WALLETRADAR: Towards Automating the Detection of Vulnerabilities in Browser-based Cryptocurrency Wallets

• URL: http://arxiv.org/abs/2405.04332v1
• Date: Tue, 7 May 2024 14:01:27 GMT
• Title: WALLETRADAR: Towards Automating the Detection of Vulnerabilities in Browser-based Cryptocurrency Wallets
• Abstract summary: We present a comprehensive security analysis of browser-based wallets in this paper, along with the development of an automated tool designed for this purpose. We design WALLETRADAR, an automated detection framework that can accurately identify security issues based on static and dynamic analysis. evaluation of 96 popular browser-based wallets shows WALLETRADAR's effectiveness, by successfully automating the detection process in 90% of these wallets with high precision.
• Score: 19.265999943788284
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Cryptocurrency wallets, acting as fundamental infrastructure to the blockchain ecosystem, have seen significant user growth, particularly among browser-based wallets (i.e., browser extensions). However, this expansion accompanies security challenges, making these wallets prime targets for malicious activities. Despite a substantial user base, there is not only a significant gap in comprehensive security analysis but also a pressing need for specialized tools that can aid developers in reducing vulnerabilities during the development process. To fill the void, we present a comprehensive security analysis of browser-based wallets in this paper, along with the development of an automated tool designed for this purpose. We first compile a taxonomy of security vulnerabilities resident in cryptocurrency wallets by harvesting historical security reports. Based on this, we design WALLETRADAR, an automated detection framework that can accurately identify security issues based on static and dynamic analysis. Evaluation of 96 popular browser-based wallets shows WALLETRADAR's effectiveness, by successfully automating the detection process in 90% of these wallets with high precision. This evaluation has led to the discovery of 116 security vulnerabilities corresponding to 70 wallets. By the time of this paper, we have received confirmations of 10 vulnerabilities from 8 wallet developers, with over $2,000 bug bounties. Further, we observed that 12 wallet developers have silently fixed 16 vulnerabilities after our disclosure. WALLETRADAR can effectively automate the identification of security risks in cryptocurrency wallets, thereby enhancing software development quality and safety in the blockchain ecosystem.

Related papers

• The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem [4.233155487893623]
  We identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser.<n>We show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth.
  arXiv  Detail & Related papers  (2026-07-07T11:08:23Z)
• GoAT-X: A Graph of Auditing Thoughts for Securing Token Transactions in Cross-Chain Contracts [52.51342355102833]
  Cross-chain bridges, the critical infrastructure of the multi-chain ecosystem, have become a primary target for attackers.<n>Existing defenses, such as bytecode-level static analysis, are ill-equipped to handle the semantic complexity of cross-chain interactions.<n>We propose GoAT-X, a framework that shifts automated cross-chain smart contracts auditing from pattern matching toward systematic first-principles verification.
  arXiv  Detail & Related papers  (2026-04-27T11:34:21Z)
• An Analysis of Attack Vectors Against FIDO2 Authentication [45.88028371034407]
  This paper examines passkeys, also known as FIDO2, which claim to provide phishing-resistant authentication.<n>A private key is stored on a user's device, the authenticator, while the server stores the corresponding public key.<n>During authentication, the server generates a challenge that the user signs with the private key; the server then verifies the signature and establishes a session.
  arXiv  Detail & Related papers  (2026-04-22T17:52:56Z)
• V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution [52.57923394143007]
  V2E is a new framework for validating whether a reported vulnerability is truly exploitable.<n>V2E automatically generates Proof-of-Concept (PoC) and then assess if the vulnerability could be triggered and incur any financial loss.<n> Evaluation on 264 manually labeled contracts shows that V2E outperforms the baseline approach.
  arXiv  Detail & Related papers  (2026-04-15T08:24:24Z)
• SecPI: Secure Code Generation with Reasoning Models via Security Reasoning Internalization [50.71047638695205]
  Reasoning language models (RLMs) are increasingly used in programming.<n>Yet, even state-of-the-art RLMs frequently introduce critical security vulnerabilities in generated code.<n>We present SecPI, a fine-tuning pipeline that teaches RLMs to internalize structured security reasoning.
  arXiv  Detail & Related papers  (2026-04-04T04:29:11Z)
• Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They? [4.641069902222306]
  address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history.<n>Recent works have shown that millions of users were targeted and lost over 100 million US dollars.<n> crypto wallets play a central role in deploying countermeasures to mitigate the address poisoning attack.
  arXiv  Detail & Related papers  (2025-08-16T17:06:56Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• CyberGym: Evaluating AI Agents' Cybersecurity Capabilities with Real-World Vulnerabilities at Scale [46.76144797837242]
  Large language model (LLM) agents are becoming increasingly skilled at handling cybersecurity tasks autonomously.<n>Existing benchmarks fall short, often failing to capture real-world scenarios or being limited in scope.<n>We introduce CyberGym, a large-scale and high-quality cybersecurity evaluation framework featuring 1,507 real-world vulnerabilities.
  arXiv  Detail & Related papers  (2025-06-03T07:35:14Z)
• WalletProbe: A Testing Framework for Browser-based Cryptocurrency Wallet Extensions [8.064056857526813]
  WalletProbe is a mutation-based testing framework based on visual-level oracles. We have identified 13 attack vectors that can be abused by attackers to exploit cryptocurrency wallets and exposed 21 concrete attack strategies.
  arXiv  Detail & Related papers  (2025-04-16T03:24:30Z)
• Towards Trustworthy GUI Agents: A Survey [64.6445117343499]
  This survey examines the trustworthiness of GUI agents in five critical dimensions. We identify major challenges such as vulnerability to adversarial attacks, cascading failure modes in sequential decision-making. As GUI agents become more widespread, establishing robust safety standards and responsible development practices is essential.
  arXiv  Detail & Related papers  (2025-03-30T13:26:00Z)
• Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents [36.49717045080722]
  This paper investigates the vulnerabilities of AI agents within blockchain-based financial ecosystems when exposed to adversarial threats in real-world scenarios.<n>We introduce the concept of context manipulation -- a comprehensive attack vector that exploits unprotected context surfaces.<n>Using ElizaOS, we showcase that malicious injections into prompts or historical records can trigger unauthorized asset transfers and protocol violations.
  arXiv  Detail & Related papers  (2025-03-20T15:44:31Z)
• SoK: A Review of Cross-Chain Bridge Hacks in 2023 [36.136619420474766]
  Cross-chain bridges remain vulnerable to various attacks despite sophisticated designs and security measures.<n>This paper analyzes recent cross-chain bridge hacks in 2022 and 2023 and examines the exploited vulnerabilities.<n>The findings contribute to developing industry-wide standards for bridge security and operational resilience.
  arXiv  Detail & Related papers  (2025-01-06T23:05:14Z)
• Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures [47.435076500269545]
  Apache Log4J was found to be vulnerable to remote code execution attacks. More than 35,000 packages were forced to update their Log4J libraries with the latest version. It is practically reasonable for software developers to update their third-party libraries whenever the software vendors have released a vulnerable-free version.
  arXiv  Detail & Related papers  (2024-11-12T01:55:51Z)
• Vulnerability anti-patterns in Solidity: Increasing smart contracts security by reducing false alarms [0.0]
  We show how integrating and extending current analyses is not only feasible, but also a next logical step in smart-contract security. We propose light-weight static checks on the morphology and dynamics of Solidity code, stemming from a developer-centric notion of vulnerability.
  arXiv  Detail & Related papers  (2024-10-22T17:21:28Z)
• Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective [53.24281798458074]
  Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning)
  arXiv  Detail & Related papers  (2024-05-21T13:34:23Z)
• Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformers [51.0477382050976]
  An extra prompt token, called the switch token in this work, can turn the backdoor mode on, converting a benign model into a backdoored one. To attack a pre-trained model, our proposed attack, named SWARM, learns a trigger and prompt tokens including a switch token. Experiments on diverse visual recognition tasks confirm the success of our switchable backdoor attack, achieving 95%+ attack success rate.
  arXiv  Detail & Related papers  (2024-05-17T08:19:48Z)
• VELLET: Verifiable Embedded Wallet for Securing Authenticity and Integrity [0.6144680854063939]
  This paper proposes a new protocol to enhance the security of embedded wallets. Our VELLET protocol introduces a wallet verifier that can match the audit trail of embedded wallets on smart contracts.
  arXiv  Detail & Related papers  (2024-04-05T03:23:19Z)
• Architectural Design for Secure Smart Contract Development [0.0]
  Several attacks on blockchain infrastructures have resulted in hundreds of millions of dollars lost and sensitive information compromised. I identify common software vulnerabilities and attacks on blockchain infrastructures. I propose a model for ensuring a stronger security standard for future systems leveraging smart contracts.
  arXiv  Detail & Related papers  (2024-01-03T18:59:17Z)
• Vulnerability Scanners for Ethereum Smart Contracts: A Large-Scale Study [44.25093111430751]
  In 2023 alone, such vulnerabilities led to substantial financial losses exceeding a billion of US dollars. Various tools have been developed to detect and mitigate vulnerabilities in smart contracts. This study investigates the gap between the effectiveness of existing security scanners and the vulnerabilities that still persist in practice.
  arXiv  Detail & Related papers  (2023-12-27T11:26:26Z)
• Empirical Review of Smart Contract and DeFi Security: Vulnerability Detection and Automated Repair [36.46679501556185]
  Decentralized Finance (DeFi) is emerging as a peer-to-peer financial ecosystem. smart contracts hold a massive amount of value, making them an attractive target for attacks. This paper reviews the progress made in the field of smart contract and DeFi security from the perspective of both vulnerability detection and automated repair.
  arXiv  Detail & Related papers  (2023-09-05T17:00:42Z)
• SoK: Design, Vulnerabilities, and Security Measures of Cryptocurrency Wallets [6.074775040047958]
  We introduce a multi-dimensional design taxonomy for existing and novel wallets. We identify previously occurring vulnerabilities and discuss the security implications of design decisions. We present a multi-layered attack framework and investigate 84 incidents between 2012 and 2024, accounting for $5.4B.
  arXiv  Detail & Related papers  (2023-07-24T15:13:39Z)
• Analyzing In-browser Cryptojacking [16.599890339599586]
  We analyze the static, dynamic, and economic aspects of in-browser cryptojacking. We apply machine learning techniques to distinguish cryptojacking scripts from benign and malicious JavaScript samples. We also build an analytical model to empirically evaluate the feasibility of cryptojacking as an alternative to online advertisement.
  arXiv  Detail & Related papers  (2023-04-26T02:46:42Z)
• Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners? [10.771021805354911]
  Attacks targeting smart contracts are increasing, causing an estimated $6.45 billion in financial losses. We aim to shed light on the effectiveness of automated security tools in identifying vulnerabilities that can lead to high-profile attacks. Our findings reveal a stark reality: the tools could have prevented a mere 8% of the attacks in our dataset, amounting to $149 million out of the $2.3 billion in losses.
  arXiv  Detail & Related papers  (2023-04-06T10:27:19Z)
• ESCORT: Ethereum Smart COntRacTs Vulnerability Detection using Deep Neural Network and Transfer Learning [80.85273827468063]
  Existing machine learning-based vulnerability detection methods are limited and only inspect whether the smart contract is vulnerable. We propose ESCORT, the first Deep Neural Network (DNN)-based vulnerability detection framework for smart contracts. We show that ESCORT achieves an average F1-score of 95% on six vulnerability types and the detection time is 0.02 seconds per contract.
  arXiv  Detail & Related papers  (2021-03-23T15:04:44Z)
• Quantum Multi-Solution Bernoulli Search with Applications to Bitcoin's Post-Quantum Security [67.06003361150228]
  A proof of work (PoW) is an important cryptographic construct enabling a party to convince others that they invested some effort in solving a computational task. In this work, we examine the hardness of finding such chain of PoWs against quantum strategies. We prove that the chain of PoWs problem reduces to a problem we call multi-solution Bernoulli search, for which we establish its quantum query complexity.
  arXiv  Detail & Related papers  (2020-12-30T18:03:56Z)
• Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
  Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance. We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
  arXiv  Detail & Related papers  (2020-10-19T13:09:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.