Ensemble multi-label machine learning solidity smart contract vulnerability detection model

The blockchain 2.0 age, marked by smart contract and Ethereum, has arrived couple years ago. Its technologies have expanded the application scenarios of blockchain technology and driven the boom of decentralized Finance. However, smart contract vulnerabilities and security issues are also emerging one after another. Hackers have exploited these vulnerabilities to cause huge economic losses. In recent years, a large amount of research on the analysis and detection of smart contract vulnerabilities has emerged, but there has been no common detection tool and corresponding test dataset. In this paper, we build GSVD dataset (Generalized Smart Contract Vulnerability Dataset) consisting four offline datasets using smart contracts on two chains, Polygon and BSC: two small Solidity datasets consisting of 153 labeled smart contract source codes, which can be used to test the performance of vulnerability mining tools; two large Solidity datasets consisting of 52,202 un labeled real smart contract source codes that can be used to verify the correctness of various theories and tools under a large number of real data conditions. At the same time, this paper integrates the scripting framework accompanying the GSVD dataset, which can execute a variety of popular automated vulnerability detection tools on top of these datasets and generate analysis results of contracts and potential vulnerabilities. We tested the Minor dataset under GSVD using three tools (Slither, Manticore, Mythril) that are kept up to date and found that the combined use of all tools detected 61.1% of labeled vulnerabilities, of which Mythril has the highest detection rate of 42.6%. It is not difficult to conclude that there`re still ample room for advancement for current smart contract vulnerability mining tools because of their underlying methods. Besides, our dataset can contribute to the ultimate target greatly by providing mining tools plenty real contracts information.

Information and communication technology based inter-organizational systems enable companies to integrate information and conduct business electronically across different parts of the organization. For organizations embracing blockchain, smart contracts provide automation and operational efficiency for inter-organizational systems. Initially utilised for financial transactions, smart contract are extended beyond banking and deployed in wide number of organizations. Smart contracts are regarded as self-executing type of contract consisting of agreement’s terms embedded directly into the code which plays a vital role in operability for inter-organizational systems, however, smart contract vulnerabilities can arise due to programming errors, leading to security issues. The effects of smart contract vulnerabilities can be significant, including loss of funds, unauthorized access to sensitive information, manipulation of data, and loss of trust in the application leading to catastrophic financial losses followed by legal implications for an organization based on blockchain technology. The goal of smart contracts exploiting vulnerabilities is to discover and eliminate potential security vulnerabilities in smart contract code prior to it being deployed. Detecting vulnerabilities in a timely manner helps to prevent financial losses, unauthorized access, and data manipulation. In order to provide a robust solution to detect vulnerabilities in smart contracts, the proposed methodology presents a novel approach for rapid detection of vulnerabilities by integrating genetic algorithm with isolation forest. Furthermore, enhancing smart contract vulnerability identification with higher accuracy and false-positive rate provides a reliable gateway for organizations to adopt blockchain.

Smart contracts are computer programs designed to automate legal agreements. They are usually developed in a high-level programming language, the most popular of which is Solidity. Every day, hundreds of thousands of new contracts are deployed managing millions of dollars’ worth of transactions. As for every computer program, smart contracts may contain bugs which can be exploited. However, since smart contracts are often used to automate financial transactions, such exploits may result in huge economic losses. In general, it is estimated that since 2019, more than $5B was stolen due to vulnerabilities in smart contracts. This article addresses the issue of smart contract vulnerabilities by introducing an executable denotational semantics for Solidity within the Isabelle/HOL interactive theorem prover. This formal semantics serves as the basis for an interactive program verification environment for Solidity smart contracts. To evaluate our semantics, we integrate grammar-based fuzzing with symbolic execution to automatically test it against the Solidity reference implementation. The article concludes by showcasing the formal verification of Solidity programs, exemplified through the verification of a basic Solidity token.

A blockchain is a data structure that is implemented as a distrusted database or digital ledger. The transactions are saved to a block of transactions that is attached in turn to the blockchain after the verification process, in which each block in the chain contains a hash signature of the previous block in addition to the hash signature of the block itself. The blocks on the blockchain are chained as an immutable list using the proof-of-work procedure, where there is no way to alter or delete an attached block due to the strict security policy used for structuring the chain of blocks. Each node holds a copy of the blockchain in which the miners take the responsibility of verifying and attaching blocks to the blockchain. The Ethereum blockchain introduced the smart contract which holds logic to be processed once the contract is established. These smart contracts are developed via the Solidity programming language. This proposed paper exploits the Ethereum blockchain along with smart contracts as the base technology for implementing the proposed blockchain-based model. The paper aims to develop a multilayered blockchain-based model, in which the blockchain model is set up on a private blockchain Ethereum network where the nodes share the electronic medical records (EMR) among the P2P (peer-to-peer) network that will be used to secure the IoT medical transactions. Solidity smart contract, introduced by Ethereum, is deployed to handle the EMR “open-query-transfer” operations on the private network, whereas the miners are responsible to validate the transactions. Finally, the research conducts a performance analysis of the Ethereum network using the Ethereum Caliper, considering several performance factors, which are: Maximum Latency, Minimum Latency, Average Latency, and Throughput.

Smart contracts are programs running on blockchain. In recent years, due to the persistent occurrence of security-related accidents in smart contracts, the effective detection of vulnerabilities in smart contracts has received extensive attention from researchers and engineers. Machine learning-based vulnerability detection techniques have the advantage that they do not need expert rules for determining vulnerabilities. However, existing approaches cannot identify vulnerabilities when the versions of smart contract compilers are updated. In this paper, we propose OC-Detector (Opcode Clustering Detector), a smart contract vulnerability detection approach based on clustering opcode instructions. OC-Detector learns the characteristics of opcode instructions to cluster them and replaces opcode instructions belonging to the same cluster with the ID of the cluster. After that, the similarity between the contract under analysis and contracts in the vulnerability database is calculated to identify vulnerabilities. The experimental results demonstrate that OC-Detector improves the F1 value of detecting vulnerabilities from 0.04 to 0.40 compared to DC-Hunter, Securify, SmartCheck and Osiris. Additionally, compared to DC-Hunter, the F1 value is improved by 0.27 when detecting vulnerabilities in smart contracts compiled by different versions of compilers.

Smart contracts are decentralized applications running on the blockchain to meet various practical scenario demands. The increasing number of security events regarding smart contracts have led to huge pecuniary losses and destroyed the ecological stability of contract layer on the blockchain. Faced with the increasing quantity of contracts, it is an emerging issue to effectively and efficiently detect vulnerabilities in smart contracts. Existing methods of detecting vulnerabilities in smart contracts like Oyente mainly employ symbolic execution. This method is very time-consuming, as the symbolic execution requires the exploration of all executable paths in a contract. In this work, we propose an efficient model for the detection of vulnerabilities in Ethereum smart contracts with machine learning techniques. The model is able to effectively and fast detect vulnerabilities based on the patterns learned from training samples. Our model is evaluated on 49502 real-world smart contracts and the results verify its effectiveness and efficiency.

With the increasing popularity of Decentralized Applications (DApps) in blockchain, securing smart contracts has been a long-term, high-priority subject in the domain. Among the various research directions for vulnerability detection, fuzzing has received extensive attention because of its high effectiveness. However, with the increasing complexity of smart contracts, existing fuzzers may waste substantial time exploring locations irrelevant to smart contract vulnerabilities. In this article, we present FunFuzz, a function-oriented fuzzer, which is dedicatedly tailored for detecting smart contract vulnerability with high effectiveness and efficiency. The key observation in our research is that most smart contract vulnerabilities exist in specific functions rather than randomly distributed in all program code like other traditional software. To this end, unlike traditional fuzzers which mainly target code coverage, FunFuzz identifies risky functions while pruning non-risky ones in smart contracts. In this way, it significantly narrows down the exploration scope during the fuzzing process. In addition, FunFuzz employs three unique strategies to direct itself toward effectively discovering vulnerabilities specific to smart contracts (e.g., reentrancy, block dependency, and gasless send). Extensive experiments on 170 real-world contracts demonstrate that FunFuzz outperforms state-of-the-art fuzzers in terms of effectiveness and efficiency.

This paper aims to explore the application of deep learning in smart contract vulnerabilities detection. Smart contracts are an essential part of blockchain technology and are crucial for developing decentralized applications. However, smart contract vulnerabilities can cause financial losses and system crashes. Static analysis tools are frequently used to detect vulnerabilities in smart contracts, but they often result in false positives and false negatives because of their high reliance on predefined rules and lack of semantic analysis capabilities. Furthermore, these predefined rules quickly become obsolete and fail to adapt or generalize to new data. In contrast, deep learning methods do not require predefined detection rules and can learn the features of vulnerabilities during the training process. In this paper, we introduce a solution called Lightning Cat which is based on deep learning techniques. We train three deep learning models for detecting vulnerabilities in smart contract: Optimized-CodeBERT, Optimized-LSTM, and Optimized-CNN. Experimental results show that, in the Lightning Cat we propose, Optimized-CodeBERT model surpasses other methods, achieving an f1-score of 93.53%. To precisely extract vulnerability features, we acquire segments of vulnerable code functions to retain critical vulnerability features. Using the CodeBERT pre-training model for data preprocessing, we could capture the syntax and semantics of the code more accurately. To demonstrate the feasibility of our proposed solution, we evaluate its performance using the SolidiFI-benchmark dataset, which consists of 9369 vulnerable contracts injected with vulnerabilities from seven different types.

The world today has realized the vast technological evolution that has greatly shaped the production and management functions of business enterprises. Traditional contracts can take weeks or even months to initiate, and there have been numerous instances of breaches and lack of trust for contracts in both the private and public sector. A smart contract can be defined as a self-executing contract that utilizes blockchain technology to digitally enforce, verify, or facilitate the performance or negotiation of a contract. Owing to the security and decentralized system exhibited by blockchain technology, smart contracts can foster transaction credibility between contracting parties without the necessity of third parties as exhibited in traditional contracts. Any business organization that aims at achieving greater heights in management and production dimensions must consider utilizing robust technologies that are aimed at bolstering its competitive edge. Owing to the newness of smart contracts, characterized by very few studies on the same, this research reviews how smart contracts through blockchain technology can be implemented in an organization to enhance performance and outlines the applications, benefits, and limitations associated with such contracts. Keywords: Blockchain technology; smart contracts; smart contract applications; smart contract benefits; smart contract implementation; cryptography; cryptocurrency DOI : 10.7176/JIEA/9-5-07 Publication date :September 30 th 2019

إنشاء عقود المعاملات وتنفيذها بين الطرق التقليدية وتقنية (البلوک تشين) والعقود الذکية- دراسة فقهية مقارنة أحمد سعد علي البرعي قسم الشريعة الإسلامية، کلية الدراسات الإسلامية والعربية للبنين، جامعة الأزهر، القاهرة، جمهورية مصر العربية. البريد الإلکتروني: dr_ahmed_saad78@yahoo.com ملخص البحث: تعد تقنية (بلوک تشين) من أهم تقنيات الثورة الصناعية الرابعة التي ستقود اقتصاديات العالم في السنوات القادمة، والتي لاقت رواجا واسعا في عالم المال والاقتصاد منذ بداية ظهورها، حتى تسارعت کثير من الدول الآن إلى الاستفادة منها في مجالات عدة، أبرزها مجال الذکية؛ حيث مکنت تلک التقنية الأفراد من إجراء عقودهم المالية وصفقاتهم التجارية بطريقة مباشرة عن طريق الند للند دون الحاجة إلى توسيط أي جهة مرکزية في المعاملة، وذلک عن طريق التمثيل الرقمي للممتلکات والأصول المالية في صورة رموز وأکواد تشفيرية مضمنة في منصات بلوک تشين يمکن نقلها بين المستخدمين بصورة آمنة وفاعلة وموثوقة، الأمر الذي مکن مستخدمي هذه الشبکات من إنشاء عقود ذکية فيما بينهم، تتولى شبکات البلوک تشين تنفيذها بطريقة آلية لا يتدخل فيها بشر؛ حيث يتم فيها- أوتوماتيکيا- نقل أصل الملکية بين أطراف المعاملة وفق بنود العقد الذي برمجوه وضمنوه في شبکة البلوک تشين، ويتم بعد ذلک تسجيل العقد وتخزين ما اقتضاه من معاملات في الشبکة بطريقة مشفرة لا يمکن لأحد أن يتلاعب فيها بمحو أو تعديل أو تزوير مهما طال الزمن، الأمر الذي سيغير في المستقبل القريب من صورة العقود والمعاملات المالية التي تجري بين الناس الآن في جميع مراحلها، بدءا من مرحلة إبرام العقد، ومرحلة توثيقه (حيث تقوم تلک الشبکات بتوثيق العقد وإشهاد جميع المستخدمين عليه، بدلا من توثيقه وتسجيله بالطرق التقليدية في الجهات المرکزية المختصة)، وانتهاء بمرحلة تنفيذه (حيث تتولى تلک الشبکات مسؤولية تنفيذ بنود العقد ونقل أصول الملکيات بين أطرافه بصورة آلية ذاتية تعمل وفق البرمجة التي اتفق عليها الطرفان وضمنوها داخل تلک المنصات)، وقد هدفت من هذه الدراسة تسليط الضوء على تلک التقنية الجديدة، ببيان ماهيتها، ونشأتها، وخصائصها، وطريقة عملها، مقارنا في ذلک بين العقود التقليدية التي جرى عليها العمل عند الفقهاء، وبين هذه العقود الذکية التي ستحل محلها في المستقبل القريب، منتهيا ببيان الرأي الفقهي في هذه النازلة. Designing Transactions Contracts and their Execution in between the traditional ways, the technology of (Blockchain) and Smart Contracts A Jurisprudential Study By: Ahmed Saad Ali Al- Boraee Department of Islamic Sharia Faculty of Islamic and Arabic Studies for Men in Cairo Azhar University E-mail : dr_ahmed_saad78@yahoo.com Abstract The technology of the blockchain is considered one of the most important technologies of the fourth industrial revolution which would lead the world economies in the following years, and which has widely flourished in the world of economy and finance since its early presence to the extent that many countries hastened to benefit from it in many fields. The most outstanding fields are where this technology enabled individuals to carry out their financial contracts and commercial bargains directly through peer- to- peer deals without resorting to any central authority as broker in the transaction. Such process runs through having digital representation of properties and financial assets in the form of symbols and decipherable codes included in blockchain platforms that can be transferred safely, effectively and trustworthily in between users. Such matters enabled the users of those networks to design smart contracts in between them. Blockchains networks take upon themselves executing them automatically as no human being is allowed to interfere since ownership assets are automatically transferred in between the two parties of the transaction in accordance with the articles of the contract which has been programmed and included in the network of blockchain. After that the contract is registered and saved in accordance with the requirements of transactions in a coded way through the network. None could manipulate this affair either by removing, modifying or even forging them along the years. Soon in the future, this affair would change the form of contracts and financial transactions running in between people in all phases; starting from the phase of signing the contracts, the phase of documentation (where those networks document the contract and all the users would testify instead of documenting and registering the contract via the specified central authorities in the traditional ways), till the phase of execution (where those networks take on the responsibility of executing the articles of the contract and transferring the assets in between the contracting parties through an automation that works in accordance with a certain programming approved by the two parties and included within those platforms). Therefore, this research is originally designed to highlight this new technology, its essence, origins, characteristics and its mechanism. The research also holds a comparison between the traditional contracts as identified by jurists and these smart contracts which will replace them soon in the future. Finally, the research concludes with the jurisprudential viewpoint regarding this mishap.

As a trusted decentralized application, smart contracts manage a large number of digital assets on the blockchain. Vulnerability detection of smart contracts is an important part of ensuring the security of digital assets. At present, many researchers extract features of smart contract source code for vulnerability detection based on deep learning methods. However, the current research mainly focuses on the single representation form of the source code, which cannot fully obtain the rich semantic and structural information contained in the source code, so it is not conducive to the detection of various and complex smart contract vulnerabilities. Aiming at this problem, this paper proposes a vulnerability detection model based on the fusion of syntax and semantic features. The syntactic and semantic representation of the source code is obtained from the abstract syntax tree and control flow graph of the smart contract through TextCNN and Graph Neural Network. The syntactic and semantic features are fused, and the fused features are used to detect vulnerabilities. Experiments show that the detection accuracy and recall rate of this model have been improved on the detection tasks of five types of vulnerabilities, with an average precision of 96% and a recall rate of 90%, which can effectively identify smart contract vulnerabilities.

Smart contracts are frequently targeted by hackers because they hold large amounts of money and cannot be modified once they are published. Existing detection methods mainly focus on known vulnerabilities with clear features and cannot deal with unknown vulnerabilities. As a consequence, proposing a method for detecting unknown vulnerabilities in smart contracts represents a significant advancement in the field of smart contract security. Aiming at this problem, based on the idea that the opcode sequences of transactions containing unknown vulnerabilities have similarities to the opcode sequences of transactions containing known vulnerabilities, we propose a novel approach for unknown vulnerability detection in smart contracts using a CNN-BiLSTM model. Our model determines whether a vulnerability is unknown by detecting the opcode sequence representing the entire execution process of a transaction. Experimental results with the opcode sequences of transactions show that the model can achieve 82.86% accuracy and 83.63% F1-score.KeywordsSmart contractsUnknown vulnerabilitiesVulnerability detectionCNN-BiLSTMOpcode sequences

This article explores the application of financial technologies in the auditing of decentralized finance (DeFi) and how these technologies can improve the audit process. The research aims to identify the main challenges faced in DeFi auditing and to offer recommendations for strengthening audit methodologies using financial technologies (FinTech). The article discusses decentralized finance and its innovative management principles based on blockchain technology, which fundamentally transforms traditional financial systems. The study identifies key risks associated with DeFi, such as vulnerabilities in smart contracts and the lack of regulatory frameworks. The theoretical foundation includes a detailed analysis of the differences between traditional and decentralized finance, highlighting DeFi’s advantages – lower operational costs, greater accessibility, and transparency – while addressing regulatory and security challenges. The research methodology is based on scientific literature analysis and the classification of FinTech tools according to established criteria to evaluate the effectiveness of audit methods and their potential for improvement. The main findings show that FinTech tools, such as artificial intelligence (e.g., decision tree models) and blockchain technology, enhance the reliability and speed of DeFi audits while highlighting the need for a more robust regulatory system. This article is relevant due to the rapid growth of the DeFi sector and its importance in the digital transformation of the financial industry. Moreover, this research aims to classify the most widely used financial technology tools according to their functions and analyze their impact on traditional and decentralized finance auditing processes, offering insights for improving audit methodologies.

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

Due to the popularity of multimedia and constantly growing capacity of network, digital media demanding is increasingly high in last decade. The digital media with copyrighted contents, such as pictures, videos, audios, and 3D-model materials, etc., are more important in today's e-commerce. In recent years, the digital media content service by using OTT (over-the-top) platform is an emerging e-commerce model. The traditional website of the digital media content (DMC) always provides the transaction platform for both content producer and content provider to upload their DMC products. Then, clients (consumers) could browse their interesting products on the website, and download DMCs after payment. However, the transaction of these copyrighted DMCs on the platform is still carried out by means of the traditional payment, e.g. credit cards, debit cards and the ACH (Automated Clearing House). This paper proposes an innovative secure private OTT (p-OTT) platform in which the transaction process could deal with the credible and customizable services by adopting blockchain technology. One of the key features of the blockchain technique is smart contract. Thus, each DMC product could be pre-defined a template of data contract. After negotiation process by using the smart contract, the real data contract (RDC) will be created and outputted by smart contract. According to the predefined template of data contract, the content producer or provider could easily implement his transaction policy. In addition, we design an online authentication key for each member and a shadow key pair for each booked DMC during a transaction period. Therefore, this paper presents a secure OTT model with blockchain technology. Finally, we shows that it is not only a secure OTT platform but also a flexible transaction via preforming smart contract.