Contract Code Research Articles

SVScanner: Detecting smart contract vulnerabilities via deep semantic extraction

Blockchain is a significant advancement in technology recently, transforming the traditional centralized system into a decentralized one. Smart contracts, as one of the best applications of blockchain, show great potential in various fields, such as finance, supply chain, and the Internet of Things (IoT). As the world’s first blockchain platform to support turing complete smart contracts, Ethereum has become the most critical infrastructure for the digital world. However, with the vigorous development of smart contracts, malicious attacks against smart contracts have frequently occurred in recent years. The issue of smart contract security has attracted widespread attention due to the huge financial losses caused by smart contract vulnerabilities. Although researchers have made some progress in detecting smart contract vulnerabilities through symbolic execution and fuzzing-based methods, existing methods mainly rely on expert knowledge and hand-crafted features, leading to many detection errors. Even worse, existing methods take tens of seconds or even minutes to detect each smart contract on average, which is extremely time-consuming. In this work, we present SVScanner, the new method combining two features of heterogeneous patterns to detect smart contract vulnerabilities in the blockchain. Specifically, we first extract global semantic features from the sequence of contract code tokens. Then we further use the attention mechanism to capture deep structural semantics from the Abstract Syntax Tree (AST) of smart contracts. Finally, we combine these two features from different patterns and use a text convolutional neural network (TextCNN) to detect contract bugs. Experimental results show that SVScanner has the ability to detect vulnerabilities effectively in real-world smart contract datasets. SVScanner achieves a 7.33% improvement in accuracy compared with other traditional methods. Moreover, our method requires significantly less detection time.

Smart Contracts-Based Demand Response Bidding Mechanism to Enhance the Load Aggregator Model in Thailand

In 2022, Thailand’s Demand Response (DR) business model was shifting from the Traditional Utility (TU) model to the Load Aggregator (LA) model in accordance with Thailand’s smart grid master plan. This research studied the current demand response model and mechanism to draw possible gaps in operations. This research deals with the data system owned by the individual load aggregator. The load aggregators collect meter data and evaluate demand adaptations before sending the results to claim compensation on behalf of their customers. This approach lacks transparency and facilitates distortion of the facts. Hence, this research introduces the data execution by smart contracts and data records on the blockchain that enhance transparent data sharing among multiple parties and maintain data integrity. Moreover, the proposed bidding algorithm allows customers to offer an expected price under the maximum incentive payment determined by the avoided costs of running the peaking power plants. Hence, the bidding helps reflect the DR operation costs on the customer side and control the budget for incentive payments. This study emphasized the smart contracts and decentralized application layer, so the public blockchain is a reasonable network for the test. However, implementation in real cases using the public blockchain requires careful considerations, such as network fees, transaction speeds, and the security of smart contract codes.

Using NFTs for ownership management of digital twins and for proof of delivery of their physical assets

A digital twin (DT) is an exact digital replica of a physical world object or asset that aids in managing, controlling, or monitoring the real object. The current systems used for managing DTs are centralized and not easily accessible. Typically, a DT is built by the original equipment manufacturer (OEM) and becomes hard to access and manage once its physical asset is transported or sold to a new owner. Moreover, a physical asset or object is typically comprised of many other physical sub-components. This translates to having one DT comprised of other sub-DTs. In this paper, we show how non-fungible tokens (NFTs) can be used to manage ownership of DTs and to provide proof of delivery (PoD) of their associated physical assets in a decentralized, secure, traceable, and transparent manner. Specifically, we propose, implement, and evaluate a solution to manage DTs and their sub-DTs using NFTs and sub-NFTs. The DTs and their sub-DTs are represented in a hierarchical way, whereby a sub-NFT maps to a sub-DT along with its physical object. We present the system architecture and design, as well as the implementation of algorithms and smart contracts along with thorough testing and validation details. We present the security analysis as well as discuss the generalization aspect of the proposed solution. All developed smart contract codes are made publicly available on GitHub.

Integrating a Blockchain-Based Governance Framework for Responsible AI

This research paper reviews the potential of smart contracts for responsible AI with a focus on frameworks, hardware, energy efficiency, and cyberattacks. Smart contracts are digital agreements that are executed by a blockchain, and they have the potential to revolutionize the way we conduct business by increasing transparency and trust. When it comes to responsible AI systems, smart contracts can play a crucial role in ensuring that the terms and conditions of the contract are fair and transparent as well as that any automated decision-making is explainable and auditable. Furthermore, the energy consumption of blockchain networks has been a matter of concern; this article explores the energy efficiency element of smart contracts. Energy efficiency in smart contracts may be enhanced by the use of techniques such as off-chain processing and sharding. The study emphasises the need for careful auditing and testing of smart contract code in order to protect against cyberattacks along with the use of secure libraries and frameworks to lessen the likelihood of smart contract vulnerabilities.

Transformer-based comparative multi-view illegal transaction detection.

In recent years, as the Ether platform has grown by leaps and bounds. Numerous unscrupulous individuals have used illegal transaction to defraud large sums of money, causing billions of dollars of losses to investors worldwide. Facing the endless stream of the illegal transaction based on Ether smart contracts problems, such as illegal transaction, money laundering, financial fraud, phishing. Currently, illegal transaction are only detected by a single view of the smart contract's contract code view feature and account transaction view feature, which is not only incomplete, but also not fully representative of the smart contract's features. More importantly, the single view detection model cannot accurately capture the global structure and semantic features between the Tokens of the view features. In this case, it is particularly important that all view features are shared among themselves. In this paper, we investigate a Transformer-based model for contrasting illegal transaction detection networks under multiple views (TranMulti-View Net). The model in this paper is based on Transformer to learn a multi-view fusion representation, which aims to maximise the fusion of the interaction information of different view features under the same condition. In this model we first use the Transformer model to learn global structure and semantic features from a sequence of Tokens tokenised by a view, capturing the remote dependencies of Tokens in the view features, and then we share the contract code view features and the account transaction view features across all views to learn important semantic information between views from each other. In addition, we find that the approach of semi-supervised training of multi-view features using contrast learning outperforms the scheme of prediction based on direct fusion of different view features, resulting in stronger correlation between view features. As a result, the underlying semantic information can be captured more accurately, leading to more accurate predictions of illegal transaction. The experimental results show that our proposed TranMulti-View Net obtains good detection results with a Precision score of 98%.

Vulnerability Detection of Ethereum Smart Contract Based on SolBERT-BiGRU-Attention Hybrid Neural Model

In recent years, with the great success of pre-trained language models, the pre-trained BERT model has been gradually applied to the field of source code understanding. However, the time cost of training a language model from zero is very high, and how to transfer the pre-trained language model to the field of smart contract vulnerability detection is a hot research direction at present. In this paper, we propose a hybrid model to detect common vulnerabilities in smart contracts based on a lightweight pre-trained language model BERT and connected to a bidirectional gate recurrent unit model. The downstream neural network adopts the bidirectional gate recurrent unit neural network model with a hierarchical attention mechanism to mine more semantic features contained in the source code of smart contracts by using their characteristics. Our experiments show that our proposed hybrid neural network model SolBERT-BiGRU-Attention is fitted by a large number of data samples with smart contract vulnerabilities, and it is found that compared with the existing methods, the accuracy of our model can reach 93.85%, and the Micro-F1 Score is 94.02%.

FL-Incentivizer: FL-NFT and FL-Tokens for Federated Learning Model Trading and Training

Federated learning (FL) is an on-device distributed learning scheme that does not require training devices to transfer their data to a centralized facility. The goal of federated learning is to learn a global model over several iterations. It is challenging to claim ownership rights and commercialize the global model efficiently and transparently. Additionally, incentives need to be provided to ensure that devices participate in the FL process. In this paper, we propose a smart contract-based framework called FL-Incentivizer, which relies on custom smart contracts to maintain flow governance of the FL process in a transparent and immutable manner. FL-Incentivizer commercializes and tokenizes the global model using FL-NFT (FL Non-Fungible Token) based on the ERC-721 standard. FL-Incentivizer uses ERC-20 compliant FL-Tokens to incentivize devices participating in FL. We present the system design and operational sequence of the FL-Incentivizer. We provide implementation and deployment details, complete smart contract codes, and qualitative evaluation of the FL-Incentivizer. After implementing FL-Incentivizer for a global iteration of a Federated learning task, we showed the FL-NFT on OpenSea and an FL-Token for a learner on MetaMask. FL-NFTs can be traded on markets such as OpenSea like other NFTs. While FL-Tokens can be transferred in the same manner as other ERC-20-based tokens.

Trusted Traceability and Certification of Refurbished Medical Devices Using Dynamic Composable NFTs

Medical devices play a crucial role in the global healthcare system, but their high cost has led to the increasing adoption of refurbished medical devices as a sustainable alternative for hospitals and patients around the world. The repositioning of refurbished devices into the market, however, is accompanied by a number of challenges, including concerns about quality and safety, as well as the risk of fraudulent activities such as counterfeiting. To address these challenges, we propose an NFT-based solution for managing refurbished medical devices that creates a secure, transparent, and verifiable record of the refurbishment process to ensure the safety and quality of these devices. The proposed solution utilizes dynamic composable NFTs as digital representations of medical devices, with replacement parts and certificate documents embedded in a parent-child NFT hierarchy, and reprocessing steps captured and reflected through the evolution of the dynamic tokens. This serves to authenticate and track the movement of refurbished devices while also providing a trustworthy means of managing individual devices and their ownership. Furthermore, the integration of non-transferable NFTs as certificates of refurbishment acts as an effective mechanism for detecting suspect medical devices and instances of fraudulent labeling, thereby increasing buyer confidence and promoting user safety. We leverage the Interplanetary File System to store and keep track of the metadata of the tokenized components of the system. We present the system architecture and implementation details with tested algorithms. We develop a front-end decentralized application (DApp) to interact with the designed smart contracts and showcase their functionalities. We also conduct security analysis to demonstrate our system is resistant to common vulnerabilities and exploits. The smart contract code is made available on GitHub.

Using Blockchain for Enabling Transparent, Traceable, and Trusted University Ranking Systems

Ranking systems have proven to improve the quality of education and help build the reputation of academic institutions. Each of the current academic ranking systems is based on different methodologies, criteria, and standards of measurement. Academic and employer reputations are subjective indicators of some rankings determined through surveying that is neither transparent nor traceable. The current academic ranking systems fall short of providing transparency and traceability features for both subjective and objective indicators that are used to calculate the ranking. Also, the ranking systems are managed and controlled in a centralized manner by specific entities. This raises concerns about fairness and trust. In this paper, we propose a blockchain-based solution to enable transparent, traceable, trusted, and decentralized academic ranking systems. We develop smart contracts to automatically govern entity interactions according to set policies. We leverage decentralized storage, oracles, and threshold encryption to securely fetch, store, and share institutions’ ranking data. We present algorithms along with their implementation and testing details, as well as validate smart contracts. The proposed solution is evaluated in terms of cost, throughput and latency, and security to show its affordability, resiliency against attacks, and superiority. All developed smart contract codes are made publicly available on GitHub.

NFTs for Open-Source and Commercial Software Licensing and Royalties

Software licenses are legal agreements of sale and usage among software developers and clients. Such legal agreements are crucial to effectively manage ownership and protect the rights of involved parties. Today’s software licensing mechanisms are mostly centralized and do not address the ever-increasing issues and complexities of modern software that may include multiple licenses, open-source distribution, rewarding other contributors of external software libraries, and utilizing royalty payments for monetization. As a result, developers have lost confidence in the existing software licensing models, and many software projects are failing due to lack of funding and royalty payments. This paper addresses such issues and complexities by proposing a novel decentralized software licensing system based on Non-Fungible Tokens (NFTs) and blockchain. The proposed licensing system is applicable to both commercial and open-source software. We use NFTs as digital tokens that encapsulate software code and their artifacts by minting them as unique valuable assets that allow developers to store and manage them on a blockchain ledger. With NFTs, developers can register and license their code, monetize it on NFT marketplaces, and earn royalties from other software projects that use their code. We present system architecture, relevant sequence diagrams, and develop aggregation algorithms for Ethereum smart contracts with ERC-1155 NFTs. Furthermore, we perform functional validation of our system and analyze the cost of its adoption. We also analyze the security of the solution and show how its applicability can be generalized and extended. We have made our smart contract code and related testing scripts publicly available on GitHub.

TxT: Real-Time Transaction Encapsulation for Ethereum Smart Contracts

Ethereum is a permissionless blockchain ecosystem that supports execution of smart contracts, the key enablers of decentralized finance (DeFi) and non-fungible tokens (NFT). However, the expressiveness of Ethereum smart contracts is a double-edged sword: while it enables blockchain programmability, it also introduces security vulnerabilities, i.e., the exploitable discrepancies between expected and actual behaviors of the contract code. To address these discrepancies and increase the vulnerability coverage, we propose a new smart contract security testing approach called transaction encapsulation. The core idea lies in the local execution of transactions on a fully-synchronized yet isolated Ethereum node, which creates a preview of outcomes of transaction sequences on the current state of blockchain. This approach poses a critical technical challenge — the well-known time-of-check/time-of-use (TOCTOU) problem, i.e., the assurance that the final transactions will exhibit the same execution paths as the encapsulated test transactions. In this work, we determine the exact conditions for guaranteed execution path replicability of the tested transactions. To demonstrate the transaction encapsulation, we implement a transaction testing tool, TxT, which reveals the actual outcomes (either benign or malicious) of Ethereum transactions. To ensure the correctness of testing, TxT deterministically verifies whether a given sequence of transactions ensues an identical execution path on the current state of blockchain. We analyze over 1.3 billion Ethereum transactions and determine that 96.5% of them can be verified by TxT. We further show that TxT successfully reveals the suspicious behaviors associated with 31 out of 37 vulnerabilities (83.8% coverage) in the smart contract weakness classification (SWC) registry. In comparison, the vulnerability coverage of all the existing defense approaches combined only reaches 40.5%.

Обнаружение уязвимостей умных контрактов с помощью модели, основанной на синтаксическом и семантическом совмещённом обучении

Detection of vulnerabilities in smart contracts is of great importance for protection of digital assets. Today many researches reveal the features of the contract code using deep learning, but often use a single form of code representation. This does not allow extracting the semantics and structure of the code fully to detect various vulnerabilities. The article proposes vulnerability detection model based on fusion of syntactic and semantic features. Using TextCNN tool and graph neural networks, it is possible to extract syntactic and se-mantic representation from the abstract syntactic tree and the graph of the contract control flow. Combining the features the model increases the detection accuracy and recovery rate for five types of vulnerabilities reaching the average accuracy of 95% and the recovery rate of 91% that ensures effective detection of smart contract vulnerabilities.

MDA-Based Approach for Blockchain Smart Contract Development

Blockchain smart contracts can support the decentralisation of business processes, but due to smart contracts’ specifics, their development is a complicated process. Introducing model-driven development principles in smart contract development can facilitate requirement specification, design, and implementation activities. This paper presents a model-driven development method MDAsmartCD (Model-Driven Architecture-based Smart Contract Development) to alleviate smart contract development by supporting the complete MDA life cycle, covering the definition of Computation-Independent Model, Platform-Independent Model, and two instances of Platform-Specific Models. In MDAsmartCD, model transformations (model-to-model and model-to-text) are used to produce smart contract code in the Hyperledger Fabric platform Go and the Ethereum platform Solidity programming languages. The method application was demonstrated by implementing the smart contract for the hackathon solution and executing the generated Solidity and Go smart contracts in the workflow of issuing certificates for hackathon participants. During the execution of the workflow, both deployed smart contracts behaved identically and recorded analogous results in respective blockchain data storages. This demonstrated that the MDAsmartCD method enables the generation of compilable and executable smart contract code, ready for deployment on a blockchain platform.

Improving smart contract search by semantic and structural clustering for source codes

The search for smart contract source codes has drawn research attention to fulfill developers’ and researchers’ needs. Yet, the existing studies are not mature enough to address smart contracts’ technical properties and functionalities. This paper proposes a system to improve the naive search for smart contract codes; for example, Etherscan has one keyword search feature without regard to the contract structure. We consider clustering smart contracts based on developers’ preferences, which increases the probability that the resulting source codes match developers’ needs. Our experimental results show a significant improvement in the complexity of the retrieved source codes of smart contracts compared with the baseline scenario using blockchain search engines (e.g., Etherscan). Our solution reduces the number of retrieved smart contract codes the developer has to check if the codes match her/his needs by 94%, 88%, 82%, or 98%, depending on the user’s search preferences.

The Automatic Generation of Smart Contract Based on Configuration in the Field of Government Services

With the development of blockchain technology, the automatic generation of smart contract has become a hot research topic. The existing smart contract automatic generation technology still has improvement spaces in complex process, third-party specialized tools required, specific the compatibility of code and running environment. In this paper, we propose an automatic smart contract generation method, which is domain-oriented and configuration-based. It is designed and implemented with the application scenarios of government service. The process of configuration, public state database definition, code generation and formal verification are included. In the Hyperledger Fabric environment, the applicability of the generated smart contract code is verified. Furthermore, its quality and security are formally verified with the help of third-party testing tools. The experimental results show that the quality and security of the generated smart contract code meet the expect standards. The automatic smart contract generation will “elegantly” be applied on the work of anti-disclosure, privacy protection, and prophecy processing in government service. To effectively enable develop “programmable government”.

A Contract Law Approach for the Treatment of Smart Contracts’ ‘Bugs’

This article attempts to derive some principles concerning the legal treatment of bugs in smart contracts, namely errors in the smart contract code which may result to some unwanted or unexpected outcome at the execution of the contract. Before dealing with this main issue, the article concludes that despite the practical issues that arise concerning the application of traditional contract law rules and principles, these rules remain relevant, and that a smart contract is typically (but not necessarily) a mere tool for the performance of the contract and not a legal contract itself. Therefore, typically, bugs in smart contracts should be examined under the doctrines of the breach of contract and/or the unfair enrichment and not as reasons for any potential invalidity of the contract. Only in (rather unlikely cases) where a smart contract could be indeed perceived as the body of the legal contract itself, printing errors in the code or other expressional mistakes concerning the semantics of the code (albeit not its function) could be perceived as potential reasons for the invalidity of the contract, according to the relevant rules of each jurisdiction. Nevertheless, even in these cases, interpretation of the contract with objective standards should not be ruled out, even when the contract is concluded by means of artificial intelligence (AI). The article examines also contributory negligence issues.

Who is gambling? Finding cryptocurrency gamblers using multi-modal retrieval methods

With the popularity of cryptocurrencies and the remarkable development of blockchain technology, decentralized applications emerged as a revolutionary force for the Internet. Meanwhile, decentralized applications have also attracted intense attention from the online gambling community, with more and more decentralized gambling platforms created through the help of smart contracts. Compared with conventional gambling platforms, decentralized gambling have transparent rules and a low participation threshold, attracting a substantial number of gamblers. In order to discover gambling behaviors and identify the contracts and addresses involved in gambling, we propose a tool termed ETHGamDet. The tool is able to automatically detect the smart contracts and addresses involved in gambling by scrutinizing the smart contract code and address transaction records. Interestingly, we present a novel LightGBM model with memory components, which possesses the ability to learn from its own misclassifications. As a side contribution, we construct and release a large-scale gambling dataset at https://github.com/AwesomeHuang/Bitcoin-Gambling-Dataset to facilitate future research in this field. Empirically, ETHGamDet achieves a F1-score of 0.72 and 0.89 in address classification and contract classification respectively, and offers novel and interesting insights.

Aroc: An Automatic Repair Framework for On-Chain Smart Contracts

Ongoing smart contract attack events have seriously impeded the practical application of blockchain. Although lots of researches have been conducted, they mostly focus on off-chain vulnerability detection. However, smart contracts cannot be modified once they have been deployed on-chain, thus existing techniques cannot protect those deployed contracts from being attacked. To mitigate this problem, we propose a general smart contract repairer named Aroc, which can automatically patch vulnerable deployed contracts without changing the contract codes. The core insight of Aroc is to generate patch contracts to abort malicious transactions in advance. Taking the three most serious bug types (i.e., reentrancy, arithmetic bugs, and unchecked low-level checks) as examples, we present how Aroc automatically repairs them on-chain. We conduct abundant evaluations on four kinds of datasets to evaluate the effectiveness and efficiency of Aroc. In particular, Aroc can repair 95.95% of the vulnerable contracts with an average correctness ratio of 93.32%. Meanwhile, Aroc introduces acceptable additional overheads to smart contract users and blockchain miners. When compared with the state-of-the-art techniques, Aroc introduces either fewer execution overheads or contract codes.

Confidential Ethereum Smart Contracts

As decentralized finance (DeFi) applications take off and pose to revolutionize the world's financial infrastructure, the current public blockchains fall short in financial privacy. That is a significant barrier for traditional financial institutions to enter DeFi. The Oasis Ethereum ParaTime proposes a new privacy-first blockchain network to execute Ethereum smart contracts and trade Ethereum digital assets. It provides full transparency into smart contract code and logic. The smart contract is executed on replicated virtual machines on a decentralized set of validator nodes, and the result is guaranteed to be correct through the consensus of those nodes. Yet, the contract data and state are confidential even to the validators and node operators. The transactions and results are only revealed to users who submit the transactions. In this article, we will explore the design of the Oasis Ethereum ParaTime, and its potential applications. We will also discuss an early testnet we launched on the Oasis Network and its future plans.

SigVM: enabling event-driven execution for truly decentralized smart contracts

This paper presents SigVM, the first blockchain virtual machine that extends EVM to support an event-driven execution model, enabling developers to build truly decentralized smart contracts. Contracts in SigVM can emit signal events, on which other contracts can listen. Once an event is triggered, corresponding handler functions are automatically executed as signal transactions. We build an end-to-end blockchain platform SigChain and a contract language compiler SigSolid to realize the potential of SigVM. Experimental results show that our benchmark applications can be reimplemented with SigVM in a truly decentralized way, eliminating the dependency on centralized and unreliable mechanisms like off-chain relay servers. The development effort of reimplementing these contracts with SigVM is small, i.e., we modified on average 3.17% of the contract code. The runtime and the gas overhead of SigVM on these contracts is negligible.