Security Of Smart Contracts Research Articles

Automatic construction and verification algorithm for smart contracts based on formal verification

As an emerging technology, blockchain demonstrates strong potential for applications in digital finance. As a core component of blockchain, the security and reliability of smart contracts is crucial. To ensure the high reliability of smart contracts, this study employs formal construction and verification techniques based on game theory. Initially, the profit function is defined using distortion techniques, and a game model for supply chain participation is designed. However, the equilibrium solution of the two-party game does not represent the optimal solution for the supply chain system. Therefore, the study introduces third-party participation to optimize the equilibrium solution. Finally, a probability model detection method is used to verify the constructed smart contract model. The results show that the supply chain model, analyzed through formal methods, has attributes consistent with theoretical analysis. Consequently, the research on automatic construction and verification algorithms for smart contracts based on formal verification proves to be effective and feasible in practical applications.

Advanced Security Auditing Methods for Solidity-Based Smart Contracts

The development of smart contracts remains in its early stages, with significant differences in underlying programming languages and application platforms resulting in a lack of standardization. This lack of standardization increases the susceptibility to vulnerabilities and associated financial losses. To address security vulnerabilities in smart contracts on the Ethereum blockchain platform, this paper proposes a security audit method based on formal verification. The method integrates an input module, static analysis module, formal verification module, analog execution module, and report and recommendation module, which can accurately discover the security vulnerabilities and logical flaws of smart contracts through formal verification and other analysis techniques, thus realizing correctness detection. During the experiment, the method detects 8 types of common vulnerabilities in 148 smart contracts and marks 21 smart contracts with vulnerabilities. After manual review and analysis, it is found that 17 of these 21 marked smart contracts do have security vulnerabilities. The experimental results show that the proposed method can accurately detect security vulnerabilities and logic flaws in smart contracts through formal verification and other analysis techniques before smart contracts are deployed, thus significantly improving the security of smart contracts and reducing the economic losses that may be caused by code defects.

Integration of NLP and machine learning methods for smart contract security: a comparison with traditional approaches

In modern blockchain systems, smart contracts are one of the most critical components for ensuring the automated execution of agreements without the need for intermediaries. However, smart contracts written in languages like Solidity may contain vulnerabilities that can be exploited by malicious actors to steal funds or manipulate assets. Given the increasing number of attacks on smart contracts, the development of effective methods for detecting such vulnerabilities is crucial. Traditional approaches to detecting vulnerabilities in smart contracts include symbolic execution, fuzzing, formal verification, and pattern matching. These methods have their advantages but face several challenges, such as high resource consumption, limitations in detecting new types of vulnerabilities, and difficulties in scaling to large contracts. As a result, there is a need to introduce new approaches, such as natural language processing (NLP) and machine learning, which can address these challenges more effectively. In this study, an NLP-based method was explored, using Word2Vec to convert smart contract code into vector representations, allowing for better analysis of the semantic relationships between elements of the code. These vector representations are then fed into a bidirectional recurrent neural network with GRU blocks and an attention mechanism. This approach allows the model to focus on the most important parts of the code and improve the accuracy of vulnerability detection. The comparative analysis showed that NLP-based methods significantly outperform traditional approaches in all key metrics. In particular, the GRU model with an attention mechanism demonstrated high results in accuracy, recall, and F-measure, making it effective for detecting complex vulnerabilities such as reentrancy. Furthermore, the NLP-based approach is capable of adapting to new types of attacks thanks to training on large datasets. Thus, the integration of NLP and machine learning represents a promising direction for enhancing the security of smart contracts. Future research can focus on improving these approaches, particularly through the implementation of advanced models such as transformers.

Survey on Quality Assurance of Smart Contracts

As blockchain technology continues to advance, the secure deployment of smart contracts has become increasingly prevalent, underscoring the critical need for robust security measures. This surge in usage has led to a rise in security breaches, often resulting in substantial financial losses for users. This paper presents a comprehensive survey of smart contract quality assurance, from understanding vulnerabilities to evaluating the effectiveness of detection tools. Our work is notable for its innovative classification of forty smart contract vulnerabilities, mapping them to established attack patterns. We further examine nine defense mechanisms, assessing their efficacy in mitigating smart contract attacks. Furthermore, we develop a labeled dataset as a benchmark encompassing ten common vulnerability types, which serves as a critical resource for future research. We also conduct comprehensive experiments to evaluate fourteen vulnerability detection tools, providing a comparative analysis that highlights their strengths and limitations. In summary, this survey synthesizes state-of-the-art knowledge in smart contract security, offering practical recommendations to guide future research and foster the development of robust security practices in the field.

Software Weakness Detection in Solidity Smart Contracts Using Control and Data Flow Analysis: A Novel Approach with Graph Neural Networks

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

Sligpt: A Large Language Model-Based Approach for Data Dependency Analysis on Solidity Smart Contracts

The advent of blockchain technology has revolutionized various sectors by providing transparency, immutability, and automation. Central to this revolution are smart contracts, which facilitate trustless and automated transactions across diverse domains. However, the proliferation of smart contracts has exposed significant security vulnerabilities, necessitating advanced analysis techniques. Data dependency analysis is a critical program analysis method used to enhance the testing and security of smart contracts. This paper introduces Sligpt, an innovative methodology that integrates a large language model (LLM), specifically GPT-4o, with the static analysis tool Slither, to perform data dependency analyses on Solidity smart contracts. Our approach leverages both the advanced code comprehension capabilities of GPT-4o and the advantages of a traditional analysis tool. We empirically evaluate Sligpt using a curated dataset of Ethereum smart contracts. Sligpt achieves significant improvements in precision, recall, and overall analysis depth compared with Slither and GPT-4o, providing a robust solution for data dependency analysis. This paper also discusses the challenges encountered, such as the computational resource requirements and the inherent variability in LLM outputs, while proposing future research directions to further enhance the methodology. Sligpt represents a significant advancement in the field of static analysis on smart contracts, offering a practical framework for integrating LLMs with static analysis tools.

A Dynamic Behavior Verification Method for Composite Smart Contracts Based on Model Checking

A composite smart contract can execute smart contracts that may belong to other owners or companies through external calls, bringing more security challenges to blockchain applications. Traditional static verification methods are inadequate for analyzing the dynamic execution of these contracts, resulting in misjudgment and omission issues. Therefore, this paper proposes a model checking approach based on dynamic behavior that verifies the security and business logic of composite smart contracts. Utilizing automata, the method models contracts, users, attackers, and extracts properties, focusing on six types of common security vulnerabilities. A thorough case study and experimental evaluation demonstrate the method’s efficiency in identifying vulnerabilities and ensuring alignment with business requirements. The UPPAAL tool is employed for comprehensive verification, proving its effectiveness in enhancing smart contract security.

Efficiently Detecting Reentrancy Vulnerabilities in Complex Smart Contracts

Reentrancy vulnerability as one of the most notorious vulnerabilities, has been a prominent topic in smart contract security research. Research shows that existing vulnerability detection presents a range of challenges, especially as smart contracts continue to increase in complexity. Existing tools perform poorly in terms of efficiency and successful detection rates for vulnerabilities in complex contracts. To effectively detect reentrancy vulnerabilities in contracts with complex logic, we propose a tool named SliSE. SliSE’s detection process consists of two stages: Warning Search and Symbolic Execution Verification . In Stage 1, SliSE utilizes program slicing to analyze the Inter-contract Program Dependency Graph (I-PDG) of the contract, and collects suspicious vulnerability information as warnings. In Stage 2, symbolic execution is employed to verify the reachability of these warnings, thereby enhancing vulnerability detection accuracy. SliSE obtained the best performance compared with eight state-of-the-art detection tools. It achieved an F1 score of 78.65%, surpassing the highest score recorded by an existing tool of 9.26%. Additionally, it attained a recall rate exceeding 90% for detection of contracts on Ethereum. Overall, SliSE provides a robust and efficient method for detection of Reentrancy vulnerabilities for complex contracts.

Smart contract vulnerability detection using wide and deep neural network

Smart contracts, integral to blockchain technology, automate agreements without intermediaries, ensuring transparency and security across various sectors. However, the immutable nature of blockchain exposes deployed contracts to potential risks if they contain vulnerabilities. Current approaches, including symbolic execution and graph-based machine learning, aim to ensure smart contract security. However, these methods suffer from limitations such as high false positive rates, heavy reliance on trained data, and over-generalization.The goal of this paper is to investigate the application of Wide and Deep Neural Networks in identifying vulnerabilities within smart contracts. We introduce WIDENNET, a method based on deep neural networks, designed to detect reentrancy and timestamp dependence vulnerabilities in smart contracts. Our approach involves extracting bytecodes from the contracts and converting them into Operational Codes (OPCODES), which are then transformed into distinct vector representations. These vectors are subsequently fed into the neural network to extract both complex and simple patterns for vulnerability detection. Testing on real-world datasets yielded an average accuracy of 83.07% and a precision of 83.13%. Our method offers a potential solution to mitigate vulnerabilities in blockchain applications.

Enhancing Oyente: four new vulnerability detections for improved smart contract security analysis

Enhancing Oyente: four new vulnerability detections for improved smart contract security analysis

NLP-BERT AND OPTIMIZATION OF EFFICIENCY-SECURITY IN BLOCKCHAIN-ACCOUNTING SMART CONTRACTS

In the evolving digital era, blockchain-based accounting systems leveraging smart contracts are increasingly crucial. Blockchain, known for its transparency and security, faces challenges in the efficiency and security of smart contracts, necessitating innovative solutions. This research explores the potential of Natural Language Processing (NLP) technology such as BERT to enhance these aspects within smart contracts. Grounded in blockchain and smart contract theories, the study investigates BERT's use in detecting financial fraud and improving transaction security. The research methodology employs Bibliometric Analysis with a PICO approach to formulate research questions and gather relevant data. Bibliometric analysis provides deeper insights into current developments and challenges in this field. The analysis reveals trends in document production, author collaborations, and keywords related to blockchain and BERT. Co-occurrence networks and thematic maps highlight the significance and relevance of these terms in the context of blockchain and smart contracts. In conclusion, this study makes a significant contribution to understanding how NLP technology can be optimized to enhance the efficiency and security of smart contracts in blockchain-based accounting systems. Further research is essential to develop BERT optimization in this context.

OpenSCV: an open hierarchical taxonomy for smart contract vulnerabilities

Smart contracts are nowadays at the core of most blockchain systems. Like all computer programs, smart contracts are subject to the presence of residual faults, including severe security vulnerabilities. However, the key distinction lies in how these vulnerabilities are addressed. In smart contracts, when a vulnerability is identified, the affected contract must be terminated within the blockchain, as due to the immutable nature of blockchains, it is impossible to patch a contract once deployed. In this context, research efforts have been focused on proactively preventing the deployment of smart contracts containing vulnerabilities, mainly through the development of vulnerability detection tools. Along with these efforts, several heterogeneous vulnerability classification schemes appeared (e.g., most notably DASP and SWC). At the time of writing, these are mostly outdated initiatives, even though new smart contract vulnerabilities are consistently uncovered. In this paper, we propose OpenSCV, a new and Open hierarchical taxonomy for Smart Contract vulnerabilities, which is open to community contributions and matches the current state of the practice while being prepared to handle future modifications and evolution. The taxonomy was built based on the analysis of the existing research on vulnerability classification, community-maintained classification schemes, and research on smart contract vulnerability detection. We show how OpenSCV covers the announced detection ability of the current vulnerability detection tools and highlight its usefulness in smart contract vulnerability research. To validate OpenSCV, we performed an expert-based analysis wherein we invited multiple experts engaged in smart contract security research to participate in a questionnaire. The feedback from these experts indicated that the categories in OpenSCV are representative, clear, easily understandable, comprehensive, and highly useful. Regarding the vulnerabilities, the experts confirmed that they are easily understandable.

Detection of malicious smart contracts by fine‐tuning GPT‐3

AbstractThis paper introduces a comprehensive framework for the detection and identification of malicious smart contracts, emphasizing their vulnerabilities. The framework leverages the capabilities of GPT‐3, which have been adapted and fine‐tuned for binary and multi‐class classification tasks. To the best of our knowledge, this study is the first to explore the use of GPT‐3 specifically for detecting and identifying malicious smart contracts. The framework addresses previously unexplored research questions and provides insightful answers through rigorous experimentation. The contributions of this work include proposing a novel approach, pioneering the adaptation of GPT‐3 for this purpose, and offering valuable insights into the detection of malicious smart contracts and vulnerabilities. Notably, our research reveals that GPT‐3 excels not only in understanding natural language but also in decoding the secrets embedded in numerical codes like opcodes. This finding extends the applicability of GPT‐3 beyond language‐based tasks and highlights its potential in enhancing smart contract security.

Transaction Security and Management of Blockchain-Based Smart Contracts in E-Banking-Employing Microsegmentation and Yellow Saddle Goatfish

The process security of money transactions is considered an important issue in e-banking. Additionally, it is an enormous problem if never controlled. particular, security should be a combination of fast and sturdy characteristics, which is the subject of previous studies suffered from. Our research attempts to improve the system in which banks deal with the security of financial transactions. This research leverages the idea of microsegmenting the entire system into designated zones to concentrate on security, where each zone has its own rules and limitations. These rules are managed by a smart contract, which decides whether they have been observed to verify the legitimacy of the customer. First, the two-phase commit algorithm (2PC) was used to specify the type of e-banking request. After this, the microsegmentation principle was applied to isolate each type of e-transaction process alone in a separate segment. Then, the yellow saddle goatfish algorithm (YSGA) was used to determine whether the smart contract conditions were optimized. Finally, if the customer is authorized, then the entire transaction process is saved in the blockchain's main ledger and secured by a unique hash. The blockchain application makes our system capable of dealing with large numbers of users in a decentralized manner. In addition, using a hash with each block prevents fraudulent transactions by adversaries. Our system has been examined against several recent well-known assaults/attacks, such as falsification, advanced persistent threat, bribery, spoofing, double spending, chosen text, race, and transaction replay attacks, and has proven to overcome them. In terms of the performance evaluation, we obtained an execution time of approximately 0.0056 nanoseconds, 3.75% complexity, and 1500 KB of memory and disk drive, which is considered low compared to that of state-of-the-art research. Thus, our proposed system is highly acceptable for banking sector applications.

Securing Smart Contracts: Harnessing the Power of Efficient NetB2 Detection

Objective: Using a variety of datasets from the Ethereum documentation and Smart Contract Dataset repository, this study tackles the crucial problem of classifying smart contract vulnerabilities. Methods: Our study uses a three-module method and focuses on the Resource 3 Dataset, which contains over 2,000 Ethereum smart contracts, including inherited contracts. The groundwork for deep learning model training is laid in Module 1 by extracting bytecode from Solidity files and creating images thereafter. In Colab, Module 2 entails importing data, pre-processing, SMOTE balancing, and building three deep learning models: CNN, XCEPTION, and EfficientNet-B2. Module 3 is a Flask-based web application created in Visual Studio Code that enables vulnerability predictions, bytecode extraction, and user interaction. Findings: With an overall accuracy of 71 percent, the Convolutional Neural Network (CNN) displays its effectiveness in classifying vulnerabilities. Although the accuracy of XCEPTION and EfficientNet-B2 is 69% and 75%, respectively, the latter is the top performer. Novelty & Applications: The online application adds to the comprehensive examination of smart contract security by giving users an easy-to-use interface. The EfficientNet-B2 model stands out as a dependable tool for precise vulnerability classification, and this study advances our understanding of and efforts to mitigate vulnerabilities in Ethereum smart contracts. Keywords: Smart Contracts, Vulnerability Classification, Ethereum, Deep Learning, Convolutional Neural Network (CNN)

Enhancing smart contract security: Leveraging pre‐trained language models for advanced vulnerability detection

AbstractThe burgeoning interest in decentralized applications (Dapps), spurred by advancements in blockchain technology, underscores the critical role of smart contracts. However, many Dapp users, often without deep knowledge of smart contracts, face financial risks due to hidden vulnerabilities. Traditional methods for detecting these vulnerabilities, including manual inspections and automated static analysis, are plagued by issues such as high rates of false positives and overlooked security flaws. To combat this, the article introduces an innovative approach using the bidirectional encoder representations from transformers (BERT)‐ATT‐BiLSTM model for identifying potential weaknesses in smart contracts. This method leverages the BERT pre‐trained model to discern semantic features from contract opcodes, which are then refined using a Bidirectional Long Short‐Term Memory Network (BiLSTM) and augmented by an attention mechanism that prioritizes critical features. The goal is to improve the model's generalization ability and enhance detection accuracy. Experiments on various publicly available smart contract datasets confirm the model's superior performance, outperforming previous methods in key metrics like accuracy, F1‐score, and recall. This research not only offers a powerful tool to bolster smart contract security, mitigating financial risks for average users, but also serves as a valuable reference for advancements in natural language processing and deep learning.

Securi-Chain: Enhancing Smart Contract Security in Blockchain Systems Through Optimized Access Control

With the increase in usage of blockchain technology across domains, there is a high demand for the need of secure access control and a high level of security for smart contracts within blockchain to accommodate the domains that already implement blockchain and become accessible to other domains that require a high level of security in its transactions. This paper aims to evaluate the relationship between the best practices of access control and security of smart contracts in blockchain to optimise the usage of both technologies for blockchain usage across domains into a generalized blockchain model named the Securi-Chain Model. A literature review compares the relationship between access control and the security of smart contracts across three domains: Healthcare, IoT, and e-voting. Based on the findings of the literature review, Securi-Chain is proposed to implement the best practices displayed in these three domains and combine them in a way that ensures secure transactions across blockchain as a generalized approach that can be used throughout various domains. This model will also implement methods that enhance the security of transaction processes within the system. A Case Scenario is used to implement the Securi-Chain Model for the Healthcare and e-voting domains to display how this proposed model is used for domains that have been researched. The research that is conducted found that blockchain networks can support not only high-level access control across transactions in a network but also the security of smart contracts that comply to safeguard confidentiality, integrity, and data accessibility. Secrui-Chain, as well as the findings of the literature review, seem to benefit the domains that have been researched, as well as domains that require a high level of security regarding transactions across a network. These domains can benefit from using blockchain technology as well as the level of security that comes with the access control and security of smart contracts that have been implemented in Securi-Chain.

Enhancement of Security and Privacy of Smart Contracts in Blockchain

Smart contracts, leveraging the power of blockchain technology, have revolutionized the execution and enforcement of agreements. However, their adoption also brings forth substantial challenges in terms of security and privacy. This research paper aims to identify the recent areas of focus and provide a comprehensive perspective on blockchain applications and smart contracts, highlighting their main issues and corresponding solutions. Furthermore, it seeks to address the gaps in current research and outline future avenues of investigation. The primary objective is to assess the security and privacy concerns associated with smart contracts in blockchain and propose effective measures to enhance their robustness. By conducting a thorough analysis of vulnerabilities, attack vectors, and privacy considerations, this study offers valuable insights into the risks involved in smart contracts. It also puts forth practical solutions and best practices to mitigate these risks, ensuring a more secure and privacy-preserving environment for the deployment and execution of smart contracts.

SafeCheck: Detecting smart contract vulnerabilities based on static program analysis methods

AbstractEthereum smart contracts are a special type of computer programs. Once deployed on the blockchain, they cannot be modified. This presents a significant challenge to the security of smart contracts. Previous research has proposed static and dynamic detection tools to identify vulnerabilities in smart contracts. These tools check contract vulnerabilities based on predefined rules, and the accuracy of detection strongly depends on the design of the rules. However, the constant emergence of new vulnerability types and strategies for vulnerability protection leads to numerous false positives and false negatives by tools. To address this problem, we analyze the characteristics of vulnerabilities in smart contracts and the corresponding protection strategies. We convert the contracts' bytecode into an intermediate representation to extract semantic information of the contracts. Based on this semantic information, we establish a set of detection rules based on semantic facts and implement a vulnerability detection tool SafeCheck using static program analysis methods. The tool is used to detect six common types of vulnerabilities in smart contracts. We have extensively evaluated SafeCheck on real Ethereum smart contracts and compared it to other tools. The experimental results show that SafeCheck performs better in smart contract vulnerability detection compared to other typical tools, with a high F‐measure (up to 83.1%) for its entire dataset.

A secure decentralised finance framework

The Secure Decentralised Finance Framework (SDFf) presented in this research addresses the burgeoning security challenges within the realm of decentralised finance (DeFi). As DeFi continues to redefine traditional financial paradigms, it concurrently introduces vulnerabilities that demand urgent attention. This framework offers a comprehensive and integrated approach to fortify the foundations of decentralised financial ecosystems. Focused on key components such as smart contract security, decentralised identity, oracle integrity, liquidity pool protection, governance mechanisms and regulatory compliance, the framework aims to establish a resilient architecture capable of withstanding evolving threats. Through theoretical exploration and case studies, this research article provides a valuable resource for developers, researchers and industry stakeholders navigating the dynamic landscape of secure and sustainable DeFi.