Solana is a rapidly evolving blockchain platform that has attracted an increasing number of users. However, this growth has also drawn the attention of malicious actors, with some phishers extending their reach into the Solana ecosystem. Unlike platforms such as Ethereum, Solana has distinct designs of accounts and transactions, leading to the emergence of new types of phishing transactions that we term SolPhish. We define three types of SolPhish and develop a detection tool called SolPhishHunter. Utilizing SolPhishHunter, we detect a total of 8,058 instances of SolPhish and conduct an empirical analysis of these detected cases. Our analysis explores the distribution and impact of SolPhish, the characteristics of the phishers, and the relationships among phishing gangs. Particularly, the detected SolPhish transactions have resulted in nearly $1.1 million in losses for victims. We report our detection results to the community and construct SolPhishDataset, thefirstSolana phishing-related dataset in academia.

Smart contracts are self-executing computer programs on blockchains. With the development of blockchain technology, the number of smart contracts has grown rapidly, as has the concern for their security. Regrettably, inconsistencies between the logic implemented in the code and the intentions described in the comments, known as Code–Comment Inconsistencies (CCI), are frequently present in some smart contracts. These inconsistencies can mislead readers in understanding the contract code and, in severe cases, may lead to vulnerabilities and economic losses. Existing learning-based methods are not tailored for smart contract languages, overlook the issue of insufficient context information caused by comment references and nested intentions, and rely on large-scale labeled data; whereas rule-based methods struggle to accommodate the flexibility with which developers express intentions, often resulting in false positives. To tackle the challenges posed by insufficient context information and the scarcity of labeled data, we introduce CCIHunter, a tool designed to detect CCIs in smart contracts. CCIHunter addresses the issue of insufficient context information during data modeling and incorporates a two-stage pre-training process that does not depend on labeled data to enhance its detection capabilities. Specifically, CCIHunter enhances comments based on templates and models code as a heterogeneous graph based on function calls. It utilizes CodeBERT and UniMp to generate embeddings for comments and code, respectively, and then calculates the similarity between these two embeddings. Consistency is judged by combining code embeddings, comment embeddings, and similarity scores. Notably, CCIHunter undergoes a two-stage pre-training that includes contrastive learning and mutation analysis, aiming to improve its ability to bridge the gap between code and comments and to focus on code elements at different granularities. Experimental results demonstrate that CCIHunter achieves a precision of 0.95, a recall of 0.90, and an F1 score of 0.93, outperforming existing tools.

This research explores strategies for using one-way anonymous Q&A software to enhance class participation and teaching effectiveness of undergraduate students. The study finds that undergraduate students, influenced by cultural factors, ed-ucational systems, and upbringing environments, tend to display introverted psychological traits, resulting in insufficient class participation. One-way anonymous Q&A software significantly improves student participation enthusiasm through mechanisms such as breaking psychological barriers, promoting deep thinking, enhancing classroom interaction, and providing diverse feedback. Case analysis shows that by introducing the proposed anonymous Q&A software to teaching activities, students asked questions more frequently, and the quality of questions also improved accordingly with a wider adoption of the software. Besides, it also shows that the learning interests of students have increased after using the software. The research suggests that future studies should deepen technological innovation, pro-mote teaching model reform, and strengthen interdisciplinary integration to better meet the needs of a modern educational environment in universities.

Smart contracts are Turing-complete programs that execute on the blockchain. Developers can implement complex contracts, such as auctions and lending, on Ethereum using the Solidity programming language. As an object-oriented language, Solidity provides libraries within its syntax to facilitate code reusability and reduce development complexity. Library misuse refers to the incorrect writing or usage of libraries, resulting in unexpected results, such as introducing vulnerabilities during library development or incorporating an unsafe library during contract development. Library misuse could lead to contract defects that cause financial losses. Currently, there is a lack of research on library misuse. To fill this gap, we collected more than 500 audit reports from the official websites of five audit companies and 223,336 real-world smart contracts from Etherscan to measure library popularity and library misuse. Then, we defined eight general patterns for library misuse; three of them occurring during library development and five during library utilization, which covers the entire library lifecycle. To validate the practicality of these patterns, we manually analyzed 1,018 real-world smart contracts and publicized our dataset. We identified 905 misuse cases across 456 contracts, indicating that library misuse is a widespread issue. Three patterns of misuse are found in more than 50 contracts, primarily due to developers lacking security awareness or underestimating negative impacts. Additionally, our research revealed that vulnerable libraries on Ethereum continue to be employed even after they have been deprecated or patched. Our findings can assist contract developers in preventing library misuse and ensuring the safe use of libraries.

With the rise of WebAssembly (Wasm), its efficient execution capabilities have opened up new opportunities for cross-language application development. As the demand for cross-language interoperability with high-level programming languages such as Python continues to grow, the need for an in-depth performance analysis becomes increasingly urgent. However, traditional performance analysis tools are ineffective in handling the JIT compilation characteristics of WebAssembly code, thereby failing to thoroughly analyze performance deficiencies in cross-language interactions. In this paper, we proposes an novel framework, WACP to explores the performance analysis of cross-language interactions between Python and WebAssembly. It combines software approaches and hardware performance monitoring techniques to address issues such as insufficient analysis data detail and the difficulty of cross-language function symbol mapping. By comparing with recently popular analysis tools, the effectiveness of our method is demonstrated across various test cases—providing detailed performance insights to offer optimization guidance. Furthermore, our study investigates the potential performance benefits of combining Python’s productivity with Wasm’s efficiency in cross-language application development.

Being the largest Initial Coin Offering project, EOSIO has attracted great interest in cryptocurrency markets. Despite its popularity and prosperity (e.g., 26,311,585,008 token transactions occurred from June 8, 2018 to Aug. 5, 2020), there is almost no work investigating the EOSIO token ecosystem. To fill this gap, we are the first to conduct a systematic investigation of the EOSIO token ecosystem by conducting a comprehensive graph analysis of the entire on-chain EOSIO data (nearly 135 million blocks). We construct token-creator graphs, token-contract creator graphs, token-holder graphs, and token-transfer graphs to characterize token creators, holders, and transfer activities. Through graph analysis, we have obtained many insightful findings and observed some abnormal trading patterns. Moreover, we propose a fake-token detection algorithm to identify tokens generated by fake users or fake transactions and analyze their corresponding manipulation behaviors. Evaluation results also demonstrate the effectiveness of our algorithm.

DeFi protocols are programs that manage high-value digital assets on blockchain. The price manipulation vulnerability is one of the common vulnerabilities in DeFi protocols, which allows attackers to gain excessive profits by manipulating token prices. In this paper, we propose DeFiTainter, an inter-contract taint analysis framework for detecting price manipulation vulnerabilities. DeFiTainter features two innovative mechanisms to ensure its effectiveness. The first mechanism is to construct a call graph for inter-contract taint analysis by restoring call information, not only from code constants but also from contract storage and function parameters. The second mechanism is a high-level semantic induction tailored for detecting price manipulation vulnerabilities, which accurately identifies taint sources and sinks and tracks taint data across contracts. Extensive evaluation of real-world incidents and high-value DeFi protocols shows that DeFiTainter outperforms existing approaches and achieves state-of-the-art performance with a precision of 96% and a recall of 91.3% in detecting price manipulation vulnerabilities. Furthermore, DeFiTainter uncovers three previously undisclosed price manipulation vulnerabilities.

Blockchain is the foundation of emerging applications, such as smart contracts, nonfungible token (NFT), and metaverse. A key issue is that blockchain requires massive storage space, which limits its deployment in resource-limited end devices, e.g., Internet of Things. Recently, coded blockchain is proposed to reduce the storage requirement of blockchain while guaranteeing its security and data integrity. Coded blockchain encodes blocks into coded symbols, which are then distributively stored by clients. A key challenge when applying coded blockchain in resource-restricted networks is to ensure all clients store the same, and also the minimum, number of coded blocks. To this end, this article addresses a novel problem that minimizes the maximum (min–max) storage requirement of clients. It formulates the said problem as an integer linear program (ILP). It then proposes centralized algorithms to improve the computational efficiency of storage assignments. Moreover, it presents distributed algorithms that satisfy the distributive property of blockchain. Numerical results show that the proposed distributed algorithm with a short length code reduces the min–max storage of clients by 80% compared with traditional blockchain. In addition, the computational complexity of distributed algorithms is significantly lower than centralized algorithms.

Since the development of Blockchain 2.0, the smart contract has become the core of blockchain. However, smart contracts with inaccurate or non-standard codes and settings may cause security vulnerabilities, extra expense cost and wast of computing resource. To avoid these problems and assist users to create new smart contract or apply existing smart contract in a more efficient way, we propose smart contract recommendation by regarding smart contract as a special form of software service in a blockchain system. First, four real-world datasets are obtained from Ethereum and EOSIO for smart contract recommendation. Then, a novel smart contract recommendation framework is proposed and evaluated. In the large-scale experiments, the results validate the feasibility of smart contract recommendation. Additionally, the datasets are publicly released online to other researchers for further studies on smart contract recommendation.

Smart contracts can be considered as a service in the blockchain system and have been applied in many fields, covering financial products, online games, real estate, transportation and logistics. However, smart contract technology is still in its infancy. Development task is facing many difficulties and challenges, thus providing a set of new or improved development aids for the smart contract ecosystem is an urgent problem that needs to be solved. This paper proposes a smart contract code recommendation method based on graph neural network, which aims to facilitate the development of smart contracts and help developers realize smart contracts faster and more securely. Experimental results show that this method is better than the existing model of smart contract code recommendation in terms of accuracy.

Applications on blockchain are currently limited by the relatively poor performance of the blockchain network such as low TPS, high latency and the resulting high transaction fees. Hence, performance optimization is one crucial problem of blockchain. Focusing on the most prosperous public blockchain Ethereum, we model the on-chain transaction confirmation process with the knowledge of Poisson process and queueing theory, derives the mean transaction-confirmation time, and explores the effect of different transaction fees on latency. We also conduct a numeric simulation of the model, which indicates that the model fits in well with the real world blockchain.

Electricity consumption of diverse facilities can be recorded hourly or minutely due to the development of smart grid and smart home technologies. As a result, the traditional relationship analysis between electricity consumption and other external factors should be improved and conducted based on fine-grained rather than coarse-grained time series data. In that case, canonical correlation analysis (CCA) is an appropriate method to process two or more datasets containing multiple variables. However, the result of CCA is not unique, which leads to the challenge for batch-oriented data analysis. To solve this problem, we propose an optimal result selection mechanism for CCA and kernel CCA algorithms based on accuracy validation of canonical weights and components. An additional clustering is also provided to optimize the approach in terms of time complexity and accuracy performance. The approach is implemented on three multivariable datasets, referring to 960 non-residential electricity consumers in 60 towns or cities of the same district, to find the canonical correlations among electricity consumption, gas consumption and climate change for every consumer. The experimental results indicate that the proposed approach outperforms other related methods. We also find out three typical patterns of canonical correlation curves, which are relative stability, cyclic change and seasonal change.

The electricity load data recorded by smart meters contain plenty of knowledge that contributes to obtaining load patterns and consumer categories. Generally, the daily load curves are clustered first in order to obtain load patterns of each consumer. However, due to the volume and high dimensions of load curves, existing clustering algorithms are not appropriate in this situation. Thus, a fused load curve clustering algorithm based on wavelet transform (FCCWT) is proposed to solve this problem. The algorithm includes two main phases. First, FCCWT applies multilevel discrete wavelet transform (DWT) to convert the daily load curves for dimensionality reduction. Second, it detects clusters at two outputs of the first phase, and then fuses two groups of clusters with a sub-algorithm named cluster fusion to achieve the optimized clusters. FCCWT is implemented on datasets of both China and United States. Their clustering performances are evaluated by diverse validity indices comparing with four typical clustering methods. The experimental results show that FCCWT outperforms other comparison methods. Additionally, case analysis of two datasets are also provided to discuss the significance of load patterns.