Sara Ghaemi, Sara Rouhani, Rafael Belchior, Rui Santos Cruz · 6 authors
The maturing of blockchain technology leads to heterogeneity, where multiple solutions specialize in a particular use case. While the development of different blockchain networks shows great potential for blockchains, the isolated networks have led to data and asset silos, limiting the applications of this technology. Blockchain interoperability solutions are essential to enable distributed ledgers to reach their full potential. Such solutions allow blockchains to support asset and data transfer, resulting in the development of innovative applications. This paper proposes a novel blockchain interoperability solution for permissioned blockchains based on the publish/subscribe architecture. We implemented a prototype of this platform to show the feasibility of our design. We evaluate our solution by implementing examples of the different publisher and subscriber networks, such as Hyperledger Besu, which is an Ethereum client, and two different versions of Hyperledger Fabric. We present a performance analysis of the whole network that indicates its limits and bottlenecks. Finally, we discuss the extensibility and scalability of the platform in different scenarios. Our evaluation shows that our system can handle a throughput in the order of the hundreds of transactions per second.
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Different types of malicious activities have been flagged in multiple\npermissionless blockchains such as bitcoin, Ethereum etc. While some malicious\nactivities exploit vulnerabilities in the infrastructure of the blockchain,\nsome target its users through social engineering techniques. To address these\nproblems, we aim at automatically flagging blockchain accounts that originate\nsuch malicious exploitation of accounts of other participants. To that end, we\nidentify a robust supervised machine learning (ML) algorithm that is resistant\nto any bias induced by an over representation of certain malicious activity in\nthe available dataset, as well as is robust against adversarial attacks. We\nfind that most of the malicious activities reported thus far, for example, in\nEthereum blockchain ecosystem, behaves statistically similar. Further, the\npreviously used ML algorithms for identifying malicious accounts show bias\ntowards a particular malicious activity which is over-represented. In the\nsequel, we identify that Neural Networks (NN) holds up the best in the face of\nsuch bias inducing dataset at the same time being robust against certain\nadversarial attacks.\n
Tomáš Krupa, Michal Ries, Ivan Kotuliak, Kristián Košťál · 5 authors
Smart contracts belong to the most rapidly growing aspect of the world of cryptocurrencies. This phenomenon attracts great attention from researchers but also the business community, and the development brings daily a lot of novel applications. Smart contracts allow running contract code transparently for all parties, without the need for a centralized authority. One of the smart contract applications is the issuance of digital assets, so-called tokens, serving as fundraising fuel for Initial Coin Offerings. ICOs bring a new easy, and bureaucracyless way for startups to raise considerable funds from crowds with incredible speed. However, the technology hides a dark side in the form of speculative scams, hardly distinguishable from genuine fundraising activities. Evaluation audit of ICOs associated with the underlying security of smart contracts is a complex issue requiring many efforts. This paper focuses on one of the most popular blockchain frameworks, Ethereum, a prominent ICO and smart contract platform, and its dominant programming language, Solidity.
Blockchain was mainly introduced for secure transactions in connection with the mining of cryptocurrency Bitcoin. This article discusses the fundamental concepts of blockchain technology and its components, such as block header, transaction, smart contracts, etc. Blockchain uses the distributed databases, so this article also explains the advantages of distributed Blockchain over a centrally located database. Depending on the application, Blockchain is broadly categorized into two categories; Permissionless and Permissioned. This article elaborates on these two categories as well. Further, it covers the consensus mechanism and its working along with an overview of the Ethereum platform. Blockchain technology has been proved to be one of the remarkable techniques to provide security to IoT devices. An illustration of how Blockchain will be useful for IoT devices has been given. A few applications are also illustrated to explain the working of Blockchain with IoT.
Reputation expresses the beliefs or opinions about someone or something that are held by an individual or by a community. Reputation Management Systems (RMSs) handle representation, computation, and storage of reputation in some quantitative form, suitable for grounding trust relations among parties. Quantifying reputation is important in situations, like online service provision, which involve interaction between parties who do not know (and potentially distrust) each other. The basic idea is to let parties rate each other. When a party is considered for interaction, its ratings can be aggregated in order to derive a score for deciding whether to trust it or not. While much valuable research work has been done on reputation-based trust schemes, the problem of establishing collective trust in the reputation management system itself has never been fully solved. Recently, several researchers have put forward the idea of using Distributed Ledger Technology (DLT) as the foundation for implementing trustworthy RMSs. The purpose of this paper is to identify some critical problems that arise when DLTs are used in order to manage evidence about previous interaction and compute reputations. The paper proposes some practical solutions and describes methods to deploy them on top of standard DLT of the Ethereum family.
Hyoungsung Kim, Jaehyuk Jang, Sangjun Park, Heung-No Lee
The error-correction code based proof-of-work (ECCPoW) algorithm is based on a low-density parity-check (LDPC) code. The ECCPoW is possible to impair ASIC with its time-varying capability of the parameters of LDPC code. Previous researches on the ECCPoW algorithm have presented its theory and implementation on Bitcoin. But they do not discuss how stable the block generation time is. A finite mean block generation time (BGT) and none heavy-tail BGT distribution are the ones of the focus in this study. In the ECCPoW algorithm, BGT may show a long-tailed distribution due to time-varying cryptographic puzzles. Thus, it is of interest to see if the BGT distribution is not heavy-tailed and if it shows a finite mean. If the distribution is heavy-tailed, then confirmation of a transaction cannot be guaranteed. We present implementation, simulation, and validation of ECCPoW Ethereum. In implementation, we explain how the ECCPoW algorithm is integrated into Ethereum 1.0 as a new consensus algorithm. In the simulation, we perform a multinode simulation to show that the ECCPoW Ethereum works well with automatic difficulty change. In the validation, we present the statistical results of the two-sample Anderson-Darling test to show that the distribution of BGT satisfies the necessary condition of the exponential distribution. Our implementation is downloadable at https://github.com/cryptoecc/ETH-ECC.
Decentralization has been widely acknowledged as a core virtue of blockchains. However, in the past, there have been few measurement studies on measuring and comparing the actual level of decentralization between existing blockchains using multiple metrics and granularities. This paper presents a new comparison study of the degree of decentralization in Bitcoin and Ethereum, the two most prominent blockchains, with various decentralization metrics and different granularities within the time dimension. Specifically, we measure the degree of decentralization in the two blockchains during 2019 by computing the distribution of mining power with three metrics (Gini coefficient, Shannon entropy, and Nakamoto coefficient) as well as three granularities (days, weeks, and months). Our measurement results with different metrics and granularities reveal the same trend that, compared with each other, the degree of decentralization in Bitcoin is higher, while the degree of decentralization in Ethereum is more stable. To obtain the cross-interval information missed in the fixed window based measurements, we propose the sliding window based measurement approach. The corresponding results demonstrate that the use of sliding windows could reveal additional cross-interval information overlooked by the fixed window based measurements, thus enhancing the effectiveness of measuring decentralization in terms of continuous trends and abnormal situations. We believe that the methodologies and findings in this paper can facilitate future studies of decentralization in blockchains.
Nur Widiyasono, Aldy Putra Aldya, Rifan Renanda Ardhian
“Miners” bekerja untuk memecahkan masalah matematika yang kompleks untuk menghasilkan pendapatan dalam bentuk mata uang digital, seperti Bitcoin, Ethereum, Monero, dan lainnya. Proses mining ini membutuhkan perangkat keras yang serius dan sumber daya CPU yang signifikan untuk menciptakan cryptocurrency. Cryptojacking salah satu alat penambangan mata uang digital secara illegal. Cryptojacking dapat memberikan return yang lebih substansial bagi penyerang.Cryptominer jenis ini tidak terlalu membahayakan secara langsung kepada para korbannya, tetapi hanya saja menggunakan akses illegal ke komputer korban dan menggunakan sumber daya korban untuk menambang crypto. Metode yang digunakan adalah dynamic analysis. Dinamic Analysis adalah mencari informasi atau sampel mengenai malware dengan cara menjalankannya. Dengan metode ini dapat terlihat “perilaku” dari malware tersebut sehingga selanjutnya dapat dianalisa dampak yang terjadi. Pengujian malware ini dilakukan dengan 2 cara yaitu pengujian pertama dilakukan dengan javascript injection pada jaringan lokal yang sama dengan korban yaitu wifi publik dan pengujian kedua dengan mengakses website yang terindikasi skrip cryptojacking. Berdasarkan hasil analisis menggunakan dynamic analysis dimana cryptojacking dapat menginfeksi langsung ke website atau melalui jaringan local dengan javascript injection, jika website telah terinfeksi cryptojacking maka pengunjung dari website tersebut akan menjadi korban dan terjadi penambangan tersembunyi yang akan memakan sumber daya korban dan cryptojacking operator dalang dibalik website yang terinfeksi akan menerima keuntungan dalam bentuk mata uang digital dari hasil cryptojacking ini
Private blockchain networks are used by enterprises to manage decentralized processes without trusted mediators and without exposing their assets publicly on an open network like Ethereum. Yet external parties that cannot join such networks may have a compelling need to be informed about certain data items on their shared ledgers along with certifications of data authenticity; e.g., a mortgage bank may need to know about the sale of a mortgaged property from a network managing property deeds. These parties are willing to compensate the networks in exchange for privately sharing information with proof of authenticity and authorization for external use. We have devised a novel and cryptographically secure protocol to effect a fair exchange between rational network members and information recipients using a public blockchain and atomic swap techniques. Using our protocol, any member of a private blockchain can atomically reveal private blockchain data with proofs in exchange for a monetary reward to an external party if and only if the external party is a valid recipient. The protocol preserves confidentiality of data for the recipient, and in addition, allows it to mount a challenge if the data turns out to be inauthentic. We also formally analyze the security and privacy of this protocol, which can be used in a wide array of practical scenarios
Sam M. Werner, Daniel Pérez, Lewis Gudgeon, Ariah Klages‐Mundt · 6 authors
Decentralized Finance (DeFi), a blockchain powered peer-to-peer financial system, is mushrooming. Two years ago the total value locked in DeFi systems was approximately 700m USD, now, as of April 2022, it stands at around 150bn USD. The frenetic evolution of the ecosystem has created challenges in understanding the basic principles of these systems and their security risks. In this Systematization of Knowledge (SoK) we delineate the DeFi ecosystem along the following axes: its primitives, its operational protocol types and its security. We provide a distinction between technical security, which has a healthy literature, and economic security, which is largely unexplored, connecting the latter with new models and thereby synthesizing insights from computer science, economics and finance. Finally, we outline the open research challenges in the ecosystem across these security types.
Abstract Several applications can benefit from recording information about the places a mobile entity visits and the length of time it spends there (e.g., shoppers, employees, buses, portable equipment, autonomous robots). This paper presents our approach to recording spatio-temporal presence information in a secure and inviolable way using a Distributed Ledger Technology. We implemented this solution as a middleware service that uses Complex Event Processing on smartphones to record beacon-smartphone proximity data in a blockchain efficiently. We have built upon the previous version of our service to include access control to the stored information. We analyzed the impact of this addition on the service’s performance and observed that it introduced very little overhead while significantly increasing user privacy. Furthermore, we compared the effect of using different blockchain technologies on overall service performance and characterized scenarios where using either IoTeX or Ethereum can be suitable for this type of application.
Mobile app markets are emerging with the popularity of smartphones. However, they fall short in several aspects, including no transparent app listing, no world-wide app access, and even insecure app downloading. To address these problems, we propose a novel blockchain-based gateway, AGChain, to bridge end users and app markets so that existing app markets could still provide services while users enjoy permanent, distributed, and secure app delegation from AGChain. To this end, we identify two previously under-estimated challenges and propose mechanisms to significantly reduce gas costs in our smart contract and make IPFS (Inter-planetary File System) based file storage really distributed. We also address three AGChain-specific system challenges to make it secure and sustainable. We have implemented an AGChain prototype (https://www.agchain.ltd/) on Ethereum. The evaluation shows that it achieves security and decentralization with minimal gas costs and reasonable performance.
The popularity of smartphones has led to the growth of mobile app markets, creating a need for enhanced transparency, global access, and secure downloading. This paper introduces AGChain, a blockchain-based gateway that enables trustworthy app delegation within existing markets. AGChain ensures that markets can continue providing services while users benefit from permanent, distributed, and secure app delegation. During its development, we address two key challenges: significantly reducing smart contract gas costs and enabling fully distributed IPFS-based file storage. Additionally, we tackle three system issues related to security and sustainability. We have implemented a prototype of AGChain on Ethereum and Polygon blockchains, achieving effective security and decentralization with a minimal gas cost of around 0.002 USD per app upload (no cost for app download). The system also exhibits reasonable performance with an average overhead of 12%.
In this work, we consider community detection in blockchain networks. We specifically take the Bitcoin network and Ethereum network as two examples, where community detection serves in different ways. For the Bitcoin network, we modify the traditional community detection method and apply it to the transaction social network to cluster users with similar characteristics. For the Ethereum network, on the other hand, we define a bipartite social graph based on the smart contract transactions. A novel community detection algorithm which is designed for low-rank signals on graph can help find users' communities based on user-token subscription. Based on these results, two strategies are devised to deliver on-chain advertisements to those users in the same community. We implement the proposed algorithms on real data. By adopting the modified clustering algorithm, the community results in the Bitcoin network is basically consistent with the ground-truth of betting site community which has been announced to the public. At the meanwhile, we run the proposed strategy on real Ethereum data, visualize the results and implement an advertisement delivery on the Ropsten test net.
Financial regulators have long-standing concerns about fully decentralized exchanges that run 'on-chain' without any obvious regulatory hooks. The popularity of Uniswap, an automated market makers (AMM), made these concerns a reality. AMMs implement a lightweight dealer-based trading system, but they are unlike anything on Wall Street, require fees intrinsically, and are susceptible to front-running attacks. This leaves the following research questions we address in this paper: (1) are conventional (i.e., order books), secure (i.e., resistant to front-running and price manipulation) and fully decentralized exchanges feasible on a public blockchain like Ethereum, (2) what is the performance profile, and (3) how much do Layer 2 techniques (e.g., Arbitrum) increase performance? To answer these questions, we implement, benchmark, and experiment with an Ethereum-based call market exchange called Lissy. We confirm the functionality is too heavy for Ethereum today (you cannot expect to exceed a few hundred trade executions per block) but show it scales dramatically (99.88% gas cost reduction) on Arbitrum.
Rongjian Lan, Ganesha Upadhyaya, Stephen Tse, Mahdi Zamani
With the rise of digital currency systems that rely on blockchain to ensure ledger security, the ability to perform cross-chain transactions is becoming a crucial interoperability requirement. Such transactions allow not only funds to be transferred from one blockchain to another (as done in atomic swaps), but also a blockchain to verify the inclusion of any event on another blockchain. Cross-chain bridges are protocols that allow on-chain exchange of cryptocurrencies, on-chain transfer of assets to sidechains, and cross-shard verification of events in sharded blockchains, many of which rely on Byzantine fault tolerance (BFT) for scalability. Unfortunately, existing bridge protocols that can transfer funds from a BFT blockchain incur significant computation overhead on the destination blockchain, resulting in a high gas cost for smart contract verification of events. In this paper, we propose Horizon, a gas-efficient, cross-chain bridge protocol to transfer assets from a BFT blockchain to another blockchain (e.g., Ethereum) that supports basic smart contract execution.
Blockchain technologies are at the heart of digital innovation and are a harbinger of Industry 4.0. Consequently, popular press and academic researchers alike have focused on its importance. Yet blockchain technologies’ most promising efforts, cryptocurrency and smart contracts, are underpinned by blockchain mining. The blockchain mining service is undergoing change, cryptocurrencies like Ethereum and others are nearing the end of their minting. Smart contracts are in their infancy. The financial impetus for providing the mining service has changed. Here, we add to the literature through a deep financial analysis of blockchain mining regarding its long-term financial viability. Our methods include a financial cost analysis and an analysis of the financial viability of cryptocurrency through focus on Ethereum. It is found that blockchain miners, despite initial profitability, cannot maintain sustainable financial viability without substantial fees. This article is important to those academics who focus on understanding how service technologies and products underpin Industry 4.0. Finally, this article contributes to the practitioners’ decision-making process to embrace blockchain mining as a technological entrepreneur.
The origins of digital money and blockchain technology goes back to the 1980s, but in the last decade, the blockchain technology gained large popularity in the financial sector with the appearance of cryptocurrencies such as Bitcoin. However, recently, many other fields of application have been recognized, particularly with the development of smart contracts. Among them is the possible application of blockchain technology in the domain of land administration, mostly as a tool for transparency in the developing countries and means to fight corruption. However, developed countries also find interest in launching pilot projects to test their applicability in land administration domain for reasons such as to increase the speed and reduce costs of the real property transactions through a more secure environment. In this paper, we analyse how transactions are handled in Serbian land administration and how this process may be supported by modern ledger technologies such as blockchain. In order to analyse how blockchain could be implemented to support transactions in land information systems (LIS), it is necessary to understand cadastral processes and transactions in LIS, as well as legislative and organizational aspects of LIS. Transactions in cadastre comprise many actors and utilize both alphanumeric (descriptive or legal) data and geospatial data about property boundaries on the cadastral map. Based on the determined requirements for the blockchain-based LIS, we propose a system architecture for its implementation. Such a system keeps track of transactions in LIS in an immutable and tamper-proof manner to increase the security of the system and consequently increase the speed of transactions, efficiency, and data integrity without a significant impact on the existing laws and regulations. The system is anticipated as a permissioned public blockchain implemented on top of the Ethereum network.
Christof Ferreira Torres, Antonio Ken Iannillo, Arthur Gervais, Radu State
In recent years, Ethereum gained tremendously in popularity, growing from a\ndaily transaction average of 10K in January 2016 to an average of 500K in\nJanuary 2020. Similarly, smart contracts began to carry more value, making them\nappealing targets for attackers. As a result, they started to become victims of\nattacks, costing millions of dollars. In response to these attacks, both\nacademia and industry proposed a plethora of tools to scan smart contracts for\nvulnerabilities before deploying them on the blockchain. However, most of these\ntools solely focus on detecting vulnerabilities and not attacks, let alone\nquantifying or tracing the number of stolen assets. In this paper, we present\nHorus, a framework that empowers the automated detection and investigation of\nsmart contract attacks based on logic-driven and graph-driven analysis of\ntransactions. Horus provides quick means to quantify and trace the flow of\nstolen assets across the Ethereum blockchain. We perform a large-scale analysis\nof all the smart contracts deployed on Ethereum until May 2020. We identified\n1,888 attacked smart contracts and 8,095 adversarial transactions in the wild.\nOur investigation shows that the number of attacks did not necessarily decrease\nover the past few years, but for some vulnerabilities remained constant.\nFinally, we also demonstrate the practicality of our framework via an in-depth\nanalysis on the recent Uniswap and Lendf.me attacks.\n
Orestis Alpos, Christian Cachin, Giorgia Azzurra Marson, Luca Zanolini
Modern blockchains support a variety of distributed applications beyond cryptocurrencies, including smart contracts -- which let users execute arbitrary code in a distributed and decentralized fashion. Regardless of their intended application, blockchain platforms implicitly assume consensus for the correct execution of a smart contract, thus requiring that all transactions are totally ordered. It was only recently recognized that consensus is not necessary to prevent double-spending in a cryptocurrency (Guerraoui et al., PODC'19), contrary to common belief. This result suggests that current implementations may be sacrificing efficiency and scalability because they synchronize transactions much more tightly than actually needed. In this work, we study the synchronization requirements of Ethereum's ERC20 token contract, one of the most widely adopted smart contacts. Namely, we model a smart-contract token as a concurrent object and analyze its consensus number as a measure of synchronization power. We show that the richer set of methods supported by ERC20 tokens, compared to standard cryptocurrencies, results in strictly stronger synchronization requirements. More surprisingly, the synchronization power of ERC20 tokens depends on the object's state and can thus be modified by method invocations. To prove this result, we develop a dedicated framework to express how the object's state affects the needed synchronization level. Our findings indicate that ERC20 tokens, as well as other token standards, are more powerful and versatile than plain cryptocurrencies, and are subject to dynamic requirements. Developing specific synchronization protocols that exploit these dynamic requirements will pave the way towards more robust and scalable blockchain platforms.
This paper presents EDSC, a novel smart contract platform design based on the event-driven execution model as opposed to the traditionally employed transaction-driven execution model. We reason that such a design is a better fit for many emerging smart contract applications and is better positioned to address the scalability and performance challenges plaguing the smart contract ecosystem. We propose EDSC's design under the Ethereum framework, and the design can be easily adapted for other existing smart contract platforms. We have conducted implementation using Ethereum client and experiments where performance modeling results show on average 2.2 to 4.6 times reduced total latency of event triggered smart contracts, which demonstrates its effectiveness for supporting contracts that demand timely execution based on events. In addition, we discuss example use cases to demonstrate the design's utility and comment on its potential security dynamics.
Hendrik Amler, Lisa Eckey, Sebastian Faust, Marcel Kaiser · 6 authors
The decentralized and trustless nature of cryptocurrencies and blockchain technology leads to a shift in the digital world. The possibility to execute small programs, called smart contracts, on cryptocurrencies like Ethereum opened doors to countless new applications. One particular exciting use case is decentralized finance (DeFi), which aims to revolutionize traditional financial services by founding them on a decentralized infrastructure. We show the potential of DeFi by analyzing its advantages compared to traditional finance. Additionally, we survey the state-of-the-art of DeFi products and categorize existing services. Since DeFi is still in its infancy, there are countless hurdles for mass adoption. We discuss the most prominent challenges and point out possible solutions. Finally, we analyze the economics behind DeFi products. By carefully analyzing the state-of-the-art and discussing current challenges, we give a perspective on how the DeFi space might develop in the near future.
Permissionless blockchains such as Bitcoin have excelled at financial services. Yet, opportunistic traders extract monetary value from the mesh of decentralized finance (DeFi) smart contracts through so-called blockchain extractable value (BEV). The recent emergence of centralized BEV relayer portrays BEV as a positive additional revenue source. Because BEV was quantitatively shown to deteriorate the blockchain's consensus security, BEV relayers endanger the ledger security by incentivizing rational miners to fork the chain. For example, a rational miner with a 10% hashrate will fork Ethereum if a BEV opportunity exceeds 4x the block reward. However, related work is currently missing quantitative insights on past BEV extraction to assess the practical risks of BEV objectively. In this work, we allow to quantify the BEV danger by deriving the USD extracted from sandwich attacks, liquidations, and decentralized exchange arbitrage. We estimate that over 32 months, BEV yielded 540.54M USD in profit, divided among 11,289 addresses when capturing 49,691 cryptocurrencies and 60,830 on-chain markets. The highest BEV instance we find amounts to 4.1M USD, 616.6x the Ethereum block reward. Moreover, while the practitioner's community has discussed the existence of generalized trading bots, we are, to our knowledge, the first to provide a concrete algorithm. Our algorithm can replace unconfirmed transactions without the need to understand the victim transactions' underlying logic, which we estimate to have yielded a profit of 57,037.32 ETH (35.37M USD) over 32 months of past blockchain data. Finally, we formalize and analyze emerging BEV relay systems, where miners accept BEV transactions from a centralized relay server instead of the peer-to-peer (P2P) network. We find that such relay systems aggravate the consensus layer attacks and therefore further endanger blockchain security.
Florian Spychiger, Paolo Tasca, Claudio J. Tessone
This study covers the evolutionary development of blockchain technologies over the last 11 years (2009–2019) and sheds lights on potential areas of innovation in heretofore unexplored sub-components. For this purpose, we collected and analyzed detailed data on 107 different blockchain technologies and studied their component-wise technological evolution. The diversity of their designs was captured by deconstructing the blockchains using the Tasca-Tessone taxonomy to build what we call the “ tree of blockchain ” composed of blockchain main and sub-components. With the support of information theory and phylogenetics, we found that most design explorations have been conducted within the components in the areas of consensus mechanisms and cryptographic primitives. We also show that some sub-components like Consensus Immutability and Failure Tolerance, Access and Control layer , and Access Supply Management have predictive power over other sub-components. We finally found that few dominant design models—the genetic driving clusters of Bitcoin, Ethereum, and XRP—influenced the evolutionary paths of most of the succeeding blockchains.