimization (ACO) algorithm to traverse the control flow graph (CFG) of smart contracts, systematically exploring execution paths and generating test cases. Subsequently, it strategically directs the search towards paths that are more susceptible to vulnerabilities within the CFG, leveraging block coverage data obtained from executing the test cases. In a comprehensive evaluation, we demonstrate that ACOFuzz excels in covering a wider array of paths within a contract while exhibiting enhanced accuracy in pinpointing specific vulnerabilities compared to contemporary fuzzers.
Giovanni Rosa, Simone Scalabrino, S. Mastrostefano, Rocco Oliveto
Abstract Smart contracts, i.e., self-executing contracts written in code, have gained popularity in recent years due to the introduction of blockchain technology. These contracts are executed automatically when certain conditions are met, and, once deployed, they can not be modified. This presents issues when errors are found or updates are needed. Previous research has mainly focused on introducing approaches and tools for detecting bugs or vulnerabilities in smart contracts. However, it is unclear if these are the only maintenance-related operations developers perform. In this paper, we aim to understand why and how developers maintain smart contracts. We run a qualitative analysis on 590 commits from 14 open-source smart contract repositories written in Solidity, the most popular programming language for smart contracts. We analyze the commit messages, related issues, and the changes made to understand what triggered changes. Then, we examine how developers changed the source code. As a result, we define two taxonomies: one reporting the reasons for the maintenance and one regarding the patterns of modifications. Our findings suggest that smart contract maintenance is often focused on improving the internal quality of the scripts (40% of the cases), and that many changes aim to fix bugs despite the several approaches available for detecting them beforehand.
Megha D Suvarna, P Raksha, C Chinmayi, Sumalatha Aradhya
Traditional voting systems face challenges such as centralization, security vulnerabilities, and high costs, which reduce public trust in democratic processes. Blockchain technology offers a decentralized and immutable solution to these issues, but high gas costs form a barrier to wide-spread adoption of the solution. This paper presents a gas-optimized Smart Contract for a decentralized voting system on the Ethereum Blockchain. Key optimizations include the use of optimal data types to improve storage, to reduce computation overhead, and to ease data access. Experimental results shows that a total gas cost reduction of 21.3%, with significant savings of 47.7% for voter registration data and 1.5% for vote casting data. These improvements enhance the efficiency and cost-effectiveness of Blockchain-based voting, making it more viable for large-scale elections.
Luigi Bellomarini, Marco Favorito, Giuseppe Galano
This work proposes a novel formal verification technique to analyze Bitcoin smart contracts (when specified in BITML) through ATL model checking, using the MCMAS model checker. In particular, we developed a translation procedure from a BITML contract to a MCMAS model that simulates the BITML semantics, hence allowing for strategic reasoning on BITML smart contracts. We implemented the technique in a prototype tool, which we tested over several case studies, showing that we can verify smart contract specifications that capture interesting multi-agent interactions and strategic specifications.
Abstract Contractual relationships between buyers and sellers can be disrupted by unanticipated shocks to attributes of the exchanged good or service; in manufacturing, such relationships often involve one buyer of components or intermediate goods and many potential sellers. We study the buyer’s selection of a seller given the option to initially agree on a smart contract which, in the advent of such unanticipated shocks, automatically adjusts the exchange price. Our benchmark analysis focuses on the case where a positive potential shock raises attribute values for both contracting parties, implying that the seller benefits more than the buyer from executing the original contract at the agreed exchange price. Taking the perspective of the buyer, we vary the shock and utility parameters to arrive at conclusions regarding the determinants of smart contract dominance in random buyer-seller matches. One of the key issues analyzed in this paper is the possibility that after the potential shock, another seller might be better and a buyer who anticipates this might be led to select a different seller. For the case of the Nash bargaining-solution, we further investigate the impact of increasing the number of utility-generating attributes on these switch rates.
ABSTRACT This study examines how task assignment mechanisms affect the participation of workers on decentralized blockchains. In developing the theory, I highlight that blockchain represents a distinct organizational form for coordinating operations under a highly decentralized structure, in which the essential tasks of system infrastructure maintenance are assigned to third‐party crowd workers through the unique governance mechanism of consensus protocol. I specifically focus on two widely adopted consensus protocols in the context of cryptocurrency, namely, proof‐of‐work (PoW), which assigns tasks that sustain the blockchain system operation based on workers' investments in computing power, and proof‐of‐stake (PoS), which assigns these tasks based on workers' investments in the native cryptocurrency as stakes. I argue that compared with PoW, PoS increases worker participation and task decentralization because the investment requirement of task participation in the form of blockchain native assets reduces workers' transaction costs in task contracting and their tendencies for hyper‐competition. My empirical analysis leverages a natural experiment on Ethereum, namely, the “Merge” event on September 15, 2022, in which the blockchain changed the assignment rules by switching the consensus protocol from PoW to PoS. The results under a difference‐in‐differences research design confirm my arguments.
Pierpaolo Della Monica, Ivan Visconti, Andrea Vitaletti, Marco Zecchini
Before a fair exchange takes place, there is typically an advertisement phase with the goal of increasing the appeal of possessing a digital asset while keeping it sufficiently hidden. Advertisement phases are implicit in mainstream definitions, and therefore are not explicitly integrated within fair-exchange protocols. In this work we give an explicit definition for such a fair exchange in a setting where parties communicate via broadcast messages only (i.e., no point-to-point connection between seller and buyer is needed). Next, we construct a fair-exchange protocol satisfying our new definition using zk-SNARKs and relying on mainstream decentralized platforms (i.e., a blockchain with smart contracts like Ethereum and a decentralized storage system like IPFS). Experimental results confirm the practical relevance of our decentralized approach, paving the road towards building decentralized marketplaces where users can, even anonymously, and without direct off-chain communications, effectively advertise and exchange their digital assets as part of a system of enhanced NFTs.
In recent years, the Ethereum platform has witnessed a proliferation of smart contracts, accompanied by exponential growth in total value locked (TVL). High-TVL smart contracts often require complex numerical computations, particularly in mathematical financial models used by many decentralized applications (DApps). Improper calculations can introduce numerical defects, posing potential security risks. Existing research primarily focuses on traditional numerical defects like integer overflow, and there is currently a lack of systematic research and effective detection methods targeting new types of numerical defects. In this paper, we identify five new types of numerical defects through the analysis of 1,199 audit reports by utilizing the open card method. Each defect is defined and illustrated with a code example to highlight its features and potential consequences. We also propose NumScout, a symbolic execution-based tool designed to detect these five defects. Specifically, the tool combines information from source code and bytecode, analyzing key operations such as comparisons and transfers, to effectively locate defects and report them based on predefined detection patterns. Furthermore, NumScout uses a large language model (LLM) to prune functions which are unrelated to numerical operations. This step allows symbolic execution to quickly enter the target function and improve runtime speed by 28.4%. We run NumScout on 6,617 real-world contracts and evaluated its performance based on manually labeled results. We find that 1,774 contracts contained at least one of the five defects, and the tool achieved an overall precision of 89.7%.
Decentralized Autonomous Organizations (DAOs) are a type of Decentralized Applications (DApps) that utilize smart contracts to support governance processes. To achieve a high degree of utility of the system, stakeholders need to identify a suitable organizational structure in the early stages of design. While Model-Driven Development (MDD) methods are established for DApp and smart contract design, they lack specialization for modeling the organizational structures of DAOs. To address this gap, we propose a modeling language and a method which support crucial DAO design and development phases. The method is evaluated through an in vivo case study. Unlike existing solutions, comprehensive stepwise guidance is provided by our method for both technical and non-technical stakeholders involved in DAO development from the initial stages of the project.
Deploying smart contracts and invoking their functions on block-chains incur gas costs, which depend on the operations executed by those functions. This makes optimizing the gas cost of smart contract functions a rewarding goal. However, existing approaches to gas cost optimization of smart contracts mainly involve rule-based optimization or automatic optimization for specific types of patterns. In this paper, we discuss a novel approach to automatically retrieving optimized versions of Solidity functions from a repository of smart contracts. The system identifies and suggests gas-efficient alternatives that maintain functional equivalence by comparing the opcode sequences of individual functions. We evaluate this approach on a dataset of 16,529 functions from real-world contracts, demonstrating substantial gas savings, as high as 34% on average when considering the most similar functions.
Scaling blockchain performance through parallel smart contract execution has gained significant attention, as traditional methods remain constrained by the performance of a single virtual machine (VM), even in multi-chain or Layer-2 systems. Parallel VMs offer a compelling solution by enabling concurrent transaction execution within a single smart contract, using multiple CPU cores. However, Ethereum's sequential, shared-everything model limits the efficiency of existing parallel mechanisms, resulting in frequent rollbacks with optimistic methods and high overhead with pessimistic methods due to state dependency analysis and locking.