Ethereum is the dominant blockchain ecosystem capable of executing Turing-complete smart contracts. Rollups gained significant traction as the primary layer 2 (L2) solution meant to bring horizontal scalability to the main Ethereum network (L1). A core component of any rollup is the sequencer, which creates new L2 blocks to be submitted in rollup batches to L1. In most of the current rollup architectures, this component is centralised. As a result, these designs are prone to inconspicuous censorship practices by the sequencer. Trusted execution environments (TEEs) can guarantee the integrity of various sequencer components, which is instrumental in addressing censorship. However, the reaction of the system design to censorship attempts depends on where a TEE is integrated and which components it protects. In particular, this reaction is limited in the case of a monolithic TEE-protected sequencer design. Proposer-Builder Separation (PBS) is a non-monolithic paradigm adopted on L1, which separates the production of blocks from proposing them for inclusion in the blockchain. Recently, PBS has been considered for integration with L2 sequencers, with an impact on alleviating censorship. In this paper, we explore the design space of TEE-integrating PBS and non-PBS sequencer variants. First, we introduce a formal framework for the censorship actions that captures the specificity of the L2 sequencer. Then, we analyse to what extent the different designs address these censorship actions. Our main contribution is a novel design variation that allows for a precise observation of censored transactions. In the presence of TEEs, in a PBS setting, we demonstrate this precise observability, which is necessary to enable resilience to censorship.
Daniel Commey, Bin Mai, Sena Hounsinou, Garth V. Crosby
This paper reviews the role of blockchain technology in enhancing the security of Internet of Things (IoT) systems and maintaining data integrity. We address the increased vulnerabilities and broader attack surface resulting from the integration of blockchain and IoT. The review emphasizes the potential of technologies like zero-knowledge proofs (ZKP) and post-quantum cryptography (PQC) to mitigate these security challenges. Additionally, we explore how game theory, machine learning, and cyber deception strengthen the defense of blockchain-based IoT systems against various threats. The paper also identifies open research areas, emphasizing the need for continued exploration to advance these fields. An additional contribution of this study is introducing a conceptual framework incorporating these technologies, laying the groundwork for developing advanced security solutions within the blockchain-enhanced IoT ecosystem.
Smart contracts are computer programs running on blockchains to automate the transaction execution between users. The absence of contract specifications poses a real challenge to the correctness verification of smart contracts. Program invariants are properties that are always preserved throughout the execution, which characterize an important aspect of the program behaviors. In this paper, we propose a novel invariant generation framework, INVCON+, for Solidity smart contracts. INVCON+ extends the existing invariant detector, InvCon, to automatically produce verified contract invariants based on both dynamic inference and static verification. Unlike INVCON+, InvCon only produces likely invariants, which have a high probability to hold, yet are still not verified against the contract code. Particularly, INVCON+ is able to infer more expressive invariants that capture richer semantic relations of contract code. We evaluate INVCON+ on 361 ERC20 and 10 ERC721 real-world contracts, as well as common ERC20 vulnerability benchmarks. The experimental results indicate that INVCON+ efficiently produces high-quality invariant specifications, achieving a recall of 80%, which can be used to secure smart contracts from 17 types of common vulnerabilities.
Samson Kahsay Gebresilassie, Joseph Rafferty, Mamun Abu-Tair, Aftab Ali · 6 authors
The Internet of Things (IoT) is a technology paradigm that has transformed several domains including manufacturing, agriculture, healthcare, power grids, travel, and retail. Despite the enormous advantages that IoT offers to organizations and transforming individuals’ everyday lives in a wide range of domains, it comes with potential cyber risks that can negatively impact, harm, or damage them. Security is the most challenging issue in IoT systems due to insecure devices, inadequate IDMS, lack of data security and privacy, lack of trust, lack of risk analysis on network traffic, various vulnerabilities and attacks, lack of physical security, and many other risk factors. Although several security architectures have been developed, they fail to properly and fully address these IoT security challenges and an urgent demand awaits for a robust IoT security architecture. Thus, this work investigates state-of-the-art solutions and proposes a holistic novel IoT security architecture called SHIELD: Secure Holistic IoT Environment with Ledger-based Defense with core security capabilities of decentralized Identity Management System (IDMS), Network Traffic Monitoring, Analysis, and dataset generation, deep learning-based Intrusion Detection System (IDS), and Distributed Ledger Technology (DLT)-based Trust Management System (TMS). The proposed architecture is qualitatively compared with existing solutions using key features like a single point of failure, risk/attack-aware, trust, real-time traffic behavior monitoring, up-to-date dataset, cross-platform functionality, and availability among others. As a result of this comparison, SHIELD architecture provides a holistic and robust solution with multiple core security features to overcome some of the key security challenges IoT environment.
The fast-paced development of blockchain technology is evident. Yet, the security concerns of smart contracts represent a significant challenge to the stability and dependability of the entire blockchain ecosystem. Conventional smart contract vulnerability detection primarily relies on static analysis tools, which are less efficient and accurate. Although deep learning methods have improved detection efficiency, they are unable to fully utilize the static relationships within contracts. Therefore, we have adopted the advantages of the above two methods, combining feature extraction mode of tools with deep learning techniques. Firstly, we have constructed corresponding feature extraction mode for different vulnerabilities, which are used to extract feature graphs from the source code of smart contracts. Then, the node features in feature graphs are fed into a graph convolutional neural network for training, and the edge features are processed using a method that combines attention mechanism with gated units. Ultimately, the revised node features and edge features are concatenated through a multi-head attention mechanism. The result of the splicing is a global representation of the entire feature graph. Our method was tested on three types of data: Timestamp vulnerabilities, reentrancy vulnerabilities, and access control vulnerabilities, where the F1 score of our method reaches 84.63%, 92.55%, and 61.36%. The results indicate that our method surpasses most others in detecting smart contract vulnerabilities.
Abstract Blockchain, as a secure distributed ledger technology, has received extensive attention from academia and industry for its decentralization, comparability and traceability. This paper proposes a method for verifying data security on blockchain, and a cryptographic uploading and retrieval scheme is combined with IOTA blockchain technology. In this way, an IoT data storage and sharing model is designed to combine blockchain with IPFS. In this paper, it is found that there is a certain delay in operating on Fabric and IOTA compared to the scenarios that do not use blockchain. But Fabric has better performance in upload and download performance than IOTA. In the proposed scheme in this paper, the uploading time is stabilized between 0.8 and 1.2, and the retrieval time is stabilized between 0.43s and 0.76s, which has superior data uploading and retrieval performance than Scheme 1. Furthermore, the time to generate a key for a 50MB file is only around 1800ms, and for a 50MB file split into 6KB blocks, the time to generate a secret key is only around 36s. In this paper, when the file size reaches 5MB, the computational overhead of encryption and decryption is about 1315ms and 1283ms, respectively, and the time overhead of data consistency validation is only about 1095ms when the data block is cut into 6KB for a file of 5MB, indicating that this paper’s scheme has a lower time overhead in the generation of the secret key, encryption and decryption, and the data consistency validation. In summary, the above experiments verify the security and applicability of this paper’s scheme in data storage and verification.
Dongze Li, Kejia Zhang, Shiwei Li, Gang Du · 5 authors
As decentralized finance (DeFi) grows and decentralized exchanges (DEXs) expand, the security of Ethereum smart contracts and blockchain transactions is receiving increasing scholarly attention. The ERC20 token standard has facilitated the emergence of numerous honeypot contracts, which deceive traders by allowing token purchases but blocking withdrawals. This study proposes a lightweight honeypot contract detection system integrated into the go-Ethereum client (Geth). Unlike previous work, our detector does not rely on contract interaction records or source code provided by contract creators. Instead, our approach performs static data flow analysis on contract bytecode to identify honeypot mechanisms. By focusing exclusively on the control flow of the ERC20 Transfer method, our system achieves faster detection than full-contract analysis methods, with an average processing time of 9.74 milliseconds per contract. Experiments on both known honeypot contracts and real-world token contracts demonstrate the effectiveness of our approach in detecting malicious ERC20 contracts.
Kainat Ansar, Mansoor Ahmed, Markus Helfert, Jungsuk Kim
In cybersecurity, personal data breaches have become one of the significant issues. This fact indicates that data breaches require unique detection systems, techniques, and solutions, which necessitate the potential to facilitate precise and quick data breach detection. Various research works on data breach detection and related areas in dealing with this problem have been proposed. Several survey studies have been conducted to comprehend insider data breaches better. However, these works did not examine techniques related to blockchain and innovative smart contract technologies to detect data breaches. In this survey, we examine blockchain-based data breach detection mechanisms developed so far to deal with data breach detection. We compare blockchain-based data breach detection techniques based on type, platform, smart contracts, consensus algorithm language/tool, and evaluation measures. We also present a taxonomy of contemporary data breach types. We conclude our study by outlining existing methodologies’ issues, offering ideas for overcoming those challenges, and pointing the way forward.
Christoph Sendner, Lukas Petzi, Jasper Stang, Alexandra Dmitrienko
Ethereum smart contracts, which are autonomous decentralized applications on the blockchain that manage assets often exceeding millions of dollars, have become primary targets for cyberattacks. In 2023 alone, such vulnerabilities led to substantial financial losses exceeding a billion of US dollars. To counter these threats, various tools have been developed by academic and commercial entities to detect and mitigate vulnerabilities in smart contracts. Our study investigates the gap between the effectiveness of existing security scanners and the vulnerabilities that still persist in practice. We compiled four distinct datasets for this analysis. The first dataset comprises 77,219 source codes extracted directly from the blockchain, while the second includes over 4 million bytecodes obtained from Ethereum Mainnet and testnets. The other two datasets consist of nearly 14,000 manually annotated smart contracts and 373 smart contracts verified through audits, providing a foundation for a rigorous ground truth analysis on bytecode and source code. Using the unlabeled datasets, we conducted a comprehensive quantitative evaluation of 17 vulnerability scanners, revealing considerable discrepancies in their findings. Our analysis of the ground truth datasets indicated poor performance across all the tools we tested. This study unveils the reasons for poor performance and underscores that the current state of the art for smart contract security falls short in effectively addressing open problems, highlighting that the challenge of effectively detecting vulnerabilities remains a significant and unresolved issue.
IoT-based remote health monitoring is a promising technology to support patients who are unable to travel to medical facilities. Due to the sensitivity of health data, it is important to secure it against all possible threats. While a great deal of work has been done to secure IoT device-cloud communication and health records on the cloud, insider attacks remain a significant challenge. Malicious insiders may tamper, steal or change patients’ health data, which results in a loss of patient trust in these systems. Audit logs in the cloud, which may point to illegal data access, may also be erased or forged by malicious insiders as they tend to have technical knowledge and privileged access to the system. Thus, in this work, we propose a Cloud Access Security Broker (CASB) model that (a) logs every action performed on user data and (b) secures those logs by placing them in a private blockchain that is viewable by the data owners (i.e., patients). Patients can query the blockchain, track their data’s movement, and be alerted if their data has been accessed by an administrator or moved outside the cloud storage. In this work, we practically implement a web application that receives health data from patients, a CASB that securely stores the records in the cloud, and integrate a private blockchain that immediately logs all actions happening in the backend of the web application and CASB. We evaluate the system’s security and performance under varying numbers of patients and actions.
Abstract A smart city provides innovative services to citizens to improve their quality of life. A smart city generates vast amounts of data as Internet of Things (IoT) integration increases. However, gathering, storing, processing, and analyzing this data can pose significant challenges, particularly given its heterogeneous nature and the fact that citizens often contribute to it. A Linux Foundation project called Hyperledger includes the Hyperledger Fabric (HF), developed by IBM and contributing to Hyperledger's development. This paper suggests a smart contract-based data security network for smart cities that uses HF. Data access rules and data-sharing policies can be enforced using smart contracts. A framework is proposed for integrating multiple smart city applications and services while ensuring data privacy and security. A significant contribution to the existing literature is made by this study, which examines the usefulness of blockchain technology and smart contracts in smart cities for data security.
To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions.
Abstract. Due to the transparent nature of blockchain, all transaction information and smart contract code is recorded on the public blockchain. It is easy for existing static analysis tools to analyze and exploit vulnerabilities in smart contract code. To mitigate this risk, we propose HermHD, an automated security enhancement tool that protects smart contracts on the Ethereum network. HermHD employs six obfuscation patterns that can rewrite the bytecode of a smart contract without affecting its functionality. By applying these obfuscation techniques, we aim to prevent reverse static analysis tools from cracking the contract and thereby enhance the security of smart contracts. To validate the effectiveness of HermHD, we conducted experiments on 121 smart contracts from a public dataset. 54The evaluation results demonstrate that all the protected smart contracts are resistant to two popular reverse engineering tools, and the additional gas cost incurred is minimal.
Kai Ma, Jintao Huang, Ningyu He, Zhuo Wang · 5 authors
Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem. To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.
A smart contract is a kind of code deployed on the blockchain that executes automatically once an event triggers a clause in the contract. Since smart contracts involve businesses such as asset transfer, they are more vulnerable to attacks, so it is crucial to ensure the security of smart contracts. Because a smart contract cannot be tampered with once deployed on the blockchain, for smart contract developers, it is necessary to fix vulnerabilities before deployment. Compared with many vulnerability detection tools for smart contracts, the amount of automatic fix approaches for smart contracts is relatively limited. These approaches mainly use defined pattern-based methods or heuristic search algorithms for vulnerability repairs. In this article, we propose RLRep , a reinforcement learning-based approach to provide smart contract repair recommendations for smart contract developers automatically. This approach adopts an agent to provide repair action suggestions based on the vulnerable smart contract without any supervision, which can solve the problem of missing labeled data in machine learning-based repair methods. We evaluate our approach on a dataset containing 853 smart contract programs (programming language: Solidity) with different kinds of vulnerabilities. We split them into training and test sets. The result shows that our approach can provide 54.97% correct repair recommendations for smart contracts.
As blockchain smart contracts become more widespread and carry more valuable digital assets, they become an increasingly attractive target for attackers. Over the past few years, smart contracts have been subject to a plethora of devastating attacks, resulting in billions of dollars in financial losses. There has been a notable surge of research interest in identifying defects in smart contracts. However, existing smart contract fuzzing tools are still unsatisfactory. They struggle to screen out meaningful transaction sequences and specify critical inputs for each transaction. As a result, they can only trigger a limited range of contract states, making it difficult to unveil complicated vulnerabilities hidden in the deep state space. In this paper, we shed light on smart contract fuzzing by employing a sequence-aware mutation and seed mask guidance strategy. In particular, we first utilize data-flow-based feedback to determine transaction orders in a meaningful way and further introduce a sequence-aware mutation technique to explore deeper states. Thereafter, we design a mask-guided seed mutation strategy that biases the generated transaction inputs to hit target branches. In addition, we develop a dynamic-adaptive energy adjustment paradigm that balances the fuzzing resource allocation during a fuzzing campaign. We implement our designs into a new smart contract fuzzer named MuFuzz, and extensively evaluate it on three benchmarks. Empirical results demonstrate that MuFuzz outperforms existing tools in terms of both branch coverage and bug finding. Overall, MuFuzz achieves higher branch coverage than state-of-the-art fuzzers (up to 25%) and detects 30 % more bugs than existing bug detectors.
Mazin Abed Mohammed, Abdullah Lakhan, Dilovan Asaad Zebari, Mohd Khanapi Abd Ghani · 8 authors
Industrial cyber–physical systems (ICPS) are emerging platforms for various industrial applications. For instance, remote healthcare monitoring, real-time healthcare data generation, and many other applications have been integrated into the ICPS platform. These healthcare applications encompass workflow tasks, such as processing within hospitals, laboratory tests, and insurance companies for patient payments, which necessitate a sequential flow. The external wireless, fog, and cloud services within ICPS face security issues that impact end-users’ healthcare applications. Blockchain technology offers an optimal solution for ICPS-enabled applications. However, blockchain technology for the ICPS platform is still vulnerable to cyberattacks, while microservices are essential for executing applications. This paper introduces the novel “Pattern-Proof Malware Validation” (PoPMV) algorithm designed for blockchain in ICPS. It exploits a deep learning model (LSTM) with reinforcement learning techniques to receive feedback and rewards in real-time. The primary objective is to mitigate security vulnerabilities, enhance processing speed, identify both familiar and unfamiliar attacks, and optimize the functionality of ICPS. Simulations demonstrate the superiority of the proposed approach compared to current blockchain frameworks, showcasing dynamic allocation of microservices and improved security with comprehensive attack detection by 30%.
If tokenized assets are to be a reality in the future decentralized Web3 then transaction keys need to be distributed and under the control of the asset-owners. This requires a careful design of wallet systems based on trusted hardware. A core feature needed for wallet systems is the attestation of the state of the transaction keys in the wallet without disclosure of the keys. This feature is relevant for relying parties such as insurance providers who need to perform risk assessment based on the security quality of the environment inside the wallet system that is protecting the transaction keys. In the longer term, all key-bearing devices that participate in a decentralized tokenized asset network will need to be hardened using trusted hardware, with attestation capabilities for detecting and countering cyberattacks.
Smart contracts are programs that define rules for transactions running on blockchains. Since any qualified transaction sequence within the same block can be orchestrated by the blockchain miner, unexpected results may occur due to data races between transactions (called transaction races). Surprisingly, transaction races in smart contracts have not been fully investigated. To address this, we propose TransRacer, an automated approach and open-source tool that employs symbolic execution to detect transaction races in smart contracts. TransRacer analyzes function dependencies to identify transaction races hidden in specific contract states. It also generates witness transactions that can trigger such races. The experimental results on 50 real-world smart contracts show the effectiveness and efficiency of TransRacer: it detects 426 races in 255.9 minutes, including 149 race bugs leading to inconsistent states.
We present SmartFix, a new technique for repairing vulnerable smart contracts. There is an urgent need to develop automatic bug-repair techniques for smart contracts, as smart contracts are safety-critical software and manual debugging is burdensome and error-prone. While several repair approaches have been proposed recently, they are unsatisfactory since no existing techniques can achieve high repairability, full automation, and safety guarantee at the same time, posing significant problems for practical use. SmartFix aims to address these shortcomings by using a “generate-and-verify” approach that iteratively enumerates candidate patches while validating their correctness by invoking a safety verifier. However, in this approach, a technical challenge arises as the search space is huge and the verification-based patch validation is expensive. To address this challenge, we present a novel technique for accelerating the generate-and-verify repair procedure using statistical models derived from the verifier’s feedback. Experimental results on real-world Ethereum smart contracts show that SmartFix is able to achieve a fix success rate of 94.8% for critical classes of vulnerabilities, far outperforming sGuard, the existing state-of-the-art technique whose success rate is 65.4%.
As the development of Solidity smart contracts has increased in popularity, the reliance on external sources such as third-party packages increases to reduce development costs. However, despite the use of external sources bringing flexibility and efficiency to the development, they could also complicate the process of assuring the security of downstream applications due to the lack of package managers for standardized ways and sources. While previous studies have only focused on code clones without considering how the external components are introduced, the compositions of a smart contract and their characteristics still remain puzzling.
The latest advancements in artificial intelligence (AI) technologies, including machine and deep learning models, in prediction, recommending, and automating processes have greatly impacted IoT devices in general, and protect them from cyberattacks in particular. Blockchain also has features that assist in creating more secure IoT devices due to its abilities of traceability, acceptability, and trust. This paper studies the current advancements in the IoT and blockchain, their architectures, and their effect on security. The paper proposes a novel framework that takes into consideration the advantages and benefits of machine/deep learning models and blockchain in order to provide a solution that makes IoT devices more secure. This framework is based on the IoT four-layer architecture, and it aims to enhance the way IoT devices detect and recognise cyberattacks using blockchain and machine/deep learning algorithms. Machine and deep learning algorithms are responsible for detecting security attacks in the IoT, based on their patterns. The blockchain platform is responsible for verifying whether a specific request is secure, and it also uses cryptography to sign all new requests in order to recognise them in future requests. The MQTTset dataset, which is contains data associated with intrusion detection cases, has been used to implement a case study that aims to prove the validity of this framework. Various machine and deep learning algorithms have been used in this case study which have all achieved high results with regard to precision, recall, accuracy, and F1 performance measurements. Such results have proven the validity and reliability of the proposed framework to detect and predict new attacks before their requests are processed within a particular IoT system.
Anna Vacca, Michele Fredella, Andrea Di Sorbo, Corrado Aaron Visaggio · 5 authors
Abstract Blockchain is a cross‐cutting technology allowing interactions among untrusted entities in a distributed manner without the need for involving a trusted third party. Smart contracts (i.e., programs running on the blockchain) enabled organizations to envision and implement solutions to real‐world problems in less cost and time. Given the immutability of blockchain and the lack of best practices for properly designing and developing smart contracts, it is crucial to assure smart contract quality before deployment. With the help of an exploratory survey involving developers and researchers, this paper identifies the practices and tools used to develop, implement, and evaluate smart contracts. The survey received 55 valid responses. Such responses indicate that (i) inefficiencies may occur during the development cycle of a smart contract, especially regarding requirements specification, design, and testing phases, and (ii) the lack of a shared standard to evaluate the functional quality of implemented smart contracts. To start coping with these issues, the adoption of functional suitability assessment measures recommended by the ISO/IEC 25000 standard, widely used in software engineering, is proposed by adapting them to the context of smart contracts. Through some examples, the manuscript also illustrates how to measure the functional completeness and correctness of smart contracts. The proposed procedure to measure smart contract functional suitability brings advantages to both developers and users of decentralized finance or non‐fungible tokens platforms, data marketplaces, or shipping and real estate services, just to mention a few. In particular, it helps (i) better outline the responsibilities of smart contracts, (ii) uncover errors and deficiencies of smart contracts in the early stages, and (iii) ensure that the established requirements are met.