As a blockchain platform that has developed vigorously in recent years, Ethereum is different from Bitcoin in that it introduces smart contracts into blockchain.Solidity is one of the most mature and widely used smart contract programming language,which is used to write smart contracts and deploy them on blockchain. However, once the data in the blockchain is written, it cannot be modified. Ethereum smart contract is stored in the block chain, which makes the smart contract can no longer repair the code problems such as re-entrancy vulnerabilities or integer overflow problems. Currently, there still lacks of an efficient and effective approach for detecting these problems in Solidity. In this paper, we first classify all the possible problems in Solidity, then propose a smart contract problem detection approach for Solidity, namely SolidityCheck. The approach uses regular expressions to define the characteristics of problematic statements and uses regular matching and program instrumentation to prevent or detect problems. Finally, a large number of experiments is performed to show that SolidityCheck is superior to existing approaches.
Stanisław Drożdż, Ludovico Minati, Paweł Oświȩcimka, Marek Stanuszek · 5 authors
Cross correlations in fluctuations of the daily exchange rates within the basket of the 100 highest-capitalization cryptocurrencies over the period October 1, 2015-March 31, 2019 are studied. The corresponding dynamics predominantly involve one leading eigenvalue of the correlation matrix, while the others largely coincide with those of Wishart random matrices. However, the magnitude of the principal eigenvalue, and thus the degree of collectivity, strongly depends on which cryptocurrency is used as a base. It is largest when the base is the most peripheral cryptocurrency; when more significant ones are taken into consideration, its magnitude systematically decreases, nevertheless preserving a sizable gap with respect to the random bulk, which in turn indicates that the organization of correlations becomes more heterogeneous. This finding provides a criterion for recognizing which currencies or cryptocurrencies play a dominant role in the global cryptomarket. The present study shows that over the period under consideration, the Bitcoin (BTC) predominates, hallmarking exchange rate dynamics at least as influential as the U.S. dollar (USD). Even more, the BTC started dominating around the year 2017, while other cryptocurrencies, such as the Ethereum and even Ripple, assumed similar trends. At the same time, the USD, an original value determinant for the cryptocurrency market, became increasingly disconnected, and its related characteristics eventually started approaching those of a fictitious currency. These results are strong indicators of incipient independence of the global cryptocurrency market, delineating a self-contained trade resembling the Forex.
We study the liquid democracy problem, where each voter can either directly vote to a candidate or delegate his voting power to a proxy. We consider the implementation of liquid democracy on the blockchain through Ethereum smart contract and to be compatible with the realtime self-tallying property, where the contract itself can record ballots and update voting status upon receiving each voting massage. A challenge comes due to the gas fee limitation of Ethereum mainnet, that the number of instruction for processing a voting massage can not exceed a certain amount, which restrict the application scenario with respect to algorithms whose time complexity is linear to the number of voters. We propose a fast algorithm to overcome the challenge, such that i) shifts the on-chain initialization to off-chain and ii) the on-chain complexity for processing each voting massage is O(\log n), where n is the number of voters.
Atomic Crosschain Transaction technology allows composable programming across private Ethereum blockchains. It allows for inter-contract and inter-blockchain function calls that are both synchronous and atomic: if one part fails, the whole call graph of function calls is rolled back. Traditional Ethereum contract functions can limit which accounts can call them by specialised application program logic. This is important as it allows application developers to specify which callers can execute functions that update contract state. In this paper we introduce the strategy required to restrict which contracts on one blockchain can call a function in a contract that is deployed on another blockchain. We show that validating the Originating Blockchain Id (the blockchain the crosschain function call started on), From Blockchain Id, and From Account provides contracts with certainty that a function call came from a specific contract on a specific blockchain.
Alex Groce, Josselin Feist, Gustavo Grieco, Michael Colburn
An important problem in smart contract security is understanding the likelihood and criticality of discovered, or potential, weaknesses in contracts. In this paper we provide a summary of Ethereum smart contract audits performed for 23 professional stakeholders, avoiding the common problem of reporting issues mostly prevalent in low-quality contracts. These audits were performed at a leading company in blockchain security, using both open-source and proprietary tools, as well as human code analysis performed by professional security engineers. We categorize 246 individual defects, making it possible to compare the severity and frequency of different vulnerability types, compare smart contract and non-smart contract flaws, and to estimate the efficacy of automated vulnerability detection approaches.
Alex Groce, Josselin Feist, Gustavo Grieco, Michael D. Colburn
An important problem in smart contract security is understanding the\nlikelihood and criticality of discovered, or potential, weaknesses in\ncontracts. In this paper we provide a summary of Ethereum smart contract audits\nperformed for 23 professional stakeholders, avoiding the common problem of\nreporting issues mostly prevalent in low-quality contracts. These audits were\nperformed at a leading company in blockchain security, using both open-source\nand proprietary tools, as well as human code analysis performed by professional\nsecurity engineers. We categorize 246 individual defects, making it possible to\ncompare the severity and frequency of different vulnerability types, compare\nsmart contract and non-smart contract flaws, and to estimate the efficacy of\nautomated vulnerability detection approaches.\n
Budankailu Kumar Subudhi, Faruk Catal, Nikolay Tcholtchev, Kin Tsun Chiu · 7 authors
VoIP-based emergency communication is a promising approach to improving the safety of citizens worldwide. The transition required in this scope includes substituting the legacy PSTN/SS7 based emergency call system by Next Generation IP based components for call establishment and control. Thereby, SIP is used as a session control protocol and RTP as the means to transfer emergency data between the caller and the corresponding Public Safety Access Point (PSAP). The emergency data is not only restricted to voice communication but can cover a rich variety of data, which can be acquired by different means (including the end-user devices) and transmitted over IP. This includes video, geopositioning data, voice, Real-Time Text, and sensor data in line with emerging IoT architectures and approaches. A vital aspect in this scope is given by the performance of the underlying network, including its capability to establish calls in emergencies and to transfer the data required for serving the situation. Therefore, in this paper, we evaluate the computational performance of the most recent VoIP emergency system implementation, which was developed by the H2020-EMYNOS project as a realisation of the EENA NG112 Long Term Definition (LTD) vision. We perform a series of trials and evaluate the performance of the EMYNOS system in a multi-party lab environment established during the project. We evaluate the time needed to perform basic emergency call operations over IP, whilst in parallel generating Internet type of background traffic. Correspondingly, we worked out a methodology and implemented it in our testbed, both of which are presented in the current paper. The obtained numerical results lead to the conclusion that SIP-based emergency services stand a good chance to replace legacy systems when it comes to their performance. Additionally, we also provide a perspective on how the blockchain technology could potentially be put to use to enhance the quality of the next-generation emergency services. We propose the utilisation of blockchain technology for tracking emergency calls and enabling efficient recognition of fraud calls, which is a critical aspect for PSAP providers concerning the potential denial of service attacks. In this context, we provide evaluations and numerical results based on a private Ethereum based blockchain playground running at the premises of Fraunhofer FOKUS.
Audi Ramadhan, Chandra Indira Septiarani, Faisal Dias, Deden Yoga Pratama
Aplikasi trading cryptocurrency merupakan sebuah aplikasi yang relatif baru yang ditandai dengan munculnya banyak cryptocurrency seperti Bitcoin, Ethereum dan lain sebagainya. Oleh sebab itu, analisis penerimaan teknologi pada aplikasi tersebut sangat penting untuk dikaji lebih dalam. Penelitian ini bertujuan untuk menganalisis dan mengukur penerimaan aplikasi trading cryptocurrency yaitu Indodax Trading Platform dengan menggunakan Technology Acceptance Model (TAM) yang diintegrasikan dengan faktor resiko dan kepercayaan. Penelitian ini merupakan penelitian kuantitatif asosiatif dengan menggunakan kuesioner untuk mendapatkan data primer. Sampel yang digunakan pada penelitian ini sebesar 134 dengan menggunakan teknil analisis Semi Equation Model – Partial Least Square (SEM-PLS). Hasil dari penelitian ini yaitu adanya pengaruh dari perceived usefulness dan trust terhadap penggunaan aplikasi trading cryptocurrency. Sedangkan resiko dan perceived ease of use tidak berpengaruh terhadap penggunaan aplikasi trading cryptocurrency.
Jae-Yun Kim, Jun-Mo Lee, Yeon-Jae Koo, Sang-Hyeon Park · 5 authors
As ethereum blockchain has become popular, the number of users and transactions has skyrocketed, causing an explosive increase of its data size. As a result, ordinary clients using PCs or smartphones cannot easily bootstrap as a full node, but rely on other full nodes such as the miners to run or verify transactions. This may affect the security of ethereum, so light bootstrapping techniques such as fast sync has been proposed to download only parts of full data, yet the space overhead is still too high. One of the biggest space overhead that cannot easily be reduced is caused by saving the state of all accounts in the block's state trie. Fortunately, we found that more than 90% of accounts are inactive and old transactions are hard to be manipulated. Based on these observations, this paper propose a novel optimization technique called ethanos that can reduce bootstrapping cost by sweeping inactive accounts periodically and by not downloading old transactions. If an inactive account becomes active, ethanos restore its state by running a restoration transaction. Also, ethanos gives incentives for archive nodes to maintain the old transactions for possible re-verification. We implemented ethanos by instrumenting the go-ethereum (geth) client and evaluated with the real 113 million transactions from 14 million accounts between 7M-th and 8M-th blocks in ethereum. Our experimental result shows that ethanos can reduce the size of the account state by half, which, if combined with removing old transactions, may reduce the storage size for bootstrapping to around 1GB. This would be reasonable enough for ordinary clients to bootstrap on their personal devices.
Agriculture is indispensable for every country. Farmers use pesticides in large quantities to increase productivity, thus causing serious damage to the agro-ecological environment. If consumers consume a large number of such vegetables, there can be an adverse effect on their health. Therefore, consumers shift from consuming general vegetables to organic vegetables. However, the price of organic vegetables is higher than that of general vegetables, and there are doubts about the authenticity of the production and marketing process. Unfortunately, production and sales records are often falsified. The blockchain may be able to guarantee the authenticity of organic vegetables because the blockchain is tamperproof and transparent. Therefore, we proposed an exercise environment for the production and marketing of organic vegetables by using Ethereum. This proposed system can ensure the authenticity of the production and sales record, it may increase the sales of organic vegetables and solve the problem of agricultural ecological environment pollution in the real world.
We present a model/executable specification of smart contract execution in Coq. Our formalization allows for inter-contract communication and generalizes existing work by allowing modelling of both depth-first execution blockchains (like Ethereum) and breadth-first execution blockchains (like Tezos). We represent smart contracts programs in Coq's functional language Gallina, enabling easier reasoning about functional correctness of concrete contracts than other approaches. In particular we develop a Congress contract in this style. This contract -- a simplified version of the infamous DAO -- is interesting because of its very dynamic communication pattern with other contracts. We give a high-level partial specification of the Congress's behavior, related to reentrancy, and prove that the Congress satisfies it for all possible smart contract execution orders.
Automated tasks play an important role in both consumer and industrial IoT environments. In many scenarios, the IoT tasks are performed given certain conditions. To facilitate the tasks, it is necessary to delegate a third party to listen to events that trigger the conditions and issue commands to the IoT resources accordingly. However, without restriction, the third party may be over-privileged and able to control the resources unconditionally. We define the third party's permission to act under some conditions as a conditional action. We propose PPCA, a privacy-preserving service that allows users to create conditional actions in a decentralized platform using smart contracts. PPCA can guarantee strict privilege at the third party that holds conditional actions. By generalizing a variety of conditions into simple forms of conditional logic, the conditions can be verified in a privacy-preserving manner. We build a prototype of PPCA on Ethereum. The performance shows the feasibility of PPCA in IoT environments.
Roben Castagna Lunardi, Regio A. Michelin, Charles V. Neu, Henry C. Nunes · 6 authors
The Internet of Things (IoT) is transforming our physical world into a complex and dynamic system of connected devices on an unprecedented scale. Connecting everyday physical objects is creating new business models, improving processes and reducing costs and risks. Recently, blockchain technology has received a lot of attention from the community as a possible solution to overcome security issues in IoT. However, traditional blockchains (such as the ones used in Bitcoin and Ethereum) are not well suited to the resource-constrained nature of IoT devices and also with the large volume of information that is expected to be generated from typical IoT deployments. To overcome these issues, several researchers have presented lightweight instances of blockchains tailored for IoT. For example, proposing novel data structures based on blocks with decoupled and appendable data. However, these researchers did not discuss how the consensus algorithm would impact their solutions, i.e., the decision of which consensus algorithm would be better suited was left as an open issue. In this paper, we improved an appendable-block blockchain framework to support different consensus algorithms through a modular design. We evaluated the performance of this improved version in different emulated scenarios and studied the impact of varying the number of devices and transactions and employing different consensus algorithms. Even adopting different consensus algorithms, results indicate that the latency to append a new block is less than 161ms (in the more demanding scenario) and the delay for processing a new transaction is less than 7ms, suggesting that our improved version of the appendable-block blockchain is efficient and scalable, and thus well suited for IoT scenarios.
Cryptocurrency is a recent and popular topic that attracts the interest of investors and fund managers. Beyond the market discipline, researchers question the interaction between cryptocurrecies and macroeconomic variables. This study we focus on how the changes in gold and oil prices effect the daily price movements of different cryptocurrencies. The daily database includes prices of the cryptocurrencies of Bitcoin, Tether, Ethereum Litecon and EOS for the period between August 1, 2017 and April 3, 2019. Initially the stationarity of the series is tested by The existence of the cointegration relationship between the series is tested by The presence of causality relationships between the series is investigated with the Dolado and Ltkepohl (1996) causality test. The paper explains the details of the empirical findings.
This paper provides a systematic survey on return and volatility spillovers of cryptocurrencies based on the empirical results of relevant academic literature. Evidence reveals that Bitcoin is the most influential among digital coins mainly as a transmitter toward digital currencies but also as a receiver of spillovers from virtual currencies and alternative assets. Ethereum, Litecoin, and Ripple present the most significant interlinkages with Bitcoin. Return spillovers are more pronounced but volatility spillovers often present a bi-directional character. Volatility shock transmission is detected among Bitcoin and national currencies, while economic policy uncertainty is not influential. This survey provides useful guidance in the hotly-debated issue of reform and decentralization of financial systems.
Modern Blockchains support the execution of user programs, called smart contracts. As a trusted computing platform, smart contracts bring decentralization, computation integrity, open access and information transparency to average users on the Internet. However, running smart-contract programs leads to high costs, known as Gas. Such costs prevent the use of smart contracts in data-intensive application scenarios, such as high-frequency trading and transparency logging. This paper addresses the Gas-based cost effectiveness in the most consuming layer of a smart contract, namely data storage. We present GRuB, a dynamic data-replication framework that monitors the smart-contract workload and makes online replication decisions. A new online algorithm is proposed that provides constant-bounded 'competitiveness' in Gas. To further save Gas, the workload monitor and decision maker are run off the Blockchain and with security against the forging of workload trace being monitored. A GRuB prototype is built, including a smart-contract component on Ethereum and an off-chain middleware on top of Google LevelDB. The cost evaluation under the YCSB workloads shows that GRuB can converge quickly to changing workloads and save Gas significantly compared with static replication schemes. Two case studies are conducted for data-intensive applications, including high-frequency trading and transparency logging, in which running GRuB leads to affordable Gas.
Feeding external data to a blockchain, a.k.a. data feed, is an essential task to enable blockchain interoperability and support emerging cross-domain applications, notably stablecoins. Given the data-intensive feeds in real life (e.g., high-frequency price updates) and the high cost in using blockchain, namely Gas, it is imperative to reduce the Gas cost of data feeds. Motivated by the constant-changing workloads in finance and other applications, this work focuses on designing a dynamic, workload-aware approach for cost effectiveness in Gas. This design space is understudied in the existing blockchain research which has so far focused on static data placement. This work presents GRuB, a cost-effective data feed that dynamically replicates data between the blockchain and an off-chain cloud storage. GRuB's data replication is workload-adaptive by monitoring the current workload and making online decisions w.r.t. data replication. A series of online algorithms are proposed that achieve the bounded worst-case cost in blockchain's Gas. GRuB runs the decision-making components on the untrusted cloud off-chain for lower Gas costs, and employs a security protocol to authenticate the data transferred between the blockchain and cloud. The overall GRuB system can autonomously achieve low Gas costs with changing workloads. We built a GRuB prototype functional with Ethereum and Google LevelDB, and supported real applications in stablecoins. Under real workloads collected from the Ethereum contract-call history and mixed workloads of YCSB, we systematically evaluate GRuB's cost which shows a saving of Gas by 10% ~ 74%, with comparison to the baselines of static data-placement.
Shantanu Pal, Tahiry Rabehaja, Ambrose Hill, Michael Hitchens · 5 authors
With the advancement of the Internet of Things (IoT) in recent years, there is a bigger potential to use online services than ever before. The use of the IoT brings numerous opportunities for both service providers and end users, however, it faces critical questions of security and privacy. Toward this, access control is one of the significant security challenges for the IoT, in particular, considering the characteristics of such IoT systems. To develop a secure access control architecture for the IoT, the propagation of access right delegation is a major issue. Many proposals present access control issues for the IoT but given the specific context of access right delegation, it is still in its infancy. This article presents an approach to address such a delegation issue for the IoT using the blockchain technology. We propose a delegation model that employv the critical issues, e.g., the use of nonunique identities, asynchronous and flexible delegation nature of communication for the IoT without the need of a centralized system. The goal of our primitive is to use attributes for validating the identity of an entity instead of relying on a concrete unique identity of an entity. To provide privacy for the attributes, we propose a dual blockchain architecture that moves the attribute storage and access of the public blockchain and onto a secure private blockchain. To demonstrate the feasibility of our proposed approach, we evaluate the system performances using the Ethereum blockchain network.
We present a new primitive supporting file replication in distributed storage networks (DSNs) called a Public Incompressible Encoding (PIE). PIEs operate in the challenging public DSN setting where files must be encoded and decoded with public randomness-i.e., without encryption-and retention of redundant data must be publicly verifiable. They prevent undetectable data compression, allowing DSNs to use monetary rewards or penalties in incentivizing economically rational servers to properly replicate data. Their definition also precludes critical, demonstrated attacks involving parallelism via ASICs and other custom hardware. Our PIE construction is the first to achieve experimentally validated near-optimal performance-within a factor of 4 of optimal by one metric. It also allows decoding orders of magnitude faster than encoding, unlike other comparable constructions. We achieve this high security and performance using a graph construction called a Dagwood Sandwich Graph (DSaG), built from a novel interleaving of depth-robust graphs and superconcentrators. PIEs' performance makes them appealing for DSNs, such as the proposed Filecoin system and Ethereum data sharding. Conversely, their near-optimality establishes concerning bounds on the practical financial and energy costs of DSNs allowing arbitrary data.
Motivated by the success of Bitcoin, lots of cryptocurrencies have been created, the majority of which were implemented as smart contracts running on Ethereum and called tokens. To regulate the interaction between these tokens and users as well as third-party tools (e.g., wallets, exchange markets, etc.), several standards have been proposed for the implementation of token contracts. Although existing tokens involve lots of money, little is known whether or not their behaviors are consistent with the standards. Inconsistent behaviors can lead to user confusion and financial loss, because users/third-party tools interact with token contracts by invoking standard interfaces and listening to standard events. In this work, we take the first step to investigate such inconsistent token behaviors with regard to ERC-20, the most popular token standard. We propose a novel approach to automatically detect such inconsistency by contrasting the behaviors derived from three different sources, including the manipulations of core data structures recording the token holders and their shares, the actions indicated by standard interfaces, and the behaviors suggested by standard events. We implement our approach in a new tool named TokenScope and use it to inspect all transactions sent to the deployed tokens. We detected 3,259,001 transactions that trigger inconsistent behaviors, and these behaviors resulted from 7,472 tokens. By manually examining all (2,353) open-source tokens having inconsistent behaviors, we found that the precision of TokenScope is above 99.9%. Moreover, we revealed 11 major reasons behind the inconsistency, e.g., flawed tokens, standard methods missing, lack of standard events, etc. In particular, we discovered 50 unreported flawed tokens.
Iddo Bentov, Yan Ji, Fan Zhang, Lorenz Breidenbach · 6 authors
We propose Tesseract, a secure real-time cryptocurrency exchange service. Existing centralized exchange designs are vulnerable to theft of funds, while decentralized exchanges cannot offer real-time cross-chain trades. All currently deployed exchanges are also vulnerable to frontrunning attacks. Tesseract overcomes these flaws and achieves a best-of-both-worlds design by using a trusted execution environment. The task of committing the recent trade data to independent cryptocurrency systems presents an all-or-nothing fairness problem, to which we present ideal theoretical solutions, as well as practical solutions. Tesseract supports not only real-time cross-chain cryptocurrency trades, but also secure tokenization of assets pegged to cryptocurrencies. For instance, Tesseract-tokenized bitcoins can circulate on the Ethereum blockchain for use in smart contracts. We provide a demo implementation of Tesseract that supports Bitcoin, Ethereum, and similar cryptocurrencies.
Blockchain naturally fits multiple industry sectors due its characteristics of decentralization, enhanced security, tamper-proof, improved traceability and transparency. However, there is a significant concern of blockchain’s performance, since blockchain trades off its performance for a completely distributed feature, which enhances its security. In this paper, we investigate the state-of-the-art progress of blockchain, mainly from a performance and security perspective. We extracted 42 primary papers from major scientific databases and 34 online technical articles. The objective is to understand the current research trends, challenges and future directions. We briefly introduce the key technologies of blockchain including distributed ledger, cryptography, consensus, smart contracts and benchmarks. We next summarize the performance and security concerns raised in the investigation. We discuss the architectural choices, performance metrics, database management enhancements, and hybrid blockchains, and try to identify the effort that the state-of-the-art has made to balance between the performance and security. We also make experiments on Ethereum and survey other popular blockchain platforms on the scalability feature of blockchain. We later discuss the potential applications and present the lessons learned. Finally, we attempt to identify the open issues and possible research directions.
Blockchain smart contracts are PC programs that can be adequately executed by an arrangement of ordinarily questioning center points, without the need of an external trusted in power. Since shrewd contracts handle and trade assets of huge regard, other than their correct execution it is also imperative that their use is secure against ambushes which go for taking or modifying the favorable circumstances. Ethereum, the most eminent and used structure for sharp contracts up to this point. It analyze the security vulnerabilities of Ethereum smart contracts, giving a logical order of customary programming traps which may incite vulnerabilities and exhibit a movement of attacks which misuse these vulnerabilities, empowering a foe to take money or cause other mischief