This study addresses the persistent challenges of limited transparency and inefficiency in accounting information systems, particularly in the context of financial reporting and auditing. It aims to examine the role of blockchain in enhancing transparency and improving audit processes within accounting systems. The research adopts a systematic literature review approach by analyzing 43 selected academic articles and relevant industry reports published between 2019 and 2026. The analysis focuses on identifying key characteristics, mechanisms, and implications of blockchain adoption in accounting practices. The findings indicate that blockchain has strong potential to improve data transparency, traceability, and reliability through features such as distributed ledgers, immutability, and smart contracts. These characteristics support real-time financial reporting and enable more continuous and efficient audit processes. The study also identifies several implementation challenges, including regulatory uncertainty, high adoption costs, and limited professional expertise. Furthermore, this research proposes a conceptual framework integrating blockchain into accounting information systems to support better governance and decision-making. The study contributes to the growing discourse on digital transformation in accounting, particularly in emerging economies.
The Criminal Evidence Management System using Blockchain is designed to provide a secure, transparent, and tamper-resistant platform for managing digital criminal evidence throughout its lifecycle.Traditional evidence management systems rely on centralized databases, making them vulnerable to unauthorized access, data manipulation, and single points of failure.Such limitations can compromise the integrity of evidence and weaken the chain of custody during legal proceedings.To address these challenges, the proposed system leverages blockchain technology to ensure the authenticity, immutability, and traceability of digital evidence.The system employs Ethereum blockchain and Solidity smart contracts to securely record evidence-related transactions, while Python, Django, and Web3 facilitate seamless interaction between users and the blockchain network.Role-based access control enables administrators and investigating officers to perform authorized operations such as evidence submission, retrieval, and verification.Every transaction is permanently recorded on the blockchain, creating an auditable history that enhances accountability and prevents unauthorized modifications.The proposed solution improves the reliability and efficiency of evidence management by eliminating the risks associated with centralized storage and manual record-keeping.Through secure storage, transparent access, and automated verification, the system strengthens the chain of custody, increases trust among law enforcement agencies, and supports the admissibility of digital evidence in judicial processes, making it a robust solution for modern forensic investigations.
Hai Liang, Xiaoye Lu, Changsong Yang, Yujue Wang · 6 authors
Smart contracts are immutable programs that automatically execute predefined logic. Once deployed, their underlying vulnerabilities are notoriously difficult to patch and highly susceptible to malicious exploitation, often leading to severe financial losses. Although existing vulnerability detection methods have demonstrated certain advantages, they still fail to achieve adequate structural–semantic coverage of vulnerability-relevant behaviors, as they are unable to jointly model opcode semantics, control-flow transitions, and data-dependency relations. To overcome these limitations, this paper proposes a novel smart contract vulnerability detection model named Cross-aligned Penetrative Graph Network (CPGNet). Specifically, CPGNet first constructs control flow graphs and data flow graphs from the abstract syntax tree, and combines them with opcode semantic embeddings to form a multidimensional initial code representation. Based on this representation, a cross-alignment mechanism is introduced to effectively capture and integrate the complex interactions between control-flow transitions and data-flow dependencies. Furthermore, an explicit–implicit feature penetration architecture is designed to inject shallow local opcode patterns into the deep semantic modeling process, enabling multi-source features to dynamically complement each other. By jointly modeling opcode semantics, control-flow structures, and data-dependency relations, CPGNet significantly enhances the representation capability for hidden and complex vulnerability patterns. Experimental results on two datasets show that CPGNet achieves stable performance, with F1-scores of 88.69% and 90.58% on the benchmark Ethereum dataset, and 78.10% and 71.53% on DIVE for reentrancy and timestamp dependency detection, respectively. These results verify the effectiveness of jointly modeling opcode semantics and graph-level structural dependencies.
Carolina Gonzalez Cambero, PAULA LAMO ANUARBE, Javier Rainer Granados
The digital transformation of the insurance sector is advancing through hybrid architectures that integrate distributed ledgers, the Internet of Things (IoT), and artificial intelligence (AI). This paper proposes a hybrid IoT–DLT architecture for parametric insurance systems operating in environments with variable connectivity. The architecture is designed to ensure data verifiability, operational resilience, and regulatory compliance with the General Data Protection Regulation (GDPR) and the Digital Operational Resilience Act (DORA). The approach is validated through a maritime cold-chain monitoring use case for fishing fleets, based on onboard IoT sensors and smart contracts. Simulation results show that the proposed multi-sensor consensus mechanism enables accurate detection of thermal breaches while significantly reducing the number of blockchain transactions by reserving on-chain registration for critical events only. The proposed approach supports distributed, auditable, and operational insurance systems even under intermittent connectivity conditions. Keywords: hybrid architecture, blockchain, Internet of Things, artificial intelligence, parametric insurance.
Jegan R R, Poornachandran R, Raevanth M, Akash Karthik D
Background The online auction websites have become more susceptible to fraud, bid rigging, and centralization, rendering unfairness and lack of trust among the players. In this paper, we introduce a decentralized e-auction system, BlockBid, based on blockchain technologies and smart contracts that will ensure a safe, transparent, and non-tampering auction system. Objective The system distributes the risks of failure of single points by storing all the bids and transactions in an immutable distributed ledger, and avoids unauthorized changes. Smart contracts automate the rules of an auction and provide fair results without the involvement of the intermediaries. Materials and Methods BlockBid is also designed to combine sophisticated user authentication and encryption tools to safeguard sensitive data of participants, to reduce the chances of identity theft and tampering of bids. The framework allows various forms of auction such as English and sealed-bid and supports real-time tracking of bids and verifiable transaction history. Results According to the results of the experimental assessment, BlockBid increases system integrity, transparency, and the possibility of fraudulent actions is significantly lower than in the case of traditional centralized platforms. Conclusion The suggested solution reveals how the immutability of blockchain and automated regulation of the process will help redefine online auctions and offer an effective, reliable, and fair solution to the participants. The paper points at the opportunities of decentralized technologies to recreate secure digital marketplaces.
Nataliya Bilous, Danylo Ostapchenko, Iryna Ahekian, Marcus Frohme
Remote tele-rehabilitation requires objective pain assessment, but existing approaches fail in two distinct ways. Self-report scales such as the Visual Analog Scale and the Numeric Pain Rating Scale are easy to falsify, opening a special case of the Oracle problem in blockchain-based insurance. Cloud-based computer vision handles falsification but transmits raw biometric video off the patient’s device, violating privacy requirements. A decentralized Edge AI-Oracle architecture is proposed that combines MediaPipe Face Mesh landmark extraction with a recurrent classifier mapping Action-Unit feature sequences to a learned pain score aligned with the Prkachin and Solomon Pain Intensity scale. The recurrent cell is selected empirically across short-context (T = 2) and long-context (T = 120 frames at 24 fps) regimes, with a two-layer Long Short-Term Memory (LSTM) network adopted for deployment. Inference and Elliptic Curve Digital Signature Algorithm (ECDSA) signing run inside an ARM TrustZone Trusted Execution Environment (TEE). Biometric logs are stored off-chain on the InterPlanetary File System (IPFS). Smart contracts anchor results on-chain and open a 24 h optimistic verification window for an off-chain Watchtower auditor. On SynPAIN the LSTM reaches F1 = 0.683 on T = 120 video (leave-one-stratum-out), with a directional but non-significant advantage over Gated Recurrent Unit (GRU) (Wilcoxon p = 0.167). Cross-dataset validation on BioVid Heat Pain Database Part A (87 subjects, 174 paired observations, leave-one-subject-out) yields F1 = 0.519 for LSTM and 0.499 for GRU (Wilcoxon p = 0.549). A processor-only TEE surrogate benchmark estimates 1.96 ms (FP32) and 0.45 ms (INT8) inference latency at T = 120 with a 0.34 MB footprint and 707 µs ECDSA signing latency, leaving the INT8 inference latency more than an order of magnitude below the 33 ms per-frame budget. The dual-layer storage reduces gas costs by a factor of 23.4 (160,261 vs. 3,744,872 gas), corresponding to an illustrative mainnet cost of approximately 0.53 USD per submission at 1 gwei, rising to roughly 16 USD at a busier 30 gwei, and falling to approximately 0.005 USD on Arbitrum One (April 2026 reference parameters), so that continuous monitoring is economically practical on Layer-2. An adaptive-adversary analysis of the Watchtower shows that gross score tampering is detected at every usable operating threshold, whereas a rational adversary who inflates by less than the dispute threshold, or who shapes the injected score to fall just inside it, evades detection. Because the false-positive rate reaches zero only for δ≳0.15, the protocol bounds rather than eliminates patient-side fraud and motivates a zero-knowledge proof-of-inference successor. The framework is architecturally and economically feasible as a cryptographically verifiable, privacy-preserving tele-rehabilitation substrate aligned with General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) requirements through the Zero-Video Transmission principle, while remaining economically viable under post-Dencun mainnet and Layer-2 conditions. Recognition accuracy on real-world data and robustness to small-magnitude tampering remain limitations that the interchangeable recognition and audit components must improve before clinical deployment.
Abstract Bitcoin was the breakthrough innovation demonstrating peer-to-peer transfer of value without a central bank and has since expanded to countless innovations such as smart contract applications, decentralized finance protocols and asset tokenization. The EU is moving from scattered state-specific rules governing cryptocurrency activities to a coherent European regulatory regime. This paper review the transition to a harmonized framework in 2024-2025 from a doctrinal-institutional perspective, unpack how to carry out the three main legislative instruments: MiCA, TFR on information accompanying transfers of funds and transfers of certain crypto-assets and amending the EU directive and the EU AML package . Moreover, I look at the implications of DAC8 for the tax treatment of crypto-assets and tokenized assets. In 2025, the market begins institutionalizing, as MiCA requires significant compliance measures in terms of governance, transparency and conduct for CASPs to get licensed. Moreover, in conjunction with the new TFR rules, compliance for CASPs, at least in the business models discussed, effectively transforms into an operational infrastructure issue revolving around data quality, process efficiency and interoperability. By way of comparison, I analyze eight example business models in eight representative EU markets that appear to be impacted. These include: two major exchanges, two broker-dealers offering cryptocurrency on trading platform, a provider of non-custodial software wallets, two DeFi protocol participants and two NFT platform providers. These fall into three general categories depending on their legal status, direct regulatory burden and level of engagement with decentralized technologies. Finally, harmonized regulatory frameworks like the one outlined for the EU increase operational fixed costs and favor consolidation, reduce the benefits for regulatory arbitrage and thereby boost user protection, although part of innovation may pivot towards B2B solutions.
Abstract Smart contracts are the fundamental building block of decentralized applications (DApps) and decentralized finance (DeFi). However, their immutability makes security flaws exceptionally costly. Despite advancements in vulnerability detection, such as static and dynamic analysis, formal verification, and Solidity language improvements, vulnerabilities continue to result in substantial financial losses, exceeding $2 billion in 2024 alone. This paper presents a comprehensive analysis of smart contract vulnerabilities derived from real-world exploits, systematically categorized into seven distinct types. Each category is illustrated with Solidity code examples and insights from notable exploits. An Enhanced test suite is developed by restructuring the existing solidity-defects-and-bugs suite and supplementing it with new smart contract implementations to address underrepresented vulnerabilities, including flash loan and price oracle manipulation. We evaluate three widely used analysis tools (Slither, Mythril, and 4naly3er) on both the original and Enhanced suites, revealing substantial limitations in detection coverage. To address these limitations, we introduce the Solidity Defects and Bugs Analysis (SDABA), which incorporates advanced analyses and detectors to identify 28 vulnerability variations across both suites. Results on the SDB and Enhanced test suites show that SDABA improves overall precision, recall, and F1-score compared with the evaluated tools. Finally, we release the source code, test suite, and vulnerability reports to support future research in smart contract security.
Ethereum sebagai platform smart contract banyak digunakan untuk dApps, namun Ethereum (Layer 1) masih menghadapi kendala skalabilitas ketika aktivitas transaksi meningkat, yang berdampak pada kemacetan jaringan, naiknya latensi, dan biaya transaksi yang tinggi. Makalah ini menyajikan kajian literatur yang berfokus pada rollups sebagai solusi utama Ethereum Layer 2 untuk mengurangi beban pemrosesan transaksi pada Layer 1. Metode yang digunakan adalah literature review terarah dengan sintesis tematik terhadap literatur yang membahas: sumber masalah skalabilitas di Ethereum Layer 1, konsep dan arsitektur rollups, perbedaan Optimistic Rollups dan Zero-Knowledge Rollups, serta tantangan implementasi rollups pada kondisi nyata. Hasil kajian menunjukkan bahwa rollups menjadi pendekatan dominan karena menggabungkan transaksi dalam batch untuk diproses di Layer 2, lalu melaporkan ringkasan/bukti ke Layer 1 sehingga efisiensi biaya dan kapasitas transaksi meningkat. Namun, efektivitas rollups bergantung pada aspek operasional dan keamanan seperti ketersediaan data, mekanisme penarikan dana, serta risiko ketergantungan pada operator/penyedia infrastruktur. Secara keseluruhan, rollups efektif sebagai solusi skalabilitas Ethereum, tetapi memerlukan penguatan desain keamanan dan keandalan operasional agar dapat diadopsi lebih luas.
Ms. Sanskruti Pawaskar, Mr. Harsh Shinde, Mr. Ruturaj Laad, Vaishali Gatty
Decentralized finance has disrupted the lending process by transferring the intermediary role from institutionally-led balance sheets into a public ledger framework of smart contracts, pooled liquidity, and tokenized governance. The relevance of such a change in the lending paradigm is more of a question of different trust mechanisms, where the solvency of actors can be maintained through the imposition of collateral and automated processing [1][3]. A qualitative comparison is made below through a literature-constrained synthesis of five sources on DeFi architecture, flash loan exploits, lending protocol structure, decentralized governance flaws, and extractable value [1]-[5]. The two protocols of Aave and Compound have been selected for being representative DeFi lending cases, as per the allowed literature that points them out to be the top loanable funds protocols, having liquidity pools and variable rates [1][3]. This comparison is made against CeFi as an institution-driven reference point rather than other DeFi lending protocols owing to the asymmetry of the evidence base. Three conclusions are drawn.Second, the risk architecture of DeFi lending is structurally different from other financial institutions in that flash loans, dependence on oracle feeds, smart contract weakness, composable nature, extractable value, and governance capture are not mere flaws in DeFi but inherent aspects of open and highly coupled financial systems [2][4][5]. Third, governance in DeFi is an additional security mechanism, as the governance of protocol control, parameters and responses to emergencies rests on the robustness of token-based decision-making mechanisms [4].
Introduction: Decentralized autonomous organizations (DAOs) are an emerging organizational form that operates entirely on blockchain infrastructure. Within a DAO, organizational governance rules are hardcoded in transparent and immutable smart contracts. In principle, these rules are intended to facilitate decentralized decision-making among token holders who collectively create, discuss, and vote on proposals that govern the organization. Despite their promise, the extent to which DAOs achieve true decentralization in practice remains unclear. This study addresses an underexplored area in the literature by empirically investigating key aspects of DAO governance, particularly the degree of decentralization and participant composition.Method: Network analysis is used to examine proposal voting coalitions among participants as a proxy for decentralization. Sentiment analysis is employed to assess trust among participants. The analysis draws on data from 54 DAOs, including 774 unique proposals and 13,085 associated token holder comments.Results: The findings indicate that DAOs may not achieve the level of decentralization originally envisioned. Moreover, decentralization and participant composition within governance structures play a critical role in shaping trust, voting participation, and overall financial performance in DAOs PracticalImplications: Although current voting mechanisms aim to reduce the dominance of large token holders (whales), DAOs may still fall short of the level of decentralization originally envisioned. Accordingly, more advanced voting mechanisms may be required to further mitigate coordination and strategic behavior in proposal voting. In addition, DAOs could benefit from adjusting the threshold requirements for the Foundation to improve accessibility for token holders and encourage broader participation. Leveraging artificial intelligence (AI) may also help streamline the voting process and improve the clarity of proposals.
The rapid development of blockchain has given rise to smart contracts that challenge traditional legal doctrine, even though the technology is crucial to supporting SDGs (Sustainable Development Goals) 9 and 16. Purpose: This study aims to analyze smart contract governance in Indonesia, Malaysia, and Thailand to support the achievement of the SDGs in the region. Method: A normative-comparative legal method is used with a socio-legal approach. This study examines the synchronization of regulations and the socio-institutional impacts. Results: The validity of smart contracts in the three countries is interpretative due to the lack of specific regulations. The self-executing and immutable nature triggers doctrinal tensions related to agreements and consumer protection, which are increased by the digital literacy gap. Conclusion: Smart contract governance in Southeast Asia requires an adaptive regulatory strategy that balances innovation and legal certainty. Suggestion: Authorities are expected to develop co-regulation-based regulations, strengthen digital institutions, and initiate regional legal standardization across ASEAN (Association of Southeast Nations). Contributions: The contribution is in the development of a blueprint for regional digital law harmonization that integrates aspects of dogmatic law with legal sociology. This study offers a model for ASEAN legal standardization that bridges technological innovation with social justice and provides indicators of institutional readiness replicated by developing countries in embracing an inclusive and sustainable digital economy.
Md. Safaet Hossain, Mohammad Shakibul Hasan Sakib, Md. Rayhan Ahmed Shis, Sakib Ahmed · 5 authors
Modern food supply chains, particularly those involving essential commodities like rice, often suffer from major challenges such as product fraud, inefficient record-keeping, and a lack of consumer trust. Traditional centralized systems are prone to data tampering, limited transparency, and poor traceability, making it difficult to verify the authenticity and origin of goods. To address these issues, our research introduces TraceRoot, a blockchain-based traceability framework designed to enhance transparency, accountability, and trust in agricultural supply chains.TraceRoot leverages the immutability and decentralization of blockchain technology to maintain a secure, distributed ledger that records every transaction and movement of goods across the supply chain. Each stakeholder including farmers, distributors, retailers, and consumers has role-based access to authenticated data through a user-friendly interface. The framework integrates smart contracts to automate transactions and digital signatures to verify the integrity of the data being uploaded, minimizing the risk of human error or manipulation
Smart contracts have attracted rapid development and widespread application. Due to the complexity of real-world smart contracts, it is error-prone to correctly enforce all intended functionalities in code implementations, resulting in unintended functional behaviors and security issues in practice. Code-comment inconsistency detection has emerged as an important solution to these issues, which leverages the redundant functional specifications in comments to detect code implementations that violate developers' intentions. However, existing inconsistency detection solutions are typically pattern-based and limited to fixed types of inconsistencies, which prevents them from detecting the diverse inconsistencies between real-world code implementations and casually written comments. To bridge the gap, this paper presents SmartComment, the first technique that combines LLMs with program analysis techniques for detecting code-comment inconsistencies in smart contracts. SmartComment introduces an LLM-driven workflow which simulates real-world interactions between code reviewers and developers to identify inconsistencies. It incorporates various program analysis techniques into the workflow, including comment propagation and code context extraction for generating input context for inconsistency detection, as well as program variant generation and differential analysis for inconsistency confirmation. Our evaluation results show that SmartComment detects 203 valid inconsistencies from a dataset of 1,000 real-world contracts with a precision of 79.9%, highlighting its effectiveness in detecting prevalent and diverse real-world inconsistencies. Compared to previous work, SmartComment achieves both higher precision and recall, detecting over 90% of inconsistencies that existing methods fail to identify. Furthermore, an ablation experiment demonstrates the effectiveness of incorporating program analysis techniques into SmartComment, improving the F1-score from 58.7% to 81.3%.
The global dairy industry confronts a persistent structural challenge in operationalising food safety and animal welfare compliance. Manual inspection regimes and intermittent audits are demonstrably inadequate for the heterogeneous, geographically dispersed landscape of small-scale farming, where data integrity, real-time monitoring capability, and regulatory transparency are simultaneously compromised. This article presents GreenDairyChain, an integrated compliance innovation framework that synthesises four enabling technologies: GreenEdgeML (a lightweight TinyML inference engine optimised for microcontroller-class devices), Privacy-Preserving Federated Learning (FL) with Graph Attention Network (GAT)-based dynamic clustering, Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (ZK-SNARKs) for cryptographic compliance verification, and a Layer-2 Polygon zkEVM Blockchain with domain-specific smart contracts governing farm identity, violation detection, audit triggers, and licence management. GreenEdgeML executes multimodal sensor fusion across four signal modalities (body temperature, accelerometer activity, ammonia concentration, and milk pH) entirely on-device using 8-bit integer quantisation, consuming 64.6 KB RAM and 82.7 mW per inference cycle on the ESP32 platform. The FL engine employs GAT-based farm clustering with DBSCAN outlier exclusion to address non-IID data heterogeneity while maintaining Byzantine fault resilience. Compliance inferences are encoded as R1CS arithmetic circuits (14,240 constraints) and verified on-chain at O(1) cost through ZK-SNARK proofs generated in 1.25 seconds. Evaluated on the Shahhet28121 benchmark dataset across 16 biomarkers, the full system achieves 96.94% global classification accuracy, a 97.7% reduction in per-round communication payload (4.25 KB), and maintains classification accuracy above 90% under 20% Gaussian sensor noise. Ablation experiments confirm that each architectural component contributes independently to system performance. The findings carry implications for green business innovation, sustainable agriculture governance, and the design of trustworthy AI ecosystems in resource-constrained rural contexts.
Jianzhong Su, Mingxi Ye, Jiachi Chen, Yuhong Nan · 7 authors
With the rapid development of decentralized applications, many malicious actors exploit smart contract vulnerabilities for launching attacks. Moreover, as smart contracts utilize more state variables to support complex functionalities, some vulnerabilities require specific states to trigger (marked as vulnerable states), bringing new challenges to the vulnerability detection task. Although many smart contract fuzzers have been proposed for this task, they face limitations due to their inability to efficiently explore smart contract states. To address this challenge, we propose a novel fuzzer, Odyssey, with fine-grained state modeling and exploration, which increases the probability of reaching vulnerable states. We improve the efficacy of the fuzzer with two key mechanisms: (1) modeling an essential state space consisting of the variables related to sensitive operations to compress the exploration scope; (2) designing state-aware exploration strategies to identify test seeds that cover new state scope or cause new state transitions, to improve the efficiency of exploration. To evaluate the performance in vulnerability detection, we adopt Odyssey to a labeled benchmark consisting of 130 vulnerable contracts. Odyssey detects at least 70% more vulnerabilities than other fuzzers. Moreover, we evaluate Odyssey on a dataset that consists of 143 DApps (involving 437 contracts) from real-world security incidents. The experimental results demonstrate that state-aware feedback enhances the ability of Odyssey in state exploration by achieving 19% higher state coverage. Meanwhile, Odyssey totally finds 15 exploits of vulnerabilities from real-world attacks, showing its advantage in detecting real-world vulnerabilities.
Victoria Kovalenko, Sergii Sheludko, Elena Sergeeva
In the context of the unprecedented pace of digital transformation and the escalation of geopolitical risks, traditional methods of monetary regulation require a fundamental reconsideration. Problem statement. The evolution of cyber threats – from financial fraud to complex operations involving artificial intelligence – poses significant risks to macroeconomic stability. The development of an integrated protection system based on central bank digital currencies (CBDCs) and SupTech instruments constitutes a critical prerequisite for preserving financial sovereignty, particularly for Ukraine in the context of European integration and martial law. Unresolved aspects of the problem. The theoretical substantiation and development of practical recommendations for integrating advanced digital instruments (CBDC, artificial intelligence, distributed ledger technology (DLT), and SupTech) into monetary and prudential policy mechanisms in order to form a comprehensive cybersecurity framework for the financial sector remain insufficiently addressed. Purpose of the article. The purpose of this article is to provide a theoretical substantiation and to develop practical recommendations for integrating modern digital instruments (such as artificial intelligence, blockchain technologies, and SupTech) into monetary and prudential policy mechanisms in order to establish a comprehensive cybersecurity system for the financial sector. The study is grounded in a systemic approach to analysing the coordination of regulatory policies. The methodology includes comparative legal analysis (comparing the models of the e-hryvnia and the Digital Euro), structural and functional modelling (two-tier CBDC architecture), and scenario analysis to identify cyber risks (including DDoS attacks and smart contract vulnerabilities) and methods for their mitigation. Presentation of the main material. A model of hybrid coordination has been developed, in which cybersecurity is integrated directly into the mechanism of monetary transmission. It has been demonstrated that the programmability of the e-hryvnia and the application of Zero-Knowledge Proofs (ZKP) technologies enable the automation of prudential supervision while preserving user privacy. Global case studies (China, the European Union, and the Bahamas) have been analysed, and the specific features of the Ukrainian e-hryvnia project have been identified as instruments for enhancing transparency and cyber resilience. For the first time, it is proposed to consider a central bank digital currency not only as a means of payment but also as an active element of the cyber-prudential system, enabling the dynamic adjustment of liquidity and limits under conditions of real cyberattacks. The concept of convergence between SupTech and RegTech systems based on unified distributed ledgers has been further developed. The proposed architectural model and cyber-risk matrix may be utilised by the National Bank of Ukraine in the finalisation of the e-hryvnia project and in the development of digital operational resilience standards in accordance with the DORA regulation. Conclusions. It has been demonstrated that digitalisation transforms the regulator into an architect of a secure financial environment. Further research will focus on the interoperability of CBDCs across countries and the role of artificial intelligence in preventing manipulation in digital asset markets.
Open access
Digital Transformation in Financial Services
Legal, Health, Environmental and COVID-19 Challenges
Smart contracts underpin a wide range of decentralized applications—from financial services to supply-chain management—but their immutability and direct control of assets magnify the impact of any security bugs. Although many fuzz approaches have been proposed and have demonstrated their effectiveness in uncovering vulnerabilities, existing methods often rely on unguided random mutation scheduling, generate redundant inputs, and fail to adapt to smart contract-specific characteristics. To overcome these challenges, we present FuzzMaster, a feedback-driven fuzzing framework that combines deep reinforcement learning (DRL) with lightweight probabilistic scheduling to steer mutation selection at runtime intelligently. By continuously analyzing execution feedback—code coverage, function-call sequences, and vulnerability signals—FuzzMaster’s DRL agent and probabilistic tables prioritize high-impact mutations and avoid wasted effort on redundant seeds. On standard VeriSmart and SmartBugs benchmarks, FuzzMaster achieves a 66.2% detection rate with 100% precision (versus 46.9% for ItyFuzz and 43.1% for Confuzzius) and uncovers most bugs within the first second of execution. Meanwhile, in real-world Ethereum contracts, FuzzMaster identified 97 vulnerabilities in 6 categories. These results demonstrate that dynamic, vulnerability-aware mutation scheduling can dramatically improve both the efficiency and effectiveness of smart contract fuzz testing.
The rapid increase in distributed mobile e-learning systems has resulted in numerous security threats, including student data protection, secure access, transparency, and decentralized education management. Traditional cloud-based e-learning systems have been prone to various risks, such as centralization vulnerability, data access violations, identity theft, and lack of scalability in a highly variable wireless learning environment. This paper proposes a blockchain-integrated, privacy-preserving, distributed mobile e-learning architecture for securely and autonomously managing student data. In this framework, blockchain technology will be used for ensuring a decentralized ledger, lightweight cryptography, smart contract-based authentication, and distributed data storage. Blockchain transaction verification, data encryption and sharing, distributed data storage, and smart contract execution are the methodologies utilized by this system to ensure secure academic record and activity management in a mobile environment. The evaluation of the proposed architecture will involve performance measurement of the following parameters: authentication accuracy, privacy protection capability, transaction processing speed, throughput, and data storage efficiency. It was revealed from experimental studies that the suggested approach provided 98.3% in terms of identification, 97.5% in relation to data privacy protection, and 91.8% concerning storage efficiency compared to other methods, including traditional cloud-based learning systems and previous blockchain-based education platforms. In addition, the suggested system enabled reducing the transaction time to 190 ms and increasing the throughput speed up to 465 transactions per second, which proves its high efficiency and capability of functioning in a distributed wireless environment. Therefore, it can be stated that introducing blockchain technology in distributed mobile e-learning systems enhances the level of privacy, resilience against malicious attacks, traceability, and autonomy in controlling personal information. The introduced concept provides a basis for designing a highly reliable and scalable framework for the future generation of wireless educational communities based on the management of decentralized and reliable data.
Health care data management comes with numerous barriers as a result of the use of different systems of record keeping, which are not compatible and increase the risks for data protection and privacy. Medical records are frequently distributed throughout various clinics and hospitals, and due to this it is hard to share information when patients are being treated. Centralized record systems bring unauthorized access to records and the problems related to the safety of data. In order to enhance the level of confidence of people and improve the level of transparency of health care data, advanced people choose decentralized technologies and uses cryptography for these purposes. Blockchain technology offers an unchangeable and decentralized ledger that guarantees safe monitoring of all information despite the presence of any centralized body. Coupled with sophisticated encryption methods, it provides the ability to limit access to private health information. In order to provide secure and respect privacy regarding medical data sharing, an Electronic Health Record (EHR) system powered by blockchain technologies is proposed. Patient record metadata is recorded on-chain while health data itself is stored on encrypted off-chain storage. In the realm of access management, smart contracts facilitate patients in designating by whom their records can be accessed and modified. The privacy of information is further strengthened by advanced cryptographic techniques like attribute-based encryption and zero-knowledge proofs. The system provides seamless interoperability among hospitals, laboratories, and telemedicine systems while ensuring high levels of security. The results of performance evaluation demonstrate that this method facilitates reliable transaction processing while providing better security, transparency and control than traditional centralized EHR systems.
Smart contracts have achieved significant success, however, their security remains a long-standing challenge. The immutability and transparency of smart contracts require establishing a strong mechanism to prevent private leakage and trusted data tampering. Apart from traditional logic and code-level vulnerabilities arising from insufficient control over contract variables and function parameters, smart contracts may store private-dependent information in blockchain records, which is a critical type of vulnerability, but often overlooked in existing security analysis. In this paper, we present an automated approach for synthesizing security policies, named SmartIFSyn, to eliminate information flow vulnerabilities in smart contracts. We formalize the semantics of Solidity, the most widely used smart contract language, and analyze information flow security of Solidity smart contracts from two perspectives: local-variable security and global-interaction security. We present a type system to guide the elimination of local-variable vulnerabilities by inferring a policy and resort to constraint solving to synthesize a desired policy in case that the type system fails. The policy ensures both local-variable and global-interaction security while it is maximally aligned with user preference. Furthermore, the policy can be subsequently converted into enforceable specifications. We implement our approach in a tool and evaluate it on 17,160 real-world Ethereum smart contracts. The experimental results demonstrate the efficacy of our approach, e.g., detected 243 vulnerabilities in 223 real-world Ethereum smart contracts.
Democratic electoral processes rely fundamentally on the integrity, transparency, and confidentiality of vote recording and tallying. Conventional centralized e-voting infrastructures are susceptible to single-point-of-failure attacks, insider manipulation, and audit opacity, undermining public confidence in electoral outcomes. This paper proposes a novel blockchain-based e-voting architecture that integrates a hybrid consensus mechanism combining Practical Byzantine Fault Tolerance (PBFT) and Proof-of-Authority (PoA) to achieve simultaneously high transaction throughput, low confirmation latency, and strong Byzantine fault resilience. The system employs RSA-based digital signatures, zero-knowledge proofs (ZKP) for voter anonymity, and Ethereum-compatible smart contracts encoded in Solidity for automated ballot management and tamper-evident tallying. The proposed framework is evaluated through a simulated electoral environment involving up to 50,000 concurrent voters, demonstrating a peak throughput of 8,750 transactions per second (TPS), an average vote confirmation latency of 0.22 seconds, and a fault tolerance threshold of up to f = (n−1)/3 Byzantine nodes. Comparative analysis against Ethereum Proof-of-Work, standard PBFT, Hyperledger Fabric, and centralized database voting systems confirms that the proposed hybrid approach outperforms all baselines across throughput, latency, security, and scalability dimensions. The system achieves 97.8% integrity assurance and 95.3% voter anonymity preservation under adversarial network conditions, establishing a practically deployable, auditable, and voter-verifiable e-voting solution suitable for national-scale elections.
Lei Yu, Jingyuan Zhang, Xin Wang, Li Yang · 6 authors
Smart contracts automate the management of high-value assets, where vulnerabilities can lead to catastrophic financial losses. In the task of automated smart contract generation using Large Language Models (LLMs), this challenge is amplified by two interconnected failures: first, they operate as unauditable "black boxes" by failing to produce a transparent reasoning process, and second, as a consequence, they generate code riddled with critical security vulnerabilities. To address both issues, we propose SmartCoder-R1 based on Qwen2.5-Coder-7B, a novel framework for secure and explainable smart contract generation. It begins with Continual Pre-training (CPT) to specialize the base model on the nuances of smart contract code. To construct the data for subsequent stages, we first prompt the DeepSeek model to generate reasoning-and-code samples from verified on-chain contracts, followed by a rigorous validation process where each sample is manually reviewed by security experts for compilability, functionality, security, and reasoning completeness. Based on this, we then apply Long Chain-of-Thought Supervised Fine-Tuning (L-CoT SFT) on 7,998 of these expert-validated samples to train the model to emulate human security analysis. Finally, to directly mitigate vulnerabilities, we employ Security-Aware Group Relative Policy Optimization (S-GRPO), a reinforcement learning phase that refines the generation policy using 1,691 samples by optimizing a weighted reward signal for compilation success, security compliance, and format correctness. Evaluated against 18 state-of-the-art baselines on a challenging benchmark of 756 real-world functions from 289 deployed contracts, SmartCoder-R1 establishes a new state of the art by achieving top performance across five key metrics: a ComPass of 87.70%, a VulRate of 8.60%, a SafeAval of 80.16%, a FuncRate of 53.84%, and a FullRate of 50.53%. This FullRate marks a 45.79% relative improvement over the strongest baseline, DeepSeek-R1. Crucially, its generated reasoning also excels in human evaluations, achieving high-quality ratings for Functionality (82.7%), Security (85.3%), and Clarity (90.7%).