Search

We report the recent discovery of two new eruptions of the recurrent nova M31N 2017-01e in the Andromeda galaxy. The latest eruption, M31N 2024-08c, reached $R=17.8$ on 2024 August 06.85 UT, $\sim2$ months earlier than predicted. In addition to this recent eruption, a search of archival PTF data has revealed a previously unreported eruption on 2014 June 18.46 UT that reached a peak brightness of $R\sim17.9$ approximately a day later. The addition of these two eruption timings has allowed us to update the mean recurrence time of the nova. We find $\langle T_\mathrm{rec} \rangle = 924.0\pm7.0$ days ($2.53\pm0.02$ yr), which is slightly shorter than our previous determination. Thus, M31N 2017-01e remains the nova with the second shortest recurrence time known, with only M31N 2008-12a being shorter. We also present a low-resolution spectrum of the likely quiescent counterpart of the nova, a $\sim20.5$ mag evolved B star displaying an $\sim14.3$ d photometric modulation., Comment: 6 pages; 1 multi-panel figure; 1 table; expanded references; accepted for publication in the Research Notes of the AAS

Smart contracts are susceptible to being exploited by attackers, especially when facing real-world vulnerabilities. To mitigate this risk, developers often rely on third-party audit services to identify potential vulnerabilities before project deployment. Nevertheless, repairing the identified vulnerabilities is still complex and labor-intensive, particularly for developers lacking security expertise. Moreover, existing pattern-based repair tools mostly fail to address real-world vulnerabilities due to their lack of high-level semantic understanding. To fill this gap, we propose ContractTinker, a Large Language Models (LLMs)-empowered tool for real-world vulnerability repair. The key insight is our adoption of the Chain-of-Thought approach to break down the entire generation task into sub-tasks. Additionally, to reduce hallucination, we integrate program static analysis to guide the LLM. We evaluate ContractTinker on 48 high-risk vulnerabilities. The experimental results show that among the patches generated by ContractTinker, 23 (48%) are valid patches that fix the vulnerabilities, while 10 (21%) require only minor modifications. A video of ContractTinker is available at https://youtu.be/HWFVi-YHcPE., Comment: 4 pages, and to be accepted in ASE2024

Ethereum has officially provided a set of system-level cryptographic APIs to enhance smart contracts with cryptographic capabilities. These APIs have been utilized in over 10% of Ethereum transactions, motivating developers to implement various on-chain cryptographic tasks, such as digital signatures. However, since developers may not always be cryptographic experts, their ad-hoc and potentially defective implementations could compromise the theoretical guarantees of cryptography, leading to real-world security issues. To mitigate this threat, we conducted the first study aimed at demystifying and detecting cryptographic defects in smart contracts. Through the analysis of 2,406 real-world security reports, we defined nine types of cryptographic defects in smart contracts with detailed descriptions and practical detection patterns. Based on this categorization, we proposed CrySol, a fuzzing-based tool to automate the detection of cryptographic defects in smart contracts. It combines transaction replaying and dynamic taint analysis to extract fine-grained crypto-related semantics and employs crypto-specific strategies to guide the test case generation process. Furthermore, we collected a large-scale dataset containing 25,745 real-world crypto-related smart contracts and evaluated CrySol's effectiveness on it. The result demonstrated that CrySol achieves an overall precision of 95.4% and a recall of 91.2%. Notably, CrySol revealed that 5,847 (22.7%) out of 25,745 smart contracts contain at least one cryptographic defect, highlighting the prevalence of these defects.

To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions., Comment: To appear at ICSE'24

A full understanding of how unusually large "Ultra Diffuse Galaxies" (UDGs) fit into our conventional understanding of dwarf galaxies remains elusive, despite the large number of objects identified locally. A natural extension of UDG research is the study of similar galaxies at higher redshift to establish how their properties may evolve over time. However, this has been a challenging task given how severely systematic effects and cosmological surface brightness dimming inhibit our ability to study low-surface brightness galaxies at high-$z$. Here, we present an identification of low stellar surface density galaxies (LDGs), likely the progenitors of local UDGs, at moderate redshift with deep near-IR observations of the El Gordo cluster at $z = 0.87$ with JWST. By stacking 8 NIRCAM filters, we are able to achieve an apparent surface brightness sensitivity of $24.59$ mag arcsec$^{-2}$, faint enough to be complete to the bright end of the LDG population. Our analysis identifies significant differences between this population and local UDGs, such as their color and size distributions, which suggest that UDG progenitors are bluer and more extended at high-$z$ than at $z = 0$. This suggests that multiple mechanisms are responsible for UDG formation and that prolonged transformation of cluster dwarfs is not a primary UDG formation mechanism at high-$z$. Furthermore, we find a slight overabundance of LDGs in El Gordo, and, in contrast to findings in local clusters, our analysis does not show a deficit of LDGs in the center of El Gordo, implying that tidal destruction of LDGs is significant between $z = 0.87$ and $z = 0$., Comment: Accepted to ApJ

We give an overview and describe the rationale, methods, and first results from NIRCam images of the JWST "Prime Extragalactic Areas for Reionization and Lensing Science" ("PEARLS") project. PEARLS uses up to eight NIRCam filters to survey several prime extragalactic survey areas: two fields at the North Ecliptic Pole (NEP); seven gravitationally lensing clusters; two high redshift proto-clusters; and the iconic backlit VV 191 galaxy system to map its dust attenuation. PEARLS also includes NIRISS spectra for one of the NEP fields and NIRSpec spectra of two high-redshift quasars. The main goal of PEARLS is to study the epoch of galaxy assembly, AGN growth, and First Light. Five fields, the JWST NEP Time-Domain Field (TDF), IRAC Dark Field (IDF), and three lensing clusters, will be observed in up to four epochs over a year. The cadence and sensitivity of the imaging data are ideally suited to find faint variable objects such as weak AGN, high-redshift supernovae, and cluster caustic transits. Both NEP fields have sightlines through our Galaxy, providing significant numbers of very faint brown dwarfs whose proper motions can be studied. Observations from the first spoke in the NEP TDF are public. This paper presents our first PEARLS observations, their NIRCam data reduction and analysis, our first object catalogs, the 0.9-4.5 $\mu$m galaxy counts and Integrated Galaxy Light. We assess the JWST sky brightness in 13 NIRCam filters, yielding our first constraints to diffuse light at 0.9-4.5 {\mu}m. PEARLS is designed to be of lasting benefit to the community., Comment: Accepted to AJ, comments welcome. We ask anyone who uses our public PEARLS (NEP TDF) data to refer to this overview paper

Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY., Comment: To appear at the Tool Demonstration Track of ASE'22. Please cite the conference version

With the rapid development of blockchain technology, different types of blockchains are adopted and interoperability across blockchains has received widespread attention. There have been many cross-chain solutions proposed in recent years, including notary scheme, sidechain, and relay chain. However, most of the existing platforms do not take confidentiality into account, although privacy has become an important concern for blockchain. In this paper, we present TrustCross, a privacy-preserving cross-chain platform to enable confidential interoperability across blockchains. The key insight behind TrustCross is to encrypt cross-chain communication data on the relay chain with the assistance of trusted execution environment and employ fine-grained access control to protect user privacy. Our experimental results show that TrustCross achieves reasonable latency and high scalability on the contract calls across heterogeneous blockchains.

With the rapid development of blockchain, Byzantine fault-tolerant protocols have attracted revived interest recently. To overcome the theoretical bounds of Byzantine fault tolerance, many protocols attempt to use Trusted Execution Environment (TEE) to prevent equivocation and improve performance and scalability. However, due to the broken quorum intersection assumption caused by the reduction of the replica number, the improvement is mostly at the cost of increased communication complexity which prevents existing TEE-based protocols to be applied to large-scale blockchain systems. In this paper, we propose TBFT, an efficient Byzantine fault-tolerant protocol in the partial synchrony setting, which has O(n) message complexity in both normal-case and view-change. Compared to previous protocols, TBFT uses TEE-assisted primitives to limit more types of malicious behaviors of replicas rather than preventing equivocation only, thereby reducing the latency and communication complexity of clients and replicas. Besides, we also introduce lightweight cryptographic primitives including a novel leader election mechanism and an efficient voting message aggregation mechanism for better security and performance. We evaluate TBFT via systematic analysis and experiments, and the results show that TBFT has better performance and scalability compared to other protocols.

In recent years, many decentralized applications based on blockchain (DApp) have been developed. However, due to inadequate testing, DApps are easily exposed to serious vulnerabilities. We find three main challenges for DApp testing, i.e., the inherent complexity of DApp, inconvenient pre-state setting, and not-so-readable logs. In this paper, we propose a testing framework named Kaya to bridge these gaps. Kaya has three main functions. Firstly, Kaya proposes DApp behavior description language (DBDL) to make writing test cases easier. Test cases written in DBDL can also be automatically executed by Kaya. Secondly, Kaya supports a flexible and convenient way for test engineers to set the blockchain pre-states easily. Thirdly, Kaya transforms incomprehensible addresses into readable variables for easy comprehension. With these functions, Kaya can help test engineers test DApps more easily. Besides, to fit the various application environments, we provide two ways for test engineers to use Kaya, i.e., UI and command-line. Our experimental case demonstrates the potential of Kaya in helping test engineers to test DApps more easily.

Since Bitcoin was first introduced in 2008, many types of cryptocurrencies have been proposed based on blockchain. However, the performance of permissionless blockchains restricts the widespread of cryptocurrency. Recently, Libra was proposed by Facebook based on a permissioned blockchain, i.e. the Libra blockchain. The vision of Libra is to become a global currency supporting financial applications, but it is doubted whether the performance of the Libra blockchain is able to support frequent micropayment scenarios. In this paper, we propose a methodology to evaluate the performance of blockchain platforms and conducted an experimental study on the Libra blockchain. The results show that the Libra blockchain can only process about one thousand transactions per second at most, and the performance drops significantly as the number of validators increases. Although it outperforms permissionless blockchain platforms, the performance of the Libra blockchain is still unsatisfactory compared to other permissioned blockchains like Hyperledger Fabric and needs to make effective improvements in order to support global micropayment in the future.