Smart contracts, self-executing agreements written in code, are increasingly prevalent in decentralized applications (dApps). However, their immutable nature and complex logic make them vulnerable to security breaches, leading to significant financial losses and reputational damage. Traditional security auditing methods, relying heavily on manual code review and fuzzing, are often insufficient in uncovering subtle vulnerabilities. This paper proposes a novel approach to smart contract security auditing utilizing formal verification. We represent smart contracts as formal specifications and employ formal verification tools to rigorously analyze their behavior and detect potential security flaws. The core claim is that leveraging formal verification techniques significantly enhances the security and reliability of smart contracts. The core mechanism involves translating the contract's logic into a formal language, allowing automated verification against predefined security properties. This approach addresses the limitations of traditional auditing, providing a more comprehensive and reliable assessment of smart contract security. The research contributes to a proactive security strategy for smart contract development, reducing the risk of vulnerabilities and fostering greater trust in decentralized systems.
Blockchain technology has garnered significant attention for its potential to revolutionize various industries. A critical component of blockchain is its consensus mechanism, which ensures the integrity and reliability of the distributed ledger. However, current blockchain consensus protocols are frequently characterized by their complexity, making formal verification challenging. This paper addresses this challenge by presenting a formal model of a blockchain consensus protocol using process calculi. Specifically, we utilize the Temporal Temporal Calculus (TCC) formalism to represent the protocol's state transitions and interactions. This approach allows for a rigorous analysis of the protocol's correctness, security, and efficiency. The model captures key aspects such as node participation, transaction validation, and block creation. The use of process calculi offers a precise and unambiguous description of the protocol, facilitating the identification and mitigation of potential vulnerabilities. This work contributes to a foundational understanding of blockchain consensus and paves the way for improved protocol design and enhanced security assurances.
The increasing prevalence of smart contracts in decentralized applications necessitates robust methods for ensuring their correctness and security. Smart contracts, due to their inherent complexity and potential for subtle errors, pose a significant challenge for traditional verification techniques. This paper proposes a novel approach combining symbolic execution with constraint solving and temporal logic verification for the systematic analysis of smart contracts. The core idea is to systematically explore the execution paths of a smart contract using symbolic execution, identifying potential vulnerabilities and execution scenarios. Subsequently, temporal logic is applied to formally verify that the contract's behavior aligns with its intended specifications over time, capturing temporal constraints such as safety and liveness properties. This integrated framework provides a more comprehensive and reliable method for verifying smart contracts compared to relying solely on symbolic execution or temporal logic alone. The approach offers a structured methodology for detecting and mitigating risks associated with smart contract development.
Blockchain technology has garnered significant attention as a revolutionary distributed ledger system. However, the security and efficiency of blockchain consensus protocols – the mechanisms that ensure agreement among nodes – remain a critical concern. These protocols are often characterized by intricate designs and complex interactions, making traditional testing methods insufficient to guarantee their robustness. This paper proposes a novel approach to formally model and verify blockchain consensus protocols using symbolic execution. Symbolic execution allows us to systematically explore all possible execution paths of a protocol, identifying potential vulnerabilities, inefficiencies, and deviations from the intended behavior. By representing variables with symbolic values rather than concrete values, we can create a comprehensive model that captures the protocol's logic without being constrained by specific data. This approach offers a rigorous and automated method for assessing the security and performance of blockchain consensus protocols, ultimately contributing to the development of more trustworthy and reliable decentralized systems.
Blockchain technology relies fundamentally on consensus mechanisms to ensure data integrity and prevent fraud. However, the inherent complexity of these mechanisms often leads to subtle vulnerabilities that can be exploited. This paper presents a novel approach to blockchain security by developing a formal specification language and accompanying verification tools. We aim to rigorously analyze and verify the security and performance of various blockchain consensus protocols, including Proof-of-Work (PoW) and Proof-of-Stake (PoS). The methodology employs mathematical modeling and logical reasoning to identify potential weaknesses and assess protocol robustness. The developed tools facilitate a systematic examination of protocol behavior under various conditions, ultimately leading to the design of more secure and reliable decentralized systems. This work offers a significant advancement in the field by providing a concrete framework for formal verification, moving beyond anecdotal evidence and subjective assessments. The core claim of this paper is that blockchain consensus mechanisms are complex and prone to vulnerabilities, and the proposed approach provides a mechanism to address this issue.
Authentication in Web 3.0 faces a structural conflict. Systems that offer full anonymity leave no lawful way to identify a malicious actor. Systems built for accountability expose a persistent wallet address to blockchain-graph analysis, or fall back on centralized key recovery. Existing designs solve one side of this conflict at the cost of the other. This paper presents PEUAP-W3, a Privacy-Enhanced and User-centric Authentication Protocol. Its contribution is the integration of five established components into a single deployed and formally analyzed system. A Circom 2 circuit of 1579 Groth16 constraints proves four facts in a single 192-byte on-chain proof: knowledge of an opening of the session credential commitment, an SpO2 value inside an 85–100% band, single-use nonce binding, and HMAC integrity. Shamir (k = 2, n = 3) sharing distributes the identity payload across three independent relays. The coordinator reconstructs an identity only after a threshold vote has been recorded on chain. Credentials are issued as W3C Verifiable Credentials 2.0 in did:key form. Four Solidity contracts verify the proof on Ethereum Sepolia. Verification costs about 241,000 gas and takes roughly 3 ms. ProVerif and Scyther find no attack under the Dolev–Yao model. A concurrency sweep to 500 simultaneous requests completes 1191 requests with zero failures at about 15.4 requests per second. A behavioral gate screens commodity abuse as a supplementary control; it is not treated as a security boundary. Against a nine-property framework, PEUAP-W3 satisfies six properties. Three remain conditional and are not verified in the current deployment: biological-origin assurance and digital replay prevention, both of which need an attested sensor; and GDPR erasure equivalence. Here, formally verified refers to the protocol models and theorems, not to the complete deployed software.
Centralised cloud authentication and authorisation commonly rely on a trusted server for identity, policy enforcement, and audit logging, which can increase the impact of compromise and complicate tamper-evident accountability. This paper presents a decentralised biometric authentication and authorisation framework that integrates fingerprint minutiae verification with Ethereum smart contracts and IPFS-based off-chain storage. Biometric templates are processed off-chain using a NIST NBIS-based pipeline ( MINDTCT minutiae extraction and Bozorth3 matching) and protected via SHA-256 hashing, zlib compression, and authenticated encryption (Fernet), while the blockchain stores only integrity metadata (hashes and IPFS content identifiers) and authorisation state. To mitigate replay attacks without introducing additional session-creation transactions, the framework uses a domain-separated request-binding hash ( tokenHash ) over the caller, nonce, timestamp, chain id, and contract address, validated on-chain together with one-time nonce consumption. A prototype was implemented using Solidity on a local Ethereum-compatible test network (Ganache), with Python/Web3 tooling and an IPFS-compatible content-addressed storage interface. Biometric performance is reported using standard metrics (FAR/FRR/EER and ROC/DET curves) on SOCOFing and FVC2002/FVC2004 benchmarks. In the core blockchain experiment, the proposed single-call attendance workflow required 74,773 gas while adding nonce-based replay protection and auditable authorisation checks on top of CID/hash anchoring (the separate literature benchmark reports end-to-end call-path gas under a shared harness). Compression reduces encrypted-template storage by approximately 76–84% across tested dataset sizes. Security analysis and attack simulation show that replay attempts (nonce/token reuse), unauthorised access, and off-chain payload tampering are rejected under the stated threat model.
Banik and Kumar (Journal of Information Security and Applications 2023) proposed a blockchain-based public key encryption with keyword search for medical data sharing in cloud environments. In this comment paper, we show that the Banik-Kumar scheme leaks keyword information from both ciphertexts and trapdoors.