Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

This paper argues that Ethereum Ponzi schemes can be classified into four source-code structures, and that those structures leave shared, detectable marks in contract code.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A known four-way classification of Ponzi smart contracts is restated and run through the Mythril scanner on a few examples, while the claimed 500-contract batch analysis is asserted without releasing data or results.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection A readable walkthrough of known Ponzi contract types, but the headline batch-detection result is asserted without any data — not a strong paper. the 4 major comments →

arxiv 2510.03819 v3 pith:NJH3WIMQ submitted 2025-10-04 cs.CR

Security Analysis of Ponzi Schemes in Ethereum Smart Contracts

Chunyi Zhang , Qinghong Wei , Xiaoqi Li This is my paper
classification cs.CR
keywords Ponzi schemesEthereum smart contractsprogram analysissymbolic executionsmart contract vulnerabilitiesstructural taxonomystatic and dynamic analysisblockchain fraud detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that Ponzi schemes hidden in Ethereum smart contracts follow four structural types—tree, chain, waterfall, and transfer—based on how the contract code stores investors and distributes payouts. Using a symbolic-execution security scanner on representative contracts, it says these structures come with recognizable economic designs and recurring code-level flaws. It further claims that a batch scan of 500 open-source contracts publicly flagged as Ponzi schemes shows common characteristics: high entry fees, outsized returns to the initiator and early investors, and frequent integer-overflow and state-anomaly warnings. If true, this gives auditors and automated detectors a program-analysis-based profile of Ponzi contracts that can complement machine-learning approaches.

Core claim

The paper's central claim is that Ponzi scheme smart contracts can be categorized by the data structure their code uses to manage investors—tree, chain, waterfall, or transfer—and that this structural choice shapes both the scam's economics and its vulnerability profile. It claims that for representative contracts of each type, static reading of the source code plus dynamic symbolic execution reveals consistent mechanisms: entry thresholds exclude small investors, payouts flow disproportionately to the originator and early participants, and detected flaws center on unchecked external calls, integer overflow, and assertion or state anomalies. The paper further claims that batch analysis of 50

What carries the argument

The central machinery is a four-way structural taxonomy—tree, chain, waterfall, transfer—that classifies a Ponzi contract by the data structure its source code uses to record investors and to distribute payouts. Paired with a symbolic-execution and SMT-based vulnerability scanner, the taxonomy lets the analysis map each scam's economic design to concrete code-level risks such as unchecked calls, integer overflow, and state anomalies.

Load-bearing premise

The batch-analysis conclusions rest on accepting a public block-explorer label as correct, complete ground truth and assuming that 500 pre-2019 open-source contracts carrying that label represent all Ponzi smart contracts.

What would settle it

Take the 500 flagged contracts and a matched set of non-flagged contracts from the same period, run the same batch scan on both, and compare the rates of high entry fees, initiator-heavy payout splits, and integer-overflow or state warnings. If those patterns appear equally often in non-flagged contracts, the claimed common characteristics are not distinctive. A second check is to manually audit a random sample of the flagged contracts to see whether the public labels are independently verified or merely self-reported.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Auditors can use a contract's investor-storage structure as a first-pass sieve for Ponzi-style payout logic.
  • The recurring warning types—unchecked external calls, integer overflow, and state anomalies—become a signature set worth checking in any contract that promises risk-free returns.
  • Because entry thresholds are a stated common characteristic, unusually high minimum investments can be treated as a screening signal rather than a normal design choice.
  • Detectors can be built per structural class, since each class has its own payout order and therefore its own attack surface.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper says 500 flagged contracts were scanned but never reports the raw scan results; a natural follow-up is to publish per-contract tool output so the claimed frequencies can be checked.
  • An obvious control is missing: comparing flagged contracts to benign contracts. Until that comparison exists, the 'common characteristics' are candidate heuristics rather than demonstrated signals.
  • The taxonomy depends on open-source code; extending it to bytecode-only contracts would test whether the four structures are truly universal or just an artifact of which contracts get open-sourced.
  • If the entry-fee and payout-inequality heuristics survive a baseline test, they could become a lightweight pre-screener that flags contracts for deeper audit before funds are committed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper claims to (i) classify Ethereum Ponzi smart contracts into four structural types (tree-, chain-, waterfall-, and transfer-based), (ii) perform hybrid static/dynamic analysis of representative cases with Mythril, and (iii) conduct batch detection of 500 open-source contracts scraped from Etherscan to reveal common characteristics of Ponzi contracts. The case studies in Section 3 are concrete and the code excerpts are useful, but the central empirical contribution—the batch detection and the claimed common characteristics—is asserted without reporting any quantitative results, control comparison, or reproducibility artifacts.

Significance. If the batch-detection results were substantiated, the paper would offer a useful structural and vulnerability profile of Ponzi contracts that could complement machine-learning detectors. The paper's strengths include the use of real contract examples, the public Mythril tool, and a candid acknowledgment in Section 3.3 that Mythril can miss critical vulnerabilities. However, as written, the paper does not deliver the promised empirical evidence: no counts, rates, error bars, control group, scripts, or result files are provided. The significance of the claimed findings therefore cannot be assessed, and the paper presently reads as a preliminary survey rather than a complete security analysis.

major comments (4)
  1. [§4.3 (Results Analysis)] The central empirical claim—that 500 contracts share common characteristics—is unsupported. The section lists qualitative conclusions (high entry thresholds, initiator-heavy profit distribution, frequent SWC-101 and SWC-110 findings) without reporting raw detection counts, per-type breakdowns, or any statistical summary. Without these numbers, the reader cannot verify the claims. Moreover, no control group of non-Ponzi contracts from the same period is analyzed, so the prevalence of SWC-101/SWC-110 in the flagged set cannot be attributed to Ponzi-ness; these vulnerability classes are known to be common in ordinary Solidity code. This is the load-bearing contribution and it is missing.
  2. [§4.1–§4.2 (Data collection and batch process)] The dataset and batch-detection procedure are not reproducible. No contract addresses, no crawl timestamp, no sampling rationale, and no scripts are given. The only statement about ground truth is that the contracts were 'flagged as a Ponzi scheme' on Etherscan.io before 2019. This label is not validated, no independent labeling is performed, and there is no discussion of potential bias or incompleteness in the flag. Without a concrete data manifest, the 500-contract corpus cannot be audited or reused.
  3. [§3.3 (Fomo3D)] Section 3.3 explicitly states that Mythril did not detect any obvious vulnerabilities in Fomo3D, and that the contract's two exploitable flaws (predictable randomness and bypassable contract-address check) were found only by manual source-code review. This directly undercuts the inference in §4.3 that Mythril-detected vulnerabilities (SWC-101, SWC-110) constitute the 'common characteristics' of Ponzi contracts. The paper needs to reconcile this tension, at minimum by benchmarking Mythril's detection rate against a non-Ponzi control group and reporting missed-detection cases in the batch results.
  4. [§3.2.2 (Chain-based Ponzi scheme)] The representative analysis contains a technical inconsistency. The paper reports SWC-101 (integer overflow) in CrystalDoubler and locates the issue at 'line 21 of the source code: string public Message = "Welcome Player! Double your ETH Now!"'. A string constant assignment does not perform integer arithmetic, so attributing integer overflow to that line is not meaningful. This suggests that the Mythril findings are being described without careful mapping to the actual vulnerable operations, which weakens confidence in the other case-study vulnerability attributions.
minor comments (5)
  1. [§2.1 and Figure 1] The background sections on blockchain architecture, consensus mechanisms, and the People's Bank of China payment system are lengthy and largely tangential to Ponzi schemes. The paper would benefit from condensing this material to a few paragraphs.
  2. [§3.2.2, code listing] Typo in the code: 'Aomount' should be 'Amount'. Also 'fenny' should be 'finney' in the prose.
  3. [§3.2.4] The vulnerability list says 'SWC-110, SWC-104, and SWC-110' for the transfer-based contract. This is redundant; the two SWC-110 instances are described as occurring in different functions, but the presentation should be clearer.
  4. [References] A substantial fraction of the references are to closely related arXiv preprints by the same research group. Some are relevant, but many appear tangential; pruning would improve readability and avoid the appearance of citation padding.
  5. [§3.1] Mythril is described as detecting 'integer removal'—presumably 'integer overflow'. Please correct this typo.

Circularity Check

0 steps flagged

No circularity: batch conclusions are under-evidenced, not definitionally forced; taxonomy and toolchain are external.

full rationale

This paper does not contain a fitted-parameter derivation or a self-definitional chain, so the 'prediction equals fit' and 'self-definitional' patterns do not apply. The four-type taxonomy is explicitly imported from Bartoletti et al. ('This is precisely the work undertaken by Massimo Bartoletti et al., who categorized Ponzi schemes into four types based on the source code'), and the vulnerability findings come from Mythril, an external tool. The batch-detection section reports qualitative conclusions ('The entry fee for investors joining the scheme is typically high', 'frequently detected by Mythril as harboring integer data overflow vulnerabilities and abnormal state vulnerabilities') without raw counts or a control group; that is an evidentiary/reproducibility weakness, not a circular reduction, because nothing in the text defines those characteristics in terms of the collection or detection process. The many Xiaoqi Li references are background and related-work citations and are not used to justify the central claims; the Fomo3D section even concedes that Mythril missed the contract's real flaws, which cuts against, rather than creates, a circular reliance on the tool. No quoted equation or fitted parameter makes an output equal to an input by construction, so no specific circular step meets the evidence bar.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

The paper contributes no fitted parameters or invented entities. Its conclusions rest on external validity assumptions about Etherscan labeling, the exhaustiveness of a prior classification, the diagnostic value of Mythril vulnerability types, and the representativeness of the crawled sample.

axioms (4)
  • domain assumption Etherscan's 'flagged as Ponzi scheme' designation is valid ground truth for labeling the 500 contracts.
    §4.1 uses Etherscan labels as the basis for crawling; no independent verification of scam status is performed.
  • domain assumption The four structural types defined by Bartoletti et al. are exhaustive for Ponzi smart contracts.
    §3.2 adopts Bartoletti et al.'s four classes without evidence of coverage; classification forms the paper's analytical frame.
  • domain assumption Mythril-detected vulnerability classes (SWC-101, SWC-104, SWC-110) are meaningful indicators of Ponzi-related risk.
    Batch analysis in §4 relies on Mythril outputs; no validation that these vulnerabilities discriminate Ponzi from non-Ponzi contracts.
  • domain assumption Open-source contracts crawled from Etherscan represent the population of Ponzi smart contracts.
    §4.1 samples only open-source, pre-2019 contracts; bytecode-only or post-2019 contracts are excluded.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Security Analysis of Ponzi Schemes in Ethereum Smart Contracts." pith.science (2026). https://pith.science/paper/NJH3WIMQ

@misc{pith2026251003819,
  author       = {Pith},
  title        = {Pith review of: Security Analysis of Ponzi Schemes in Ethereum Smart Contracts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NJH3WIMQ}},
  note         = {Machine review of arXiv:2510.03819}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The rapid advancement of blockchain technology has precipitated the widespread adoption of Ethereum and smart contracts across a variety of sectors. However, this has also given rise to numerous fraudulent activities, with many speculators embedding Ponzi schemes within smart contracts, resulting in significant financial losses for investors. Currently, there is a lack of effective methods for identifying and analyzing such new types of fraudulent activities. This paper categorizes these scams into four structural types and explores the intrinsic characteristics of Ponzi scheme contract source code from a program analysis perspective. The Mythril tool is employed to conduct static and dynamic analyses of representative cases, thereby revealing their vulnerabilities and operational mechanisms. Furthermore, this paper employs shell scripts and command patterns to conduct batch detection of open-source smart contract code, thereby unveiling the common characteristics of Ponzi scheme smart contracts.

Figures

Figures reproduced from arXiv: 2510.03819 by Chunyi Zhang, Qinghong Wei, Xiaoqi Li.

Figure 1
Figure 1. Figure 1: Payment System of the People’s Bank of China [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Framework for Intelligent Ponzi Scheme Detection Solutions [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Two Types of Ethereum Accounts There are two types of accounts in Ethereum, both sharing the same address space. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The Transaction Relationship Between External and Internal Accounts [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The Role of External Account Transactions [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Blockchain Diagram [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Block Structure Diagram 10 [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Blockchain System Architecture Diagram (2) Immutability: Transaction information for every user in the blockchain is stored and updated across all nodes. Modifications on a single node are invalid, ensuring high data security and stability. (3) Anonymity: Data interactions between nodes on a blockchain do not require mutual trust, facilitating the accumulation of credibility. Moreover, due to its decentral… view at source ↗
Figure 9
Figure 9. Figure 9: Relationships Between Blockchain Systems [PITH_FULL_IMAGE:figures/full_fig_p013_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Proof of Work Flowchart [PITH_FULL_IMAGE:figures/full_fig_p015_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Schematic Diagram of the PBFT Consensus Mechanism [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Etheramid Contract Trading Activity Chart [PITH_FULL_IMAGE:figures/full_fig_p019_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Fomo3D Dividend Distribution Ratios Among Different Teams [PITH_FULL_IMAGE:figures/full_fig_p023_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Web Crawler Retrieves Sample Data 4 Batch Detection and Result Analysis 4.1 Experimental Data Collection The smart contract source code data utilized for batch detection was obtained through a process of data collection from the Etherscan.io website using web crawlers. Since the last smart contract flagged as a Ponzi scheme on Etherscan.io predates 2019, all crawled smart contract source code originates f… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. CKG-LLM: LLM-Assisted Detection of Smart Contract Access Control Vulnerabilities Based on Knowledge Graphs

    cs.CR 2025-12 unverdicted novelty 6.0

    CKG-LLM uses LLMs to generate executable queries over contract knowledge graphs for detecting access control vulnerabilities and reports superior performance versus existing tools.

  2. PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement

    cs.CR 2026-04 unverdicted novelty 4.0

    PSR2 framework detects atomicity violations in smart contracts at 94.69% F1-score by fusing structural path analysis and semantic context reasoning, outperforming baselines.

Reference graph

Works this paper leans on

41 extracted references · 2 linked inside Pith · cited by 2 Pith papers

  1. [1]

    A survey of attacks on ethereum smart contracts (sok)

    Nicola Atzei, Massimo Bartoletti, and Tiziana Cimoli. A survey of attacks on ethereum smart contracts (sok). InInternational conference on principles of secu- rity and trust, pages 164–186. Springer, 2017

    2017

  2. [2]

    Dissecting ponzi schemes on ethereum: identification, analysis, and impact.Future Genera- tion Computer Systems, 102:259–277, 2020

    Massimo Bartoletti, Salvatore Carta, Tiziana Cimoli, and Roberto Saia. Dissecting ponzi schemes on ethereum: identification, analysis, and impact.Future Genera- tion Computer Systems, 102:259–277, 2020

    2020

  3. [3]

    A study of emerging areas in adoption of blockchain technology and it’s prospective challenges in india

    Ajay Kumar Bharti et al. A study of emerging areas in adoption of blockchain technology and it’s prospective challenges in india. In2019 Women Institute of Technology Conference on Electrical and Computer Engineering (WITCON ECE), pages 146–153. IEEE, 2019

    2019

  4. [4]

    Investigating mmm ponzi scheme on bitcoin

    Yazan Boshmaf, Charitha Elvitigala, Husam Al Jawaheri, Primal Wijesekera, and Mashael Al Sabah. Investigating mmm ponzi scheme on bitcoin. InProceedings of the 15th ACM Asia Conference on Computer and Communications Security, pages 519–530, 2020

    2020

  5. [5]

    A next-generation smart contract and decentralized applica- tion platform.white paper, 3(37):2–1, 2014

    Vitalik Buterin et al. A next-generation smart contract and decentralized applica- tion platform.white paper, 3(37):2–1, 2014

    2014

  6. [6]

    Detecting ponzi schemes on ethereum: Towards healthier blockchain technology

    Weili Chen, Zibin Zheng, Jiahui Cui, Edith Ngai, Peilin Zheng, and Yuren Zhou. Detecting ponzi schemes on ethereum: Towards healthier blockchain technology. InProceedings of the 2018 world wide web conference, pages 1409–1418, 2018

    2018

  7. [7]

    Performance evaluation of ethereum pri- vate and testnet networks using hyperledger caliper

    Wonseok Choi and James Won-Ki Hong. Performance evaluation of ethereum pri- vate and testnet networks using hyperledger caliper. In2021 22nd Asia-Pacific Net- work Operations and Management Symposium (APNOMS), pages 325–329. IEEE, 2021. 28

    2021

  8. [8]

    Majority is not enough: Bitcoin mining is vulner- able.Communications of the ACM, 61(7):95–102, 2018

    Ittay Eyal and Emin G¨ un Sirer. Majority is not enough: Bitcoin mining is vulner- able.Communications of the ACM, 61(7):95–102, 2018

    2018

  9. [9]

    Slither: a static analysis framework for smart contracts

    Josselin Feist, Gustavo Grieco, and Alex Groce. Slither: a static analysis framework for smart contracts. In2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB), pages 8–15. IEEE, 2019

    2019

  10. [10]

    In29th USENIX Security Symposium (USENIX Security 20), pages 2757–2774, 2020

    Joel Frank, Cornelius Aschermann, and Thorsten Holz.{ETHBMC}: A bounded model checker for smart contracts. In29th USENIX Security Symposium (USENIX Security 20), pages 2757–2774, 2020

    2020

  11. [11]

    Smartembed: A tool for clone and bug detection in smart contracts through structural code embedding

    Zhipeng Gao, Vinoj Jayasundara, Lingxiao Jiang, Xin Xia, David Lo, and John Grundy. Smartembed: A tool for clone and bug detection in smart contracts through structural code embedding. In2019 IEEE International Conference on Software Maintenance and Evolution (ICSME), pages 394–397. IEEE, 2019

    2019

  12. [12]

    (short paper) developing a smart storage container for a blockchain-based supply chain application

    Johannes Hinckeldeyn and Kreutzfeldt Jochen. (short paper) developing a smart storage container for a blockchain-based supply chain application. In2018 Crypto valley conference on blockchain technology (CVCBT), pages 97–100. IEEE, 2018

    2018

  13. [13]

    Evaluat- ing machine-learning techniques for detecting smart ponzi schemes

    Giacomo Ibba, Giuseppe Antonio Pierro, and Marco Di Francesco. Evaluat- ing machine-learning techniques for detecting smart ponzi schemes. In2021 IEEE/ACM 4th International Workshop on Emerging Trends in Software Engi- neering for Blockchain (WETSEB), pages 34–40. IEEE, 2021

    2021

  14. [14]

    Contractfuzzer: Fuzzing smart contracts for vulnerability detection

    Bo Jiang, Ye Liu, and Wing Kwong Chan. Contractfuzzer: Fuzzing smart contracts for vulnerability detection. InProceedings of the 33rd ACM/IEEE international conference on automated software engineering, pages 259–269, 2018

    2018

  15. [15]

    Blockchain application in metaverse: A review.arXiv preprint arXiv:2504.11730, 2025

    Bingquan Jin, Hailu Kuang, and Xiaoqi Li. Blockchain application in metaverse: A review.arXiv preprint arXiv:2504.11730, 2025

    arXiv 2025

  16. [16]

    Uechecker: Detecting unchecked external call vulnerabilities in dapps via graph analysis.arXiv preprint arXiv:2508.01343, 2025

    Dechao Kong, Xiaoqi Li, and Wenkai Li. Uechecker: Detecting unchecked external call vulnerabilities in dapps via graph analysis.arXiv preprint arXiv:2508.01343, 2025

    arXiv 2025

  17. [17]

    Interaction-aware vulner- ability detection in smart contract bytecodes.IEEE Transactions on Dependable and Secure Computing, 2025

    Wenkai Li, Xiaoqi Li, Yingjie Mao, and Yuqing Zhang. Interaction-aware vulner- ability detection in smart contract bytecodes.IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  18. [18]

    Detecting malicious accounts in web3 through transaction graph

    Wenkai Li, Zhijie Liu, Xiaoqi Li, and Sen Nie. Detecting malicious accounts in web3 through transaction graph. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, pages 2482–2483, 2024

    2024

  19. [19]

    Hybrid analysis of smart contracts and malicious behaviors in ethereum

    Xiaoqi Li et al. Hybrid analysis of smart contracts and malicious behaviors in ethereum. 2021

    2021

  20. [20]

    Movescanner: Analysis of security risks of move smart contracts.arXiv preprint arXiv:2508.17964, 2025

    Yuhe Lu, Zhongwen Li, and Xiaoqi Li. Movescanner: Analysis of security risks of move smart contracts.arXiv preprint arXiv:2508.17964, 2025. 29

    arXiv 2025

  21. [21]

    Mak- ing smart contracts smarter

    Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, and Aquinas Hobor. Mak- ing smart contracts smarter. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 254–269, 2016

    2016

  22. [22]

    Natlm: Detecting defects in nft smart contracts leveraging llm.arXiv preprint arXiv:2508.01351, 2025

    Yuanzheng Niu, Xiaoqi Li, and Wenkai Li. Natlm: Detecting defects in nft smart contracts leveraging llm.arXiv preprint arXiv:2508.01351, 2025

    arXiv 2025

  23. [23]

    Mining characteristics of vulnerable smart contracts across lifecycle stages.IET Blockchain, 5(1):e70016, 2025

    Hongli Peng, Wenkai Li, and Xiaoqi Li. Mining characteristics of vulnerable smart contracts across lifecycle stages.IET Blockchain, 5(1):e70016, 2025

    2025

  24. [24]

    Multicfv: Detecting control flow vulner- abilities in smart contracts leveraging multimodal deep learning.arXiv preprint arXiv:2508.01346, 2025

    Hongli Peng, Xiaoqi Li, and Wenkai Li. Multicfv: Detecting control flow vulner- abilities in smart contracts leveraging multimodal deep learning.arXiv preprint arXiv:2508.01346, 2025

    arXiv 2025

  25. [25]

    Us securities and exchange commission.Retrieved from No-Action Letters: http://www

    US Securities. Us securities and exchange commission.Retrieved from No-Action Letters: http://www. sec. gov/answers/noaction. htm, 2014

    2014

  26. [26]

    When blockchain meets crawlers: Real-time market analytics in solana nft markets.arXiv preprint arXiv:2506.02892, 2025

    Chengxin Shen, Zhongwen Li, Xiaoqi Li, and Zongwei Li. When blockchain meets crawlers: Real-time market analytics in solana nft markets.arXiv preprint arXiv:2506.02892, 2025

    arXiv 2025

  27. [27]

    Verismart: A highly precise safety verifier for ethereum smart contracts

    Sunbeom So, Myungho Lee, Jisu Park, Heejo Lee, and Hakjoo Oh. Verismart: A highly precise safety verifier for ethereum smart contracts. In2020 IEEE Sympo- sium on Security and Privacy (SP), pages 1678–1694. IEEE, 2020

    2020

  28. [28]

    Smartcheck: Static analysis of ethereum smart contracts

    Sergei Tikhomirov, Ekaterina Voskresenskaya, Ivan Ivanitskiy, Ramil Takhaviev, Evgeny Marchenko, and Yaroslav Alexandrov. Smartcheck: Static analysis of ethereum smart contracts. InProceedings of the 1st international workshop on emerging trends in software engineering for blockchain, pages 9–16, 2018

    2018

  29. [29]

    Multi-class bitcoin-enabled service identification based on transaction history summarization

    Kentaroh Toyoda, Tomoaki Ohtsuki, and P Takis Mathiopoulos. Multi-class bitcoin-enabled service identification based on transaction history summarization. In2018 IEEE international conference on internet of things (iThings) and IEEE green computing and communications (GreenCom) and IEEE cyber, physical and social computing (CPSCom) and IEEE smart data (Sm...

    2018

  30. [30]

    Securify: Practical security analysis of smart contracts

    Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Buen- zli, and Martin Vechev. Securify: Practical security analysis of smart contracts. InProceedings of the 2018 ACM SIGSAC conference on computer and communi- cations security, pages 67–82, 2018

    2018

  31. [31]

    The inefficiency of bitcoin.Economics Letters, 148:80–82, 2016

    Andrew Urquhart. The inefficiency of bitcoin.Economics Letters, 148:80–82, 2016

    2016

  32. [32]

    There’s no free lunch, even using bitcoin: Tracking the popularity and profits of virtual currency scams

    Marie Vasek and Tyler Moore. There’s no free lunch, even using bitcoin: Tracking the popularity and profits of virtual currency scams. InInternational conference on financial cryptography and data security, pages 44–61. Springer, 2015

    2015

  33. [33]

    Contractward: Automated vulnerability detection models for ethereum smart contracts.IEEE Transactions on Network Science and Engineering, 8(2):1133– 1144, 2020

    Wei Wang, Jingjing Song, Guangquan Xu, Yidong Li, Hao Wang, and Chunhua Su. Contractward: Automated vulnerability detection models for ethereum smart contracts.IEEE Transactions on Network Science and Engineering, 8(2):1133– 1144, 2020. 30

    2020

  34. [34]

    Ai-based vulnerability analysis of nft smart contracts

    Xin Wang and Xiaoqi Li. Ai-based vulnerability analysis of nft smart contracts. arXiv preprint arXiv:2504.16113, 2025

    arXiv 2025

  35. [35]

    A first look at blockchain- based decentralized applications.Software: Practice and Experience, 51(10):2033– 2050, 2021

    Kaidong Wu, Yun Ma, Gang Huang, and Xuanzhe Liu. A first look at blockchain- based decentralized applications.Software: Practice and Experience, 51(10):2033– 2050, 2021

    2033

  36. [36]

    Security analysis of chatgpt: Threats and privacy risks.arXiv preprint arXiv:2508.09426, 2025

    Yushan Xiang, Zhongwen Li, and Xiaoqi Li. Security analysis of chatgpt: Threats and privacy risks.arXiv preprint arXiv:2508.09426, 2025

    arXiv 2025

  37. [37]

    Penetration testing for system security: Meth- ods and practical approaches.arXiv preprint arXiv:2505.19174, 2025

    Wei Zhang, Ju Xing, and Xiaoqi Li. Penetration testing for system security: Meth- ods and practical approaches.arXiv preprint arXiv:2505.19174, 2025

    arXiv 2025

  38. [38]

    Risk assessment and security analysis of large language models.arXiv preprint arXiv:2508.17329, 2025

    Xiaoyan Zhang, Dongyang Lyu, and Xiaoqi Li. Risk assessment and security analysis of large language models.arXiv preprint arXiv:2508.17329, 2025

    Pith/arXiv arXiv 2025

  39. [39]

    Blockchain challenges and opportunities: A survey.International journal of web and grid services, 14(4):352–375, 2018

    Zibin Zheng, Shaoan Xie, Hong-Ning Dai, Xiangping Chen, and Huaimin Wang. Blockchain challenges and opportunities: A survey.International journal of web and grid services, 14(4):352–375, 2018

    2018

  40. [40]

    Blockchain security based on cryp- tography: a review.arXiv preprint arXiv:2508.01280, 2025

    Wenwen Zhou, Dongyang Lyu, and Xiaoqi Li. Blockchain security based on cryp- tography: a review.arXiv preprint arXiv:2508.01280, 2025

    Pith/arXiv arXiv 2025

  41. [41]

    Malicious code detection in smart contracts via opcode vectorization.arXiv preprint arXiv:2504.12720, 2025

    Huanhuan Zou, Zongwei Li, and Xiaoqi Li. Malicious code detection in smart contracts via opcode vectorization.arXiv preprint arXiv:2504.12720, 2025. 31

    arXiv 2025

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.