With the rapid expansion of blockchain applications, smart contracts are becoming increasingly complex, making the automated detection of contract vulnerabilities more critical than ever. Large language models, due to their advanced code comprehensive ability, are considered to have the potential to undertake the task of automated software vulnerability discovery. Although there have been empirical studies on ChatGPT's automated discovery of contract vulnerabilities, the current empirical research has not addressed how well ChatGPT can detect logical vulnerabilities in smart contracts or whether ChatGPT's detection performance for logical vulnerabilities can be improved. To fill this gap, this study collected and organized seven types of logical vulnerability source codes from 6165 real smart contract audit reports and three datasets, such as Web3Bugs, and used this database to validate ChatGPT's detection capability for logical vulnerabilities. To improve ChatGPT's accuracy in detecting logical vulnerabilities, we fine-tuned ChatGPT with a dataset marked with a specific method, achieving an average accuracy rate of 95% for single vulnerability detection per training session. We improved the original marking method to increase further the number of vulnerabilities that a single model can detect. We used a specific completion marking format, ultimately enabling ChatGPT to detect various logical vulnerabilities. In terms of enhancing model scalability, we found a special training set marking method that allows for the addition of detectable vulnerability types through secondary training.

In recent years, vulnerabilities in EOSIO smart contracts (hereafter referred to as contracts) have led to significant financial losses. Grey-box fuzzing, as a lightweight test generation approach, can enhance the security of EOSIO contracts. However, developing a grey-box fuzzer from scratch is time-consuming and requires a deep understanding of EOSIO internals. In this work, we proposed AntFuzzer, the first highly extensible grey-box fuzzing framework for EOSIO contracts. AntFuzzer implements a novel approach that interfaces AFL (American Fuzzy Lop) to conduct AFL-style grey-box fuzzing on EOSIO contracts. Compared to black-box fuzzing tools, AntFuzzer can effectively trigger those hard-to-cover branches. It improved code coverage on 37.5% of contracts in our benchmark dataset. AntFuzzer also provides unified interfaces for developing new detection plugins for emerging vulnerabilities. We implemented six plugins that detected 741 vulnerabilities across 4,616 real-world contracts in large-scale fuzzing experiments, demonstrating AntFuzzer’s effectiveness and efficiency.

Administrative punishment is one of the most important ways of enforcing administrative law in the field of market supervision in China. However, at the current stage, the abuse of data access permission and the difficulty in managing timeliness in administrative punishment still remain unresolved, which hinders the legalization and standardization of the administrative punishment system. Inspired by blockchain, which is inherently traceable, tamper-proof, and transparent, we design a system, punishment supervisor (PEATS), which is suitable for administrative punishment and technically overcomes the defects of the traditional administrative punishment procedure. To prevent the abuse of data access permission, we innovatively introduce the ACG (authorization control gateway) to verify the access permission of users based on the records in the MSD (market supervision department) contract. To ensure the timeliness of the administrative punishment procedure, we design a special case contract that has the same status as the general case processing state of administrative punishment to track case progress on the blockchain. We experiment and evaluate PEATS in terms of functionality and performance and find that PEATS provides traceability, transparency, and timeliness assurance. In addition, PEATS has 80.9% of the throughput of a traditional server with no more than an additional 3% latency and at most 60 KB additional storage space per case.

To address the law enforcement challenges arising from the rapid expansion of the online catering industry, China’s market regulatory authorities are pursuing countermeasures through legislative efforts and innovative regulatory models. At present, administrative law enforcement for online catering faces difficulties in license management and ensuring the authenticity and security of data. Specifically, there is a prevalence of fraudulent licenses in the industry, and the market supervision department struggles to verify the authenticity of the data gathered during investigations and evidence collection. The tamper-proof and transparent features of blockchain technology cannot be directly applied to the online catering domain. Consequently, to attain trusted license management and secure data-sharing measures, further system design is necessary. To achieve trusted license management, we employ blockchain technology for managing qualification certificates and delineate the format for valid certificates and the application process. The secure data-sharing protocol is divided into two stages. In the first stage, we ensure data authenticity before uploading it to the blockchain through a consensus process involving platforms, users, and merchants. In the second stage, we implement fine-grained access control based on the on-chain data from the previous stage, utilizing conditional proxy reencryption and ultimately employing the data digest on the blockchain for verification. The experiment thoroughly validates the system’s functionality, which is traceable, transparent, and scalable. Moreover, the minimal delay introduced by ensuring data authenticity is virtually negligible. The system’s additional storage overhead does not surpass 10%, remaining within acceptable limits.

Being the most popular programming language for developing Ethereum smart contracts, Solidity allows using inline assembly to gain fine-grained control. Although many empirical studies on smart contracts have been conducted, to the best of our knowledge, none has examined inline assembly in smart contracts. To fill the gap, in this paper, we conduct the first large-scale empirical study of inline assembly on more than 7.6 million open-source Ethereum smart contracts from three aspects, namely, source code, bytecode, and transactions after designing new approaches to tackle several technical challenges. Through a thorough quantitative and qualitative analysis of the collected data, we obtain many new observations and insights. Moreover, by conducting a questionnaire survey on using inline assembly in smart contracts, we draw new insights from the valuable feedback. This work sheds light on the development of smart contracts as well as the evolution of Solidity and its compilers.