Cross-chain bridges are essential decentralized applications (DApps) to facilitate interoperability between different blockchain networks. Unlike regular DApps, the functionality of cross-chain bridges relies on the collaboration of information both on and off the chain, which exposes them to a wider risk of attacks. According to our statistics, attacks on cross-chain bridges have resulted in losses of nearly 4.3 billion since 2021. Therefore, it is particularly necessary to understand and detect attacks on cross-chain bridges. In this paper, we collect the largest number of cross-chain bridge attack incidents to date, including 49 attacks that occurred between June 2021 and September 2024, of which 22 were attacks on cross-chain bridge business logic. Our analysis reveal that attacks against cross-chain business logic cause significantly more damage than those that do not. These cross-chain attacks exhibit different patterns compared to normal transactions in terms of call structure, which effectively indicates potential attack behaviors. Given the significant losses in these cases and the scarcity of related research, this paper aims to detect attacks against cross-chain business logic, and propose the BridgeGuard tool. Specifically, BridgeGuard models cross-chain transactions from a graph perspective, and employs a two-stage detection framework comprising global and local graph mining to identify attack patterns in cross-chain transactions. We conduct multiple experiments on the datasets with 203 attack transactions and 40,000 normal cross-chain transactions. The results show that BridgeGuard's reported recall score is 36.32% higher than that of state-of-the-art tools and can detect unknown attack transactions.

Smart contracts are Turing-complete programs that run on blockchain technology, capable of managing on-chain assets according to predefined logic, and become immutable once deployed on the blockchain. In recent years, the value of smart contracts on blockchains, notably Ethereum, has been on the rise. However, the hiding vulnerabilities made the substantial value of smart contracts a target of many hackers, leading to numerous attack incidents. Therefore, vulnerability detection in smart contracts before deployment is essential. Currently, many fuzzers for detecting smart contract vulnerabilities can only identify vulnerabilities based on the execution patterns of the underlying opcodes, overlooking the financial semantic properties of the contracts, which leads to many vulnerabilities being difficult to detect or resulting in a high rate of false positives. To this end, we focus on the financial characteristics of contracts, define contract vulnerability patterns starting from the high-level semantic properties of contracts, and combine fuzzers using evolutionary algorithms and symbolic constraint solving to detect vulnerabilities, culminating in the development of FinanceFuzz . Specifically, FinanceFuzz defines invariant and equivalence properties of finance that contracts should satisfy. Utilizing these properties, FinanceFuzz can generate transaction sequences for testing and identify vulnerable contracts that violate the properties. We conducted experiments on a dataset containing 437 smart contracts from the real world, the experimental results demonstrating that our tool outperforms other state-of-the-art tools in detecting vulnerabilities, achieving higher recall rate without false positive.

Cross-chain technology enables seamless asset transfer and message-passing within decentralized finance (DeFi) ecosystems, facilitating multi-chain coexistence in the current blockchain environment. However, this development also raises security concerns, as malicious actors exploit cross-chain asset flows to conceal the provenance and destination of assets, thereby facilitating illegal activities such as money laundering. Consequently, the need for cross-chain transaction traceability has become increasingly urgent. Prior research on transaction traceability has predominantly focused on single-chain and centralized finance (CeFi) cross-chain scenarios, overlooking DeFi-specific considerations. This paper proposesABCTracer, an automated, bi-directional cross-chain transaction tracing tool, specifically designed for DeFi ecosystems. By harnessing transaction event log mining and named entity recognition techniques,ABCTracerautomatically extracts explicit cross-chain cues. These cues are then combined with information retrieval techniques to encode implicit cues.ABCTracerfacilitates the autonomous learning of latent associated information and achieves bidirectional, generalized cross-chain transaction tracing. Our experiments on 12 mainstream cross-chain bridges demonstrate thatABCTracerattains 91.75% bi-directional traceability (F1 metrics) with self-adaptive capability. Furthermore, we applyABCTracerto real-world cross-chain attack transactions and money laundering traceability, thereby bolstering the traceability and blockchain ecological security of DeFi bridging applications.

Cross-chain bridges are currently the most popular solution to support asset interoperability between heterogeneous blockchains. Over the past year, there have been more than ten serious attacks against cross-chain bridges, resulting in billions of dollars in losses. Among these attacks, fake deposits stand out as particularly destructive. Hackers can perpetrate such attacks by verifying the authenticity of proof associated with fake deposits on the target blockchain, subsequently pilfering the assets. However, existing tools have limitations in detecting this type of attack. To address this problem, this work proposes a tool to protect cross-chain bridges from fake deposit attacks by analyzing the network of transaction traces. Specifically, the framework first records the execution traces for each transaction, and then extracts the relevant contract interactions therein to extract statistical and structural features. Finally, real case labels are utilized to identify attacking and non-attacking transactions. We conducted experiments to validate the tool’s effectiveness and efficiency. In particular, for the detection of fake deposit transactions, our method achieved an average precision of 0.89, a recall value of 0.83, and the ability to identify 38.65 transactions per second.

The non-fungible token (NFT) is an emergent type of cryptocurrency that has garnered extensive attention since its inception. The uniqueness, indivisibility, and humanistic value of NFTs are the key characteristics that distinguish them from traditional tokens. The market capitalization of NFT reached 21.5 billion USD in 2021, almost 200 times that of all previous transactions. However, the subsequent rapid decline in NFT market fever in the second quarter of 2022 casts doubt on the ostensible boom in the NFT market. To date, there has been no comprehensive and systematic study of the NFT trade market or of the NFT bubble and hype phenomenon. To address this gap, we conduct an in-depth investigation of the entire Ethereum ERC721 and ERC1155 NFT ecosystems by dividing the NFT ecosystem participants into three categories: creators, transferors, and holders, to understand their manipulations of NFTs and infer their intentions. We examine the differences between NFT and ERC20 traders and then analyze the possible reasons behind these differences, leading us to gain insights into the varying degrees of market bubble associated with the two kinds of tokens. Through the construction and analysis of the NFT transfer graph (NTG), we uncover certain anomalous behaviors related to bubbles, along with quantifying the proportion of these anomalous behaviors, to reveal the degree of bubbles within the entire ecosystem.

Unmanned surface vessels (USVs) are generally subjected to wind force, wave and undercurrent action. Some unidentified objects such as underwater obstacles and submerged reefs should be monitored and evaded with converged communication, autonomous control and network system so as to achieve autonomous and automatic avoidance of danger and real-time control of flight path. Next, based on performing interference mechanics analysis on the USVs under the disturbance of wind force and wave on water surface, the relationship parameters between the bow angle, the deviation angle, safety evaluation function and the external force were obtained, and the comprehensive information of water surface environment was evaluated in combination with the dynamic window approach (DWA) algorithm. Further, the related model was established for simulation by using the simulation software MATLAB, and both reliability and stability of the modified DWA algorithm were designed and examined. Accordingly, the modified DWA algorithm can enhance the safety of the USVs in autonomous path planning and achieve rapid obstacle avoidance and autonomous path planning of the USVs. Our simulation revealed that the modified DWA algorithm can safely and rapidly correct the bow angle and the deviation angle, optimize the path trajectory and reduce the risk of roll-over of the USVs under sudden external force.

To combat cybercrimes and maintain financial security for the blockchain ecosystem, “know your customer” (KYC) is an essential and also challenging process due to the pseudonymity nature of blockchain technology. To unlock the potential of KYC on blockchain-based platforms like Ethereum, account labeling is a powerful means which can de-anonymize addresses by mining public transaction records. Existing studies on account labeling are mainly conducted via machine learning (ML) methods fed with hand-crafted features or graph neural networks based on the modeled transaction network. However, ML approaches based on hand-crafted features ignore the global interaction information between accounts, making it easy for criminals to evade detection. Moreover, the performance of traditional GCN methods when applied to Ethereum transaction network encounters limitations due to label sparsity, network heterophily, and large network size of the transaction network. In this article, we first analyze Ethereum accounts involved in typical businesses, in terms of both account and topological features. Then based on the analytical results, we propose a novel GCN method named know-your-customer graph convolutional network (KYC-GCN) which contains two key designs: 1) multihop aggregators and importance-based sampling are designed to tackle the dilemma between accuracy and efficiency. 2) GCN architecture is improved to explicitly capture local and more global information. Experimental results on a realistic Ethereum dataset show that the proposed KYC-GCN (90.2% accuracy, 86.2% Marco-F1) achieves state-of-the-art classification performance, and results on six benchmarks demonstrate that it yields great performance under homophily and heterophily.