Smart contracts automate the management of high-value assets, where vulnerabilities can lead to catastrophic financial losses. This challenge is amplified in Large Language Models (LLMs) by two interconnected failures: they operate as unauditable "black boxes" lacking a transparent reasoning process, and consequently, generate code riddled with critical security vulnerabilities. To address both issues, we propose SmartCoder-R1 (based on Qwen2.5-Coder-7B), a novel framework for secure and explainable smart contract generation. It begins with Continual Pre-training (CPT) to specialize the model. We then apply Long Chain-of-Thought Supervised Fine-Tuning (L-CoT SFT) on 7,998 expert-validated reasoning-and-code samples to train the model to emulate human security analysis. Finally, to directly mitigate vulnerabilities, we employ Security-Aware Group Relative Policy Optimization (S-GRPO), a reinforcement learning phase that refines the generation policy by optimizing a weighted reward signal for compilation success, security compliance, and format correctness. Evaluated against 17 baselines on a benchmark of 756 real-world functions, SmartCoder-R1 establishes a new state of the art, achieving top performance across five key metrics: a ComPass of 87.70

Converting activity diagrams in System Modeling Language (SysML) and natural language requirements into executable probabilistic verification results remains a key bottleneck for safetycritical model-based systems engineering (MBSE). This process involves the use of probabilistic symbolic models (PRISM) and probabilistic computation tree logic (PCTL) specifications. Existing automation approaches suffer from high error rates due to one-shot generation, lack of intermediate validation, and absence of systematic error recovery. This paper proposes a progressive verification pipeline integrating three synergistic innovations: (1) stepwise PCTL generation decomposes synthesis into validated phases; (2) dual-layer structured intermediate representation separates rule-level validation from model-level validation; (3) closed-loop targeted repair applies type-specific correction strategies. Evaluation on 52 industrial cases across 16 domains demonstrates 92% PCTL accuracy and 92% PRISM equivalence, outperforming state-of-the-art baselines by 7-12 percentage points while reducing verification time by over 90%. Ablation studies confirm synergistic gains across all pipeline components.

Visual analysis of spatiotemporal density distributions is crucial for understanding spatiotemporal dynamics. However, existing methods suffer from visual occlusion and information loss when simultaneously displaying multiple density distributions. We present Strunkmap as an abstract approach to address these challenges. We introduce anisotropic kernel density estimation to enhance the accuracy of density generation. We extract the trunks of density distributions to identify the overall spatial patterns. Path scanning and trunk-outline matching strategies are employed to preserve local spatial structure. We design a stacked trunk plot that enables lossless density representation while conserving substantial screen space. Based on the visual design, Strunkmap integrates multiple heatmaps within a single map to effectively display temporal evolution of density distributions without visual occlusion. Ablation studies and comparative experiments validate the superiority of Strunkmap in accuracy and efficiency for hotspot identification and trend exploration. Theoretical analysis demonstrates Strunkmap's scalability, which we further verify through large-scale spatiotemporal data visualization. Color encoding schemes and scaling ratios are discussed to illustrate the flexibility. Our evaluations with user feedback demonstrate that Strunkmap is a viable solution with significant potential to real-world applications.

Graph Anomaly Detection (GAD) has gained significant attention in areas such as financial risk control and social network security, becoming a critical research problem. Vanilla Graph Neural Networks (GNNs), a popular method for graph modeling, are known to perform poorly in GAD due to the assumption of homophily preferences. This article argues that the issue lies in the insufficient feature extraction ability caused by their single filtering property (low-pass filtering) and revealing the effectiveness of multi-band filtering to deal with GAD. From this, we note two other overlooked issues: (1) How can multi-band band-pass filtering further fuse multi-scale neighborhood information? (2) Adaptation between raw attributes of nodes and graph filters (graph topology). The former bridges the respective advantages of spectral domain and spatial domain, and the latter is an important bottleneck for the encoding capacity of the filters. To address these, we propose a new GAD method, Graph Perturbed Networks (GraphPN). Each hidden layer of GraphPN is a band-pass filter, enabling multi-band and multi-scale filtering through simple stacking and skip connections. We analyze its spectral locality and spatial locality to provide theoretical support. Additionally, GraphPN is supplemented with a tailored feature activation module to complete the adaptation of the above two. This module readjusts node indices and decouples graph convolution, introducing rich topological information to node attributes. In addition to further enhancing detection performance, another possibly counter-intuitive effect is that the distinguishability of the two classes of nodes is improved even before filtering. The proposed method performs well in real-world datasets compared with the current state-of-the-art baselines, which fully demonstrates its superiority. Codes are available at https://github.com/Thankstaro/GraphPN.

The complexity of code reviews has driven efforts to automate review comments, but prior approaches oversimplify this task by treating it as snippet-level code-to-text generation and relying on text similarity metrics like BLEU for evaluation. These methods overlook repository context, real-world merge request evaluation, and defect detection, limiting their practicality. To address these issues, we explore the full automation pipeline within the online recommendation service of a company with nearly 400 million daily active users, analyzing industry-grade C++ codebases comprising hundreds of thousands of lines of code. We identify four key challenges: 1) capturing relevant context, 2) improving key bug inclusion (KBI), 3) reducing false alarm rates (FAR), and 4) integrating human workflows. To tackle these, we propose 1) code slicing algorithms for context extraction, 2) a multi-role LLM framework for KBI, 3) a filtering mechanism for FAR reduction, and 4) a novel prompt design for better human interaction. Our approach, validated on real-world merge requests from historical fault reports, achieves a 2x improvement over standard LLMs and a 10x gain over previous baselines. While the presented results focus on C++, the underlying framework design leverages language-agnostic principles (e.g., AST-based analysis), suggesting potential for broader applicability.

The automation of code review activities has emerged as a critical research focus for optimizing development efficiency while ensuring code quality. While recent advancements in Large Language Models (LLMs) have shown promise, existing approaches predominantly isolate the three core code review tasks—review necessity prediction, review comment generation, and code refinement, overlooking their valuable interdependencies. Empirical analysis reveals that isolated-trained comment-generation models often produce superficial comments (e.g., “Undefined ‘userInput’”) due to insufficient understanding of defect patterns, which is what necessity prediction tasks precisely target. Recent efforts to model interdependencies through knowledge distillation remain constrained by static framework designs.To address these challenges, we present MoE-Reviewer, which adopts the Mixture-of-Experts (MoE) framework on the LLaMA model to tackle the interdependence of code review tasks. MoE-Reviewer enables collaborative modeling for the three tasks mentioned above. By integrating dynamic coordination routing strategies and fine-grained expert mechanisms, MoE-Reviewer facilitates effective knowledge sharing across tasks while mitigating parameter interference. Evaluations conducted on the CodeReviewer dataset demonstrated that MoE-Reviewer outperforms existing methods, achieving state-of-the-art performance with an F1-score of 73.2% and improving the BLEU score for review comment generation by 5.32 to 11.62. Additionally, routing analysis further validates the effectiveness of our approach.

Smart contracts are a core component of blockchain ecosystems, but their transparency and immutability make them vulnerable to attacks, leading to significant financial losses. Thus, repairing vulnerabilities in smart contracts is crucial for establishing a trustworthy blockchain environment. Existing smart contract vulnerability repair methods suffer from a critical “one-for-all” design limitation, where a single model is tasked with fixing diverse vulnerability types, leading to suboptimal performance due to insufficient specialization. To address this, we propose MoEFix, a novel framework leveraging a Mixture-of-Experts (MoE) architecture tailored for smart contract characteristics. MoEFix partitions vulnerabilities into subspaces, trains specialized experts for each type (e.g., reentrancy, integer overflow), and employs a vulnerability-aware router to dynamically allocate repairs. We further redesign the repair workflow to align with large language models, enabling end-to-end secure contract generation instead of partial patches, and to achieve this, we curated a dataset of 1,391 contracts covering five critical vulnerability types. To validate our approach, we extend the benchmark PVD test suite. Experiments demonstrate that MoEFix outperforms state-of-the-art methods by 21.64% in overall accuracy, achieving improvements of 26.19% (reentrancy) and 23.08% (delegatecall) for specific vulnerabilities.

Smart contract vulnerabilities pose significant security risks to blockchain systems, potentially leading to severe financial losses. Existing methods face several limitations: (1) Program analysis-based approaches rely on predefined patterns, lacking flexibility for new vulnerability types; (2) Deep learning-based methods lack explanations; (3) Large language model-based approaches suffer from high false positives. We propose MOS, a smart contract vulnerability detection framework based on mixture-of-experts tuning (MOE-Tuning) of large language models. First, we conduct continual pre-training on a large-scale smart contract dataset to provide domain-enhanced initialization. Second, we construct a high-quality MOE-Tuning dataset through a multi-stage pipeline combining LLM generation and expert verification for reliable explanations. Third, we design a vulnerability-aware routing mechanism that activates the most relevant expert networks by analyzing code features and their matching degree with experts. Finally, we extend the feed-forward layers into multiple parallel expert networks, each specializing in specific vulnerability patterns. We employ a dual-objective loss function: one for optimizing detection and explanation performance, and another for ensuring reasonable distribution of vulnerability types to experts through entropy calculation. Experiments show that MOS significantly outperforms existing methods with average improvements of 6.32 The vulnerability explanations achieve positive ratings (scores of 3-4 on a 4-point scale) of 82.96 conciseness through human and LLM evaluation.

Rename refactoring is an essential practice in software maintenance, and Variable Rename Refactoring (VRR) is much more challenging than other types of identifiers. Meaningful variable names are critical for code readability and maintainability, as inconsistent variable names can hinder developers from comprehending code. Existing VRR research primarily focuses on Variable Name Consistency Checking (VCC) or variable name recommendation independently, but merely checking inconsistencies or recommending variable names is insufficient: a fully automated process must identify inconsistent names and then rectify them.In this paper, we propose AUVANA, a novel language model based framework to fully AUtomate VAriable reNAme refactoring that automates VRR by integrating inconsistency detection and meaningful variable name generation in Java. Unlike rule-based or semi-automatic approaches, AUVANA eliminates manual effort through two synergistic components: 1) a VCC model that identifies inconsistent variable names and 2) a Variable Name Refactoring (VNR) model that generates consistent replacements. To bridge the gap between pre-training and fine-tuning, we leverage prompt-tuning to improve model performance and tackle the challenge of multiple variable name occurrences. Hard negatives are introduced to address data scarcity.Experimental results demonstrate that AUVANA outperforms SoTA methods. On JavaRef and TL-CodeSum datasets, AUVANA achieves 57.8% and 56.1% Exact Match (EM) accuracy for VNR, exceeding prior baselines by 7.64% and 5.65%, respectively. For VCC, AUVANA attains 95.6% and 94.8% overall accuracy on JavaRef and TL-CodeSum, respectively, showcasing its ability to accurately detect inconsistent variable names. User study demonstrates that AUVANA VRR performance surpasses human in efficiency, precision and EM Accuracy. Artifacts are released to support future research.

With the increasing security issues in blockchain, smart contract vulnerability detection has become a research focus. Existing vulnerability detection methods have their limitations: 1) Static analysis methods struggle with complex scenarios. 2) Methods based on specialized pre-trained models perform well on specific datasets but have limited generalization capabilities. In contrast, general-purpose Large Language Models (LLMs) demonstrate impressive ability in adapting to new vulnerability patterns. However, they often underperform on specific vulnerability types compared to methods based on specialized pre-trained models. We also observe that explanations generated by general-purpose LLMs can provide fine-grained code understanding information, contributing to improved detection performance. Inspired by these observations, we propose SAEL, an LLM-based framework for smart contract vulnerability detection. We first design targeted prompts to guide LLMs in identifying vulnerabilities and generating explanations, which serve as prediction features. Next, we apply prompt-tuning on CodeT5 and T5 to process contract code and explanations, enhancing task-specific performance. To combine the strengths of each approach, we introduce an Adaptive Mixture-of-Experts architecture. This dynamically adjusts feature weights via a Gating Network, which selects relevant features using TopK filtering and Softmax normalization, and incorporates a Multi-Head Self-Attention mechanism to enhance cross-feature relationships. This design enables effective integration of LLM predictions, explanation features, and code features through gradient optimization. The loss function jointly considers both independent feature performance and overall weighted predictions. Experiments show that SAEL outperforms existing methods across various vulnerabilities.

Smart contract vulnerability detection is a critical challenge in the rapidly evolving blockchain landscape. Existing vulnerability detection methods face two main issues: (1) Existing datasets lack comprehensiveness and sufficient quality, with limited vulnerability type coverage and insufficient distinction between high-quality and low-quality explanations for preference learning. (2) Large language models (LLMs) often struggle with accurately interpreting specific concepts in smart contract security. Through our empirical analysis, we found that even after continual pre-training and supervised fine-tuning, LLMs still exhibit limitations in precisely understanding the execution order of state changes in smart contracts, which can lead to incorrect vulnerability explanations despite making correct detection decisions. These limitations result in poor detection performance, leading to potentially severe financial losses. To address these challenges, we propose Smart-LLaMA-DPO, an advanced detection method based on the LLaMA-3.1-8B. First, we construct a comprehensive dataset covering four vulnerability types and machine-unauditable vulnerabilities, containing labels, detailed explanations, and precise vulnerability locations for Supervised Fine-Tuning (SFT), as well as paired high-quality and low-quality outputs for Direct Preference Optimization (DPO). Second, we perform continual pre-training using large-scale smart contract code to enhance the LLM's understanding of specific security practices in smart contracts. Futhermore, we conduct supervised fine-tuning with our comprehensive dataset. Finally, we apply DPO, which leverages human feedback to improve the quality of generated explanations. Smart-LLaMA-DPO utilizes a specially designed loss function that encourages the LLM to increase the probability of preferred outputs while decreasing the probability of non-preferred outputs, thereby enhancing the LLM's ability to generate high-quality explanations. We evaluate Smart-LLaMA-DPO on four major vulnerability types: reentrancy, timestamp dependence, integer overflow/underflow, and delegatecall, as well as machine-unauditable vulnerabilities. Our method significantly outperforms state-of-the-art baselines, with average improvements of 10.43% in F1 score and 7.87% in accuracy. Moreover, both LLM evaluation and human evaluation demonstrate the superior quality of explanations generated by Smart-LLaMA-DPO in terms of correctness, thoroughness, and clarity.

With the increasing security issues in the blockchain, smart contract vulnerability detection has gradually become the focus of research. Recently, many approaches have been proposed to detect smart contract vulnerabilities. Despite promising results, these approaches still have three drawbacks: 1) Symbolic execution and static analysis methods are constrained by predefined rules, which limits their adaptability to different vulnerabilities. 2) Most smart contract code contains abundant irrelevant information which is useless for vulnerability detection. 3) Pre-trained models fail to bridge the gap between pre-training and detecting smart contract vulnerabilities.To solve these problems, we propose an approach named PSCVFinder for detecting reentrancy vulnerability and times-tamp dependency vulnerability, which are two severe vulnerabilities in smart contract. To better detect these vulnerabilities, we propose CSCV which is a smart contract slicing method to reduce the irrelevant code. Unlike existing approaches, our model first learns the representation of programming language through the pre-training model, then fully exploits the capacity of large language model with prompt-tuning to precisely detect smart contract vulnerability. We conduct experiments on real-world dataset and the results reflect that PSCVFinder scores 93.83% and 93.49% on two kinds of vulnerabilities in F1-score, surpassing the state-of-the-art baseline by 1.14% and 4.02%, respectively.

Large display interaction has undergone considerable growth, whereas distant pointing poses challenges due to distance limitations and input devices. Smart devices with superior computing power and rich input capabilities aim to surmount these restrictions. However, pointing interactions in single-layer have limited accuracy in large display scenarios. We investigate a hierarchical pointing approach that couples multiple control modes of rotation attitude, touch operation, and pressure simulation with different cursor strategies. Specifically, it covers the dual-layer cursor with the hierarchical structure, the pressure-dependent multistage gain cursor, and the cursor projection technique based on the target acquisition mechanism. We contrast seven distant pointing techniques in two groups of experiments. Our results indicate that the hierarchical interaction strategy improves user performance, and cursor projection achieves an optimal trade-off between velocity and accuracy for high Fitts' index of difficulty (ID) contexts.

Decentralized Finance (DeFi) ecosystem has grown rapidly in the past few years. In the DeFi ecosystem, flash loan is a novel type of uncollateralized loan with nearly negligible lending costs. Malicious attackers can easily borrow a large number of crypto assets, and utilize them to disrupt the price of crypto assets to make a profit. Many flash loan based price manipulation attacks have been reported recently, and caused immense economic losses, e.g., 30 million USD in a single attack. In this paper, we conduct an empirical study on real-world flash loan based attacks in the past two years and present three attack patterns for price manipulation attacks. Then, we propose an approach, LeiShen, to automatically detect price manipulation attacks with asset transfers. We evaluate LeiShen on the first 14,500,000 blocks in Ethereum, and detect 180 attacks with a precision of 78.9%. Among our newly-found attacks, the severest attack has caused a total loss of more than 6.1 million USD.

With the development of blockchain technology, security concerns have become increasingly prominent in recent years. Money laundering through blockchain has been found to generate a significant amount of money and has become a serious threat. Towards money laundering detection in Bitcoin, conventional methods heavily rely on fixed expert rules, leading to low accuracy and poor scalability. Graph convolutional network approaches have improved this issue, but they fail to distinguish the importance of surrounding transactions and the structural information of different transactions. To solve above problems, we propose an approach to detect money laundering on blockchain by mining its transaction records, named AEtransGAT. First, we use a novel approach called transGAT as an encoder to determine the significance of surrounding transactions by considering the transaction amount values of transaction flows. The original features and the features after graph embedding are combined to address the issue of feature distortion. Second, we deploy the graph autoencoder as the decoder to learn the overall structural information of different transactions, and the concatenated embedding is used to output the classification results as the detector. Finally, we propose our model based on mutual learning in this task which takes the advantages of both transactions classification loss and structure reconstruction loss. We validate the performance of our model on the Elliptic dataset which is the only large open source dataset in Bitcoin anti-money laundering. The results show that our method outperforms current state-of-the-art methods and is linearly scalable.

Dengue as an acute infectious disease threatens global public health and has sparked broad research interest. However, existing studies generally ignore the spatial dependencies involved in dengue forecast, and consideration of temporal periodicity is absent. In this work, we propose a spatiotemporal component fusion model (STCFM) to solve the dengue risk forecast issue. Considering that mosquitoes are an important vector of dengue transmission, we introduce feature factors involving mosquito abundance and spatiotemporal lags to model temporal trends and spatial distributions separately on the basis of statistical properties. Specifically, we conduct multiscale modeling of temporal dependencies to enhance the forecast capability of relevant periods by capturing the historical variation patterns of the data across different segments in the temporal dimension. In the spatial dimension, we quantify the multivariate spatial correlation analysis as additional features to strengthen the spatial feature representation and adopt the ConvLSTM model to learn spatial dependencies adequately. The final forecast results are obtained by stacking strategy fusion in ensemble learning. We conduct experiments on real dengue datasets. The results indicate that STCFM improves prediction accuracy through effective spatiotemporal feature representations and outperforms candidate models with a reasonable component construction strategy.

Bitcoin has emerged as a popular decentralized cryptocurrency and attracted much attention from the public. Bitcoin embodies the Nakamoto consensus to reach an agreement about its blockchain ledger. However, the Nakamoto consensus can suffer from selfish mining attacks. Existing studies on selfish mining usually assume that the total mining power is divided into two parts (i.e., honest and selfish), and ignore propagation delay among miners. The assumptions cannot reflect real-world scenarios, in which multiple miners generate blocks at a fixed interval and propagate them with certain delay. Therefore, it is unknown how the practical factors, i.e., multiple miners and propagation delay, can affect selfish mining. In this paper, we explore the impact of multiple miners and propagation delay on selfish mining. First, we propose a new selfish mining strategy that can handle these factors. Second, we design a simulation approach to analyze the performance of the new selfish mining strategy. From our empirical study we observe many interesting findings that can be utilized in combating selfish mining. For example, the blockchain system with a higher orphan rate is more vulnerable to the selfish mining attack.

共识协议作为区块链的核心技术,近年来已经得到学术界和产业界的广泛重视,并取得了一系列研究成果.当前,关于共识协议的综述研究一般将共识协议作为整体进行比较分析,缺乏对共识协议中主要步骤的解耦与比较.将共识协议分为出块节点选举和主链共识两个主要步骤,并针对每个步骤进行协议间的分析比较.在出块节点选举部分,主要讨论工作量证明和权益证明,分析其中存在的问题以及相应解决方案的分类比较.在主链共识部分,针对概率性共识和确定性共识,总结其安全目标,并进行安全性分析比较.通过对区块链共识协议的系统梳理,最后总结共识协议的发展现状和发展趋势,以及未来的重要研究方向.

The blockchain technology is regarded as a significant trust-building technology and has attracted much attention from the public. The longest chain rule has been widely applied in blockchain systems to reach consensus on the distributed ledger. However, the longest chain rule cannot support a higher transaction throughput due to its lower security. As an alternative solution to the longest chain rule, GHOST is proposed as a safer consensus rule. Existing studies show that the longest chain rule can suffer from selfish mining attacks. However, it is unclear how selfish mining attacks perform on GHOST. In this paper, we explore the performance of selfish mining on GHOST. We first propose the original selfish mining (GHOST-SM) and stubborn mining (GHOST-StuM) for GHOST. We then evaluate these two selfish mining strategies on our blockchain simulation system. The experimental result shows that GHOST achieves better security than the longest chain rule. However, when the block generation rate increases, the security of GHOST is close to the longest chain rule. For example, the threshold for selfish mining attacks of GHOST is increased by 47.55% and 0.60% compared to the longest chain rule corresponding to the block generation interval of 1 second and 15 seconds.

登革热、疟疾等重要虫媒传染病是澜湄次区域频发的热带传染病,对区域社会生产和人民生活构成重大威胁.为了控制区域虫媒病的传播,建没澜湄次区域虫媒传染病联防联控平台,作为响应我国“一带一路”倡议的典型案例,平台利用现代信息技术,增强对虫媒传染病的监测、预测、预警能力,便于相关组织或机构及时制定应对措施.