Yoshi Sato

Modern software security increasingly relies on bug bounty pro- grams, which incentivize independent researchers to discover and responsibly disclose vulnerabilities. While effective in traditional software ecosystems, these programs face unique challenges in the context of smart contracts. Smart contracts run on blockchains, manage financial assets, and are typically authored by pseudony- mous developers. As a result, when vulnerabilities are discovered, security researchers often lack a secure and reliable channel for disclosure. Existing workarounds, such as encrypting messages to contract authors' public keys, introduce inefficiencies and privacy risks, since ciphertexts themselves may reveal the presence of bugs. We propose DeadDrop, the first system to support oblivious bug reporting for smart contracts. DeadDrop combines oblivious message retrieval (OMR) with a trusted execution environment (TEE) to enable researchers to privately and efficiently deliver vul- nerability reports without revealing their intended recipient or overwhelming authors with spam. Our design specifies security requirements for such a system, presents practical techniques for handling long messages, and introduces a bug specification lan- guage to formalize submissions. We implement a prototype and evaluate its performance, demonstrating that oblivious bug report- ing is both feasible and efficient, achieving an amortized processing time of approximately 3 ms per submission. Finally, we discuss in- centive mechanisms to encourage participation, highlighting open challenges for decentralized bug bounty ecosystems.

Confidential Virtual Machines (CVMs) like Intel TDX and AMD SEV-SNP provide hardware-based isolation for cloud workloads. While SEV-SNP supports GPU passthrough for legacy (non-CC capable) accelerators, Intel TDX currently lacks this capability. This work-in-progress analyzes the performance implications of enabling such functionality across both platforms. We identify fundamental architectural differences: SEV-SNP’s guest-controlled page encryption enables near-native performance, while TDX’s hypervisor-mediated design requires mandatory VMEXITs and may impose significantly higher costs. Our CUDA microbenchmarks establish baseline metrics showing pageable transfers achieve 50-75% throughput of pinned DMA on Intel Xeon systems. We present the technical requirements for TDX GPU passthrough and analyze why Intel’s stricter security model complicates performance. This work provides developers with critical performance expectations when choosing between CVM platforms for GPU workloads, highlighting the trade-offs between security architectures and practical performance.

Serverless computing offers elasticity and cost efficiency, while confidential VMs (CVMs) provide strong hardware-backed isolation. Combining the two promises privacy-preserving serverless platforms, but faces a fundamental challenge: CVMs incur high startup costs that break the performance model of serverless. We present SC2, a prototype serverless platform built with Knative, Kubernetes, and Confidential Containers. SC2 introduces a cache layer that enables efficient warmup and reuse of CVMs, mitigating cold-start latency while preserving confidentiality guarantees. Our early results demonstrate that caching can make confidential serverless practical, opening a path toward scalable privacy-preserving cloud services.

The landscape of Trusted Execution Environments (TEEs) is shifting rapidly from application-layer enclaves (Intel SGX) to VM-based confidential computing (Intel TDX, AMD SEV-SNP, ARM Realms). This shift enables "Confidential Containers," but introduces new attack surfaces and architectural complexities that are not well-systematized in current literature. This project aims to provide a Systematization of Knowledge (SoK) analyzing the security guarantees, performance overheads, and trust models of emerging confidential container frameworks.