SmartSecure : An Integrated Semantic Vulnerability Mining Framework for Ethereum Smart Contract

With the rapid development of the blockchain, smart contract technology has been widely applied. The number of smart contracts has grown at a high rate and nearly at an average of thousands per day. However, the correctness and security of the smart contract itself are facing huge problems. The well-known DAO vulnerability, and Parity multi-signature wallet’ vulnerabilities have leaded to a hundreds of millions dollars loss, and they are both caused by the security problems of smart contracts. Once the smart contract vulnerability is exploited, it is very likely to bring the loss of cryptocurrencies, the disorder of the financial order and other catastrophic consequences. Therefore the security of smart contracts is imminent. This project has designed and implemented a vulnerability detection system of Ethereum smart contract. The system uses the assembly instruction sequences of the smart contract to generate the control flow graph, then performs symbolic execution and vulnerability constraint solving over the control flow. The system can detect some common types of vulnerabilities, such as the integer overflow and underflow vulnerability, reentry vulnerability and unchecked call return value vulnerability. It has a high accuracy of detection result, and gives support for export vulnerability report.

A comprehensive survey of smart contract security: State of the art and research directions

Blockchain technology and its applications are gaining popularity day by day. It is a ground-breaking technology that allows users to communicate without the need of a trusted middleman. A smart contract (self-executable code) is deployed on the blockchain and auto executes due to a triggering condition. In a no-trust contracting environment, smart contracts can establish trust among parties. Terms and conditions embedded in smart contracts will be imposed immediately when specified criteria have been fulfilled. Due to this, the malicious assailants have a special interest in smart contracts. Blockchains are immutable means if some transaction is deployed or recorded on the blockchain, it becomes unalterable. Thus, smart contracts must be analyzed to ensure zero security vulnerabilities or flaws before deploying the same on the blockchain because a single vulnerability can lead to the loss of millions. For analyzing the security vulnerabilities of smart contracts, various analysis tools have been developed to create safe and secure smart contracts. This paper presents a systematic review on Ethereum smart contracts analysis tools. Initially, these tools are categorized into static and dynamic analysis tools. Thereafter, different sources code analysis techniques are studied such as taint analysis, symbolic execution, and fuzzing techniques. In total, 86 security analysis tools developed for Ethereum blockchain smart contract are analyzed regardless of tool type and analysis approach. Finally, the paper highlights some challenges and future recommendations in the field of Ethereum smart contracts.

Smart contracts, pivotal to blockchain technology, automate contract enforcement with precision and reliability but are plagued by security vulnerabilities that have led to significant financial losses. Traditional methods like static analysis and fuzzy testing, though foundational, typically fail to grasp the complex logic of smart contract code, resulting in poor adaptability to the evolving landscape of blockchain applications. To address these challenges, this paper introduces an advanced Graph Neural Network (GNN) approach tailored for smart contract vulnerability detection on the VNT blockchain platform. Our methodology leverages the inherent structural and semantic relationships within contract code, transforming it into a graph representation for deeper learning. The enhanced GNN model effectively captures intricate patterns and dependencies that traditional methods overlook, significantly improving detection accuracy and efficiency. Experimental results demonstrate that our approach outperforms existing techniques, offering a promising avenue for both refining smart contract security analyses and guiding future development practices. We further contribute to the field by providing a robust dataset of smart contracts, fostering further research and application enhancements. Experimental results demonstrate that the proposed method not only advances the security of smart contract in VNT but also establishes a new benchmark for the application of deep learning in blockchain.

• Created a refined, expanded, and precisely labeled dataset with explanations, risk assessments, and fixes for each vulnerability • Fine-tuned an open-source LLM: LLaMA-3.1-8B using parameter-efficient techniques (LoRA) for smart contract vulnerability detection • Fine-tuned GPT-4o-mini on the same corpus for comparative analysis • Developed a real-time Visual Studio Code (VSCode) plugin integrating GPT-4o-mini for smart contract auditing • Released the datasets, tool, and fine-tuned model to advance research in smart contract security Since the advent of Ethereum, ensuring the security of smart contracts has become imperative. Integer overflow and underflow, reentrancy, and timestamp dependency remain the three most prevalent vulnerabilities in deployed contracts. Existing static-analysis tools often yield insufficient accuracy, and datasets derived from them inherit the same shortcomings. Moreover, the smart contract ecosystem lacks a dependable, real-time auditing aid for developers and a fine-tuned model trained on a truly comprehensive corpus. In this paper, we present three main contributions. (1) Dataset curation: the state-of-the-art vulnerability datasets are aggregated and harmonized, producing a clean, fully labeled dataset that integrates detailed explanations, potential security risks, vulnerable line ranges, code snippets, and corresponding fixes. The dataset is publicly available via our GitHub repository. (2) Model fine-tuning: the LLaMA-3.1-8B model as well as GPT-4o-mini are fine-tuned on this corpus and evaluated with both standard classification metrics and text-quality measures. The fine-tuned LLaMA-3.1 model achieves a precision of 93.55%, an average semantic similarity of 77.48%, and a code similarity of 87.25%. (3) IDE integration: We implement a real-time Visual Studio Code extension, backed by the GPT-4o API, that highlights, explains, and automatically patches vulnerabilities as the developer writes. Together, these contributions deliver a rigorously validated model and a practical developer toolchain that markedly advance the state of smart contract security research and practice.

EAOS: Exposing attacks in smart contracts through analyzing opcode sequences with operands

Vulnerable smart contract function locating based on Multi-Relational Nested Graph Convolutional Network

Blockchain technology and smart contracts are emerging as transformative tools for enhancing transparency and efficiency in supply chain management and vendor relations. Traditional supply chains often face challenges such as inefficiencies, lack of transparency, and susceptibility to fraud (Kouhizadeh & Sarkis, 2018). Blockchain, a decentralized ledger technology, coupled with smart contracts, which are self-executing contracts with the terms directly written into code, offers promising solutions to these challenges (Wang, Han, & Beynon-Davies, 2019). This paper explores the application of blockchain and smart contracts in these domains, examining their potential to provide immutable records, streamline processes, and mitigate risks (Casado-Vara et al., 2018). Through a comprehensive analysis of current literature and case studies, we identify key benefits including improved transparency, enhanced efficiency, and better risk management (Christidis & Devetsikiotis, 2016; Tian, 2016). Our findings suggest that blockchain and smart contracts can significantly improve supply chain transparency and vendor management, though their implementation requires careful consideration of technical, regulatory, and organizational factors (Saberi et al., 2019). Notable case studies, such as Walmart’s blockchain pilot for food safety and De Beers' diamond tracking initiative, illustrate the practical benefits and challenges of adopting these technologies in real-world scenarios (Casino, Dasaklis, & Patsakis, 2019; Kshetri, 2018). Despite the promising outlook, further research is needed to address scalability, interoperability, and regulatory compliance issues to fully realize the potential of blockchain and smart contracts in supply chain management (Hughes et al., 2019).

As a novel decentralized computing paradigm, blockchain is expected to disrupt the existing e-commerce architecture and process. Secure smart contracts are the crucial foundation for e-commerce based on blockchain. However, vulnerabilities in smart contracts occur from time to time and cause significant financial losses in e-commerce. Some static verification methods have been developed to guarantee security for e-commerce smart contracts at design time, but they cannot support complex scenarios at runtime. As a lightweight verification method, runtime verification is a potential method for secure e-commerce smart contracts. The existing runtime verification methods are based on the manual instrument, which leads to additional overheads and gas consumption. To deal with this, we propose a passive learning-based runtime verification framework for e-commerce smart contracts. Firstly, by exploring the Genetic algorithm to evolve state merging and automaton reorganizing in order to simultaneously split time and gas behaviors, we propose a passive learning method to model runtime information for e-commerce smart contracts (PL4ESC). It directly learns P2TA (priced probabilistic timed automaton) from runtime traces without any prior knowledge. Then, we integrate PL4ESC with the open-source PAT (Process Analysis Toolkit) to automatically verify the security of runtime e-commerce smart contracts. The experiments show that PL4ESC is better at accuracy and precision than state-of-the-art passive learning methods. It improves accuracy by 1 to 4 percent compared to TAG and RTI+. As far as we know, it is not only the first learning method that can learn a P2TA from traces, but it is also the first automated runtime verification framework for e-commerce smart contracts. This will provide security guarantees for blockchain-based e-commerce.

In decentralized apps, smart contracts are used to conduct trusted transactions on the Blockchain (BC). While smart contracts are highly effective, they are also highly susceptible to security flaws, leading to serious financial consequences. However, the combination of BC technology and artificial intelligence provides a solution for powerful, secure, and decentralized applications in various sectors. Furthermore, large language models (LLMs), which are essential advanced machine learning frameworks, are now used in various applications, including customer service, chatbots, code generation, vulnerability detection, and language translation. This study investigates the use of LLMs for automated vulnerability detection in Solidity-based smart contracts. Specifically, three models are evaluated and compared: GPT-3.5-turbo, DeepSeek R1, and LLaMA-3. With a labeled, multi-class dataset including four vulnerability types, the models are assessed across three reasoning strategies: zero-shot, few-shot, and chain of thought. A prompt-based evaluation and performance comparison is conducted using standard metrics such as accuracy, precision, recall, F1-score, and average detection time. Results show that in the zero-shot setting, GPT-3.5-turbo achieves the highest accuracy of 94.59%, followed closely by LLaMA-3 with 92%, while DeepSeek R1 achieved 78.95%. In the few-shot setting, LLaMA-3 outperformed other models. Furthermore, in the CoT setting, LLaMA-3 demonstrates the strongest overall performance with 96% accuracy and an F1-score of 0.82, surpassing DeepSeek R1's average of 78.95% and GPT-3.5's CoT performance, which is notably lower. Hence, this study develops an evaluation framework for LLM-based vulnerability detection, and we have demonstrated that prompt engineering has the potential to enhance the security of smart contracts.

The blockchain based smart contracts allow the creation of peer-to-peer lending in a decentralized finance model called DeFi. While Aave, Compound, and MakerDAO make it easier to gain access to capital and do away with middlemen, security breaches are highly likely to occur. This study analyzes the smart contract vulnerabilities such as reentrancy attacks, oracle manipulation, flash loan exploits, are systematically highlighted and their impact on projects in the market. Furthermore, it completes assessment beyond the security focus of liquidity volatility, regulatory uncertainty and fragmented risk management framework. A systematic literature review was adopted in the study with peer reviewed journal, industry report as well as case studies of past DeFi exploits. The key vulnerabilities, risk assessment methods, and mitigation frameworks are dealt as a theme. According to findings, although smart contract security has improved, DeFi is still very prone to exploitation for the lack of centralized oversight and standardised security measures. The study also brings our attention to the fact that risks in smart contract need continuous smart contract audits, formal verification schemes, and decentralized insurance mechanisms as well as regulatory collaboration. For the sustainable growth of DeFi lending platforms, such a balance should be made possible between technological security measures and improved governance and regulatory frameworks. The increased security mechanisms will increase the user trust and make decentralized lending an alternative to traditional financial systems.

Blockchain is an emerging technology with broad applications. As an important application of the blockchain, smart contracts can formulate trading rules to manage thousands of virtual currencies. Nowadays, the IoT (Internet of Things) combined with blockchain has become a new trend and smart contract can implement different transaction demands for IoT-blockchain systems. Once there exits vulnerability in the smart contract program, the security of the virtual currency will not be guaranteed. However, ensuring the security of smart contracts is never an easy task. On the one hand, existing smart contracts cannot identify fake users or malicious programs, which is difficult to be regulated at present; on the other hand, smart contracts involving in multiple trading users are very similar to shared-memory concurrent programs. To deal with these problems, this study uses formal verification methods, adopting the Communicating Sequence Processes (CSP) theory to formally model concurrent programs. Then the FDR (Failure Divergence Refinement), a refinement checker or model checker for CSP, is utilized to successfully detect the vulnerability regarding concurrency in one smart contract public in Ethereum. The results show the potential advantage of using CSP and FDR tool to check the vulnerability in smart contracts especially from the perspective of concurrency.

The world today has realized the vast technological evolution that has greatly shaped the production and management functions of business enterprises. Traditional contracts can take weeks or even months to initiate, and there have been numerous instances of breaches and lack of trust for contracts in both the private and public sector. A smart contract can be defined as a self-executing contract that utilizes blockchain technology to digitally enforce, verify, or facilitate the performance or negotiation of a contract. Owing to the security and decentralized system exhibited by blockchain technology, smart contracts can foster transaction credibility between contracting parties without the necessity of third parties as exhibited in traditional contracts. Any business organization that aims at achieving greater heights in management and production dimensions must consider utilizing robust technologies that are aimed at bolstering its competitive edge. Owing to the newness of smart contracts, characterized by very few studies on the same, this research reviews how smart contracts through blockchain technology can be implemented in an organization to enhance performance and outlines the applications, benefits, and limitations associated with such contracts. Keywords: Blockchain technology; smart contracts; smart contract applications; smart contract benefits; smart contract implementation; cryptography; cryptocurrency DOI : 10.7176/JIEA/9-5-07 Publication date :September 30 th 2019

Smart contracts are frequently targeted by hackers because they hold large amounts of money and cannot be modified once they are published. Existing detection methods mainly focus on known vulnerabilities with clear features and cannot deal with unknown vulnerabilities. As a consequence, proposing a method for detecting unknown vulnerabilities in smart contracts represents a significant advancement in the field of smart contract security. Aiming at this problem, based on the idea that the opcode sequences of transactions containing unknown vulnerabilities have similarities to the opcode sequences of transactions containing known vulnerabilities, we propose a novel approach for unknown vulnerability detection in smart contracts using a CNN-BiLSTM model. Our model determines whether a vulnerability is unknown by detecting the opcode sequence representing the entire execution process of a transaction. Experimental results with the opcode sequences of transactions show that the model can achieve 82.86% accuracy and 83.63% F1-score.KeywordsSmart contractsUnknown vulnerabilitiesVulnerability detectionCNN-BiLSTMOpcode sequences

Ethereum holds multiple billions of U.S. dollars in the form of Ether cryptocurrency and ERC-20 tokens, with millions of deployed smart contracts algorithmically operating these funds. Unsurprisingly, the security of Ethereum smart contracts has been under rigorous scrutiny. In recent years, numerous defense tools have been developed to detect different types of smart contract code vulnerabilities. When opportunities for exploiting code vulnerabilities diminish, the attackers start resorting to social engineering attacks, which aim to influence humans - often the weakest link in the system. The only known class of social engineering attacks in Ethereum are honeypots, which plant hidden traps for attackers attempting to exploit existing vulnerabilities, thereby targeting only a small population of potential victims.