Blockchain technology has emerged as a transformative solution for enhancing the security and transparency of financial transactions in the digital age. By leveraging its decentralized and immutable ledger, blockchain minimizes the risks associated with fraud, unauthorized access, and data breaches in financial systems. This research examines the role of blockchain in securing financial transactions, focusing on its core features such as distributed consensus, cryptographic security, and transparency. It explores real-world applications, including cryptocurrency transactions, cross-border payments, and smart contracts, highlighting their impact on reducing transaction costs and increasing trust. Furthermore, the study addresses challenges such as scalability, regulatory concerns, and energy consumption associated with blockchain technology. By evaluating existing use cases and future potentials, this research provides a comprehensive framework for integrating blockchain into financial systems. It underscores the importance of collaboration between financial institutions, regulatory bodies, and blockchain innovators to create a secure and sustainable digital financial ecosystem.
In recent years, security incidents stemming from centralization defects in smart contracts have led to substantial financial losses. A centralization defect refers to any error, flaw, or fault in a smart contract's design or development stage that introduces a single point of failure. Such defects allow a specific account or user to disrupt the normal operations of smart contracts, potentially causing malfunctions or even complete project shutdowns. Despite the significance of this issue, most current smart contract analyses overlook centralization defects, focusing primarily on other types of defects. To address this gap, our paper introduces six types of centralization defects in smart contracts by manually analyzing 597 Stack Exchange posts and 117 audit reports. For each defect, we provide a detailed description and code examples to illustrate its characteristics and potential impacts. Additionally, we introduce a tool named CDRipper (Centralization Defects Ripper) designed to identify the defined centralization defects. Specifically, CDRipper constructs a permission dependency graph (PDG) and extracts the permission dependencies of functions from the source code of smart contracts. It then detects the sensitive operations in functions and identifies centralization defects based on predefined patterns. We conduct a large-scale experiment using CDRipper on 244,424 real-world smart contracts and evaluate the results based on a manually labeled dataset. Our findings reveal that 82,446 contracts contain at least one of the six centralization defects, with our tool achieving an overall precision of 93.7%.
We introduce a novel class of systemic risk measures, the Vulnerability Conditional risk measures, which try to capture the "tail risk" of a risky position in scenarios where one or more market participants is experiencing financial distress. Various theoretical properties of Vulnerability Conditional risk measures, along with a series of related contribution measures, have been considered in this paper. We further introduce the backtesting procedures of VCoES and MCoES. Through numerical examples, we validate our theoretical insights and further apply our newly proposed risk measures to the empirical analysis of cryptocurrencies, demonstrating their practical relevance and utility in capturing systemic risk.
Mojtaba Eshghie, Viktor Åryd, Cyrille Artho, Martin Monperrus
Structured code differencing is the act of comparing the hierarchical structure of code via its abstract syntax tree (AST) to capture modifications. AST-based source code differencing enables tasks such as vulnerability detection and automated repair where traditional line-based differencing falls short. We introduce SoliDiffy, the first AST differencing tool for Solidity smart contracts with the ability to generate an edit script that soundly shows the structural differences between two smart-contracts using insert, delete, update, move operations. In our evaluation on 353,262 contract pairs, SoliDiffy achieved a 96.1% diffing success rate, surpassing the state-of-the-art, and produced significantly shorter edit scripts. Additional experiments on 925 real-world commits further confirmed its superiority compared to Git line-based differencing. SoliDiffy provides accurate representations of smart contract evolution even in the existence of multiple complex modifications to the source code. SoliDiffy is made publicly available at https://github.com/mojtaba-eshghie/SoliDiffy.
Julio Aguilar, Kacper Bąk, Michael Boyle, Valerian Callens · 5 authors
Smart contract families are similar smart contract applications that are built from a shared set of assets. In this work, we show how to express smart contract families in Solidity using existing tooling. Solidity is a popular language for smart contracts on the Ethereum blockchain, which is also in use on other Ethereum Virtual Machine (EVM) compatible blockchains and layer two solutions. We are motivated to explore this because EVM-compatible chains are becoming popular but they are also making subtle changes to opcode semantics. Users can reuse Solidity smart contracts from one EVM-compatible chain to another, but may find that those contracts do not have the same behaviour. Our approach provides a method for engineering for multiple chains simultaneously, but also allows functionality to be added or ignored based on desired features. This work allows developers to quickly build software product families which can be optimized for specific target blockchains and simplify smart contract audits.
Lei Yu, Shiqi Chen, Hang Yuan, Peng Wang · 10 authors
With the rapid development of blockchain technology, smart contract security has become a critical challenge. Existing smart contract vulnerability detection methods face three main issues: (1) Insufficient quality of datasets, lacking detailed explanations and precise vulnerability locations. (2) Limited adaptability of large language models (LLMs) to the smart contract domain, as most LLMs are pre-trained on general text data but minimal smart contract-specific data. (3) Lack of high-quality explanations for detected vulnerabilities, as existing methods focus solely on detection without clear explanations. These limitations hinder detection performance and make it harder for developers to understand and fix vulnerabilities quickly, potentially leading to severe financial losses. To address these problems, we propose Smart-LLaMA, an advanced detection method based on the LLaMA language model. First, we construct a comprehensive dataset covering four vulnerability types with labels, detailed explanations, and precise vulnerability locations. Second, we introduce Smart Contract-Specific Continual Pre-Training, using raw smart contract data to enable the LLM to learn smart contract syntax and semantics, enhancing their domain adaptability. Furthermore, we propose Explanation-Guided Fine-Tuning, which fine-tunes the LLM using paired vulnerable code and explanations, enabling both vulnerability detection and reasoned explanations. We evaluate explanation quality through LLM and human evaluation, focusing on Correctness, Completeness, and Conciseness. Experimental results show that Smart-LLaMA outperforms state-of-the-art baselines, with average improvements of 6.49% in F1 score and 3.78% in accuracy, while providing reliable explanations.
Smart contracts are self-executing digital contracts that run on a blockchain network. They enable the automation and decentralization of various operations and have become increasingly popular in recent years. However, smart contracts are susceptible to vulnerabilities, and their deployment without proper security testing can result in severe consequences, such as financial losses and reputational damage. In this article, we explore the use of deep learning techniques, particularly Convolutional Neural Networks (CNNs), for detecting and classifying vulnerabilities in smart contracts deployed on the Ethereum main net. We compare different kinds of neural architectures, i.e., a baseline LSTM, multiple 1D CNNs working on the smart contracts’ bytecode, a Vision Transformer (Swin v2 Tiny), and various 2D CNNs that work on RGB images obtained from the bytecode (i.e., ResNet-50, ResNeXt-50, Inception v3, and EfficientNetv2 Small). We provide an in-depth analysis of these techniques to classify a dataset of smart contracts we have collected. Our study shows that the use of deep neural networks can represent a promising technique to automatically assess smart contracts’ correctness and classify potential vulnerabilities. According to our experiments, the ResNet 1D CNN working directly on the smart contract bytecode offers the best results in terms of classification capabilities. Moreover, due to the unbalanced sizes of the different classes, the classification resulted in more effectiveness for the unchecked calls and reentrancy vulnerability classes while still providing good results for others.
The emergence of blockchain technology has ushered in a transformative era of decentralized and trustless systems, challenging conventional centralized models reliant on intermediaries. At the core of this revolution lies the concept of smart contracts, self-executing agreements encoded on a blockchain, automating contractual processes without intermediaries. Smart contracts offer numerous advantages, including automation, cost reduction, transparency, and enhanced security. However, their widespread adoption faces challenges, with a paramount one being the limitation of scalability within blockchain networks. This paper studies existing scalable solution of blockchain, compares the existing techniques and discusses the best scalable solution depending on the requirement of the system. It assesses existing research, case studies and unlocking the full potential of smart contracts in the realm of blockchain technology.
Daniel E. Martínez, Lena Magdalena, Agnes Novalita Savitri
The integration of Artificial Intelligence (AI) and Blockchain is revolutionizing the financial sector, targeting crucial challenges like security and transparency. This paper explores the synergistic effects of AI and Blockchain on enhancing the security of financial transactions through advanced real-time fraud detection, anomaly identification, and decentralized transaction verification. Employing a comprehensive review of existing literature and case studies, the research investigates how AI’s capabilities in processing vast data volumes can be leveraged alongside Blockchain’s robust, immutable ledger system to mitigate risks in financial operations effectively. The findings reveal that integrating AI with Blockchain not only significantly improves the security by enabling the real-time detection of anomalies but also upholds the integrity and transparency of transactions across distributed ledgers. The results underscore the potential of AI-Blockchain technology to enhance financial transaction frameworks and highlight its capacity to support the achievement of the United Nations Sustainable Development Goals (SDGs), particularly SDG 8 (Decent Work and Economic Growth), SDG 9 (Industry, Innovation, and Infrastructure), and SDG 16 (Peace, Justice, and Strong Institutions) by fostering more transparent and secure economic environments. The conclusion of the study suggests further research on the scalability of AI-Blockchain integrations and their broader application across various industries, pointing towards a transformative impact on global financial practices.
Wenqian Zhao, Lavanya Pobbathi, S Ramprasath, Meghana Patibandla
The rapid advancements in Generative AI have opened new possibilities for automating complex processes, such as the generation of smart contracts within the real estate industry. This paper presents a comprehensive review of existing literature and research on the application of Gen AI in creating smart contracts, with a focus on ensuring correctness, fairness, and data privacy. We explore the methodologies employed in using large language models (LLMs) like GPT-4 to develop smart contract requirements that are not only precise but also adaptable to the evolving needs of stakeholders in real estate transactions. Additionally, we discuss the critical role of human oversight in refining AI-generated specifications to meet regulatory and ethical standards, thereby enhancing the reliability and transparency of automated contracts. Through this analysis, we highlight the potential of Gen AI to revolutionize the real estate industry by streamlining the creation of smart contracts, reducing the risk of human error, and ensuring that transactions are secure, fair, and compliant with privacy regulations.
Smart contracts are essential for managing digital assets in blockchain networks, highlighting the need for effective security measures. This paper introduces SmartLLMSentry, a novel framework that leverages large language models (LLMs), specifically ChatGPT with in-context training, to advance smart contract vulnerability detection. Traditional rule-based frameworks have limitations in integrating new detection rules efficiently. In contrast, SmartLLMSentry utilizes LLMs to streamline this process. We created a specialized dataset of five randomly selected vulnerabilities for model training and evaluation. Our results show an exact match accuracy of 91.1% with sufficient data, although GPT-4 demonstrated reduced performance compared to GPT-3 in rule generation. This study illustrates that SmartLLMSentry significantly enhances the speed and accuracy of vulnerability detection through LLM-driven rule integration, offering a new approach to improving Blockchain security and addressing previously underexplored vulnerabilities in smart contracts.
Dat Tien Nguyen, Dung Cam Huynh, Tran Bao Anh Nguyen
The Industrial Revolution 4.0 and modern technology have had a significant impact on Vietnam’s economy. One of the most notable developments is the emergence of blockchain technology. “Smart contracts” or “virtual contracts” have become an important term on the Blockchain platform, offering many advantages and being widely deployed in areas such as finance, business, trade, and insurance. Although smart contracts have potential benefits, businesses are still hesitant to establish them. The article employs analytical methods and synthesizes data to provide evaluative insights. Additionally, this article analyzes the concept and characteristics of smart contracts, the trend of applying smart contracts in some countries worldwide, and provides suggestions for Vietnamese businesses on how to apply smart contracts, along with notes and recommendations.
While smart contracts are foundational elements of blockchain applications, their inherent susceptibility to security vulnerabilities poses a significant challenge. Existing training datasets employed for vulnerability detection tools may be limited, potentially compromising their efficacy. This paper presents a method for improving the quantity and quality of smart contract vulnerability datasets and evaluates current detection methods. The approach centers around semantic-preserving code transformation, a technique that modifies the source code structure without altering its semantic meaning. The transformed code snippets are inserted into all potential locations within benign smart contract code, creating new vulnerable contract versions. This method aims to generate a wider variety of vulnerable codes, including those that can bypass detection by current analysis tools. The paper experiments evaluate the method's effectiveness using tools like Slither, Mythril, and CrossFuzz, focusing on metrics like the number of generated vulnerable samples and the false negative rate in detecting these vulnerabilities. The improved results show that many newly created vulnerabilities can bypass tools and the false reporting rate goes up to 100% and increases dataset size minimum by 2.5X.
Hanting Chu, Pengcheng Zhang, Hai Dong, Yan Xiao · 5 authors
Given that smart contracts execute transactions worth hundreds of millions of dollars daily, the issue of smart contract security has attracted considerable attention over the past few years. Traditional methods for detecting vulnerabilities heavily rely on manually developed rules and features, leading to the problems of low accuracy, high false positives, and poor scalability. Although deep learning-inspired approaches were designed to alleviate the problem, most of them rely on monothetic features, which may result in information incompetence during the learning process. Furthermore, the lack of available labeled vulnerability datasets is also a major limitation. To address these issues, we collect and construct a dataset of five labeled smart contract vulnerabilities, and proposeDeepFusion, a vulnerability detection method that fuses code representation information, including program slice information and abstraction syntax tree (AST) structured information. First, we develop automated tools to extract contract vulnerability slicing information from source code, and extract structured information from source code-converted AST. Second, code features and global structured features are fused into the data. Finally, the fused data are input into the Bidirectional Long Short-Term Memory+ Attention (BiLSTM+ATT) model for smart contract vulnerability detection. The BiLSTM model can capture long-term dependencies in both directions and is more suitable for processing serialized information generated byDeepFusion, while the attention mechanism can highlight the characteristic information of vulnerabilities. We conducted experiments via collecting a real smart contract dataset. The experimental results show that our method significantly outperforms the existing methods in detecting the vulnerabilities ofreentrancy,timestamp dependence,integer overflow and underflow,Use tx.origin for authentication, andUnprotected Self-destruct Instructionby 6.36%, 6.42%, 16.5%, 21.29%, and 25.05%, respectively. To the best of our knowledge, the latter two vulnerabilities are the first to be detected using deep learning methods.
One type of insurance that people purchase to cover unexpected medical expenses is health insurance. In exchange for premium payments, the insurance company may cover a portion of the insured person's medical expenses, such as prescription medications, hospital stays, and doctor visits. This method makes access to healthcare easier and less expensive. Health insurance systems do, however, have a number of issues, including fair insurance premium calculation, automation, data verification, privacy and security, and cost effectiveness. These issues are starting to be addressed by blockchain technology, particularly with the help of smart contracts. Using a comparison analysis between Ethereum and Optimism smart contracts, this paper demonstrates the performance of health insurance. Simulation of these BC technologies was carried out both on the Sepolia testnet and using Alchemy. Tools and metrics provided to monitor the performance of Alchemy applications, detect errors, and analyze user interactions were used in the measurements. While Ethereum's well-established ecosystem offers robust support for smart contracts, Optimism distinguishes itself as a scalable substitute that delivers quicker transaction speeds and more affordable options. According to the analysis results, the advantages and disadvantages of Ethereum and Optimism are highlighted when it comes to health insurance.
G. Sowmya, K. Alankruthi, Jami Harika, Thota Nagini · 6 authors
The technology of smart contracts will change the real estate sector forever through a greater efficiency and openness. The research investigates smart contracts as a possibility for dealing with real estate transactions, their elimination of the middleman, improved security and transparency of transactions. Besides the possibility of traditional procedures, smart contracts (self-executed agreements having the terms in the code of the contract) yield several benefits such as increased fraud prevention, automated execution of contracts, and immutable records. Through vivid examples of practical uses, this article points to legal and regulatory challenges to be addressed. It also underlines the working benefits of smart contracts in real estate. The paper’s conclusion consists of the investigation of the present boundaries and the descriptions of the further inquiries, emphasizing the possibility of smart contracts to be a game-changer in the real estate sector.
Smart contracts, self-executing agreements directly encoded in code, are fundamental to blockchain technology, especially in decentralized finance (DeFi) and Web3. However, the rise of Ponzi schemes in smart contracts poses significant risks, leading to substantial financial losses and eroding trust in blockchain systems. Existing detection methods, such as PonziGuard, depend on large amounts of labeled data and struggle to identify unseen Ponzi schemes, limiting their reliability and generalizability. In contrast, we introduce PonziSleuth, the first LLM-driven approach for detecting Ponzi smart contracts, which requires no labeled training data. PonziSleuth utilizes advanced language understanding capabilities of LLMs to analyze smart contract source code through a novel two-step zero-shot chain-of-thought prompting technique. Our extensive evaluation on benchmark datasets and real-world contracts demonstrates that PonziSleuth delivers comparable, and often superior, performance without the extensive data requirements, achieving a balanced detection accuracy of 96.06% with GPT-3.5-turbo, 93.91% with LLAMA3, and 94.27% with Mistral. In real-world detection, PonziSleuth successfully identified 15 new Ponzi schemes from 4,597 contracts verified by Etherscan in March 2024, with a false negative rate of 0% and a false positive rate of 0.29%. These results highlight PonziSleuth's capability to detect diverse and novel Ponzi schemes, marking a significant advancement in leveraging LLMs for enhancing blockchain security and mitigating financial scams.
The development of smart contracts remains in its early stages, with significant differences in underlying programming languages and application platforms resulting in a lack of standardization. This lack of standardization increases the susceptibility to vulnerabilities and associated financial losses. To address security vulnerabilities in smart contracts on the Ethereum blockchain platform, this paper proposes a security audit method based on formal verification. The method integrates an input module, static analysis module, formal verification module, analog execution module, and report and recommendation module, which can accurately discover the security vulnerabilities and logical flaws of smart contracts through formal verification and other analysis techniques, thus realizing correctness detection. During the experiment, the method detects 8 types of common vulnerabilities in 148 smart contracts and marks 21 smart contracts with vulnerabilities. After manual review and analysis, it is found that 17 of these 21 marked smart contracts do have security vulnerabilities. The experimental results show that the proposed method can accurately detect security vulnerabilities and logic flaws in smart contracts through formal verification and other analysis techniques before smart contracts are deployed, thus significantly improving the security of smart contracts and reducing the economic losses that may be caused by code defects.
The cryptocurrency market offers attractive but risky investment opportunities, characterized by rapid growth, extreme volatility, and uncertainty. Traditional risk management models, which rely on probabilistic assumptions and historical data, often fail to capture the market’s unique dynamics and unpredictability. In response to these challenges, this paper introduces a novel portfolio optimization model tailored for the cryptocurrency market, leveraging a credibilistic CVaR framework. CVaR was chosen as the primary risk measure because it is a downside risk measure that focuses on extreme losses, making it particularly effective in managing the heightened risk of significant downturns in volatile markets like cryptocurrencies. The model employs credibility theory and trapezoidal fuzzy variables to more accurately capture the high levels of uncertainty and volatility that characterize digital assets. Unlike traditional probabilistic approaches, this model provides a more adaptive and precise risk management strategy. The proposed approach also incorporates practical constraints, including cardinality and floor and ceiling constraints, ensuring that the portfolio remains diversified, balanced, and aligned with real-world considerations such as transaction costs and regulatory requirements. Empirical analysis demonstrates the model’s effectiveness in constructing well-diversified portfolios that balance risk and return, offering significant advantages for investors in the rapidly evolving cryptocurrency market. This research contributes to the field of investment management by advancing the application of sophisticated portfolio optimization techniques to digital assets, providing a robust framework for managing risk in an increasingly complex financial landscape.
There is a huge demand to ensure the compliance of smart contracts listed on blockchain platforms to safety and economic standards described in natural languages. Today, manual efforts in the form of auditing are commonly used to achieve this goal. ML-based automated techniques have the promise to alleviate human efforts and the resulting monetary costs. However, unlike other domains where ML techniques have had huge successes, no systematic ML techniques have been proposed or applied to smart contract auditing. We present SC-Bench, the first dataset for automated smart-contract auditing research. SC-Bench consists of 5,377 real-world smart contracts running on Ethereum, a widely used blockchain platform, and 15,975 violations of standards on Ehereum called ERCs. Out of these violations, 139 are real violations programmers made. The remaining are errors systematically injected by us to reflect the violations of different ERC rules. We evaluate SC-Bench using GPT-4 by prompting it with both the contracts and ERC rules. In addition, we manually identify each violated rule and the corresponding code site (i.e., oracle) and prompt GPT-4 with the information asking for a True-or-False question. Our results show that without the oracle, GPT-4 can only detect 0.9% violations, and with the oracle, it detects 22.9% violations. These results show the potential room for improvement in ML-based techniques for smart-contract auditing.
Smart contracts usually hold a large amount of digital assets, which can cause substantial losses if these contracts have vulnerabilities. Thus, it is essential to adequately detect possible vulnerabilities in smart contracts before deployment. There are many types of vulnerabilities in smart contracts, and different detection methods have their own unique advantages, some vulnerabilities may be more suitable for expert rule-based methods, while some vulnerabilities are more suitable for deep learning-based methods. A single detection method usually fails to fully use its ability to detect vulnerabilities. To address the above problems, we propose a composite approach named CDE-VD (Combining Deep Learning and Expert Rules for Smart Contract Vulnerability Detection) to improve the performance of vulnerability detection. The method divides smart contract samples into deep learning-prone sam-ples and expert rule-prone samples by classifying them before detection, and extracts expert rule features to train the smart contract detection method classifier to predict the category of the samples under analysis, then selects the suitable method for detection. The experimental results show that the vulnerability detection performance of CDE-VD outperforms that of single detection methods. Compared with the SOTA method MANDO, CDE-VD achieves average improvements of 3.22%, 2.32%, 9.25%, and 6.54% in terms of the Accuracy, Precision, Recall, and F1-score for five categories of vulnerabilities such as access control and time manipulation, respectively, which indicates that category prediction of the smart contract samples could improve vulnerability detection performance.
The substantial value held by smart contracts (SCs) makes them an enticing target for malicious attacks. The process of fixing vulnerabilities in SCs is intricate, primarily due to the immutability of blockchain technology. This research paper introduces a systematic literature review (SLR) that evaluates rectification systems designed to patch vulnerabilities in SCs. Following the guidelines set forth by the PRISMA statement, this SLR meticulously reviews a total of 31 papers. In this context, we classify recently published SC automated repair frameworks based on their methodologies for automatic program repair (APR), rewriting strategies, and tools for vulnerability detection. We argue that automated patching enhances the reliability and adoption of SCs, thereby allowing developers to promptly address identified vulnerabilities. Furthermore, existing automated repair tools are capable of addressing only a restricted range of vulnerabilities, and in some cases, patches may not be effective in preventing the targeted vulnerabilities. Another key point that should be taken into account is the simplicity of the patch and the gas consumption of the modified program. Alternatively, large language models (LLMs) have opened new avenues for automatic patch generation, and their performance can be improved by innovative methodologies.