Skip to content

Research

I work on security and privacy in Ethereum: smart accounts, smart contracts, and zero-knowledge applications. I build analysis tools and protocols, then test how well they hold up against attackers.

So far that has meant screening delegated account code before a user signs (AuthGuard-7702), paying gas for stealth addresses without linking them to their owners (PrivGas), finding bugs in on-chain proof verifiers (ZKScan), and detecting misbehaving vehicles in V2X networks (Secure-BSM).

Publications

Google Scholar

Security & Decentralized Systems

  • 2026

    Pre-Authorization Screening of EIP-7702 Account Delegation in Ethereum Blockchain under an Execution-Audited Adaptive Adversary Accepted

    M M Imran, Anik Tahabilder, Changxin Bai, Qiang Zhu, Shiyong Lu

    8th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS)

    BibTeX 
    @inproceedings{authguard77022026,
  title = {Pre-Authorization Screening of EIP-7702 Account Delegation in Ethereum Blockchain under an Execution-Audited Adaptive Adversary},
  author = {M M Imran and Anik Tahabilder and Changxin Bai and Qiang Zhu and Shiyong Lu},
  booktitle = {8th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS)},
  year = {2026},
  note = {Accepted},
}
    Architecture diagram: runtime bytecode is disassembled and split into 256-token opcode chunks; a shared chunk encoder and learned chunk attention build a contract representation; a risk prediction head outputs a logit that is temperature-scaled and mapped to High, Warning, Caution, or No Warning tiers using validation-derived thresholds. Enlarge figure
    Fig. 2. AuthGuard-Seq architecture and validation-fitted post-processing.

    Fig. 2. AuthGuard-Seq architecture and validation-fitted post-processing.

    Architecture diagram: runtime bytecode is disassembled and split into 256-token opcode chunks; a shared chunk encoder and learned chunk attention build a contract representation; a risk prediction head outputs a logit that is temperature-scaled and mapped to High, Warning, Caution, or No Warning tiers using validation-derived thresholds.

  • 2026

    PrivGas: A Privacy-Preserving Gas Sponsorship Protocol for Blockchain Stealth Addresses Accepted

    M M Imran, Anik Tahabilder, Changxin Bai, Qiang Zhu, Shiyong Lu

    Presented at the conference

    IEEE 4th International Conference on Artificial Intelligence, Blockchain and Internet of Things (AIBThings)

    BibTeX 
    @inproceedings{privgasstealthaddressgassponsorship2026,
  title = {PrivGas: A Privacy-Preserving Gas Sponsorship Protocol for Blockchain Stealth Addresses},
  author = {M M Imran and Anik Tahabilder and Changxin Bai and Qiang Zhu and Shiyong Lu},
  booktitle = {IEEE 4th International Conference on Artificial Intelligence, Blockchain and Internet of Things (AIBThings)},
  year = {2026},
  note = {Accepted},
}
    Three-stage protocol diagram: in Fund, a sender pays a non-refundable fee through an announcement registry; in Bootstrap, a paymaster deposits a credit into a shielded credit pool; in Spend, the stealth account redeems the credit with a zero-knowledge proof through the ERC-4337 EntryPoint and its nullifier is marked spent. Enlarge figure
    Fig. 1. PrivGas architecture and three-stage protocol flow.

    Fig. 1. PrivGas architecture and three-stage protocol flow.

    Three-stage protocol diagram: in Fund, a sender pays a non-refundable fee through an announcement registry; in Bootstrap, a paymaster deposits a credit into a shielded credit pool; in Spend, the stealth account redeems the credit with a zero-knowledge proof through the ERC-4337 EntryPoint and its nullifier is marked spent.

  • 2026

    ZKScan: A Static Analyzer for Smart Contract Based Zero-Knowledge Proof Verifiers on Blockchains Accepted

    Anik Tahabilder, M M Imran, Changxin Bai, Qiang Zhu, Shiyong Lu

    IEEE 4th International Conference on Artificial Intelligence, Blockchain and Internet of Things (AIBThings)

    BibTeX 
    @inproceedings{zkscan2026,
  title = {ZKScan: A Static Analyzer for Smart Contract Based Zero-Knowledge Proof Verifiers on Blockchains},
  author = {Anik Tahabilder and M M Imran and Changxin Bai and Qiang Zhu and Shiyong Lu},
  booktitle = {IEEE 4th International Conference on Artificial Intelligence, Blockchain and Internet of Things (AIBThings)},
  year = {2026},
  note = {Accepted},
}
    Pipeline diagram: Solidity and Yul source is parsed, constants are resolved, and a VerifierIR is built; IR-level, dataflow, and source-level detectors run in parallel and their results are deduplicated and filtered into findings. Enlarge figure
    Fig. 2. ZKScan multi-stage analysis pipeline and detector routing.

    Fig. 2. ZKScan multi-stage analysis pipeline and detector routing.

    Pipeline diagram: Solidity and Yul source is parsed, constants are resolved, and a VerifierIR is built; IR-level, dataflow, and source-level detectors run in parallel and their results are deduplicated and filtered into findings.

  • 2026

    Secure-BSM: Blockchain-Assisted Collaborative Misbehavior Detection in Vehicular Networks

    M M Imran, Yi Zhu, Shiyong Lu

    2026 IEEE 4th International Conference on Mobility, Operations, Services and Technologies (MOST), pp. 160–171

    BibTeX 
    @inproceedings{securebsmblockchainmisbehaviordetection2026,
  title = {Secure-BSM: Blockchain-Assisted Collaborative Misbehavior Detection in Vehicular Networks},
  author = {M M Imran and Yi Zhu and Shiyong Lu},
  booktitle = {2026 IEEE 4th International Conference on Mobility, Operations, Services and Technologies (MOST)},
  year = {2026},
  pages = {160--171},
  doi = {10.1109/MOST69733.2026.00026},
}
    Vehicles in two road zones form Pocket Ledgers that reach consensus on misbehavior reports, such as against an attacker vehicle, and synchronize with a global Root Ledger holding the vehicle registry, rate-limit token manager, and reputation vault. Enlarge figure
    Fig. 1. Three-layer architecture of Secure-BSM.

    Fig. 1. Three-layer architecture of Secure-BSM.

    Vehicles in two road zones form Pocket Ledgers that reach consensus on misbehavior reports, such as against an attacker vehicle, and synchronize with a global Root Ledger holding the vehicle registry, rate-limit token manager, and reputation vault.

Earlier Publications

Collaborative work in scientific workflows, applied machine learning, and embedded and networked systems.

Contact

If you'd like to talk about a research collaboration, a faculty position, or an industry research role in blockchain security, email me.

mmimran@wayne.edu