The research objective of the article: The aim of the paper is to present the challenges and opportunities of Initial Coin Offering (ICO) procedure (sometimes appearing in literature and official documents as the Initial Token Offering (ITO)) from the point of view of a company as well as verify the hypothesis about ICO as a cheap form of capital rising that is often presented in websites dedicated to ICO. There are enumerated the differences and similarities to the Initial Public Offering and possible advantages over other methods of capital rising. The paper points out the most important barriers to the use of ICO. The research method applied: As there is shortage of available research papers and literature related to the topic that are focused on financial aspects such as comparison between ICO and other methods of capital rising, there was conducted the analysis of reliable internet sources and a case study method of Ethereum – the first company that applied the Initial Coin Offering procedure. The mentioned research method has its limits, as it is necessary to verify received information. That is the reason why only professional websites dedicated to the topic were used. The outcome of the research (considerations, analyses), main conclusion(s): the Initial Coin Offering procedure is recognised as a very controversial topic. It is clearly visible that ICO has many advantages over traditional forms of rising capital for the company, but, so far, ambiguous legal status, cost level and high risk of scams and other possible abuses make it difficult to become widely applied by newly created companies.
The article presents an econometric analysis of the effect of stock indicators, such as Comex Gold futures, Dow Jones Industrial Average index and NASDAQ Composite, on the Ethereum cryptocurrency dynamics in the 100-day period. As part of the study, an econometric model of the dynamics of e-currency was built. The survey results show that when the Comex gold futures price changes by 1% on average, the Ethereum price changes by 5.01% in the same direction, when the Dow Jones Industrial Average index changes by 1%, the Ethereum price is 10.897%, and when the NASDAQ Composite index changes, the Ethereum price will change in the opposite direction to 3.59%
We present SOLAR, a new analysis tool for automatically detecting standard violation errors in Ethereum smart contracts.Given the Ethereum Virtual Machine (EVM) bytecode of a smart contract and a user specified constraint or invariant derived from a technical standard such as ERC-20,SOLAR symbolically executes the contract, explores all possible execution paths, and checks whether it is possible to initiate a sequence of malicious transactions to violate the specified constraint or invariant. Our experimental results highlight the effectiveness of SOLAR in finding new errors in smart con-tracts. Out of the evaluated 779 ERC-20 and 310 ERC-721smart contracts, SOLAR found 255 standard violation errors in 197 vulnerable contracts with only three false positives.237 out of the 255 errors are zero-day errors that are not re-ported before. Our results sound the alarm on the prevalence of standard violation errors in critical smart contracts that manipulate publicly traded digital assets
Michael Rodler, Wenting Li, Ghassan Karame, Lucas Davi
Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this paper, we address this problem in the context of re-entrancy exploits and propose a novel smart contract security technology, dubbed Sereum (Secure Ethereum), which protects existing, deployed contracts against re-entrancy attacks in a backwards compatible way based on run-time monitoring and validation. Sereum does neither require any modification nor any semantic knowledge of existing contracts. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent attacks with a false positive rate as small as 0.06% and with negligible run-time overhead. As a by-product, we develop three advanced re-entrancy attacks to demonstrate the limitations of existing offline vulnerability analysis tools.
Blockchain has been widely adopted in the last few years even though it is in its infancy. The first well-known application built on blockchain technology was Bitcoin, which is a decentralized and distributed ledger to record crypto-currency transactions. All of the transactions in Bitcoin are anonymously transferred and validated by participants in the network. Bitcoin protocol and its operations are so reliable that technologists have been inspired to enhance blockchain technologies and deploy it outside of the crypto-currency world. The demand for private and non-crypto-currency solutions have surged among consortiums because of the security and fault tolerant features of blockchain. To introduce blockchain concepts, we survey the three most popular blockchain architectures: Bitcoin, Ethereum, and Hyperledger Fabric. We then build Gradubique, a blockchain network built on top of Hyperledger Fabric. Gradubique allows instructors from any school to post exam and course grades to the Gradubique network. Employers and graduate schools can extract transcripts from Gradubique. Security is guaranteed by the blockchain technology. Standardization and translation of transcripts can be built into the network, and the distributed nature of the network can make it virtually cost-free.
Purwono Purwono, Alfian Ma’arif, Wahyu Rahmaniar, Qazi Mazhar ul Haq · 6 authors
Blockchain technology has a promising future in a number of industries and enterprises. Formerly connected to virtual currency like Bitcoin, blockchain has evolved into a versatile technology with many applications. In the upcoming years, it is predicted that blockchain will revolutionize a variety of industries, including banking, supply chain management, healthcare, voting systems, and more. The future of blockchain technology depends critically on its ability to increase security and transparency. By providing a decentralized and unchangeable record, eliminating the need for middlemen, and boosting participant confidence, blockchain promotes secure and traceable transactions. This transparency has the potential to transform whole industries by reducing fraud, streamlining processes, and increasing output. Blockchain also has the power to change financial systems. Blockchain-based smart contracts facilitate faster, more efficient transactions by automating and enforcing contractual agreements without the need for middlemen. By enabling speedier cross-border transactions, reducing costs, and boosting financial inclusion, tokenization and blockchain-based digital currencies have the potential to overturn conventional banking institutions. Blockchain’s key attributes, including decentralization, transparency, immutability, and security, make it a desirable choice for a range of organizations. Cross-border payments, trade finance, and smart contracts are just a few of the financial sector processes that blockchain technology has the potential to enhance and automate, lowering costs and increasing productivity. Additionally, the tamper-resistance of blockchain technology can boost transaction security and reliability, allowing for a wider use in traditional financial institutions. Outside of the financial industry, blockchain technology has a lot of promise, particularly in industries like supply chain management, healthcare, energy, intellectual property, and governance. By enabling transparent and traceable transactions, blockchain may improve supply chain efficiency, ensure product authenticity, and boost customer trust. By facilitating the secure exchange of patient data and research data, the decentralized nature of blockchain technology can enhance data security, interoperability, and privacy in the healthcare sector. A more decentralized and sustainable energy ecosystem may be supported by blockchain technology through peer-to-peer energy exchange, grid management, and monitoring of renewable energy certificates in the energy sector. Additionally, blockchain technology has the potential to transform decentralized governance structures, voting procedures, intellectual property rights, and digital identity management. By allowing people to own and manage their digital identities, blockchain can enhance privacy and reduce identity theft. Blockchain-based voting systems can offer transparency, security, and verifiability, thereby increasing voter turnout and public trust in democratic institutions. Blockchain can also enable the secure and transparent management of intellectual property rights, fostering author credit and just compensation.
This paper intends to review the need of cryptocurrency on the European and International market. Why cryptocurrency is bad and good at the same time for the international financial market is one of the main issues of this paper. Where are Bitcoin, Ethereum, Ripple, Bitcoin Cash, Litecoin going to and why cryptocurrencies are necessary on today’s market. Although there is no sure thing on crypto, on the long term, the market keeps going up and there is much interest in this direction.
With the recent rise of cryptocurrencies' popularity, the security and management of crypto-tokens have become critical. We have witnessed many attacks on users and providers, which have resulted in significant financial losses. To remedy these issues, several wallet solutions have been proposed. However, these solutions often lack either essential security features, usability, or do not allow users to customize their spending rules. In this paper, we propose SmartOTPs, a smart-contract wallet framework that gives a flexible, usable, and secure way of managing crypto-tokens in a self-sovereign fashion. The proposed framework consists of four components (i.e., an authenticator, a client, a hardware wallet, and a smart contract), and it provides 2-factor authentication (2FA) performed in two stages of interaction with the blockchain. To the best of our knowledge, our framework is the first one that utilizes one-time passwords (OTPs) in the setting of the public blockchain. In SmartOTPs, the OTPs are aggregated by a Merkle tree and hash chains whereby for each authentication only a short OTP (e.g., 16B-long) is transferred from the authenticator to the client. Such a novel setting enables us to make a fully air-gapped authenticator by utilizing small QR codes or a few mnemonic words, while additionally offering resilience against quantum cryptanalysis. We have made a proof-of-concept based on the Ethereum platform. Our cost analysis shows that the average cost of a transfer operation is comparable to existing 2FA solutions using smart contracts with multi-signatures.
André Greubel, Alexandra Dmitrienko, Samuel Kounev
In the Tor anonymity network, the distribution of topology information relies on the correct behavior of five out of the nine trusted directory authority servers. This centralization is concerning since a powerful adversary might compromise these servers and conceal information about honest nodes, leading to the full de-anonymization of all Tor users. Our work aims at distributing the work of these trusted authorities, such increasing resilience against attacks on core infrastructure components of the Tor network. In particular, we leverage several emerging technologies, such as blockchains, smart contracts, and trusted execution environments to design and prototype a system called SmarTor. This system replaces the directory authorities with a smart contract and a distributed network of untrusted entities responsible for bandwidth measurements. We prototyped SmarTor using Ethereum smart contracts and Intel SGX secure hardware. In our evaluation, we show that SmarTor produces significantly more reliable and precise measurements compared to the current measurement system. Overall, our solution improves the decentralization of the Tor network, reduces trust assumptions and increases resilience against powerful adversaries like law enforcement and intelligence services.
Christof Ferreira Torres, Julian Schütte, Radu State
The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language.
This paper addresses the problem of uploading large quantities of sensitive industrial data to a public distributed network by proposing a new framework. The framework combines the existing technologies of the distributed web and distributed ledger to provide a mechanism of encrypting data and choosing whom to share the data with. The framework is designed to work with existing platforms; the InterPlanetary File System (IPFS) and the Ethereum blockchain platforms are used as examples within this paper, though it is stated that similar platforms are capable of providing the requirements for the framework to operate. The framework uses the concept of the Diffie-Hellman Key Exchange (DHKE), and is implemented in three different mechanisms of the DHKE: one-step Elliptical-Curve Diffie-Hellman Key Exchange (ECDH); two-step ECDH; and Supersingular Isogeny Diffie-Hellman Key Exchange (SIDH). The paper discusses the security of each along with individual advantages and disadvantages, and concludes that the SIDH is the most appropriate implementation for future use due to it being post-quantum secure.
In the age of Big Data, enabling task scheduling while protecting users' privacy is critical for various decentralized applications in blockchain-based smart contract platforms. Such a privacy-preserving task scheduler requires the task input data to be secretly maintained until a prescribed task execution time and be automatically recorded into the blockchain to enabling the execution of the task at the execution time, even if the user goes offline. While straight-forward centralized approaches provide a basic solution to the problem, unfortunately they are limited to a single point of trust and involve a single point of control. This paper presents decentralized techniques for supporting privacy-preserving task scheduling using smart contracts in Ethereum blockchain networks. We design a privacy-preserving task scheduling protocol that is managed by a manager smart contract. The protocol requires a user to schedule a task by deploying a proxy smart contract maintaining the non-sensitive information of the task while creating decentralized secret trust and selecting trustees from the network to maintain the sensitive information of the task. With security techniques including secret sharing and layered encryption as well as security deposit paid by trustees as economic deterrence, the protocol can protect the sensitive information against possible attacks including some trustees destroying the sensitive information (drop attack) or secretly releasing the sensitive information before the execution time (release-ahead attack). We demonstrate the attack-resilience of the proposed protocol through rigorous analysis.Our implementation and experimental evaluation on the Ethereum official test network demonstrate the low monetary cost and the low time overhead associated with the proposed approach.
Cloud Service Level Agreement (SLA) is challengeable due to lacking a trustworthy platform. This paper presents a witness model to credibly enforce the cloud service level agreement. Through introducing the witness role and using the blockchain based smart contract, we solve the trust issues about who can detect the service violation, how the violation is confirmed and the compensation is guaranteed. In this model, a verifiable consensus sortition algorithm proposed by us is firstly leveraged to select independent witnesses to form a witness committee. They are responsible for a specific service level agreement and get paid by monitoring and detecting service violation. Through carefully designing the witness' payoff function in the agreement, we further leverage game theory to analyze and prove that it is not the witness itself is trustworthy. Instead, the witness has to tell the truth because of its greedy nature, which is the desire to maximize its own revenue. As long as the service violation is confirmed by the witness committee, the compensation is automatically transferred to the customer by the smart contract. Finally, we implement a proof-of-concept prototype with the smart contract of Ethereum blockchain. It demonstrates the feasibility of our model.
Blockchain technologies are rapidly gaining attention in the multi-agent systems (MAS) community to face critical issues such as trust, secured communications, and data consistency. In particular, the notion of smart contract can be exploited to deploy trustworthy computations automatically executed by the network in a consistent way. MAS coordination - modelling and engineering of agents interaction in a MAS - thus represents an appealing application field for smart contracts, potentially enabling fully-decentralised, trustworthy coordination. Along this line, we focus on the Ethereum blockchain technology, map it onto LINDA tuple-based coordination model, and discuss two proof-of-concept implementations of LINDA on Ethereum. We hence demonstrate conceptual and technical feasibility of blockchain-based coordination in MAS, while emphasising issues of applying the blockchain beyond accountability and identity management.
Xu Wang, Xuan F. Zha, Guangsheng Yu, Wei Ni · 8 authors
Ethereum, as the first Turing-complete blockchain platform, provides various application program interfaces for developers. Although blockchain has highly improved security, faulty configuration and usage can result in serious vulnerabilities. In this paper, we focus on the security vulnerabilities of the official Go-version Ethereum client (geth). The vulnerabilities are because of the insecure API design and the specific Ethereum wallet mechanism. We demonstrate attacks exploiting these vulnerabilities in an Ethereum testbed. The vulnerabilities are confirmed by the scanning results on the public Internet. Finally, corresponding countermeasures against attacks are provided to enhance the security of the Ethereum platform.
Fatih Ceylan, Ramazan Eki̇nci̇, Osman Tüzün, Hakan Kahyaoğlu
Başta Bitcoin olmak üzere kripto paralar son dönemde çok sık kullanılmaya başlamıştır. “Para birimi” olarak ve “Değer birikim aracı” olarak kabul görmeye başlayan kripto paraların fiyat hareketlerinin analiz edilmesi ihtiyacı ortaya çıkmıştır. Bu piyasaların büyümesi ve küresel entegrasyonu ile birlikte fiyatlarda meydana gelen önemli değişimlerin temelinde spekülatif balonların olup olmadığı finansal istikrar konusunda açıklık ve güvence açısından önem arz etmektedir. Ayrıca kripto para piyasasında meydana gelen spekülatif hareketler piyasa katılımcılarının sürü psikolojisiyle hareket edip etmedikleri sorusunu ortaya çıkarmaktadır. Bu nedenle çalışmada Bitcoin ve Etherium para birimlerinde spekülatif balonların varlığı Philips vd. (2015) tarafından geliştirilen yöntem ile tespit edilmiş ve ne zaman oluştukları tahminlenmiştir. Piyasada balonların olması ve bu balonların süre olarak varlığı sürü psikolojisinin olduğu yönünde bilgi sağlarken, bu piyasada dengeleyici bir spekülasyonun olmadığı yönünde de bir bilgidir. Elde edilen bulgular doğrultusunda Bitcoin ve Etherium kripto para birimlerinde çok sayıda baloncuk olduğu tespit edilmiştir. Özellikle 2017-2018 yılları arasında büyük baloncukların ortaya çıkması bu para birimlerinin spekülatif hareketlere karşı eğilimli olduğunu gösterilmiştir.
We propose and compare two approaches to identify smart contracts as token systems by analyzing their public bytecode. The first approach symbolically executes the code in order to detect token systems by their characteristic behavior of updating internal accounts. The second approach serves as a comparison base and exploits the common interface of ERC-20, the most popular token standard. We present quantitative results for the Ethereum blockchain, and validate the effectiveness of both approaches using a set of curated token systems as ground truth. We observe 100% recall for the second approach. Recall rates of 89% (with well explainable missed detections) indicate that the first approach may also be able to identify "hidden" or undocumented token systems that intentionally do not implement the standard. One possible application of the proposed methods is to facilitate regulator' tasks of monitoring and policing the use of token systems and their underlying platforms.
The cryptocurrency is attracting more and more attention because of the blockchain technology. Ethereum is gaining a significant popularity in blockchain community, mainly due to the fact that it is designed in a way that enables developers to write smart contracts and decentralized applications (Dapps). There are many kinds of cryptocurrency information on the social network. The risks and fraud problems behind it have pushed many countries including the United States, South Korea, and China to make warnings and set up corresponding regulations. However, the security of Ethereum smart contracts has not gained much attention. Through the Deep Learning approach, we propose a method of sentiment analysis for Ethereum's community comments. In this research, we first collected the users' cryptocurrency comments from the social network and then fed to our LSTM + CNN model for training. Then we made prediction through sentiment analysis. With our research result, we have demonstrated that both the precision and the recall of sentiment analysis can achieve 0.80+. More importantly, we deploy our sentiment analysis1 on RatingToken and Coin Master (mobile application of Cheetah Mobile Blockchain Security Center23). We can effectively provide detail information to resolve the risks of being fake and fraud problems.
Elvira Albert, Pablo Gordillo, Albert Rubio, Ilya Sergey
Gas is a measurement unit of the computational effort that it will take to execute every single operation that takes part in the Ethereum blockchain platform. Each instruction executed by the Ethereum Virtual Machine (EVM) has an associated gas consumption specified by Ethereum. If a transaction exceeds the amount of gas allotted by the user (known as gas limit), an out-of-gas exception is raised. There is a wide family of contract vulnerabilities due to out-of-gas behaviours. We report on the design and implementation of GASTAP, a Gas-Aware Smart contracT Analysis Platform, which takes as input a smart contract (either in EVM, disassembled EVM, or in Solidity source code) and automatically infers sound gas upper bounds for all its public functions. Our bounds ensure that if the gas limit paid by the user is higher than our inferred gas bounds, the contract is free of out-of-gas vulnerabilities.
Elvira Albert, Pablo Gordillo, Albert Rubio, Ilya Sergey
Gas is a measurement unit of the computational effort that it will take to execute every single operation that takes part in the Ethereum blockchain platform. Each instruction executed by the Ethereum Virtual Machine (EVM) has an associated gas consumption specified by Ethereum. If a transaction exceeds the amount of gas allotted by the user (known as gas limit), an out-of-gas exception is raised. There is a wide family of contract vulnerabilities due to out-of-gas behaviours. We report on the design and implementation of GASTAP, a Gas-Aware Smart contracT Analysis Platform, which takes as input a smart contract (either in EVM, disassembled EVM, or in Solidity source code) and automatically infers sound gas upper bounds for all its public functions. Our bounds ensure that if the gas limit paid by the user is higher than our inferred gas bounds, the contract is free of out-of-gas vulnerabilities.
Yonggen Gu, Dingding Hou, Xiaohong Wu, Jie Tao · 5 authors
Distributed data storage has received more attention due to its advantages in reliability, availability and scalability, and it brings both opportunities and challenges for distributed data storage transaction. The traditional transaction system of storage resources, which generally runs in a centralized mode, results in high cost, vendor lock-in and single point failure risk. To overcome the above shortcomings, considering the storage policy with erasure coding, in this paper we propose a decentralized transaction method for cloud storage based on a smart contract, which takes into account the resource cost for distributed data storage. First, to guarantee the availability and decrease the storing cost, a reverse Vickrey-Clarke-Groves (VCG) based auction mechanism is proposed for storage resource selection and transaction. Then we deploy and implement the proposed mechanism by designing a corresponding smart contract. Especially, we address the problem of how to implement a VCG-like mechanism in a blockchain environment. Based on the private chain of Ethereum, we make the simulation for the proposed storage transaction method. The results of simulation show that the proposed transaction model can realize competitive trading of storage resources and ensure the safe and economic operation of resource trading.
Wesley Joon-Wie Tann, Xing Han, Sourav Sen Gupta, Yew-Soon Ong
Symbolic analysis of security exploits in smart contracts has demonstrated to be valuable for analyzing predefined vulnerability properties. While some symbolic tools perform complex analysis steps, they require a predetermined invocation depth to search vulnerable execution paths, and the search time increases with depth. The number of contracts on blockchains like Ethereum has increased 176 fold since December 2015. If these symbolic tools fail to analyze the increasingly large number of contracts in time, entire classes of exploits could cause irrevocable damage. In this paper, we aim to have safer smart contracts against emerging threats. We propose the approach of sequential learning of smart contract weaknesses using machine learning---long-short term memory (LSTM)---that allows us to be able to detect new attack trends relatively quickly, leading to safer smart contracts. Our experimental studies on 620,000 smart contracts prove that our model can easily scale to analyze a massive amount of contracts; that is, the LSTM maintains near constant analysis time as contracts increase in complexity. In addition, our approach achieves $99\%$ test accuracy and correctly analyzes contracts that were false positive (FP) errors made by a symbolic tool.
Boris Radovanov, Aleksandra Marcikić, Nebojša Gvozdenović
Because of increasing interest in cryptocurrency investments, there is a need to quantify their variation over time. Therefore, in this paper we try to answer a few important questions related to a time series of cryptocurrencies. According to our goals and due to market capitalization, here we discuss the daily market price data of four major cryptocurrencies: Bitcoin (BTC), Ethereum (ETH), Ripple (XRP) and Litecoin (LTC). In the first phase, we characterize the daily returns of exchange rates versus the U.S. Dollar by assessing the main statistical properties of them. In many ways, the interpretation of these results could be a crucial point in the investment decision making process. In the following phase, we apply an autocorrelation function in order to find repeating patterns or a random walk of daily returns. Also, the lack of literature on the comparison of cryptocurrency price movements refers to the correlation analysis between the aforementioned data series. These findings are an appropriate base for portfolio management. Finally, the paper conducts an analysis of volatility using dynamic volatility models such as GARCH, GJR and EGARCH. The results confirm that volatility is persistent over time and the asymmetry of volatility is small for daily returns.