arXiv subjects

Joshua Ellul

Publications and source records attributed to Joshua Ellul.

12 recordsLinked to original sources

arXiv2025

An Initial Exploration of Fine-tuning Small Language Models for Smart Contract Reentrancy Vulnerability Detection

Large Language Models (LLMs) are being used more and more for various coding tasks, including to help coders identify bugs and are a promising avenue to support coders in various tasks including vulnerability detection -- particularly given the flexibility of such generative AI models and tools. Yet for many tasks it may not be suitable to use LLMs, for which it may be more suitable to use smaller language models that can fit and easily execute and train on a developer's computer. In this paper we explore and evaluate whether smaller language models can be fine-tuned to achieve reasonable results for a niche area: vulnerability detection -- specifically focusing on detecting the reentrancy bug in Solidity smart contracts.

cs.SE↗

arXiv2025

Enhanced Smart Contract Reputability Analysis using Multimodal Data Fusion on Ethereum

The evaluation of smart contract reputability is essential to foster trust in decentralized ecosystems. However, existing methods that rely solely on code analysis or transactional data, offer limited insight into evolving trustworthiness. We propose a multimodal data fusion framework that integrates code features with transactional data to enhance reputability prediction. Our framework initially focuses on AI-based code analysis, utilizing GAN-augmented opcode embeddings to address class imbalance, achieving 97.67% accuracy and a recall of 0.942 in detecting illicit contracts, surpassing traditional oversampling methods. This forms the crux of a reputability-centric fusion strategy, where combining code and transactional data improves recall by 7.25% over single-source models, demonstrating robust performance across validation sets. By providing a holistic view of smart contract behaviour, our approach enhances the model's ability to assess reputability, identify fraudulent activities, and predict anomalous patterns. These capabilities contribute to more accurate reputability assessments, proactive risk mitigation, and enhanced blockchain security.

cs.LG↗

arXiv2025

Identifying Likely-Reputable Blockchain Projects on Ethereum

Identifying reputable Ethereum projects remains a critical challenge within the expanding blockchain ecosystem. The ability to distinguish between legitimate initiatives and potentially fraudulent schemes is non-trivial. This work presents a systematic approach that integrates multiple data sources with advanced analytics to evaluate credibility, transparency, and overall trustworthiness. The methodology applies machine learning techniques to analyse transaction histories on the Ethereum blockchain. The study classifies accounts based on a dataset comprising 2,179 entities linked to illicit activities and 3,977 associated with reputable projects. Using the LightGBM algorithm, the approach achieves an average accuracy of 0.984 and an average AUC of 0.999, validated through 10-fold cross-validation. Key influential factors include time differences between transactions and received_tnx. The proposed methodology provides a robust mechanism for identifying reputable Ethereum projects, fostering a more secure and transparent investment environment. By equipping stakeholders with data-driven insights, this research enables more informed decision-making, risk mitigation, and the promotion of legitimate blockchain initiatives. Furthermore, it lays the foundation for future advancements in trust assessment methodologies, contributing to the continued development and maturity of the Ethereum ecosystem.

cs.CR↗

arXiv2025

Aggregating Digital Identities through Bridging. An Integration of Open Authentication Protocols for Web3 Identifiers

Web3's decentralised infrastructure has upended the standardised approach to digital identity established by protocols like OpenID Connect. Web2 and Web3 currently operate in silos, with Web2 leveraging selective disclosure JSON web tokens (SD-JWTs) and Web3 dApps being reliant on on-chain data and sometimes clinging to centralised system data. This fragmentation hinders user experience and the interconnectedness of the digital world. This paper explores the integration of Web3 within the OpenID Connect framework, scrutinising established authentication protocols for their adaptability to decentralised identities. The research examines the interplay between OpenID Connect and decentralised identity concepts, the limitations of existing protocols like OpenID Connect for verifiable credential issuance, OpenID Connect framework for verifiable presentations, and self-issued OpenID provider. As a result, a novel privacy-preserving digital identity bridge is proposed, which aims to answer the research question of whether authentication protocols should inherently support Web3 functionalities and the mechanisms for their integration. Through a Decentralised Autonomous Organisation (DAO) use case, the findings indicate that a privacy-centric bridge can mitigate existing fragmentation by aggregating different identities to provide a better user experience. While the digital identity bridge demonstrates a possible approach to harmonise digital identity across platforms for their use in Web3, the bridging is unidirectional and limits root trust of credentials. The bridge's dependence on centralised systems may further fuel the debate on (de-)centralised identities.

cs.CR↗

arXiv2024

A Trust-Centric Approach To Quantifying Maturity and Security in Internet Voting Protocols

Voting is a cornerstone of collective participatory decision-making in contexts ranging from political elections to decentralized autonomous organizations (DAOs). Despite the proliferation of internet voting protocols promising enhanced accessibility and efficiency, their evaluation and comparison are complicated by a lack of standardized criteria and unified definitions of security and maturity. Furthermore, socio-technical requirements by decision makers are not structurally taken into consideration when comparing internet voting systems. This paper addresses this gap by introducing a trust-centric maturity scoring framework to quantify the security and maturity of seventeen internet voting systems. A comprehensive trust model analysis is conducted for selected internet voting protocols, examining their security properties, trust assumptions, technical complexity, and practical usability. In this paper we propose the Internet Voting Maturity Framework (IVMF) which supports nuanced assessment that reflects real-world deployment concerns and aids decision-makers in selecting appropriate systems tailored to their specific use-case requirements. The framework is general enough to be applied to other systems, where the aspects of decentralization, trust, and security are crucial, such as digital identity, Ethereum layer-two scaling solutions, and federated data infrastructures. Its objective is to provide an extendable toolkit for policy makers and technology experts alike that normalizes technical and non-technical requirements on a univariate scale.

cs.CR↗

arXiv2024

A Systematisation of Knowledge: Connecting European Digital Identities with Web3

The terms self-sovereign identity (SSI) and decentralised identity are often used interchangeably, which results in increasing ambiguity when solutions are being investigated and compared. This article aims to provide a clear distinction between the two concepts in relation to the revised Regulation as Regards establishing the European Digital Identity Framework (eIDAS 2.0) by providing a systematisation of knowledge of technological developments that led up to implementation of eIDAS 2.0. Applying an inductive exploratory approach, relevant literature was selected iteratively in waves over a nine months time frame and covers literature between 2005 and 2024. The review found that the decentralised identity sector emerged adjacent to the OpenID Connect (OIDC) paradigm of Open Authentication, whereas SSI denotes the sector's shift towards blockchain-based solutions. In this study, it is shown that the interchangeable use of SSI and decentralised identity coincides with novel protocols over OIDC. While the first part of this paper distinguishes OIDC from decentralised identity, the second part addresses the incompatibility between OIDC under eIDAS 2.0 and Web3. The paper closes by suggesting further research for establishing a digital identity bridge for connecting applications on public-permissionless ledgers with data originating from eIDAS 2.0 and being presented using OIDC.

cs.CR↗

arXiv2023

The MEV Saga: Can Regulation Illuminate the Dark Forest?

In this article, we develop an interdisciplinary analysis of MEV which desires to merge the gap that exists between technical and legal research supporting policymakers in their regulatory decisions concerning blockchains, DeFi and associated risks. Consequently, this article is intended for both technical and legal audiences, and while we abstain from a detailed legal analysis, we aim to open a policy discussion regarding decentralized governance design at the block building layer as the place where MEV occurs. Maximal Extractable Value or MEV has been one of the major concerns in blockchain designs as it creates a centralizing force which ultimately affects user transactions. In this article, we dive into the technicality behind MEV, where we explain the concept behind the novel Proposal Builder Separation design as an effort by Flashbots to increase decentralization through modularity. We underline potential vulnerability factors under the PBS design, which open space for MEV extracting adversarial strategies by inside participants. We discuss the shift of trust from validators to builders in PoS blockchains such as Ethereum, acknowledging the impact that the later ones may have on users' transactions (in terms of front running) and censorship resistance (in terms of transaction inclusion). We recognize that under PBS, centralized (dominant) entities such as builders could potentially harm users by extracting MEV via front running strategies. Finally, we suggest adequate design and policy measures which could potentially mitigate these negative effects while protecting blockchain users.

cs.CY↗

arXiv2023

Active External Calls for Blockchain and Distributed Ledger Technologies: Debunking cited inability of Blockchain and DLT to make external calls

Blockchain and other distributed ledger technologies have enabled peer-to-peer networks to maintain ledgers with an immutable history and guaranteed computation, all carried out without the need of trusted parties. In practice, few applications of blockchain are closed i.e. do not interact with the world outside the blockchain, and various techniques have been proposed and used to handle such interaction. One problem is that it is widely accepted that, due to the decentralised nature of blockchain networks and constraints to ensure trust and determinism, such communication can only flow into the blockchain, and that blockchain systems cannot initiate and execute calls to external systems or services. In this paper we show that this misconception is preconceived by building on our previously presented solution to demonstrate that such calls can be directly initiated from the blockchain itself in a feasible and efficient manner.

cs.CR↗

arXiv2021

Towards External Calls for Blockchain and Distributed Ledger Technology

It is widely accepted that blockchain systems cannot execute calls to external systems or services due to each node having to reach a deterministic state. However, in this paper we show that this belief is preconceived by demonstrating a method that enables blockchain and distributed ledger technologies to perform calls to external systems initiated from the blockchain/DLT itself.

cs.DC↗

arXiv2021

A Pragmatic Approach to Regulating Artificial Intelligence: A Technology Regulator's Perspective

Artificial Intelligence (AI) and the regulation thereof is a topic that is increasingly being discussed within various fora. Various proposals have been made in literature for defining regulatory bodies and/or related regulation. In this paper, we present a pragmatic approach for providing a technology assurance regulatory framework. To the best knowledge of the authors this work presents the first national AI technology assurance legal and regulatory framework that has been implemented by a national authority empowered through law to do so. In aim of both providing assurances where required and not stifling innovation yet supporting it, herein it is proposed that such regulation should not be mandated for all AI-based systems and that rather it should primarily provide a voluntary framework and only be mandated in sectors and activities where required and as deemed necessary by other authorities for regulated and critical areas.

cs.CY↗

arXiv2021

EtherClue: Digital investigation of attacks on Ethereum smart contracts

Programming errors in Ethereum smart contracts can result in catastrophic financial losses from stolen cryptocurrency. While vulnerability detectors can prevent vulnerable contracts from being deployed, this does not mean that such contracts will not be deployed. Once a vulnerable contract is instantiated on the blockchain and becomes the target of attacks, the identification of exploit transactions becomes indispensable in assessing whether it has been actually exploited and identifying which malicious or subverted accounts were involved. In this work, we study the problem of post-factum investigation of Ethereum attacks using Indicators of Compromise (IoCs) specially crafted for use in the blockchain. IoC definitions need to capture the side-effects of successful exploitation in the context of the Ethereum blockchain. Therefore, we define a model for smart contract execution, comprising multiple abstraction levels that mirror the multiple views of code execution on a blockchain. Subsequently, we compare IoCs defined across the different levels in terms of their effectiveness and practicality through EtherClue, a prototype tool for investigating Ethereum security incidents. Our results illustrate that coarse-grained IoCs defined over blocks of transactions can detect exploit transactions with less computation; however, they are contract-specific and suffer from false negatives. On the other hand, fine-grained IoCs defined over virtual machine instructions can avoid these pitfalls at the expense of increased computation which are nevertheless applicable for practical use.

cs.CR↗

arXiv2019

Blockchain and the Common Good Reimagined

Blockchain, Smart Contracts and Distributed Ledger Technology (DLT) are being touted to revolutionise digital services - through decentralisation. Cryptocurrencies, self-sovereign identities, decentralised certificate registries, and transparent voting systems are but a few applications which promise to empower endusers and provide assurances that neither data nor the associated computational logic have been tampered with. Decentralisation, disintermediation, transparency, verifiability, auditability, openness, inclusion, tamper-proof, immutability are just some of the buzz words that continue to be swung around in the promotion of the benefits brought about by Blockchain-based systems to the users. The rhetoric used creates parallels between the features brought about through blockchains and values that many try to uphold, for example honesty, openness, transparency, teamwork and unchanging truth. In this paper a number of blockchain applications aimed at supporting initiatives for common good are highlighted. This is followed by a discussion on technology de/centralisation and a thought experiment used to raise questions regarding the use of decentralised technology in terms of social implications.

cs.CY↗