Christoph Sendner, Lukas Petzi, Jasper Stang, Alexandra Dmitrienko
Ethereum smart contracts, which are autonomous decentralized applications on the blockchain that manage assets often exceeding millions of dollars, have become primary targets for cyberattacks. In 2023 alone, such vulnerabilities led to substantial financial losses exceeding a billion of US dollars. To counter these threats, various tools have been developed by academic and commercial entities to detect and mitigate vulnerabilities in smart contracts. Our study investigates the gap between the effectiveness of existing security scanners and the vulnerabilities that still persist in practice. We compiled four distinct datasets for this analysis. The first dataset comprises 77,219 source codes extracted directly from the blockchain, while the second includes over 4 million bytecodes obtained from Ethereum Mainnet and testnets. The other two datasets consist of nearly 14,000 manually annotated smart contracts and 373 smart contracts verified through audits, providing a foundation for a rigorous ground truth analysis on bytecode and source code. Using the unlabeled datasets, we conducted a comprehensive quantitative evaluation of 17 vulnerability scanners, revealing considerable discrepancies in their findings. Our analysis of the ground truth datasets indicated poor performance across all the tools we tested. This study unveils the reasons for poor performance and underscores that the current state of the art for smart contract security falls short in effectively addressing open problems, highlighting that the challenge of effectively detecting vulnerabilities remains a significant and unresolved issue.
Ethereum is a rapidly evolving blockchain with new features as well as new vulnerabilities being introduced regularly. Interaction with the network is costly compared to other blockchains or traditional software systems. When starting to develop on Ethereum, a supported smart contract programming language needs to be learned, most notably Solidity. Having various pitfalls raises the question of what the best practices for the safe and efficient usage of Ethereum are. This study primarily aims to combine knowledge from existing research resources, while also introducing new approaches learned from practical smart contract development analysis and inquiry, which are subsequently compiled into lists of best practices. The most important findings are that code quality and security should be prioritized. Moreover, some simple gas-saving strategies can help to decrease interaction costs with little effort.
Ahmed Bouteska, Mohammad Zoynul Abedin, Petr Hájek, Kunpeng Yuan
Cryptocurrency price forecasting is attracting considerable interest due to its crucial decision support role in investment strategies. Large fluctuations in non-stationary cryptocurrency prices motivate the urgent need for accurate forecasting models. The lack of seasonal effects and the need to meet a number of unrealistic requirements make it difficult to make accurate forecasts using traditional statistical methods, leaving machine learning, particularly ensemble and deep learning, as the best technology in the area of cryptocurrency price forecasting. This is the first work to provide a comprehensive comparative analysis of ensemble learning and deep learning forecasting models, examining their relative performance on various cryptocurrencies (Bitcoin, Ethereum, Ripple, and Litecoin) and exploring their potential trading applications. The results of this study reveal that gated recurrent unit, simple recurrent neural network, and LightGBM methods outperform other machine learning methods, as well as the naive buy-and-hold and random walk strategies. This can effectively guide investors in the cryptocurrency markets.
Federated learning (FL) has emerged as an alternative to traditional machine learning in scenarios where training data is sensitive. In federated learning, training is held at end devices, and thus data does not need to leave users devices. However, most approaches to federated learning rely on a central server to coordinate the learning process which, in turn, introduces its own security and privacy problems. We propose Federify, a decentralized federated learning framework based on blockchain which employs homomorphic encryption and zero knowledge proofs to provide security, privacy, and transparency. The scheme preserves the confidentiality of both the data used for training and the local models using homomorphic encryption. zkSNARKs are used to provide security by verifying the contributions from the different agents, and transparency of both the learning process and the incentive mechanism is achieved by delegating coordination into a smart contract in a public blockchain. We have also implemented, deployed, and evaluated a proof of concept of our framework, to demonstrate its viability both in terms of computational resources needed and cost to train in a public generic blockchain such as Ethereum.
The emergence of blockchain technology has paved the way for innovative solutions in various domains, particularly in enhancing democratic processes. This research paper presents the design, development, and evaluation of a Web3 blockchain decentralized voting application (DAPP) built using React JS for frontend development and Solidity for smart contract implementation. The objective of this study is to explore the feasibility and effectiveness of employing blockchain technology to create a secure, transparent, and decentralized voting system. The proposed DAPP leverages the immutability and transparency features of blockchain technology to ensure the integrity of the voting process. Smart contracts coded in Solidity are utilized to execute the voting mechanism, ensuring tamper-proof recording and tallying of votes. React JS, a popular JavaScript library for building user interfaces, is employed to develop an intuitive and user-friendly frontend interface, enhancing accessibility and usability for voters. Key aspects addressed in this research include the architecture of the DAPP, the design of smart contracts for voting logic, integration of React JS components for frontend development, and security considerations to prevent vulnerabilities and attacks. Additionally, the paper discusses the implications of decentralized voting systems on democracy, including increased trust, transparency, and participation.
Zaman Nihat, Işıl Karabey Aksakalli, Nursena Bayğın
With the rise of digitalization and increased internet usage, digital certificates' security issues have gained significant importance. The utilization of counterfeit certificates can lead to deceptive identity and capability verifications, allowing untrustworthy individuals to assume misleading positions. Simultaneously, factors such as data leaks and technical glitches can jeopardize the security of certificates. These challenges can complicate talent verification processes and result in unsuitable individuals being placed in incorrect roles. The proposed work aims to thwart forged certificates and ensure their verifiability within this context. The methodology employed in the study strives to mitigate potential data loss or accessibility problems by adopting a decentralized storage structure. The primary objective is to establish certificates that are reliable, traceable, and capable of being verified. A rapid and efficient user interface was developed using React.js to achieve this aim. Smart contracts were scripted on the Ethereum blockchain using Solidity, and data, including user information and certificate details, were stored within components like MongoDB. In the phase of practical implementation, diverse scenarios have been designed to facilitate the generation, verification, and monitoring of certificates. The proposed approach is geared towards deterring forgery and enhancing the credibility of certificates. Through this system, users and organizations can authenticate certificates and prevent the proliferation of counterfeit ones. Furthermore, the enhanced security and ease of sharing certificates on digital platforms offer substantial advantages to certificate holders. In summary, this study strives to enhance the safeguarding and dependability of certificates by addressing the security concerns posed by the era of digitalization.
Open access
Blockchain Technology Applications and Security
IoT and Edge/Fog Computing
Advanced Steganography and Watermarking Techniques
Using the Bollinger Bands trading strategy (BBTS), investors are advised to buy (and then sell) Bitcoin and Ethereum spot prices in response to BBTS’s oversold (overbought) signals. As a result of analyzing whether investors would profit from round-turn trading of these two spot prices, this study may reveal the following remarkable outcomes and investment strategies. This study first demonstrated that using our novel design with a heatmap matrix would result in multiple higher returns, all of which were greater than the highest return using the conventional design. We contend that such an impressive finding could be the result of big data analytics and the adaptability of BBTS in our new design. Second, because cryptocurrency spot prices are relatively volatile, such indices may experience a significant rebound from oversold to overbought BBTS signals, resulting in the potential for much higher returns. Third, if history repeats itself, our findings might enhance the profitability of trading these two spots. As such, this study extracts the diverse trading performance of multiple BB trading rules, uses big data analytics to observe and evaluate many outcomes via heatmap visualization, and applies such knowledge to investment practice, which may contribute to the literature. Consequently, this study may cast light on the significance of decision-making through the utilization of big data analytics and heatmap visualization.
Fei Wu, Thomas Thiery, Stefanos Leonardos, Carmine Ventre
The Ethereum block-building process has changed significantly since the emergence of Proposer-Builder Separation. Validators access blocks through a marketplace, where block builders bid for the right to construct the block and earn MEV (Maximal Extractable Value) rewards in an on-chain competition, known as the MEV-boost auction. While more than 90% of blocks are currently built via MEV-Boost, trade-offs between builders' strategic behaviors and auction design remain poorly understood. In this paper we address this gap. We introduce a game-theoretic model for MEV-Boost auctions and use simulations to study different builders' bidding strategies observed in practice. We study various strategic interactions and auction setups and evaluate how the interplay between critical elements such as access to MEV opportunities and improved connectivity to relays impact bidding performance. Our results demonstrate the importance of latency on the effectiveness of builders' strategies and the overall auction outcome from the proposer's perspective.
Статья посвящена возможности внедрения в образовательную среду блокчейн-технологии посредством смарт-контрактов. Для достижения данной цели перед авторами были поставлены следующие задачи: исследовать блокчейн-технологии на предмет применимости в образовательной среде; обосновать необходимость применения смарт-контрактов в учебном процессе; разработать алгоритм внедрения смарт-контрактов для хранения учебной информации и использования ее для дальнейшего анализа. Проведенный анализ образовательной среды подтолкнул авторов к предложению использовать блокчейн как инструмент управления учебным процессом. Для разработки смарт-контрактов выбрана платформа Ethereum. Программный код смарт-контракта был скомпилирован в компиляторе Remix. Также авторы провели сравнительный анализ норм национального законодательства и юридического понимания термина «смарт-контракт».
Ethereum is undergoing significant changes to its architecture as it evolves. These changes include its switch to PoS consensus and the introduction of significant infrastructural changes that do not require a change to the core protocol, but that fundamentally affect the way users interact with the network. These changes represent an evolution toward a more modular architecture, in which there exists new exogenous vectors for centralization. This paper builds on previous studies of decentralization of Ethereum to reflect these recent significant changes, and Ethereum's new modular paradigm.
Rafael Belchior, Dimo Dimov, Zahary Karadjov, Jonas Pfannschmidt · 6 authors
The field of blockchain interoperability plays a pivotal role in blockchain adoption. Despite these advances, a notorious problem persists: the high number and success rate of attacks on blockchain bridges. We propose Harmonia, a framework for building robust, secure, efficient, and decentralized cross-chain applications. A main component of Harmonia is DendrETH, a decentralized and efficient zero-knowledge proof-based light client. DendrETH mitigates security problems by lowering the attack surface by relying on the properties of zero-knowledge proofs. The DendrETH instance of this paper is an improvement of Ethereum’s light client sync protocol that fixes critical security flaws. This light client protocol is implemented as a smart contract, allowing blockchains to read the state of the source blockchain in a trust-minimized way. Harmonia and DendrETH support several cross-chain use cases, such as secure cross-blockchain bridges (asset transfers) and smart contract migrations (data transfers), without a trusted operator. We implemented Harmonia in 9K lines of code. Our implementation is compatible with the Ethereum Virtual Machine (EVM) based chains and some non-EVM chains. Our experimental evaluation shows that Harmonia can generate light client updates with reasonable latency, costs (a dozen to a few thousand US dollars per year), and minimal storage requirements (around 4.5 MB per year). We also carried out experiments to evaluate the security of DendrETH. We provide an open-source implementation and reproducible environment for researchers and practitioners to replicate our results.
Automated Market Maker (AMM)-based Decentralized Exchanges (DEXs) are crucial in Decentralized Finance (DeFi), but Ethereum implementations suffer from high transaction costs and price synchronization challenges. To address these limitations, we compare the XRP Ledger (XRPL)-AMM-Decentralized Exchange (DEX), a protocol-level implementation, against a Generic AMM-based DEX (G-AMM-DEX) on Ethereum, akin to Uniswap's V2 AMM implementation, through agent-based simulations using real market data and multiple volatility scenarios generated via Geometric Brownian Motion (GBM). Results demonstrate that the XRPL-AMM-DEX achieves superior price synchronization, reduced slippage, and improved returns due to XRPL's lower fees and shorter block times, with benefits amplifying during market volatility. The integrated Continuous Auction Mechanism (CAM) further mitigates impermanent loss by redistributing arbitrage value to Liquidity Providers (LPs). To the best of our knowledge, this study represents the first comparative analysis between protocol-level and smart contract AMM-based DEX implementations and the first agent-based simulation validating theoretical auction mechanisms for AMM-based DEXs.
Sergey Khvan, Refik Çağlar Kızılırmak, Mehdi Shafiee
The integration of blockchain and IoT presents tremendous potential for unlocking new opportunities and capabilities. With additive decentralized features, businesses and individuals can benefit from increased security, transparency, and efficiency in various applications. This chapter first presents the technical aspects of this integration, including the role of smart contracts in decentralized IoT systems and how blockchain enhances the security, stability, and transparency of IoT networks. Then, a step-by-step tutorial for developing smart contracts and ledger on Ethereum blockchain is presented, particularly from the perspective of IoT nodes. The considered scenario is for an IoT device that writes/retrieves data from the blockchain; however, the presented methodology can easily be extended for different use cases.
The purpose of this study is to examine the market efficiency of cryptocurrencies, specifically at a weak level. The study focuses on six prominent cryptocurrencies selected based on their significant market capitalization: Bitcoin (BTC), Tether (USDT), Ethereum (ETH), Binance Coin (BNB-USD), Ripple (XRP-USD), and Cardano USD (ADA-USD). The analysis utilizes unit root, Ljung–Box, variance ratio, runs, and the Brock–Dechert–Scheinkman (BDS) tests to assess different aspects of market efficiency. The data spans from September 2017 to April 2023, encompassing a wide time frame to capture potential shifts in market behavior. The results of all the tests, except the BDS test, indicate that the tested cryptocurrencies' markets are inefficient. However, the BDS test yielded different results, suggesting that BTC and ETH exhibit market efficiency compared to the other cryptocurrencies. This discrepancy indicates that the BDS test may be capturing different aspects of the time series behavior. The practical implication is that investors and market participants should exercise caution and consider the varying levels of efficiency when making decisions regarding these cryptocurrencies. Also, investors should consider a range of factors, including technical and fundamental analyses, when making investment decisions in a dynamic and evolving market.
Stephen Kirkman, Steven Fulton, Jeffrey Hemmes, Christopher Garcia · 5 authors
The motivation of this research (and also one of the nation’s cyber goals) is enhancing the resilience of Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) systems against ransomware attacks. ICS and SCADA systems run some of the most important networks in the country: our critical infrastructure (i.e., water flow, power grids, etc.). Disruption of these systems causes confusion, panic, and in some cases loss of life. We propose a SCADA architecture that uses blockchain to help protect ICS data from ransomware. We focus on the historian. In a SCADA system, the historian collects events from devices in the control network for real-time and future analysis. We choose to use Ethereum and its Proof of Stake (PoS) consensus protocol. The other goal of this research focuses on the resilience of blockchain. There is very little research in protecting the blockchain itself. By performing encryption testing on an Ethereum private network, we explore how vulnerable blockchain is and discuss potential ways to make a blockchain client more resilient.
Chibuzo Obi-Okoli, Olamide Jogunola, Bamidele Adebisi, Mohammad Ali A. Hammoudeh
The rapid growth and psudonomity inherent in blockchain technology such as in Bitcoin and Ethereum has marred its original intent to reduce dependant on centralised system, but created an avenue for illicit activities, including fraud, phishing, scams, etc. This undermines the reputation of blockchain network, giving rise to the need to identify these illicit activities within the blockchain network. This current work tackles this crucial problem by investigating and implementing six machine learning algorithms with a particular emphasis on striking a balance between accuracy, precision and recall. The novelty of the work lies in the utilising of the synthetic minority over-sampling technique to handle data imbalance. Thus, increasing the accuracy of the light gradient boosting machine classifier to 98.4%. The outcome of this work holds great potential for enhancing the security and credibility of blockchain ecosystems paving the way for a more secure and dependable digital future in the age of decentralised and trustless systems.
Abstract Pay-for-outcome financing mechanisms have been used to address agricultural runoffs to overcome the inefficiencies associated with push-based solutions, which are dependent on subsidies or philanthropic funding. As a market-based approach, pay-for-outcome platforms seek to incentivize sustainable practices, compensated by beneficiaries of the positive outcomes. Execution of pay-for-outcome financing mechanisms in an agriculture context is a complex transaction, involving investors, farmers, third party verifiers of outcomes, government and corporate beneficiaries, and thus requires a costly governance structure. Effective governance mechanisms are needed to meet the transaction costs identified in performance measurements. This study investigates the efficacy of blockchain technology to address transaction costs in pay-for-outcome financing for sustainable agriculture. Through a proof-of-concept, this study quantifies and explores the potential cost-saving benefits of utilizing blockchain. The proof-of-concept is an application of blockchain within a pay-for-outcome incentive model, namely the Soil and Water Outcomes Fund, for sustainable agriculture. Utilizing the Ethereum blockchain, transactions are facilitated through crypto wallets and a hybrid smart contract, while precipitation is used as a proxy for agricultural runoff measurements. Drawing from Transaction Cost Economics theory, a discussion is presented on how blockchains can reduce transaction costs, enhancing the governance and efficiency of pay-for-outcome mechanisms. Furthermore, the article presents blockchain transaction fees in the context of the scale of operations, considering the total number of participants in the Soil and Water Outcomes Fund. Our findings indicate that blockchain technology has the capacity to simplify intricate transactions, boost measurement accuracy, cut administrative expenses, and foster trust and transparency among stakeholders, thereby reducing the overall transaction costs associated with pay-for-outcome incentives. While blockchain has its limitations and is not a universally applicable solution for every type of transaction cost, we believe that blockchains are well-suited to facilitate pay-for-outcome financing such as the Soil and Water Outcomes Fund.
Ethereum has emerged as a leading platform for decentralized applications (dApps) due to its robust smart contract capabilities. One of the critical issues in the Ethereum ecosystem is Maximal Extractable Value (MEV), a concept that has gained significant attention in the blockchain community. However, MEV has remained a major challenge with significant implications for the platform's operation and integrity. This paper introduces the FairFlow protocol, a novel framework designed to mitigate the effects of MEV within Ethereum's existing infrastructure. The protocol aims to provide a more equitable environment, preventing exploitation by miners or validators, and protecting user data. The combined approach of auction-based block space allocation and randomized transaction ordering significantly reduces the potential for MEV exploitation.
Sarah A. Flanery, Kamalesh Mohanasundar, Christiana Chamon, Srujan Kotikela · 5 authors
With the natural evolution of the web, the need for decentralization has rendered the current centralized education system out of date. The student does not "own" their credentials, as the only way their accomplishments are directly linked to their person and considered valuable is by verification through a stamp of an expensive, prestigious institution. However, going to a university is no longer the only way to acquire an education; open-source learning material is widely available and accessible through the internet. However, our society does not deem these methods of education as verifiable if they do not include a degree or certificate. Additionally, a valid certificate for the vast majority of open-source courses costs a few hundred dollars to obtain. The centralized nature of education inadvertently places students in underprivileged communities at a disadvantage in comparison to students in economically advantaged communities, thus a decentralized approach to education would eliminate the vast majority of such discrepancies. In the present paper, we integrate Decentralized Identity (DID) with Web 3.0 to upload credentials linked directly to the user. Each credential is appended to an Ethereum blockchain that, by design, cannot be altered once uploaded. We include DID document based access controls to display the candidate's upload and verification history. Finally, we utilize TLS protocols to provide a secure connection to the internet for ensuring non-fungibility of credentials and authentication of users.
Protecting the privacy of blockchain transactions is extremely important for users. Stealth address protocols (SAP) allow users to receive assets via stealth addresses that they do not associate with their stealth meta-addresses. SAP can be generated using different cryptographic approaches. DKSAP uses an elliptic curve multiplication and hashing of the resulting shared secret. Another approach is to use a elliptic curve pairing. This paper presents four SA protocols that use elliptic curve pairing as a cryptographic solution. ECPDKSAPs are pairing-based protocols that include viewing key and spending key, while ECPSKSAP is a pairing-based protocol that uses a single key with which spending and the viewing key are derived. We find that ECPDKSAPs give significantly better results than DKSAP with the view tag. The best results are achieved with Protocol 3 (Elliptic Curve Pairing Dual Key Stealth Address Protocol), which is Ethereum-friendly. ECPSKSAP is significantly slower, but it provides an interesting theoretical result as it uses only one private key.
The e-book services we use today have a serious drawback in that we will no longer be able to read the books we have purchased when the service is terminated. One way to solve this problem is to build a decentralized system that does not depend on a specific company or organization by combining smart contracts running on the Ethereum blockchain and distributed storage such as an IPFS. However, a simple combination of existing technologies does not make the stored e-book data persistent, so the risk of purchased e-books becoming unreadable remains. In this paper, we propose a decentralized distributed storage called d-book-repository, which has both access management function and data durability for purchased e-books. This system uses NFTs as access rights to realize strict access control by preventing clients who do not have NFTs from downloading e-book data. In addition, e-book data stored on storage nodes in the distributed storage is divided into shards using Reed–Solomon codes, and each storage node stores only a single shard, thereby preventing the creation of nodes that can restore the entire content from locally stored data. The storage of each shard is not handled by a single node but by a group of nodes, and the shard is propagated to all nodes in the group using the gossip protocol, where erasure codes are utilized to increase the resilience against node departure. Furthermore, an incentive mechanism to encourage participation as a storage node is implemented using smart contracts. We built a prototype of the proposed system on AWS and evaluated its performance. The results showed that both downloading and uploading 100 MB of e-book data (equivalent to one comic book) were completed within 10 s using an instance type of m5.xlarge. This value is only 1.3 s longer for downloading and 2.2 s longer for uploading than the time required for a simple download/upload without access control, confirming that the overhead associated with the proposed method is sufficiently small.
Suleiman Dahir Mohamed, Mohd Tahir Ismail, Majid Khan Majahar Ali
This study finds breaks, trend breaks, and outliers in the last decade returns of five cryptocurrencies Bitcoin, Ethereum, Litecoin, Tether USD, and Ripple that experienced frequent changes. The study uses the indicator saturation (IS) approach to simultaneously identify breaks, trend breaks, and outliers in these returns to gain a deeper understanding in their dynamics. The study found that monthly, weekly and daily breaks existed in these returns as well as trend breaks, and outliers mostly during the market peaks in 2017, 2018, 2020, and 2021 that can be attributed to a number of things, such as the global Covid-19 pandemic in 2020, the 2021 crypto crackdown in China, the 2020 price halving of Bitcoin, and the 2017–2018 initial coin offering (ICO) boom. These returns also have common break segments and outliers. The application of IS technique to cryptocurrencies and simultaneous detection of market breaks, trend breaks, and outliers makes this study unique. This study is limited to considering only returns of five digital coins. These results may help traders, investors, and financial analysts modify their tactics and risk-management techniques to deal with the complexity of the cryptocurrency market.
Jannik Lucas Sommer, Magnus Mølgaard Lund, Nicola Cibin, Michele Albano
The frequency of software supply chain attacks has reached unprecedented levels, primarily due to the increasing reliance on huge numbers of software and hardware dependencies, and the inherent vulnerabilities they harbor. Currently, vendors providing these software and hardware components share security advisories to centralized databases or post them on proprietary websites, which security engineers have to search manually to find vulnerabilities relevant for their systems. Furthermore, the security advisories often do not follow a standard machine-readable format, which results in the engineers having to manually analyze the documents. In this paper, SENTINEL, a novel solution for automating dissemination and discovery of security advisories leveraging Web3 technologies, is presented. In particular, the Ethereum blockchain is used by vendors to notify asset owners of novel vulnerabilities in their systems in a reliable and accountable manner. Evaluation tests conducted on the Ethereum Sepolia Testnet confirm that our proposal is a functional and functioning solution for securely disseminating and discovering security advisories utilizing a fully decentralized infrastructure. SENTINEL’s source code is released as open source software on GitHub.
Fatma Ben Hamadou, Taicir Mezghani, Mouna Boujelbène Abbes
Understanding the interplay between investor sentiment and cryptocurrency returns has become a critical area of research. Indeed, this study aims to uncover the role of Google investor sentiment on cryptocurrency returns (including Bitcoin, Litecoin, Ethereum, and Tether), especially during the 2017-18 bubble (January 01, 2017, to December 31, 2018) and the COVID-19 pandemic (January 01, 2020, to March 15, 2022). To achieve this, we use two techniques: quantile causality and wavelet coherence. First, the quantile causality test unveils that investors’ optimistic sentiments have notably higher cryptocurrency returns, whereas pessimistic sentiment has significantly opposite effects. Moreover, the wavelet coherence analysis shows that co-movement between investor sentiment and Tether cannot be considered significant. This result supports the role of Tether as a stablecoin in portfolio diversification strategies. In fact, the findings will help investors improve the accuracy of cryptocurrency return forecasts in times of stressful events and pave the way for enhanced decision-making utility.