Framework Architecture
Source: PwC, January 2024
Table 1: Architecture of Qwen2.5-Coder. (Qwen2.5-Coder Technical Report)
Table 2: Overview of the special tokens. (Qwen2.5-Coder Technical Report)
Figure 1: Number of data tokens across different cc-stages, and the validation effectiveness of training Qwen2.5-Coder using corresponding data. (Qwen2.5-Coder Technical Report)
Table 3: The performance of Qwen2.5-Coder training on different data mixture policy.
Table 4: Performance metrics of Veritas model.
Table 5: Evaluation results on the ground-true dataset.
Table 6: Evaluation results across severity levels.
Table 7: Evaluation results on the large dataset. ((𝑥,𝑦): 𝑥 true positives, and 𝑦 false positives)
Figure 3: Evaluation results on the ground-truth dataset with each design point deactivated.
| Certik in 20-22 | AI Audits in 24-26 | |
|---|---|---|
| Peak-to-trough crypto market cap | $200B →$2T | $1T →??? |
| % projects getting security audits | 10% | 50-75% |
| % leader market share | 60% | 60-75% |
| Projects audited | 10k+ | 100k+ |
| Capital raised | $230m | fair launch |
| Valuation | $2B | $10B+ |
Figure 1. Yearly total value stolen in crypto hacks and number of hacks 2016- 2023
Figure 2. Monthly total value stolen in crypto hacks and number of hacks 2023
| Attack Vector Sub-category | Definition | On-chain or Off-chain |
|---|---|---|
| Protocol exploitation | When an attacker exploits vulnerabilities in a blockchain component of a protocol, such as ones pertaining to validator nodes, the protocol’s virtual machine, or in the mining layer. | On-chain |
| Insider attack | When an attacker working inside a protocol, such as a rogue developer, uses privileged keys or other private information to directly steal funds. | Off-chain |
| Phishing | When an attacker tricks users into signing permissions, often done by supplanting a legitimate protocol, allowing the attacker to spend tokens on users’ behalf. Phishing may also happen when an attacker tricks users into directly sending funds to malicious smart contracts. | Off-chain |
| Contagion | When an attacker exploits a protocol due to vulnerabilities created by a hack in another protocol. Contagion also includes hacks that are closely related to hacks in other protocols. | On-chain |
| Compromised server | When an attacker compromises a server that is owned by a protocol, thereby disrupting the protocol’s normal workflow or gaining knowledge to further exploit the protocol in the future. | Off-chain |
| Wallet hack | When an attacker exploits a protocol that provides custodial/wallet services and subsequently acquires information about the wallets’ operation. | Off-chain |
| Price manipulation hack | When an attacker exploits a smart contract vulnerability or utilizes a flawed oracle that does not reflect accurate asset prices, facilitating the manipulation of a digital token’s price. | On-chain |
| Smart contract exploitation | When an attacker exploits a vulnerability in a smart contract code, which typically grants direct access to various control mechanisms of a protocol and token transfers. | On-chain |
| Compromised private key | When an attacker acquires access to a user’s private key, which can occur through a leak or a failure in off-chain software, for example. | Off-chain |
| Governance attacks | When an attacker manipulates a blockchain project with a decentralized governance structure by gaining enough influence or voting rights to enact a malicious proposal. | On-chain |
| Third-party compromised | When an attacker gains access to an off-chain third-party program that a protocol uses, which provides information that can later be used for an exploit. | Off-chain |
| Other | Either the attack does not fit in any of the previous categories or there is not enough information to properly classify it. | On-chain/Off-chain |
Figure 3. Yearly share of value stolen in DeFi hacks by attack vector
Figure 4. Blockchain General Architecture.
Figure 5. An SC developed in Solidity.
Figure 6. The main advantages of Blockchain and SCs.
| Attack Type | Description | Example |
|---|---|---|
| Reentrancy Attacks | Allows an attacker to repeatedly call an SC function before the previous call completes | Drain a contract’s funds by creating a malicious contract that calls the target contract’s function multiple times |
| Integer Overflow and Underflow | Exploits vulnerabilities in the way SCs handle integer values | Underflow a contract’s balance by sending a large negative number as input to a function expecting a positive number |
| Denial-of-Service (DoS) | Aims to overload an SC’s resources, making it unable to process legitimate transactions | Send a large number of transactions to the contract in a short period of time |
| Malicious Input | Involves sending malicious data inputs to an SC, causing it to behave in unintended ways | Transfer funds to an unintended recipient by sending malicious input data to a contract |
| Front-Running | Involves exploiting the time delay between a transaction being submitted and confirmed on the blockchain | Profit from a transaction by submitting a higher gas price transaction ahead of the original transaction |
| Logic Bombs | A piece of malicious code that lies dormant in an SC until a specific trigger condition is met | Transfer funds to the attacker’s account when a specific date or time is reached |
| Cross-Chain Attacks | Exploit vulnerabilities in the interaction between different blockchain networks | Steal funds from one network and transfer them to another by exploiting weaknesses in cross-chain transactions |
| Time Manipulation | Exploits the way SCs handle time-based events | Trigger an action prematurely or delay it indefinitely by manipulating the timestamp or block number |
| Authorization Flaws | Occurs when an SC fails to properly authenticate and authorize users who interact with it | Gain unauthorized access to a contract’s funds or execute unauthorized transactions |
| Gas Limit Attacks | Exploit the way SCs handle gas, the unit of measurement for computational work | Revert a transaction and potentially steal funds by setting a low gas limit on a transaction |
Figure 7: Bug classification diagram.
Figure 8. The difference between Classical Programming and Machine Learning.
Figure 9. An illustration of AI lifecycle.
| Ref. | Adopted Technique | Contribution |
|---|---|---|
| [59] | GNN, Expert Knowledge, Temporal Message Propagation Network | Proposed a technique for vulnerability detection in SCs using graph neural networks and expert knowledge, and introduced a temporal message propagation network to extract graph features |
| [60] | Multi-layer bidirectional Transformer structure, CodeBERT | Introduced VDDL, a vulnerability detection model that used a multi-layer bidirectional Transformer structure and incorporated CodeBERT |
| [61] | NLP, Image Processing, Code Analysis Techniques | Used a multi-modal AI framework for vulnerability detection in SCs |
| [62] | Active and SSL, BERT | Introduced ASSBert, an SC vulnerability detection framework that combines active SSL and employs BERT |
| [63] | DL-based Approach | Proposed ReVulDL, a two-stage SC debugger that uses a DL-based approach to detect and locate re-entry vulnerabilities |
| [66] | NN, BiLSTM, Hierarchical Attention Mechanism | Proposed a vulnerability detection tool that utilized neural networks and introduced a hierarchical attention mechanism |
| [67] | Multi-view Cascading Ensemble Model (MulCas) | Constructed a larger dataset and extracted numerous independent features from multiple perspectives for identifying Ponzi schemes when SC are created |
| [68] | Heterogeneous Graph Transformation Network | Proposed SHGTNs, a heterogeneous graph transformation network for detecting financial frauds on Ethereum platforms |
| [69] | ML, Bytecode, GRU Networks, Attention Mechanisms | Developed SCSGuard, a tool that used ML technology for detecting fraudulent behaviors in SCs by leveraging the bytecode of SCs as a novel feature |
| [70] | Convolutional Neural Network (CNN) Architecture | Introduced CodeNet, a new CNN architecture for detecting SC vulnerabilities that solved the problem of loss of local information in existing CNN models |
| [71] | Deep Reinforcement Learning, Multi-Agent Fuzz Testing | Developed improved techniques for detecting vulnerabilities in SCs using deep reinforcement learning and multi-agent fuzz testing |
| [73] | DL Models, LSTM, ANN, GRU | Trained three different DL models, GRU, ANN, LSTM and, and used them for predicting the existence of vulnerabilities in SCs |
| [74] | Deep and Cross Networks | Presented Link-DC, a new SC vulnerability detection model that used deep and cross networks for constructing high-order nonlinear features |
| [75] | High-level Syntactic Features, Low-level Bytecode Features | Introduced SmartMixModel, a vulnerability detection model that extracts features on two levels: low-level bytecode features and high-level syntactic features |
| [76] | AI Model | Proposed GVD-net, an AI model to detect security vulnerabilities in Ethereum SCs |
| [77] | AI-based Static Analysis Tool, Eth2Vec | Introduced Eth2Vec, an AI-based static analysis tool that utilized neural networks for automatically learning features of vulnerable contracts and detecting vulnerabilities in SCs |
| [79] | DL, Various Code Representations | Utilized DL techniques for detecting vulnerabilities in SCs by combining various code representations |
| [78] | DL, Modular and Systematic Vulnerability Detection Framework | Proposed DeeSCVHunter, a modular and systematic vulnerability detection framework based on DL, for reentrancy and time dependence vulnerabilities |
| [80] | SVM | Proposed SCscan, a scanning tool based on SVM for identifying potential security risks in SCs |
| Classical Techniques | AI-Based Techniques | |
|---|---|---|
| Vulnerability Detection | Manual code review and testing | Automated code analysis and vulnerability detection |
| Anomaly Detection | Manual monitoring and analysis | Automated behavior-based anomaly detection |
| Predictive Analytics | Limited predictive capabilities | Advanced predictive analytics using machine learning |
| Behavior-based Security | Limited behavior-based monitoring | Advanced behavior-based monitoring using machine learning |
| Advantages | Established techniques, but slower and less accurate than AI-based techniques | Faster, more accurate, scalable, adaptable, and able to learn from new data and threats |
Figure 10. Our Optimized-CodeBERT Model Architecture.
Figure 11. The Architecture of Optimized-LSTM.
Figure 12. The Architecture of Optimized-CNN.
Figure 13. Comparison of Recall Results.
| Aspect | Advantages | Disadvantages |
|---|---|---|
| Security | Improves protection against vulnerabilities and bugs | May become a target for malicious actors if not securely managed |
| Compliance | Facilitates adherence to regulations like the EU Data Act | May conflict with blockchain's principle of immutability |
| Governance | Can be designed to incorporate community consensus | Might introduce elements of centralized control |
| User Trust | Enhances confidence in safety mechanisms | Users may fear potential misuse or overreach |
Figure 1: Relational Diagram for Smart Contract "Kill Switch" Implementation
| Blockchain | Strategies | Strengths | Weaknesses | Gov. | Regulation |
|---|---|---|---|---|---|
| Ethereum [21] & BNB Smart Chain [22] | Self-destruct function in Solidity; Pause and emergency stop design patterns; Upgradeable contracts | Offers built-in functions for contract termination; Compatible with widespread tools and infrastructure | No external mechanism; Potential security risks; Possible removal of self-destruct function raises long-term viability concerns | No | Yes, through custom implementations using Solidity features |
| Cardano [23] | Design-specific conditions within smart contracts built into Plutus; Stateful smart contracts; Seamless interaction with off-chain code | Uses robust functional programming language (Haskell) for Plutus; Strong on-chain governance mechanisms | No external mechanism; Complex implementation and limited adoption compared to Ethereum | Yes | Yes, through design-specific conditions |
| Solana [24] | Upgradable programs; State management | High throughput and low latency with upgradable programs | No external mechanism; Immaturity of the ecosystem and less community support for governance models | No | Yes, through upgradable programs |
| Hyperledger Fabric [25] | Chaincode lifecycle management; Endorsement policies; Private data collection; Administrative control | Permissioned blockchain with strong lifecycle management and administrative controls | Centralized nature might not align with decentralization principles | Yes | Yes, through administrative control and governance mechanisms |
| Corda [26] | Built-in contract upgrade; Explicit termination conditions; Administrative control | Focus on privacy and business transactions with upgradable contracts | Limited use cases outside of enterprise applications | Yes | Yes, through explicit contract conditions |
| IOTA [27] | State management built into the ISCP; Ability to respond to external inputs or triggers that could include termination signals | Scalable with no transaction fees suitable for IoT | Still evolving with ongoing updates to smart contract capabilities | Yes | Yes, through decentralized control mechanisms |
| Aptos [28] & Sui [29] | Move language flexibility for contract updates; Expressive smart contract implementations tracking and managing assets | Strong type system for formal verification and security; Supports more complex governance and transaction models | Newer ecosystems with less mature tooling and support | Yes | Yes, through explicit contract conditions |
Figure 2: Comparison of Kill Switch Approaches Across Platforms
Figure 3: Balancing Factors in Kill Switch Implementation
Figure 4: Implications of Kill Switch Mechanisms
This domain name has a "highlight spot", look closely at the letter ẹ in it, and you can find that is not the letter e. Confusing? It is actually Punycode, the standard description is as below:
> A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA) is an internationalized domain name encoding that represents a limited set of characters in both Unicode and ASCII codes.
If someone decode trẹzor, it looks like this: xn-trzor-o51b, which is the real domain name!
Hackers have been using Punycode for phishing for years, back in 2018, some Binance users were compromised by the same trick.
These kinds of phishing sites can already make many people fall, not to mention those more advanced attacks such as official mailbox getting controlled, or mail forgery attacks caused by SPF configuration issues. As a result, the source of the email looks exactly the same as the official one.
If it is a rogue insider, the user can do nothing. project teams should put a lot of effort into preventing insider threats. Insiders are the biggest Trojan horse, but they very often get neglected.
#### Web3 Privacy Issues
With the growing popularity of Web3, more and more interesting or boring projects appeared: like all kinds of Web3 infrastructures, social platforms, etc. Some of them have done massive data analysis and identified various behavioral portraits of the targets, not only on the blockchain side, but also on well-known Web2 platforms. Once the portrait comes out, the target is basically a transparent person. And the appearance of Web3 social platforms may also aggravate such privacy issues.
Think about it, when you play around with all these Web3-related things, such as signature binding, on chain interactions, etc., are you giving away more of your privacy? Many might not agree, but as many pieces come together there will be a more accurate & comprehensive picture: which NFTs you like to collect, which communities you joined, which whitelists you're on, who you're connected with, which Web2 accounts you're bound to, what time periods you're active in, and so on. See, blockchain sometimes makes privacy worse. If you care about privacy, you will have to be careful with everything newly emerged and keep the good habit of segregating your identity.
At this point, if the private key is accidentally stolen, the loss is not as simple as just money, but all the carefully maintained Web3 rights and interests. We often say that the private key is the identity, and now you have a real ID problem.
Never test human nature.
## Blockchain Shenanigans
Blockchain technology created a whole new industry. Whether you call it BlockFi, DeFi, cryptocurrency, virtual currency, digital currency, Web3, etc, the core of everything is still the blockchain. Most hype centered on financial activities, such as crypto assets, including non-fungible tokens (or NFT, digital collectible).
Blockchain industry is highly dynamic and fascinating, but there are just too many ways to do evil. The special characteristics of blockchain give rise to some rather unique evils, including and not limited to crypto theft, cryptojacking, ransomware, dark web trading, C2 attack, money laundering, Ponzi schemes, gambling, etc. I made a mind map back in 2019 for reference.
> SoulBound Audit Tokens