Automated Runtime Verification of Security for E-Commerce Smart Contracts

With the rapid development of the blockchain, smart contract technology has been widely applied. The number of smart contracts has grown at a high rate and nearly at an average of thousands per day. However, the correctness and security of the smart contract itself are facing huge problems. The well-known DAO vulnerability, and Parity multi-signature wallet’ vulnerabilities have leaded to a hundreds of millions dollars loss, and they are both caused by the security problems of smart contracts. Once the smart contract vulnerability is exploited, it is very likely to bring the loss of cryptocurrencies, the disorder of the financial order and other catastrophic consequences. Therefore the security of smart contracts is imminent. This project has designed and implemented a vulnerability detection system of Ethereum smart contract. The system uses the assembly instruction sequences of the smart contract to generate the control flow graph, then performs symbolic execution and vulnerability constraint solving over the control flow. The system can detect some common types of vulnerabilities, such as the integer overflow and underflow vulnerability, reentry vulnerability and unchecked call return value vulnerability. It has a high accuracy of detection result, and gives support for export vulnerability report.

The blockchain based smart contracts allow the creation of peer-to-peer lending in a decentralized finance model called DeFi. While Aave, Compound, and MakerDAO make it easier to gain access to capital and do away with middlemen, security breaches are highly likely to occur. This study analyzes the smart contract vulnerabilities such as reentrancy attacks, oracle manipulation, flash loan exploits, are systematically highlighted and their impact on projects in the market. Furthermore, it completes assessment beyond the security focus of liquidity volatility, regulatory uncertainty and fragmented risk management framework. A systematic literature review was adopted in the study with peer reviewed journal, industry report as well as case studies of past DeFi exploits. The key vulnerabilities, risk assessment methods, and mitigation frameworks are dealt as a theme. According to findings, although smart contract security has improved, DeFi is still very prone to exploitation for the lack of centralized oversight and standardised security measures. The study also brings our attention to the fact that risks in smart contract need continuous smart contract audits, formal verification schemes, and decentralized insurance mechanisms as well as regulatory collaboration. For the sustainable growth of DeFi lending platforms, such a balance should be made possible between technological security measures and improved governance and regulatory frameworks. The increased security mechanisms will increase the user trust and make decentralized lending an alternative to traditional financial systems.

Smart contracts are frequently targeted by hackers because they hold large amounts of money and cannot be modified once they are published. Existing detection methods mainly focus on known vulnerabilities with clear features and cannot deal with unknown vulnerabilities. As a consequence, proposing a method for detecting unknown vulnerabilities in smart contracts represents a significant advancement in the field of smart contract security. Aiming at this problem, based on the idea that the opcode sequences of transactions containing unknown vulnerabilities have similarities to the opcode sequences of transactions containing known vulnerabilities, we propose a novel approach for unknown vulnerability detection in smart contracts using a CNN-BiLSTM model. Our model determines whether a vulnerability is unknown by detecting the opcode sequence representing the entire execution process of a transaction. Experimental results with the opcode sequences of transactions show that the model can achieve 82.86% accuracy and 83.63% F1-score.KeywordsSmart contractsUnknown vulnerabilitiesVulnerability detectionCNN-BiLSTMOpcode sequences

• Created a refined, expanded, and precisely labeled dataset with explanations, risk assessments, and fixes for each vulnerability • Fine-tuned an open-source LLM: LLaMA-3.1-8B using parameter-efficient techniques (LoRA) for smart contract vulnerability detection • Fine-tuned GPT-4o-mini on the same corpus for comparative analysis • Developed a real-time Visual Studio Code (VSCode) plugin integrating GPT-4o-mini for smart contract auditing • Released the datasets, tool, and fine-tuned model to advance research in smart contract security Since the advent of Ethereum, ensuring the security of smart contracts has become imperative. Integer overflow and underflow, reentrancy, and timestamp dependency remain the three most prevalent vulnerabilities in deployed contracts. Existing static-analysis tools often yield insufficient accuracy, and datasets derived from them inherit the same shortcomings. Moreover, the smart contract ecosystem lacks a dependable, real-time auditing aid for developers and a fine-tuned model trained on a truly comprehensive corpus. In this paper, we present three main contributions. (1) Dataset curation: the state-of-the-art vulnerability datasets are aggregated and harmonized, producing a clean, fully labeled dataset that integrates detailed explanations, potential security risks, vulnerable line ranges, code snippets, and corresponding fixes. The dataset is publicly available via our GitHub repository. (2) Model fine-tuning: the LLaMA-3.1-8B model as well as GPT-4o-mini are fine-tuned on this corpus and evaluated with both standard classification metrics and text-quality measures. The fine-tuned LLaMA-3.1 model achieves a precision of 93.55%, an average semantic similarity of 77.48%, and a code similarity of 87.25%. (3) IDE integration: We implement a real-time Visual Studio Code extension, backed by the GPT-4o API, that highlights, explains, and automatically patches vulnerabilities as the developer writes. Together, these contributions deliver a rigorously validated model and a practical developer toolchain that markedly advance the state of smart contract security research and practice.

Information and communication technology based inter-organizational systems enable companies to integrate information and conduct business electronically across different parts of the organization. For organizations embracing blockchain, smart contracts provide automation and operational efficiency for inter-organizational systems. Initially utilised for financial transactions, smart contract are extended beyond banking and deployed in wide number of organizations. Smart contracts are regarded as self-executing type of contract consisting of agreement’s terms embedded directly into the code which plays a vital role in operability for inter-organizational systems, however, smart contract vulnerabilities can arise due to programming errors, leading to security issues. The effects of smart contract vulnerabilities can be significant, including loss of funds, unauthorized access to sensitive information, manipulation of data, and loss of trust in the application leading to catastrophic financial losses followed by legal implications for an organization based on blockchain technology. The goal of smart contracts exploiting vulnerabilities is to discover and eliminate potential security vulnerabilities in smart contract code prior to it being deployed. Detecting vulnerabilities in a timely manner helps to prevent financial losses, unauthorized access, and data manipulation. In order to provide a robust solution to detect vulnerabilities in smart contracts, the proposed methodology presents a novel approach for rapid detection of vulnerabilities by integrating genetic algorithm with isolation forest. Furthermore, enhancing smart contract vulnerability identification with higher accuracy and false-positive rate provides a reliable gateway for organizations to adopt blockchain.

The blockchain 2.0 age, marked by smart contract and Ethereum, has arrived couple years ago. Its technologies have expanded the application scenarios of blockchain technology and driven the boom of decentralized Finance. However, smart contract vulnerabilities and security issues are also emerging one after another. Hackers have exploited these vulnerabilities to cause huge economic losses. In recent years, a large amount of research on the analysis and detection of smart contract vulnerabilities has emerged, but there has been no common detection tool and corresponding test dataset. In this paper, we build GSVD dataset (Generalized Smart Contract Vulnerability Dataset) consisting four offline datasets using smart contracts on two chains, Polygon and BSC: two small Solidity datasets consisting of 153 labeled smart contract source codes, which can be used to test the performance of vulnerability mining tools; two large Solidity datasets consisting of 52,202 un labeled real smart contract source codes that can be used to verify the correctness of various theories and tools under a large number of real data conditions. At the same time, this paper integrates the scripting framework accompanying the GSVD dataset, which can execute a variety of popular automated vulnerability detection tools on top of these datasets and generate analysis results of contracts and potential vulnerabilities. We tested the Minor dataset under GSVD using three tools (Slither, Manticore, Mythril) that are kept up to date and found that the combined use of all tools detected 61.1% of labeled vulnerabilities, of which Mythril has the highest detection rate of 42.6%. It is not difficult to conclude that there`re still ample room for advancement for current smart contract vulnerability mining tools because of their underlying methods. Besides, our dataset can contribute to the ultimate target greatly by providing mining tools plenty real contracts information.

Smart contracts, pivotal to blockchain technology, automate contract enforcement with precision and reliability but are plagued by security vulnerabilities that have led to significant financial losses. Traditional methods like static analysis and fuzzy testing, though foundational, typically fail to grasp the complex logic of smart contract code, resulting in poor adaptability to the evolving landscape of blockchain applications. To address these challenges, this paper introduces an advanced Graph Neural Network (GNN) approach tailored for smart contract vulnerability detection on the VNT blockchain platform. Our methodology leverages the inherent structural and semantic relationships within contract code, transforming it into a graph representation for deeper learning. The enhanced GNN model effectively captures intricate patterns and dependencies that traditional methods overlook, significantly improving detection accuracy and efficiency. Experimental results demonstrate that our approach outperforms existing techniques, offering a promising avenue for both refining smart contract security analyses and guiding future development practices. We further contribute to the field by providing a robust dataset of smart contracts, fostering further research and application enhancements. Experimental results demonstrate that the proposed method not only advances the security of smart contract in VNT but also establishes a new benchmark for the application of deep learning in blockchain.

Smart contracts are programs running on blockchain. In recent years, due to the persistent occurrence of security-related accidents in smart contracts, the effective detection of vulnerabilities in smart contracts has received extensive attention from researchers and engineers. Machine learning-based vulnerability detection techniques have the advantage that they do not need expert rules for determining vulnerabilities. However, existing approaches cannot identify vulnerabilities when the versions of smart contract compilers are updated. In this paper, we propose OC-Detector (Opcode Clustering Detector), a smart contract vulnerability detection approach based on clustering opcode instructions. OC-Detector learns the characteristics of opcode instructions to cluster them and replaces opcode instructions belonging to the same cluster with the ID of the cluster. After that, the similarity between the contract under analysis and contracts in the vulnerability database is calculated to identify vulnerabilities. The experimental results demonstrate that OC-Detector improves the F1 value of detecting vulnerabilities from 0.04 to 0.40 compared to DC-Hunter, Securify, SmartCheck and Osiris. Additionally, compared to DC-Hunter, the F1 value is improved by 0.27 when detecting vulnerabilities in smart contracts compiled by different versions of compilers.

Smart contracts are decentralized applications running on the blockchain to meet various practical scenario demands. The increasing number of security events regarding smart contracts have led to huge pecuniary losses and destroyed the ecological stability of contract layer on the blockchain. Faced with the increasing quantity of contracts, it is an emerging issue to effectively and efficiently detect vulnerabilities in smart contracts. Existing methods of detecting vulnerabilities in smart contracts like Oyente mainly employ symbolic execution. This method is very time-consuming, as the symbolic execution requires the exploration of all executable paths in a contract. In this work, we propose an efficient model for the detection of vulnerabilities in Ethereum smart contracts with machine learning techniques. The model is able to effectively and fast detect vulnerabilities based on the patterns learned from training samples. Our model is evaluated on 49502 real-world smart contracts and the results verify its effectiveness and efficiency.

With the increasing popularity of Decentralized Applications (DApps) in blockchain, securing smart contracts has been a long-term, high-priority subject in the domain. Among the various research directions for vulnerability detection, fuzzing has received extensive attention because of its high effectiveness. However, with the increasing complexity of smart contracts, existing fuzzers may waste substantial time exploring locations irrelevant to smart contract vulnerabilities. In this article, we present FunFuzz, a function-oriented fuzzer, which is dedicatedly tailored for detecting smart contract vulnerability with high effectiveness and efficiency. The key observation in our research is that most smart contract vulnerabilities exist in specific functions rather than randomly distributed in all program code like other traditional software. To this end, unlike traditional fuzzers which mainly target code coverage, FunFuzz identifies risky functions while pruning non-risky ones in smart contracts. In this way, it significantly narrows down the exploration scope during the fuzzing process. In addition, FunFuzz employs three unique strategies to direct itself toward effectively discovering vulnerabilities specific to smart contracts (e.g., reentrancy, block dependency, and gasless send). Extensive experiments on 170 real-world contracts demonstrate that FunFuzz outperforms state-of-the-art fuzzers in terms of effectiveness and efficiency.

Smart Contracts ensure trust through blockchain technology, streamline processes, and have disruptive potential across various industries. However, the issue of smart contract security cannot be underestimated. The vulnerability of smart contracts to exploitation has led to substantial losses, prompting increased attention toward vulnerability mining. Existing efforts for analyzing contract security heavily depend on inflexible rules set by experts, making them non‐adaptable or scalable. Although various machine‐learning methods have emerged for vulnerability mining in smart contracts, a research gap remains in effectively integrating diverse features of complex smart contracts with deep neural networks for enhanced detection. This paper presents SmartSecure, a vulnerability mining framework incorporating high‐level semantic features extracted from contract source code. It provides in‐depth local insights into vulnerabilities through contract property graphs that integrate abstract syntax trees, control flow graphs, and data dependency graphs, encompassing all syntactic and semantic aspects of the contract function. To fortify these features, we integrate them with low‐level features derived from opcode sequences, encompassing global aspects. These diverse features are seamlessly fused and processed through a novel neural network design, resulting in a robust and effective solution. We evaluate our framework over 25,129 real‐world smart contracts. Extensive experiments demonstrate the superiority of our method over existing tools and neural network‐based approaches. It achieves an exceptional performance level of up to 97.6%, marking a significant step forward in smart contract security.

This paper aims to explore the application of deep learning in smart contract vulnerabilities detection. Smart contracts are an essential part of blockchain technology and are crucial for developing decentralized applications. However, smart contract vulnerabilities can cause financial losses and system crashes. Static analysis tools are frequently used to detect vulnerabilities in smart contracts, but they often result in false positives and false negatives because of their high reliance on predefined rules and lack of semantic analysis capabilities. Furthermore, these predefined rules quickly become obsolete and fail to adapt or generalize to new data. In contrast, deep learning methods do not require predefined detection rules and can learn the features of vulnerabilities during the training process. In this paper, we introduce a solution called Lightning Cat which is based on deep learning techniques. We train three deep learning models for detecting vulnerabilities in smart contract: Optimized-CodeBERT, Optimized-LSTM, and Optimized-CNN. Experimental results show that, in the Lightning Cat we propose, Optimized-CodeBERT model surpasses other methods, achieving an f1-score of 93.53%. To precisely extract vulnerability features, we acquire segments of vulnerable code functions to retain critical vulnerability features. Using the CodeBERT pre-training model for data preprocessing, we could capture the syntax and semantics of the code more accurately. To demonstrate the feasibility of our proposed solution, we evaluate its performance using the SolidiFI-benchmark dataset, which consists of 9369 vulnerable contracts injected with vulnerabilities from seven different types.

As a trusted decentralized application, smart contracts manage a large number of digital assets on the blockchain. Vulnerability detection of smart contracts is an important part of ensuring the security of digital assets. At present, many researchers extract features of smart contract source code for vulnerability detection based on deep learning methods. However, the current research mainly focuses on the single representation form of the source code, which cannot fully obtain the rich semantic and structural information contained in the source code, so it is not conducive to the detection of various and complex smart contract vulnerabilities. Aiming at this problem, this paper proposes a vulnerability detection model based on the fusion of syntax and semantic features. The syntactic and semantic representation of the source code is obtained from the abstract syntax tree and control flow graph of the smart contract through TextCNN and Graph Neural Network. The syntactic and semantic features are fused, and the fused features are used to detect vulnerabilities. Experiments show that the detection accuracy and recall rate of this model have been improved on the detection tasks of five types of vulnerabilities, with an average precision of 96% and a recall rate of 90%, which can effectively identify smart contract vulnerabilities.

Vulnerable smart contract function locating based on Multi-Relational Nested Graph Convolutional Network

Metallocene and Single Site Polymers (#1624)