Tootfinder

Detecting State Manipulation Vulnerabilities in Smart Contracts Using LLM and Static Analysis
Hao Wu, Haijun Wang, Shangwang Li, Yin Wu, Ming Fan, Yitao Zhao, Ting Liu
https://arxiv.org/abs/2506.08561

Detecting State Manipulation Vulnerabilities in Smart Contracts Using LLM and Static Analysis
An increasing number of DeFi protocols are gaining popularity, facilitating transactions among multiple anonymous users. State Manipulation is one of the notorious attacks in DeFi smart contracts, with price variable being the most commonly exploited state variable-attackers manipulate token prices to gain illicit profits. In this paper, we propose PriceSleuth, a novel method that leverages the Large Language Model (LLM) and static analysis to detect Price Manipulation (PM) attacks proactively.…

This https://arxiv.org/abs/2504.13398 has been replaced.
initial toot: https://mastoxiv.page/@arXiv_csCR_…

Insecurity Through Obscurity: Veiled Vulnerabilities in Closed-Source Contracts
Most blockchains cannot hide the binary code of programs (i.e., smart contracts) running on them. To conceal proprietary business logic and to potentially deter attacks, many smart contracts are closed-source and employ layers of obfuscation. However, we demonstrate that such obfuscation can obscure critical vulnerabilities rather than enhance security, a phenomenon we term insecurity through obscurity. To systematically analyze these risks on a large scale, we present SKANF, a novel EVM byteco…

Properties of UTxO Ledgers and Programs Implemented on Them
Polina Vinogradova (Input Output Global), Alexey Sorokin (Input Output Global)
https://arxiv.org/abs/2506.05832

Properties of UTxO Ledgers and Programs Implemented on Them
Trace-based properties are the gold standard for program behaviour analysis. One of the domains of application of this type of analysis is cryptocurrency ledgers, both for the purpose of analyzing the behaviour of the ledger itself, and any user-defined programs called by it, known as smart contracts. The (extended) UTxO ledger model is a kind of ledger model where all smart contract code is stateless, and additional work must be done to model stateful programs. We formalize the application of …

Shill Bidding Prevention in Decentralized Auctions Using Smart Contracts
M. A. Bouaicha, G. Destefanis, T. Montanaro, N. Lasla, L. Patrono
https://arxiv.org/abs/2506.00282

Shill Bidding Prevention in Decentralized Auctions Using Smart Contracts
In online auctions, fraudulent behaviors such as shill bidding pose significant risks. This paper presents a conceptual framework that applies dynamic, behavior-based penalties to deter auction fraud using blockchain smart contracts. Unlike traditional post-auction detection methods, this approach prevents manipulation in real-time by introducing an economic disincentive system where penalty severity scales with suspicious bidding patterns. The framework employs the proposed Bid Shill Score (BS…

FSM Modeling For Off-Blockchain Computation
Christian Gang Liu
https://arxiv.org/abs/2506.02086 https://arxiv.org/pdf/2506.02086

FSM Modeling For Off-Blockchain Computation
Blockchain benefits are due to immutability, replication, and storage-and-execution of smart contracts on the blockchain. However, the benefits come at increased costs due to the blockchain size and execution. We address three fundamental issues that arise in transferring certain parts of a smart contract to be executed off-chain: (i) identifying which parts (patterns) of the smart contract should be considered for processing off-chain, (ii) under which conditions should a smart-contract patter…

Legal Compliance Evaluation of Smart Contracts Generated By Large Language Models
Chanuka Wijayakoon, Hai Dong, H. M. N. Dilum Bandara, Zahir Tari, Anurag Soin
https://arxiv.org/abs/2506.00943

Legal Compliance Evaluation of Smart Contracts Generated By Large Language Models
Smart contracts can implement and automate parts of legal contracts, but ensuring their legal compliance remains challenging. Existing approaches such as formal specification, verification, and model-based development require expertise in both legal and software development domains, as well as extensive manual effort. Given the recent advances of Large Language Models (LLMs) in code generation, we investigate their ability to generate legally compliant smart contracts directly from natural lang…

Transforming Automatically BPMN Models to Smart Contracts with Nested Collaborative Transactions (TABS )
Christian Gang Liu, Peter Bodorik, Dawn Jutla
https://arxiv.org/abs/2506.02727

Transforming Automatically BPMN Models to Smart Contracts with Nested Collaborative Transactions (TABS+)
Development of blockchain smart contracts is more difficult than mainstream software development because the underlying blockchain infrastructure poses additional complexity. To ease the developer's task of writing smart contract, as other research efforts, we also use Business Process Model and Notation BPMN modeling to describe application requirements for trade of goods and services and then transform automatically the BPMN model into the methods of a smart contract. In our previous research…

Supporting Long-term Transactions in Smart Contracts Generated from Business Process Model and Notation (BPMN) Models
Christian Gang Liu
https://arxiv.org/abs/2505.24309

Supporting Long-term Transactions in Smart Contracts Generated from Business Process Model and Notation (BPMN) Models
To alleviate difficulties in writing smart contracts for distributed blockchain applications, as other research, we propose transformation of Business Process Model and Notation (BPMN) models into blockchain smart contracts. Unlike other research, we use Discrete Event Hierarchical State Machine (DE-HSM) multi-modal modeling to identify collaborative trade transactions that need to be supported by the smart contract and describe how the trade transactions, that may be nested, are supported by a…

Solsmith: Solidity Random Program Generator for Compiler Testing
Lantian Li, Zhihao Liu, Zhongxing Yu
https://arxiv.org/abs/2506.03909 https://

Solsmith: Solidity Random Program Generator for Compiler Testing
Smart contracts are computer programs that run on blockchain platforms, with Solidity being the most widely used language for their development. As blockchain technology advances, smart contracts have become increasingly important across various fields. In order for smart contracts to operate correctly, the correctness of the compiler is particularly crucial. Although some research efforts have been devoted to testing Solidity compilers, they primarily focus on testing methods and do not addres…

Automated Mechanism to Support Trade Transactions in Smart Contracts with Upgrade and Repair
Christian Gang Liu, Peter Bodorik, Dawn Jutla
https://arxiv.org/abs/2506.03877

Automated Mechanism to Support Trade Transactions in Smart Contracts with Upgrade and Repair
In our previous research, we addressed the problem of automated transformation of models, represented using the business process model and notation (BPMN) standard, into the methods of a smart contract. The transformation supports BPMN models that contain complex multi-step activities that are supported using our concept of multi-step nested trade transactions, wherein the transactional properties are enforced by a mechanism generated automatically by the transformation process from a BPMN mode…

Talking Transactions: Decentralized Communication through Ethereum Input Data Messages (IDMs)
Xihan Xiong, Zhipeng Wang, Qin Wang, Endong Liu, Pascal Berrang, William Knottenbelt
https://arxiv.org/abs/2505.24724

Talking Transactions: Decentralized Communication through Ethereum Input Data Messages (IDMs)
Can you imagine, blockchain transactions can talk! In this paper, we study how they talk and what they talk about. We focus on the input data field of Ethereum transactions, which is designed to allow external callers to interact with smart contracts. In practice, this field also enables users to embed natural language messages into transactions. Users can leverage these Input Data Messages (IDMs) for peer-to-peer communication. This means that, beyond Ethereum's well-known role as a financial …