Federated learning enables the development of a machine learning model among collaborating agents without requiring them to share their underlying data. However, malicious agents who train on random data, or worse, on datasets with the result classes inverted, can weaken the combined model. BlockFLow is an accountable federated learning system that is fully decentralized and privacy-preserving. Its primary goal is to reward agents proportional to the quality of their contribution while protecting the privacy of the underlying datasets and being resilient to malicious adversaries. Specifically, BlockFLow incorporates differential privacy, introduces a novel auditing mechanism for model contribution, and uses Ethereum smart contracts to incentivize good behavior. Unlike existing auditing and accountability methods for federated learning systems, our system does not require a centralized test dataset, sharing of datasets between the agents, or one or more trusted auditors; it is fully decentralized and resilient up to a 50% collusion attack in a malicious trust model. When run on the public Ethereum blockchain, BlockFLow uses the results from the audit to reward parties with cryptocurrency based on the quality of their contribution. We evaluated BlockFLow on two datasets that offer classification tasks solvable via logistic regression models. Our results show that the resultant auditing scores reflect the quality of the honest agents' datasets. Moreover, the scores from dishonest agents are statistically lower than those from the honest agents. These results, along with the reasonable blockchain costs, demonstrate the effectiveness of BlockFLow as an accountable federated learning system.
Ilham Qasse, Josef Spillner, Manar Abu Talib, Qassim Nasir
Repositories are important indicators for liveness and maturity in software development communities. They host user-facing applications or re-usable artefacts to build such applications. While rarely decentralised themselves, they are important for hosting code for decentralized applications. In this study, we investigate public repositories dedicated to decentralised applications, or ĐApps, executing on heterogeneous blockchain platforms. The study is the first to report aggregated metrics on the repository-level and application-level characteristics including ĐApps metadata, associated smart contracts composition and inconsistencies between repositories in both schema and content. The main contributions are data acquisition tools and an evolving public dataset along with an initial analysis to derive key metrics in a reproducible way. Insights provided encompass the dominance of Ethereum, the absence of smart contracts for a significant portion of applications, and unused application advertisement potential by absence from popular repositories. The insights can be exploited by developers to build high-quality and highly popular applications and set up corresponding quality checks.
Universal connectivity is still unavailable or expensive for half of the global population, despite being critical for social participation. The deployment of crowdsourced networking infrastructures creates an opportunity for local development, where anyone can deploy a new device. In such infrastructures connectivity offer can expand incrementally and be sustainable through investment and fees resulting from the demand and consumption of content and services, including Internet access, that compensate the cost of the underlying network. While routing coordinates network data flows, economic flows can be coordinated by smart contracts built over a local distributed ledger. We define crowdsourced networks, the concept, architecture, and implementation using a local Ethereum PoA blockchain with Solidity smart contracts that compensate the data traffic contribution and consumption recorded by a traffic monitoring system, on a wireless mesh network. The prototype software has been validated in a controlled mesh network environment. Functional tests show its ability to account and route economic flows with small resource consumption, and therefore confirms these networks can develop organically by the addition of consumer and provider participants to reach the typical scale of most wireless mesh access networks and deliver networking services that aim to be socially and economically sustainable.
Academic publication of latest research results are crucial to advance the development of all disciplines. However, the current academic publication procedure lacks transparency in the review process, and reviewers do not have strong incentives to provide quality reviews for their peers. This may lead to misconducts in the review process, e.g. an anonymous reviewer may give biased comments to a paper without being noticed since the comments are seldom published for evaluation. In addition, it is ironic that the research community has to pay a lot to access papers reviewed by the community for free, though free sharing of research results is important for research advances.To address the above problems, we propose Open-Pub, a decentralized, transparent yet privacy-preserving academic publication scheme based on the blockchain technology. The blockchain promises transparency in the review process and provides an incentive mechanism based on cryptocurrency, but the privacy requirement in the double-blind review process still needs to be fulfilled. To this end, we first design a threshold identity-based group signature (TIBGS) using verifiable secret sharing to protect identity confidentiality. Then we develop a strong double-blind procedure to protect the identities of authors and reviewers. With this strong double-blind procedure, authors can choose to submit papers anonymously, and validators distribute papers anonymously to reviewers on the blockchain according to their research interests. This process is publicly recorded and traceable on the blockchain so as to realize transparent peer preview. To evaluate its efficiency, we implement Open-Pub based on Ethereum and conduct comprehensive experiments to evaluate its performance, including computation costs and processing delay. The experiment results show that Open-Pub is highly efficient in computation and processing anonymous transactions.
João F. Ferreira, Pedro E. D. Cruz, Thomas Durieux, Abreu, Rui
Over the last few years, there has been substantial research on automated analysis, testing, and debugging of Ethereum smart contracts. However, it is not trivial to compare and reproduce that research. To address this, we present SmartBugs, an extensible and easy-to-use execution framework that simplifies the execution of analysis tools on smart contracts written in Solidity, the primary language used in Ethereum. SmartBugs is currently distributed with support for 10 tools and two datasets of Solidity contracts. The first dataset can be used to evaluate the precision of analysis tools, as it contains 143 annotated vulnerable contracts with 208 tagged vulnerabilities. The second dataset contains 47,518 unique contracts collected through Etherscan. We discuss how SmartBugs supported the largest experimental setup to date both in the number of tools and in execution time. Moreover, we show how it enables easy integration and comparison of analysis tools by presenting a new extension to the tool SmartCheck that improves substantially the detection of vulnerabilities related to the DASP10 categories Bad Randomness, Time Manipulation, and Access Control (identified vulnerabilities increased from 11% to 24%).
Non-fungible tokens are an up and coming application domain for smart contracts. Ethereum is the first blockchain-based decentralized computing platform that has standardized this type of tokens into a well-defined interface, namely ERC721. We propose a framework that provides developers with a smart contract suite that offers complete implementations of the ERC721 standard and common extensions and features frequently encountered in ERC721-based applications. We introduce a specification language that enables customization and configuration of the smart contract suite by including and excluding the supported features and extensions. We evaluate the smart contract suite for its extensibility and reusability and compare the metrics with four reference implementations tackling a similar problem. In addition to this, we evaluate and analyze the effort and efficiency of the specification language in comparison to manual configuration of the smart contract suite. Our contribution lies in examining quality metrics for code extensibility and reusability and determining the more insightful metrics for assessing these quality attributes in the context of Solidity smart contracts. Additionally, from the lines of code metric, We conclude that our specification language offers a simple and efficient alternative to manual smart contract suite customization.
Federated learning enables the development of a machine learning model among\ncollaborating agents without requiring them to share their underlying data.\nHowever, malicious agents who train on random data, or worse, on datasets with\nthe result classes inverted, can weaken the combined model. BlockFLow is an\naccountable federated learning system that is fully decentralized and\nprivacy-preserving. Its primary goal is to reward agents proportional to the\nquality of their contribution while protecting the privacy of the underlying\ndatasets and being resilient to malicious adversaries. Specifically, BlockFLow\nincorporates differential privacy, introduces a novel auditing mechanism for\nmodel contribution, and uses Ethereum smart contracts to incentivize good\nbehavior. Unlike existing auditing and accountability methods for federated\nlearning systems, our system does not require a centralized test dataset,\nsharing of datasets between the agents, or one or more trusted auditors; it is\nfully decentralized and resilient up to a 50% collusion attack in a malicious\ntrust model. When run on the public Ethereum blockchain, BlockFLow uses the\nresults from the audit to reward parties with cryptocurrency based on the\nquality of their contribution. We evaluated BlockFLow on two datasets that\noffer classification tasks solvable via logistic regression models. Our results\nshow that the resultant auditing scores reflect the quality of the honest\nagents' datasets. Moreover, the scores from dishonest agents are statistically\nlower than those from the honest agents. These results, along with the\nreasonable blockchain costs, demonstrate the effectiveness of BlockFLow as an\naccountable federated learning system.\n
David Yakira, Avi Asayag, Ido Grayevsky, Idit Keidar
We study the problem of providing blockchain applications with \emph{economically viable randomness} (EVR), namely, randomness that has significant economic consequences. Applications of EVR include blockchain-based lotteries and gambling. An EVR source guarantees (i) secrecy, assuring that the random bits are kept secret until some predefined condition indicates that they are safe to reveal (e.g., the lottery's ticket sale closes), and (ii) robustness, guaranteeing that the random bits are published once the condition holds. We formalize the EVR problem and solve it on top of an Ethereum-like blockchain abstraction, which supports smart contracts and a transferable native coin. Randomness is generated via a distributed open commit-reveal scheme by game-theoretic agents who strive to maximize their coin holdings. Note that in an economic setting, such agents might profit from breaking secrecy or robustness, and may engage in side agreements (via smart contracts) to this end. Our solution creates an incentive structure that counters such attacks. We prove that following the protocol gives rise to a stable state, called Coalition-Proof Nash Equilibrium, from which no coalition comprised of a subset of the players can agree to deviate. In this stable state, robustness and secrecy are satisfied. Finally, we implement our EVR source over Ethereum.
Mohammad Hossein Chinaei, Hassan Habibi Gharakheili, Vijay Sivaraman
Verification of data generated by wearable sensors is increasingly becoming of concern to health service providers and insurance companies. These devices are typically vulnerable to a wide range of cybersecurity attacks, attempting to manipulate sensing data. Most of these disastrous attacks would remain undetected since neither healthcare servers nor Internet-of-Things (IoT) sensors are aware of the existence of attackers in the middle of communication. Thus, there is a need for a verification framework that various authorities can request a verification service for the local network data of a target IoT device. In this article, we leverage blockchain as a distributed platform to realize an on-demand verification scheme. This allows authorities to automatically transact with connected devices for witnessing services. A public request is made for witness statements on the data of a target IoT that is transmitted on its local network, and subsequently, devices (in close vicinity of the target IoT) offer witnessing service. Our contributions are threefold: 1) we develop a system architecture based on blockchain and smart contract that enables authorities to dynamically avail a verification service for data of a subject device from a distributed set of witnesses which are willing to provide (in a privacy-preserving manner) their local wireless measurement in exchange of monetary return; 2) we then develop a method to optimally select witnesses in such a way that the verification error is minimized subject to monetary cost constraints; and 3) finally, we evaluate the efficacy of our scheme using real Wi-Fi session traces collected from a five-storeyed building with more than thirty access points, representative of a hospital. According to the current pricing schedule of the Ethereum public blockchain, our scheme enables healthcare authorities to verify data transmitted from a typical wearable device with the verification error of the order 0.01% at cost of less than $ 2 for 1-hr witnessing service.
Dimitris Vyzovitis, Yusef Napora, Dirk McCormick, David Dias · 5 authors
Permissionless blockchain environments necessitate the use of a fast and attack-resilient message propagation protocol for Block and Transaction messages to keep nodes synchronised and avoid forks. We present GossipSub, a gossip-based pubsub protocol, which, in contrast to past pubsub protocols, incorporates resilience against a wide spectrum of attacks. Firstly, GossipSub's mesh construction implements an eager push model keeps the fan-out of the pubsub delivery low and balances excessive bandwidth consumption and fast message propagation throughout the mesh. Secondly, through gossip dissemination, GossipSub realises a lazy-pull model to reach nodes far-away or outside the mesh. Thirdly, through constant observation, nodes maintain a score profile for the peers they are connected to, allowing them to choose the most well-behaved nodes to include in the mesh. Finally, and most importantly, a number of tailor-made mitigation strategies designed specifically for these three components make GossipSub resilient against the most challenging Sybil-based attacks. We test GossipSub in a testbed environment involving more than 5000 VM nodes deployed on AWS and show that it stays immune to all considered attacks. GossipSub is currently being integrated as the main messaging layer protocol in the Filecoin and the Ethereum 2.0 (ETH2.0) blockchains.
Dimitris Vyzovitis, Yusef Napora, Dirk McCormick, David Dias · 5 authors
Permissionless blockchain environments necessitate the use of a fast and\nattack-resilient message propagation protocol for Block and Transaction\nmessages to keep nodes synchronised and avoid forks. We present GossipSub, a\ngossip-based pubsub protocol, which, in contrast to past pubsub protocols,\nincorporates resilience against a wide spectrum of attacks.\n Firstly, GossipSub's mesh construction implements an eager push model keeps\nthe fan-out of the pubsub delivery low and balances excessive bandwidth\nconsumption and fast message propagation throughout the mesh. Secondly, through\ngossip dissemination, GossipSub realises a lazy-pull model to reach nodes\nfar-away or outside the mesh. Thirdly, through constant observation, nodes\nmaintain a score profile for the peers they are connected to, allowing them to\nchoose the most well-behaved nodes to include in the mesh. Finally, and most\nimportantly, a number of tailor-made mitigation strategies designed\nspecifically for these three components make GossipSub resilient against the\nmost challenging Sybil-based attacks. We test GossipSub in a testbed\nenvironment involving more than 5000 VM nodes deployed on AWS and show that it\nstays immune to all considered attacks. GossipSub is currently being integrated\nas the main messaging layer protocol in the Filecoin and the Ethereum 2.0\n(ETH2.0) blockchains.\n
Proliferation of IoT devices in society demands a renewed focus on securing the use and maintenance of such systems. IoT-based systems will have a great impact on society and therefore such systems must have guaranteed resilience. We introduce cryptographic-based building blocks that strive to ensure that distributed IoT networks remain in a healthy condition throughout their lifecycle. Our presented solution utilizes deterministic and interlinked smart contracts on the Ethereum blockchain to enforce secured management and maintenance for hardened IoT devices. A key issue investigated is the protocol development for securing IoT device deployments and means for communicating securely with devices. By supporting values of openness, automation, and provenance, we can introduce novel means that reduce the threats of surveillance and theft, while also improving operator accountability and trust in IoT technology.
This project aims to create a blockchain-based model that addresses key challenges in digital voting. The goal is to develop a secure and transparent system that eliminates common issues such as delays in result announcements, voter identity verification concerns, and security risks [1]. Voting is the backbone of any democracy, and ensuring its integrity is crucial. Traditional digital voting systems often face problems like fraud, manipulation, and lack of transparency. Blockchain technology, with its decentralized and tamper-proof nature, offers a promising solution. It functions as a distributed ledger that records transactions securely in a peer-to-peer network, making it nearly impossible to alter past data [2]. This technology brings several benefits to voting, including decentralization, security, transparency, immutability, and voter anonymity [3]. A major highlight of this project is the integration of blockchain with smart contracts, which adds an extra layer of security and automation to the voting process [4]. The system is designed to work on the Ethereum blockchain, using smart contracts written in Solidity and accessed through blockchain wallets [5]. By eliminating the need for a central authority to oversee elections, this approach ensures a fair and transparent voting process where every vote is securely recorded and cannot be tampered with [6]. In essence, this project reimagines digital voting by leveraging blockchain’s strengths, making elections more secure, efficient, and trustworthy.
Open access
3 source records
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
The proposed system is a decentralized authentic platform that aims to leverage blockchain along with other technologies to design a trusted framework which would enable charity donations to be as accountable, trustworthy and transparent. The paper explores the potential for deploying blockchain within existing organizations to support smooth conduction of charity funds from the donor to the actual needy person using a stable Ethereum based Blockchain oriented platform. In this fast developing world of modernization, some people are becoming too competitive to earn money while others have no clue about getting even a penny. But at the same time, there exist people who wish to contribute to the society out of altruism. There exist many online donation platforms in the world and yet issues concerning extra fees, accountability and processing delay still exist as well as these existing centralized systems for charities are so corrupt that people lose belief in these trustless systems and hence the charities become futile. This paper explores how the blockchain can be leveraged in the philanthropic sector, through charitable donation services via a web- based donor platform.
Gulshan Kumar, Rahul Saha, William J. Buchanan, G. Geetha · 8 authors
A distributed and transparent ledger system is considered for various e-commerce products including health medicines, electronics, security appliances, food products and many more to ensure technological and e-commerce sustainability. This solution, named as 'PRODCHAIN', is a generic blockchain framework with lattice-based cryptographic processes for reducing the complexity for tracing the e-commerce products. Moreover, we have introduced a rating based consensus process called Proof of Accomplishment (PoA). The solution has been analyzed and experimental studies are performed on Ethereum network. The results are discussed in terms of latency and throughput which prove the efficiency of PRODCHAIN in e-commerce products and services. The presented solution is beneficial for improving the traceability of the products ensuring the social and financial sustainability. This work will help the researchers to gain knowledge about the blockchain implications for supply chain possibilities in future developments for society.
Yuichiro Chinen, Naoto Yanai, Jason Paul Cruz, Shingo Okamura
Ethereum smart contracts are programs that are deployed and executed in a consensus-based blockchain managed by a peer-to-peer network. Several re-entrancy attacks that aim to steal Ether, the cryptocurrency used in Ethereum, stored in deployed smart contracts have been found in the recent years. A countermeasure to such attacks is based on dynamic analysis that executes the smart contracts themselves, but it requires the spending of Ether and knowledge of attack patterns for analysis in advance. In this paper, we present a static analysis tool named \textit{RA (Re-entrancy Analyzer)}, a combination of symbolic execution and equivalence checking by a satisfiability modulo theories solver to analyze smart contract vulnerabilities to re-entrancy attacks. In contrast to existing tools, RA supports analysis of inter-contract behaviors by using only the Etherum Virtual Machine bytecodes of target smart contracts, i.e., even without prior knowledge of attack patterns and without spending Ether. Furthermore, RA can verify existence of vulnerabilities to re-entrancy attacks without execution of smart contracts and it does not provide false positives and false negatives. We also present an implementation of RA to evaluate its performance in analyzing the vulnerability of deployed smart contracts to re-entrancy attacks and show that RA can precisely determine which smart contracts are vulnerable.
Abstract Cryptocurrencies are unique and extra-ordinary currencies which to be econometrically forced into the linear model due to their systematic complexity and extreme movements. This paper was conducted to provide an alternative analysis as a solution for escaping the restrictions of traditional linear assumptions. Five predominant digital currencies such as Bitcoin (BTC), Stellar network (XLM), Litecoin (LTC), Ethereum Classic (ETC), and IOTA were chosen to be employed in the multiple processes based on Bayesian approaches. Market dominance and data regime classifications are the essential components that lead to successfully investigate the dependent structures and co-movements in the digital financial market. The empirical findings could assume that the modern time-series data was meticulously estimated by the flexible modern tool. Bayesian statistics and simulations have the sufficient potency as the suitable solution.
Ignacio Huitzil, Alvaro Fuentemilla, Fernando Bobillo
This paper proposes a novel extension of blockchain systems with fuzzy ontologies. The main advantage is to let the users have flexible restrictions, represented using fuzzy sets, and to develop smart contracts where there is a partial agreement among the involved parts. We propose a general architecture based on four fuzzy ontologies and a process to develop and run the smart contracts, based on a reduction to a well-known fuzzy ontology reasoning task (Best Satisfiability Degree). We also investigate different operators to compute Pareto-optimal solutions and implement our approach in the Ethereum blockchain.
In Bitcoin and Ethereum, nodes require large storage capacity to maintain all the blockchain data, such as transactions, UTXOs, and account states. As of May 2020, the storage size of the Bitcoin blockchain has expanded to 270 GB, and it will continue to increase. This storage requirement is a major hurdle to becoming a block proposer or validator. Although many studies have attempted to reduce the storage size, in the proposed methods, a node cannot keep all blocks or cannot generate a block. We propose an architecture called Trail that allows nodes to hold all blocks in a small storage and to generate and validate blocks and transactions. Trail does not depend on a consensus algorithm or fork choice rule. In this architecture, a client who issues transactions has the data to prove its own balances and can generate a transaction containing the proof of balances. The nodes in Trail do not store transactions, UTXOs and account balances: they keep only blocks. The blocksize is approximately 8 KB, which is 100 times smaller than that of Bitcoin. Further, the block size is constant regardless of the number of accounts and the number of transactions. Compared to traditional blockchains, clients who issue transactions must store additional data. However, we show that proper data archiving can keep the account device storage size small. Trail allows more users to be block proposers and validators and improves the decentralization of the blockchain.
Im letzten Jahrzehnt hat der Begriff Blockchain aufgrund des Medienrummels um Bitcoin, der ersten Kryptowährung, immense Popularität erlangt. Bald darauf wurde die Blockchain-Technologie zu einer Inspiration für zusätzliche Anwendungen neben Kryptowährungen. Eine solche Anwendung sind Smart Contracts oder Programme mit dem Ziel, die Vereinbarungen eines Vertrags automatisch und sicher ohne die Unterstützung einer zentralen Stelle auszuführen. Derzeit ist Ethereum die wichtigste Blockchain-Plattform für Smart Contracts. Smart Contracts im Ethereum-Netzwerk können Teil einer dezentralen Anwendung sein oder als eigene Einheit existieren. Sie können durch eine externe Transaktion (User) oder eine interne Transaktion (einen Smart Contract) ausgelöst werden. Angesichts der Bedeutung und Sensibilität der Informationen und / oder Daten, mit denen Smart Contracts täglich umgehen, ist es wichtig, ein besseres Verständnis dafür zu erlangen, wie Smart Contracts tatsächlich funktionieren, welche Funktionen sie ausführen und wie sie im Ethereum-Netzwerk miteinander verbunden sind. In dieser Arbeit wird ein Ansatz für das Clustering von Smart Contracts auf Ethereum hinsichtlich der gemeinsamen Funktionalität vorgeschlagen, das die Graphdatenbank Neo4j und andere Visualisierungsmethoden und / oder –werkzeuge verwendet. Es werden verschiedene Datensätze (Partitionen des kompletten Datensatzes an Smart Contracts auf Ethereum), sowie zwei Clustering- Ansätze verwendet, um einen besseren Einblick in die Funktionsweise von Smart Contracts zu erhalten und deren funktionale Ähnlichkeiten zu verstehen.
Abstract Cryptocurrencies play a major role in the global financial ecosystem. Their presence across different geopolitical corridors, including in repressive regimes, has been one of their striking features. In this work, we leverage this feature for bootstrapping Censorship Resistant communication. We conceptualize the notion of stego-bootstrapping scheme and its security in terms of rareness and security against chosencovertext attacks. We present MoneyMorph , a provably secure stego-bootstrapping scheme using cryptocurrencies. MoneyMorph allows a censored user to interact with a decoder entity outside the censored region, through blockchain transactions as rendezvous, to obtain bootstrapping information such as a censorshipresistant proxy and its public key. Unlike the usual bootstrapping approaches (e.g., emailing) with heuristic security, if any, MoneyMorph employs public-key steganography over blockchain transactions to ensure provable cryptographic security. We design rendezvous over Bitcoin, Zcash, Monero, and Ethereum, and analyze their effectiveness in terms of available bandwidth and transaction cost. With its highly cryptographic structure, we show that Zcash provides 1148 byte bandwidth per transaction costing less than 0.01 USD as fee.
Conventional certificate verification, whether paper-based or backed by a centralized digital registry, remains exposed to forgery, single points of failure, and slow manual cross-checking between issuers, holders, and verifiers. This paper presents a decentralized, blockchain-based framework for issuing, storing, and verifying academic and professional certificates that addresses these weaknesses without placing the full document on-chain. Each certificate is reduced to a SHA-256 hash, signed with the issuing institution's RSA private key, and recorded through an Ethereum smart contract, while the original file is retained off-chain on IPFS and referenced by its Content Identifier. Only institutions that pass a unanimous, vote-based onboarding process administered by a validator consortium are permitted to issue certificates, which constrains the system to a trusted-issuer model while preserving decentralization across the validator set. A hash-mapped Bloom Filter sits in front of the blockchain query path and performs a fast probabilistic existence check, allowing forged or non-existent certificates to be rejected before an on-chain lookup is triggered. A prototype was implemented with Solidity smart contracts on the Ethereum Sepolia testnet, a Node.js/Web3.js application layer, and a React.js frontend with MetaMask-based authentication. Evaluation on the testnet shows that the Bloom Filter pre-check lowers the average lookup time for invalid certificates by roughly 87%, keeps verification of valid certificates under two seconds end-to-end, holds the false-positive rate below 0.5% for up to 50,000 stored certificate hashes, and reduces the gas cost of issuing a certificate to approximately 4.57 USD. These results indicate that combining consortium governance, cryptographic hashing, and probabilistic filtering yields a certificate validation pipeline that is simultaneously tamper-resistant, low-cost, and fast enough for real-time institutional use.
Tam Bang, Hoang H. Nguyen, Dung Nguyen, Toan Trieu · 5 authors
Ethereum smart contracts based on blockchain technology are powerful and promising applications that provide a global platform for exchanging cryptocurrencies and public services. This technology are garnering a huge impact and is widely adopted in the current times as it can transform the way we transfer and exchange value by passing the need for a middleman and reducing cost. These smart contracts also represent a basis for true ownership of digital assets and a wide range of decentralized applications. Besides this, since Ethereum and its smart contracts are a publicly accessible, unchangeable and distributed platform, they are extremely vulnerable to various forms of attack, with their security becoming a top priority. However, current security-verifying programs tend to provide many technical details which are pretty hard for normal people to understand briefly. To tackle this problem, we designed a process aiming to mitigate these limitations, with our key insight being a combination of semantic structure analysis and symbolic execution on control-flow graphs (CFG for short). This article proposes a new approach for auditing Ethereum smart contracts, applying this technique would benefit both average users without any technical knowledge and security experts as well.
Jiachi Chen, Xin Xia, David Lo, John Grundy · 5 authors
Software development is a very broad activity that captures the entire life cycle of a software, which includes designing, programming, maintenance and so on. In this study, we focus on the maintenance-related concerns of the post-deployment of smart contracts. Smart contracts are self-executed programs that run on a blockchain. They cannot be modified once deployed and hence they bring unique maintenance challenges compared to conventional software. According to the definition of ISO/IEC 14764, there are four kinds of software maintenance, i.e., corrective, adaptive, perfective, and preventive maintenance. This study aims to answer (i) What kinds of issues will smart contract developers encounter for corrective, adaptive, perfective, and preventive maintenance after they are deployed to the Ethereum? (ii) What are the current maintenance-related methods used for smart contracts? To obtain the answers to these research questions, we first conducted a systematic literature review to analyze 131 smart contract related research papers published from 2014 to 2020. Since the Ethereum ecosystem is fast-growing, some results from previous publications might be out-of-date and there may be a gap between academia and industry. To address this, we performed an online survey of smart contract developers on Github to validate our findings and received 165 useful responses. Based on the survey feedback and literature review, we present the first empirical study on smart contract maintenance-related concerns. Our study can help smart contract developers better maintain their smart contract-based projects, and we highlight some key future research directions to improve the Ethereum ecosystem.