The security of distributed applications backed by blockchain technology relies mainly on keeping the associated cryptographic keys (i.e. private keys) in well-protected storage. Since they are the unique proof of ownership of the underlying digital assets. If the keys are stolen or lost, there is no way to recover the assets. The cold wallet is a good candidate for basic use cases, but it has a substantial challenge for more complex applications as it does not scale. Warm and hot wallets are more convenient options for blockchain-based solutions that aim to transact in a cloud environment. In this work, we focus on Hardware Security Module (HSM) based wallet. The HSM is the de-facto standard device designed to manage high-value cryptographic keys and to protect them against hacks. In this demonstration, we present an HSM-based working prototype that secures the entire life cycle of Ethereum public and private keys.
Ethereum is one of the oldest examples of blockchain technology provides a system that converts centralized storage to distributed and records transactions by way of decentralized and not by a centralized system and can be verified by each node, therefore it is suitable for storing fingerprints from official diploma documents and transcripts that are published. Smart contract is needed for making contract transactions to Ethereum with programming code, so contracts such as diplomas and transcripts uploaded on the Ethereum blockchain can distribute and produce diploma validation and the authenticity of transcripts with transaction hash, consensus, and comply with ERC-721 token standardization. The results showed that a sample of 5 electronic documents in pdf format with a transaction speed of 1 second on each file that were published and secured with Ethereum blockchain technology can be easily verified for authenticity, the system proposed and developed by us takes in consideration invalid and failure cases by giving the necessary feedback to the user.
Cryptocurrencies do not only allow for money transfers in the absence of a trusted third party but also enable the execution of distributed applications. Due to the rapid pace of development of cryptocurrencies, the foundations of such applications have not been rigorously studied. This is particularly problematic since in these applications, real money is at stake, and security breaches regularly cause severe financial losses.In this thesis, we present two systematic approaches to reliably verify the security of distributed blockchain applications based on formal foundations. To this end, we focus on the cryptocurrencies with the highest market capitalization, Bitcoin and Ethereum. In Ethereum, distributed applications are realized as smart contracts, reactive programs written in Ethereum’s expressive scripting language. In contrast, Bitcoin supports only a basic scripting language, and advanced applications are realized as peer-to-peer cryptographic protocols that resort to the execution of simple smart contracts in case of disputes among peers. As a result, the challenge in verifying distributed applications on the Ethereum blockchain lies in the study and abstraction of the semantics of Ethereum’s evolved scripting language, whereas Bitcoin, the study of distributed applications, requires a systematic analysis of the cryptographic protocols.In the thesis, we first formalize the formerly under-specified semantics of Ethereum’s native smart contract language EVM bytecode and implement the semantics in the proof assistant F*. In this context, we formally characterize relevant generic properties for smart contract security, which capture real-world attack scenarios.We then survey existing automated static analyzers for Ethereum smart contracts unveiling the weaknesses in the semantic foundations of these tools and the practical impact of these weaknesses on the analysis results. Based on these findings, we propose our own automatic static analysis tool for Ethereum smart contracts, which comes with a rigorous soundness proof while still showing competitive performance. In this course, we also propose a general framework for the modular and semantic-driven development of automatic static analyzers. Finally, we study the security of payment channel networks for Bitcoin. Payment channel networks are distributed protocols that allow for efficient and cheap payments between Bitcoin users and offer a promising solution to Bitcoin’s scalability problems. We unveil a security issue in Bitcoin’s existing payment channel network implementation and formally characterize the relevant security and privacy notions in this context. We further develop a cryptographic primitive for the construction of payment channel networks with formal security guarantees
N. Suganthi, Gokul Sridharan, E Shravanth, K. Veena
Abstract: Democratic rule is based on safe and open electoral systems that can preserve their authenticity. The conventional voting processes are hampered significantly by electoral fraud and security breaches as well as centralized management and inefficiencies in auditability and accessibility. The issues of electoral systems reduce public trust along with lowering the credibility of election results. This paper introduces a new three-tier blockchain-based e-voting system designed to enhance voter privacy alongside system scalability and end-to-end verifiability to restore trust in electoral processes. Voter verification at Layer 1 (Identity Verification) combines Decentralized Identity (DID) with Zero-Knowledge Proofs (ZKP) and multimodal biometric techniques involving fingerprint scanning, facial recognition technology, and voice analysis. The system enables only the participation of valid voters while also protecting their private data and fulfilling different user needs. The system's Layer 2 (Vote Casting & Secure Storage) employs a hybrid consensus algorithm combining Byzantine Fault Tolerance (BFT) and Delegated Proof-of-Stake (dPoS) to store votes securely while reducing energy consumption. The system leverages Triple-Blind Signatures to provide complete voter anonymity by decoupling voter identities from their votes as well as any accompanying metadata. Lattice-based post-quantum cryptography is employed to encrypt votes which are distributed across sharded blockchain subnets for enhanced performance without sacrificing fault tolerance. The system accumulates votes via Merkle roots and verifies them via zk-SNARKs in Layer 3 (Result Processing & Transparency) that allows public observation without compromising voter privacy. A Live Audit Dashboard provides voters with the capability to check their vote in real time which facilitates transparent and accountable voting processes. The suggested system attains a secure and open electronic voting process using sophisticated cryptographic protocols in a decentralized setup compliant with international requirements while enabling digital democratic participation.
Xiao Fan Liu, Huanhuan Ren, Si-Hao Liu, Xian-Jian Jiang
Abstract The cryptocurrency economy provides a comprehensive digital trace of human economic behavior: almost all cryptocurrency users’ activities are faithfully recorded in transactions on public blockchains. However, the user identifiers in the transaction records, i.e., blockchain addresses, are anonymous. That is, they cannot be associated with any real “off-chain” identify of actual users. Nonetheless, identifying the economic roles of the addresses from their past behaviors is still feasible. This paper analyzes Ethereum token transactions, characterizes key economic agents’ behavior from their transaction patterns, and explores their identifiability through interpretable machine learning models. Specifically, six types of most active economic agents are considered, including centralized cryptocurrency exchanges, decentralized exchanges, cryptocurrency wallets, token issuers, airdrop services, and gaming services. Transaction patterns such as trading volume, transaction tempo, and structural properties of transaction networks are defined for individual blockchain addresses. The results showed that cryptocurrency exchanges and online wallets have signature behavior patterns and hence can be accurately distinguished from other agents. Token issuers, airdrop services, and gaming services can sometimes be confused. Moreover, transaction networks’ features provide the richest information in the economic agent’s identification.
Blockchain technology's (BT) Ethereum Smart Contracts allows programmable transactions that involve the transfer of monetary assets among peers on a BT network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This technology enables consumers to make agreements in a transparent and conflict-free environment. However, the security vulnerabilities within these smart contracts are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. In this paper, we propose a framework that combines static and dynamic analysis to detect Denial of Service (DoS) vulnerability due to an unexpected revert in Ethereum Smart Contracts. Our framework, SmartScan, statically scans smart contracts under test (SCUTs) to identify patterns that are potentially vulnerable in these SCUTs and then uses dynamic analysis to precisely confirm their exploitability of the DoS-Unexpected Revert vulnerability, thus achieving increased performance and more precise results. We evaluated SmartScan on a set of 500 smart contracts collected from the Etherscan. Our approach shows an improvement in precision and recall when compared to available state of the art techniques.
Amaç: Bu araştırmanın amacı, Bitcoin ve altcoin kripto para piyasalarında finansal balonların varlığını araştırmaktır. Tasarım/Yöntem: Çalışmada, Bitcoin ve piyasa değeri açısından Bitcoin’den sonra gelen ilk beş kripto para birimine (Ethereum, Litecoin, Chainlink, Ripple ve Cardano) ait veriler kullanılmıştır. Kripto para piyasasında finansal balonların tespitinde GSADF testi kullanılmıştır. Bulgular: Çalışma sonucunda Bitcoin ve altcoinlerde finansal balonlar tespit edilmiştir. Bitcoin, Ethereum, Ripple ve Chainlink için tespit edilen balonlar istatistiksel olarak anlamlı iken Litecoin ve Cardano için tespit edilen finansal balonlar istatistiksel olarak anlamlı değildir. Sınırlılıklar: Çalışmada altcoin kripto para piyasasını temsilen piyasa değeri bakımından ilk beş kripto para birimine ait veriler kullanılmıştır. 2021 yılı başında çeşitli borsalarda işlem gören dört binden fazla altcoin olduğu göz önünde bulundurulduğunda çalışmanın veri setinin çalışmanın kısıtını oluşturduğu söylenebilir. Özgünlük/Değer: Çalışmadan elde edilen bulgular, araştırmacılar, politika yapıcılar, profesyoneller ve yatırımcılar açısından önem arz etmektedir. Çalışmada kullanılan veri setinin güncel olması 2020 yılı sonunda gerçekleşen finansal balonların tespitini olanaklı kılmıştır. Bu nedenle de çalışmanın ilgili literatüre katkı sağlaması beklenmektedir.
Nikolay Ivanov, Jianzhi Lou, Ting Chen, Jin Li · 5 authors
Ethereum holds multiple billions of U.S. dollars in the form of Ether cryptocurrency and ERC-20 tokens, with millions of deployed smart contracts algorithmically operating these funds. Unsurprisingly, the security of Ethereum smart contracts has been under rigorous scrutiny. In recent years, numerous defense tools have been developed to detect different types of smart contract code vulnerabilities. When opportunities for exploiting code vulnerabilities diminish, the attackers start resorting to social engineering attacks, which aim to influence humans -- often the weakest link in the system. The only known class of social engineering attacks in Ethereum are honeypots, which plant hidden traps for attackers attempting to exploit existing vulnerabilities, thereby targeting only a small population of potential victims. In this work, we explore the possibility and existence of new social engineering attacks beyond smart contract honeypots. We present two novel classes of Ethereum social engineering attacks - Address Manipulation and Homograph - and develop six zero-day social engineering attacks. To show how the attacks can be used in popular programming patterns, we conduct a case study of five popular smart contracts with combined market capitalization exceeding $29 billion, and integrate our attack patterns in their source codes without altering their existing functionality. Moreover, we show that these attacks remain dormant during the test phase but activate their malicious logic only at the final production deployment. We further analyze 85,656 open-source smart contracts, and discover that 1,027 of them can be used for the proposed social engineering attacks. We conduct a professional opinion survey with experts from seven smart contract auditing firms, corroborating that the exposed social engineering attacks bring a major threat to the smart contract systems.
Vladyslav Tipanov, О. В. Драчов, Світлана Ткаленко, Tetiana Mirzodaieva · 5 authors
Abstract. The essence of cryptocurrencies is considered and the definition of their legal status is offered. The experience of some jurisdictions regarding the opportunities and threats of using and regulating cryptocurrencies has been studied. The authors analyzed the cryptocurrency market. The factors that led to the widespread use of cryptocurrency, which include financial instability, significant currency fluctuations, limiting capital flows and inflation of the currency in the country. The problem of information protection using blockchain technology, which is solved by a combination of block design and cryptographic protection, is considered. The capitalization of TOP cryptocurrencies for the last three years is analyzed, among which the leading ones are Bitcoin (VTS), Ethereum (ETH), Tether (USDT) and others. Identified issues that need to be addressed in the field of finance and legal regulation. In the process of analyzing the experience of regulating cryptocurrency, we have found similar and distinctive features in some jurisdictions. First, each country, in view of the great potential of the blockchain technology, is trying in one way or another to create a favorable climate for its development. Secondly, the use of cryptocurrency goods is rapidly developing, and their impact on economic processes, both at the international and national levels is increasing, while states are faced with the problem of adapting their tax legislation to the current challenges of the digital economy, since the definition of the status of cryptocurrency does not directly lead to lack of funds to the state budget from operations with these assets. Thirdly, today there are more than 2,000 cryptocurrencies is traded through various trading platforms — stock exchanges and can be used to launder proceeds from crime. Thus, it is necessary to develop common standards for the regulation of cryptocurrency and the requirements for such crypto exchange counterparts, through the licensing of operations with cryptocurrencies. At the same time, the important question is what government bodies should exercise such control. Keywords: technology blockchain, cryptocurrency, virtual currency, legal regulation of cryptocurrencies, state functions, cryptocurrencies taxation. JEL classіfіcatіon F01, F20, K33, K34 Formulas: 0; fig.: 0; tabl.: 1; bibl.: 23.
The rapid growth of Decentralized Finance (DeFi) boosts the Ethereum ecosystem. At the same time, attacks towards DeFi applications (apps) are increasing. However, to the best of our knowledge, existing smart contract vulnerability detection tools cannot be directly used to detect DeFi attacks. That's because they lack the capability to recover and understand high-level DeFi semantics, e.g., a user trades a token pair X and Y in a Decentralized EXchange (DEX). In this work, we focus on the detection of two types of new attacks on DeFi apps, including direct and indirect price manipulation attacks. The former one means that an attacker directly manipulates the token price in DEX by performing an unwanted trade in the same DEX by attacking the vulnerable DeFi app. The latter one means that an attacker indirectly manipulates the token price of the vulnerable DeFi app (e.g., a lending app). To this end, we propose a platform-independent way to recover high-level DeFi semantics by first constructing the cash flow tree from raw Ethereum transactions and then lifting the low-level semantics to high-level ones, including token trade, liquidity mining, and liquidity cancel. Finally, we detect price manipulation attacks using the patterns expressed with the recovered DeFi semantics. We have implemented a prototype named \tool{} and applied it to more than 350 million transactions. It successfully detected 432 real-world attacks in the wild. We confirm that they belong to four known security incidents and five zero-day ones. We reported our findings. Two CVEs have been assigned. We further performed an attack analysis to reveal the root cause of the vulnerability, the attack footprint, and the impact of the attack. Our work urges the need to secure the DeFi ecosystem.
Javier Arcenegui, Rosario Arjona, Roberto Román, Iluminada Baturone
Non-fungible tokens (NFTs) are widely used in blockchain to represent unique and non-interchangeable assets. Current NFTs allow representing assets by a unique identifier, as a possession of an owner. The novelty introduced in this paper is the proposal of smart NFTs to represent IoT devices, which are physical smart assets. Hence, they are also identified as the utility of a user, they have a blockchain account (BCA) address to participate actively in the blockchain transactions, they can establish secure communication channels with owners and users, and they operate dynamically with several modes associated with their token states. A smart NFT is physically bound to its IoT device thanks to the use of a physical unclonable function (PUF) that allows recovering its private key and, then, its BCA address. The link between tokens and devices is difficult to break and can be traced during their lifetime, because devices execute a secure boot and carry out mutual authentication processes with new owners and users that could add new software. Hence, devices prove their trusted hardware and software. A whole demonstration of the proposal developed with ESP32-based IoT devices and Ethereum blockchain is presented, using the SRAM of the ESP32 microcontroller as the PUF.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
The idea of sharing economy gives rise to unique ideas and develops innovative businesses. This article aims to relate the smart city concept by introducing the smart transport system and explores the opportunities of adopting blockchain technology in ride-sharing services. Blockchain technology is a distributed, decentralized public ledger that allows peer-to-peer transactions in a secured way without any third party. This paper proposes a blockchain-based framework from the existing centralized framework for a ride-sharing service and implements the same as a decentralized application (DApp) based on smart contracts on Ethereum Blockchain. Using smart contracts facilitate the users with automated transactions, removes the intermediaries, and enables various activities to be carried out safely and securely. Implementation of smart contracts is done using the Solidity programming language. This DApp uses the min matching algorithm to match riders requesting rideshare to save total travel distance. With the overwhelming growth in the usage of cryptocurrencies, smart contracts usage in applications as proposed in this paper can transform the sharing economy.
Modern day businesses are largely dependent on digital technologies. People prefer viewing the reviews before making any decisions. It applies to all consumables like buying Electronic items, Clothing, Travel, Guest-House, Restaurant, Rental, Housing, Automobile, Cosmetics, Jewellery, Movies, etc. Online services like Mantra, Yelp, Amazon, Facebook, Google My Business, Trip Advisor offer great services to the customer. However, drawbacks of these systems are fake reviews, negative reviews and sometimes even tampering of the reviews given by the customers, which has a huge impact on the business leading to huge financial losses. Sometimes a competitor in the business might also influence the ratings being provided. The centralized storage of these reviews also leads to problems like tampering or manipulation of the data being stored. In this paper we propose an application in the restaurant industry that solves all these drawbacks by making use of the Ethereum blockchain. The food reviews given by the customers are stored as smart contracts in the blockchain, which can't be altered, thus guaranteeing the authenticity of the reviews. Validity of the reviews is ensured because it is difficult for the restaurants to delete or create new accounts to wipe away the bad reviews given. Blockchain is immutable so we ensure that the reviews are genuine and the system is trustable.
Plenty of research on smart mobility is currently devoted to the inclusion of novel decentralized software architectures to these systems, due to the inherent advantages in terms of transparency, traceability, trustworthiness. MOVO is a decentralized application (dApp) for smart mobility. It includes: (i) a module for collecting data from vehicles and smartphones sensors; (ii) a component for interacting with Distributed Ledger Technologies (DLT) and Decentralized File Storages (DFS), for storing and validating sensor data; (iii) a module for "offline" interaction between devices. The dApp consists of an Android application intended for use inside a vehicle, which helps the user/driver collect contextually generated data (e.g. a driver's stress level, an electric vehicle's battery level), which can then be shared through the use of DLT (i.e., IOTA DLT and Ethereum smart contracts) and DFS (i.e., IPFS). The third module consists of an implementation of a communication channel that, via Wi-Fi Direct, allows two devices to exchange data and payment information with respect to DLT (i.e. cryptocurrency and token) assets. In this paper, we describe the main software components and provide an experimental evaluation that confirms the viability of the MOVO dApp in real mobility scenarios.
The advancement of internet technology, cybersecurity, and the distributed system has enabled the development and establishment of electronic voting systems. This study focuses on the design and architecture of a secure and auditable electronic voting system that consists of a website, database system, and blockchain. The Ethereum blockchain is chosen due to its smart contract that is suitable for applications such as e-voting. The implementation is done using the Go language, and the Ethereum blockchain is accessible through the e-voting website. Initial testing and evaluation results show that the proposed design and architecture of the e-voting system allows a secure transaction to take place and auditable at the same time. Several configurations on the blockchain, such as block size, gas limit, and the number of sealers, could be modified to boost the performances further.
In this paper I report the discovery of neurons which showed a neural correlate with ongoing fluctuations of Bitcoin and Ethereum prices at the time of the recording. I used the publicly available dataset of Neuropixel recordings by the Allen Institute to correlate the firing rate of single neurons with cryptocurrency price. Out of ~40.000 recorded single neurons, ~70% showed a significant correlation with Bitcoin or Ethereum prices. Even when using the conservative Bonferroni correction for multiple comparisons, ~35% of neurons showed a significant correlation, which is well above the expected false positive rate of 5%. These results were due to "nonsense correlations": when correlating two signals which both evolve slowly over time, the chances of finding a significant correlation between the two are much higher than when comparing signals which lack this property.
Abstract This study examined the evolving oil market efficiency by applying daily historical data to the three benchmark cryptocurrencies (Bitcoin, Ethereum, and Ripple), gold, and West Texas Intermediate (WTI) crude oil. The data coverage of daily returns was from August 2015 to April 2019. We applied two alternative tests to examine linear and nonlinear dependency, i.e., automatic portmanteau and generalized spectral tests. The analysis of observed results validated the adaptive market hypothesis (AMH) in all markets, but the degree of adaptability between the data was different. In this study, we also analyzed the existence of evolutionary behavior in the market. To achieve this goal, we checked the results by applying the rolling-window method with three different window lengths (50, 100, and 150 days) on the test statistics, which was consistent with the findings of AMH.
Decentralized services are increasingly being developed and their Decentralized applications are increasingly developed but their performance metrics are not tested enough. The total number of transactions that can be supported by the blockchain network and the performance effects of selecting different consensus protocols, using different block intervals and block size should be tested. There are some blockchain performance tools but most are built for specific blockchain frameworks and require complex configuration. The GoHammer tool is developed to provide an easy to use, flexible test tool for the Ethereum/Quorum blockchain frameworks. Transaction per second (TPS) values and several performance metrics will be tested. This tool is also a part of the series of tools that can be integrated with Tubu-io. This tool will help in developing more efficient decentralized systems and will affect decreasing the costs of developing decentralized application projects.
The adoption of Internet of Things (IoT) technology across many applications, such as autonomous systems, communication, and healthcare, is driving the market’s growth at a positive rate. The emergence of advanced data analytics techniques such as blockchain for connected IoT devices has the potential to reduce the cost and increase in cloud platform adoption. Blockchain is a key technology for real-time IoT applications providing trust in distributed robotic systems running on embedded hardware without the need for certification authorities. There are many challenges in blockchain IoT applications such as the power consumption and the execution time. These specific constraints have to be carefully considered besides other constraints such as number of nodes and data security. In this paper, a novel approach is discussed based on hybrid HW/SW architecture and designed for Proof of Work (PoW) consensus which is the most used consensus mechanism in blockchain. The proposed architecture is validated using the Ethereum blockchain with the Keccak 256 and the field-programmable gate array (FPGA) ZedBoard development kit. This implementation shows improvement in execution time of 338% and minimizing power consumption of 255% compared to the use of Nvidia Maxwell GPUs.
Quantum computation represents a threat to many cryptographic protocols in operation today. It has been estimated that by 2035, there will exist a quantum computer capable of breaking the vital cryptographic scheme RSA2048. Blockchain technologies rely on cryptographic protocols for many of their essential sub-routines. Some of these protocols, but not all, are open to quantum attacks. Here we analyze the major blockchain-based cryptocurrencies deployed today -- including Bitcoin, Ethereum, Litecoin and ZCash, and determine their risk exposure to quantum attacks. We finish with a comparative analysis of the studied cryptocurrencies and their underlying blockchain technologies and their relative levels of vulnerability to quantum attacks.
Bishakh Chandra Ghosh, Tanay Bhartia, Sourav Kanti Addya, Sandip Chakraborty
With the increasing adoption of private blockchain platforms, consortia operating in various sectors such as trade, finance, logistics, etc., are becoming common. Despite having the benefits of a completely decentralized architecture which supports transparency and distributed control, existing private blockchains limit the data, assets, and processes within its closed boundary, which restricts secure and verifiable service provisioning to the end-consumers. Thus, platforms such as e-commerce with multiple sellers or cloud federation with a collection of cloud service providers cannot be decentralized with the existing blockchain platforms. This paper proposes a decentralized gateway architecture interfacing private blockchain with end-users by leveraging the unique combination of public and private blockchain platforms through interoperation. Through the use case of decentralized cloud federations, we have demonstrated the viability of the solution. Our testbed implementation with Ethereum and Hyperledger Fabric, with three service providers, shows that such consortium can operate within an acceptable response latency while scaling up to 64 parallel requests per second for cloud infrastructure provisioning. Further analysis over the Mininet emulation platform indicates that the platform can scale well with minimal impact over the latency as the number of participating service providers increases.
Christian Bräm, Marco Eilers, Péter Müller, Robin Sierra · 5 authors
Smart contracts are programs that execute inside blockchains such as Ethereum to manipulate digital assets. Since bugs in smart contracts may lead to substantial financial losses, there is considerable interest in formally proving their correctness. However, the specification and verification of smart contracts faces challenges that do not arise in other application domains. Smart contracts frequently interact with unverified, potentially adversarial outside code, which substantially weakens the assumptions that formal analyses can (soundly) make. Moreover, the core functionality of smart contracts is to manipulate and transfer resources; describing this functionality concisely requires dedicated specification support. Current reasoning techniques do not fully address these challenges, being restricted in their scope or expressiveness (in particular, in the presence of re-entrant calls), and offering limited means of expressing the resource transfers a contract performs.
In this paper, we present a novel specification methodology tailored to the domain of smart contracts. Our specification constructs and associated reasoning technique are the first to enable: (1) sound and precise reasoning in the presence of unverified code and arbitrary re-entrancy, (2) modular reasoning about collaborating smart contracts, and (3) domain-specific specifications based on resources and resource transfers, which allow expressing a contract's behavior in intuitive and concise ways and exclude typical errors by default. We have implemented our approach in 2vyper, an SMT-based automated verification tool for Ethereum smart contracts written in the Vyper language, and demonstrated its effectiveness in succinctly capturing and verifying strong correctness guarantees for real-world contracts.