smart contract development

Smart contracts exhibit extremely low fault tolerance due to code immutability, and existing formal verification approaches suffer from limitations in semantic expressiveness and reasoning capability for specification modeling. Method: Through a systematic literature review, this work integrates model checking, theorem proving, and static analysis, and—novelty—introduces description logic (DL) into smart contract formal verification for the first time. It constructs a new verification framework that combines strong semantic expressiveness with decidable reasoning support, and proposes a cross-tool, cross-platform verification methodology. A taxonomy-based evaluation framework for mainstream verification tools is also established. Contribution/Results: Comparative experiments demonstrate that DL significantly improves the accuracy, scalability, and automation potential of specification modeling. The framework establishes a new paradigm for high-assurance smart contract development, enabling more rigorous, interoperable, and practically deployable verification workflows.

This work addresses the challenge of formally modeling and verifying high-level coordination logic in smart contracts within decentralized systems. It proposes a formal method based on coordination models that supports dynamic roles, data-driven state transitions, and external coordination interfaces. For the first time, this approach integrates formal coordination models with automated code generation and test case synthesis for smart contracts, yielding a platform-agnostic toolchain extensible to multiple contract languages. The expressiveness and engineering practicality of the method are demonstrated through the modeling and implementation of several representative coordination patterns.

This work addresses the challenges of repairing deployed smart contracts and the limited expressiveness of existing formal methods in modeling multi-party liability allocation. To overcome these limitations, the authors propose a formal modeling approach based on Relativized Contract Language (RCL) and the RECALL verification tool, which precisely captures the responsibilities of multiple parties and automatically detects and resolves specification conflicts during the modeling phase. The method then generates Solidity code directly from the verified model and validates its functionality within the Remix IDE. Experimental results demonstrate that this approach significantly enhances the logical consistency, reliability, and security of smart contracts, thereby underscoring the critical value of upfront formal verification in the development of complex contractual systems.

This work addresses reliability and security challenges of smart contract execution architectures in complex, interconnected systems. We comparatively analyze two dominant paradigms—Order-Execute (OE) and Execute-Order-Validate (EOV)—and propose a rigorous reliability assessment framework integrating formal modeling of safety properties with fault injection. Leveraging a realistic IoT-based energy system, we construct a simulation environment and empirically evaluate the frameworks against representative smart contract vulnerabilities. Results demonstrate that EOV—by relocating validation to occur after execution but before ordering—significantly enhances robustness against reentrancy, time-dependent, and state-inconsistency attacks, achieving superior system-level reliability and security compared to OE. To our knowledge, this is the first study to systematically quantify the security boundaries of these paradigms within the energy IoT domain, providing both theoretical foundations and practical guidance for designing high-assurance smart contract execution architectures.

Smart contracts’ reliance on external data introduces significant security and reliability risks, yet systematic empirical studies remain scarce. To address this gap, we conduct the first large-scale statistical analysis of 9,356 real-world smart contracts, integrating abstract syntax tree parsing, keyword matching, manual annotation, and mining of professional security audit reports to construct the first structured database of external dependencies. We propose a reproducible framework for identifying and classifying such dependencies, revealing a statistically significant positive correlation between contract complexity and external dependency intensity. Our analysis uncovers 249 vulnerabilities directly attributable to external data handling—constituting 9% of all reported vulnerabilities in the audited datasets. These findings provide critical empirical evidence and foundational infrastructure to support secure smart contract development, formal verification, and security auditing practices.

本文研究了链下组件中的信息流控制问题，使用静态信息流控制技术来确保链上和链下组件间数据的完整性和保密性。

Current DevOps infrastructures for blockchain applications are predominantly controlled by single entities, lacking decentralized deployment and governance mechanisms. This work proposes a decentralized deployment architecture decoupled from specific governance and upgrade schemes, integrating DAO-based governance, smart contract upgradability, and DevOps best practices. By adopting an extended registry pattern, the architecture enables deterministic deployments and, for the first time, incorporates version control, testing and validation, and user interface components into a unified decentralized framework. The project provides an open-source reference implementation that substantially lowers the barrier to practical decentralized deployment. Experimental evaluation demonstrates the effectiveness and practicality of the proposed architecture.

Smart contract auditing suffers from high costs, low efficiency, and limitations of existing automated tools—such as high false positive rates or hallucinations from large language models (LLMs). To address these challenges, this work proposes an end-to-end auditing framework grounded in a novel Cross-Contract Interaction Model (CCIM) as its structural backbone. The framework integrates a multi-signal engine with a parallel LLM pipeline and employs a staged false positive reduction mechanism, a structured adjudication engine, and deterministic validation via symbolic execution and fuzzing to verify LLM-generated vulnerability claims. Evaluated on the EVMbench benchmark, the approach achieves a 71.7% recall rate for high-severity vulnerabilities and attains 100% recall across 25 audit tasks, outperforming the strongest baseline by 26 percentage points.

本文提出CARE架构，通过明确责任边界和域范围的能力解析来解决模块化智能合约系统中的协调、共享状态等问题，并使用TLA+进行形式化验证。

This study addresses the challenges of software supply chain security and the insufficient trustworthiness of large language model (LLM)-based agents by proposing a permissioned blockchain-driven agent collaboration framework. The framework employs LLM-powered security agents to monitor the entire Software Development Life Cycle (SDLC), while integrating smart contracts and cryptographic signature authentication to achieve decentralized integrity verification, transparent provenance tracking, and verifiable deployment decisions. By establishing a generalized AI-integrated architecture, this work provides continuous security assurance for software supply chains, effectively enhancing the trustworthiness of agent collaboration and overall system robustness.