Summary Decentralization, in the form of mesh networking and blockchain, two promising technologies, is coming to the telecommunications industry. Mesh networking allows wider low‐cost Internet access with infrastructures built from routers contributed by diverse owners, whereas blockchain enables transparency and accountability for investments, revenue, or other forms of economic compensations from sharing of network traffic, content, and services. Crowdsourcing network coverage, combined with crowdfunding costs, can create economically sustainable yet decentralized Internet access. This means that every participant can invest in resources and pay or be paid for usage to recover the costs of network devices and maintenance. While mesh networks and mesh routing protocols enable self‐organized networks that expand organically, cryptocurrencies and smart contracts enable the economic coordination among network providers and consumers. We explore and evaluate two existing blockchain software stacks, Hyperledger Fabric (HLF) and Ethereum geth with Proof of Authority (PoA) intended as a local lightweight distributed ledger, deployed in a real city‐wide production mesh network and in laboratory network. We quantify the performance and bottlenecks and identify the current limitations and opportunities for improvement to serve locally the needs of wireless mesh networks, without the privacy and economic cost of relying on public blockchains.
Jianbo Gao, Han Liu, Chao Liu, Qingshan Li · 6 authors
While Ethereum smart contracts enabled a wide range of blockchain applications, they are extremely vulnerable to different forms of security attacks. Due to the fact that transactions to smart contracts commonly involve cryptocurrency transfer, any successful attacks can lead to money loss or even financial disorder. In this paper, we focus on the overflow attacks in Ethereum, mainly because they widely rooted in many smart contracts and comparatively easy to exploit. We have developed EASYFLOW, an overflow detector at Ethereum Virtual Machine level. The key insight behind EASYFLOW is a taint analysis based tracking technique to analyze the propagation of involved taints. Specifically, EASYFLOW can not only divide smart contracts into safe contracts, manifested overflows, well-protected overflows and potential overflows, but also automatically generate transactions to trigger potential overflows. In our preliminary evaluation, EASYFLOW managed to find potentially vulnerable Ethereum contracts with little runtime overhead. A demo video of EASYFLOW is at https://youtu.be/QbUJkQI0L6o.
One major shortcoming of permissionless blockchains such as Bitcoin and Ethereum is that they are unsuitable for running Computationally Intensive smart Contracts (CICs). This prevents such blockchains from running Machine Learning algorithms, Zero-Knowledge proofs, etc. which may need non-trivial computation. In this paper, we present YODA, which is to the best of our knowledge the first solution for efficient computation of CICs in permissionless blockchains with guarantees for a threat model with both Byzantine and selfish nodes. YODA selects one or more execution sets (ES) via Sortition to execute a particular CIC off-chain. One key innovation is the MultI-Round Adaptive Consensus using Likelihood Estimation (MIRACLE) algorithm based on sequential hypothesis testing. M I RACLE allows the execution sets to be small thus making YODA efficient while ensuring correct CIC execution with high probability. It adapts the number of ES sets automatically depending on the concentration of Byzantine nodes in the system and is optimal in terms of the expected number of ES sets used in certain scenarios. Through a suite of economic incentives and technical mechanisms such as the novel Randomness Inserted Contract Execution (RICE) algorithm, we force selfish nodes to behave honestly. We also prove that the honest behavior of selfish nodes is an approximate Nash Equilibrium. We present the system design and details of YODA and prove the security properties of MIRACLE and RICE. Our prototype implementation built on top of Ethereum demonstrates the ability of YODA to run CICs with orders of magnitude higher gas per unit time as well as total gas requirements than Ethereum currently supports. It also demonstrates the low overheads of RICE.
Ahsan Manzoor, Madhusanka Liyanage, An Braeken, Salil S. Kanhere · 5 authors
Data is central to the Internet of Things (IoT) ecosystem. Most of the current IoT systems are using centralized cloud-based data sharing systems, which will be difficult to scale up to meet the demands of future IoT systems. Involvement of such third-party service provider requires also trust from both sensor owner and sensor data user. Moreover, the fees need to be paid for their services. To tackle both the scalability and trust issues and to automatize the payments, this paper presents a blockchain based proxy re-encryption scheme. The system stores the IoT data in a distributed cloud after encryption. To share the collected IoT data, the system establishes runtime dynamic smart contracts between the sensor and data user without the involvement of a trusted third party. It also uses a very efficient proxy re-encryption scheme which allows that the data is only visible by the owner and the person present in the smart contract. This novel combination of smart contracts with proxy re-encryption provides an efficient, fast and secure platform for storing, trading and managing of sensor data. The proposed system is implemented in an Ethereum based testbed to analyze the performance and the security properties.
Energy storage units (ESUs) enable several attractive features of modern smart grids such as enhanced grid resilience, effective demand response, and reduced bills. However, uncoordinated charging of ESUs stresses the power system and can lead to a blackout. On the other hand, existing charging coordination mechanisms suffer from several limitations. First, the need for a central charging coordinator (CC) presents a single point of failure that jeopardizes the effectiveness of the charging coordination. Second, a transparent charging coordination mechanism does not exist where users are not aware whether the CC is honest or not in coordination charging requests among them in a fair way. Third, existing mechanisms overlook the privacy concerns of the involved customers. To address these limitations, in this paper, we leverage the blockchain and smart contracts to build a decentralized charging coordination mechanism without the need for a centralized charging coordinator. First ESUs should use tokens for anonymously authenticate themselves to the blockchain. Then each ESU sends a charging request that contains its State-of-Charge (SoC), Time-to-complete-charge (TCC) and amount of required charging to the smart contract address on the blockchain. The smart contract will then run the charging coordination mechanism in a self-executed manner such that ESUs with the highest priorities are charged in the present time slot while charging requests of lower priority ESUs are deferred to future time slots. In this way, each ESU can make sure that charging schedules are computed correctly. Finally, we have implemented the proposed mechanism on the Ethereum test-bed blockchain, and our analysis shows that execution cost can be acceptable in terms of gas consumption while enabling decentralized charging coordination with increased transparency, reliability, and privacy preserving.
Alexander Yakubov, Wazen M. Shbair, Nida Khan, Radu State · 6 authors
Pretty Good Privacy (PGP) is one of the most prominent cryptographic standards offering end-to-end encryption for email messages and other sensitive information. PGP allows to verify the identity of the correspondent in information exchange as well as the information integrity. PGP implements asymmetric encryption with certificates shared through a network of PGP key servers. Many recent breaches show that certificate infrastructure can be compromised as well as exposed to operational errors. In this paper we propose a new PGP management framework with the key server infrastructure implemented using blockchain technology. Our framework resolves some problems of PGP key servers focusing in particular on fast propagation of certificate revocation among key servers and elimination of man-in-the-middle risk. We also provided user access right control where only the certificate holder can change information related to the certificate. We designed and developed a prototype for key server deployment on permissioned Ethereum blockchain. Permissioned blockchain should allow to control the costs of PGP key server infrastructure maintenance at the present level.
There has been increased interest in the use of blockchains to control Internet of Things devices either directly, or through smart contracts. Many blockchains, such as Ethereum and Fabric, have support for smart contracts. The use of public blockchains while attractive due to their decentralization and availability, do pose challenges, such as unpredictable transaction latencies and cryptocurrency price fluctuations. Transactions in the Ethereum network, such as invokations of smart contracts used to control an IoT device, have no fairness or eventuality guarantees. In this work we describe a “spam attack” method available to parties with sufficient cryptocurrency reserves to delay a statistically significant portion of transactions submitted to the Ethereum network. This paper derives estimations on the costs and effects of such an attack, and is based on an analysis of historical transactions.
Reports on the development of Open and Interoperable Distributed Ledger Technology/Blockchain standards. Discusses how these standards drive global blockchain adoption and take development of the technology ecosystem to the next level. The field of blockchain or distributed ledger is growing rapidly. The lack of consensus on definitions, implementation, management, and core attributes is driving the need for standardization. Blockchain is often confused with cryptocurrencies like Bitcoin or Ethereum, but the potential applications of this technology in diverse fields, such as smart contracts, buying and selling energy, and so much more, make distributed ledger technologies one of the high-potential technologies for the future.
Ethereum is the second most valuable cryptocurrency today, with a current market cap of over $68B. What sets Ethereum apart from other cryptocurrencies is that it uses the blockchain to not only store a record of transactions, but also smart contracts and a history of calls made to those contracts. Thus, Ethereum represents a new form of distributed system: one where users can implement contracts that can provide functionality such as voting protocols, crowdfunding projects, betting agreements, and many more. However, despite the massive investment, little is known about how contracts in Ethereum are actually created and used.
Ethereum, the second-largest cryptocurrency valued at a peak of $138 billion in 2018, is a decentralized, Turing-complete computing platform. Although the stability and security of Ethereum---and blockchain systems in general---have been widely-studied, most analysis has focused on application level features of these systems such as cryptographic mining challenges, smart contract semantics, or block mining operators. Little attention has been paid to the underlying peer-to-peer (P2P) networks that are responsible for information propagation and that enable blockchain consensus. In this work, we develop NodeFinder to measure this previously opaque network at scale and illuminate the properties of its nodes. We analyze the Ethereum network from two vantage points: a three-month long view of nodes on the P2P network, and a single day snapshot of the Ethereum Mainnet peers. We uncover a noisy DEVp2p ecosystem in which fewer than half of all nodes contribute to the Ethereum Mainnet. Through a comparison with other previously studied P2P networks including BitTorrent, Gnutella, and Bitcoin, we find that Ethereum differs in both network size and geographical distribution.
Son zamanlarda; blok zinciri tabanlı kripto para ödeme sistemleri(bitcoin, ethereum) oldukça popüler olmuştur. Merkezi olmayan eşler arası(P2P) ağ yapısına sahip olan bu sistemde tüm işlemler, sadece ekleme yapılabilen bir ana defterde(ledger) tutulmaktadır. Madenciler ise bu ağ yapısındaki düğümleri oluşturmaktadır, her madenci defterin yerel kopyasına sahiptir. Blok zincirinde, PoW uzlaşma protokolü işlemi onaylamakta ve zincire yeni blok eklenmesine izin vermektedir. Ödülü almak için, madenciler eşler arası ağda işlemi tamamlamak için birbirleriyle yarışırlar. Ödül sistemi, blok zinciri kullanan bitcoin’i popülerleştirmiş, fakat aynı zamanda saldırganların blok zincirine ilgisini artırmıştır. Saldırganlar tarafından blok zincirinin madenci havuzuna ve ağ yapısının güvenliğine farklı saldırılar yapılmıştır. Bu makalede, blok zinciri alt yapısına karşı mevcut saldırılar sunulmuştur. İlk bölümlerde, P2P mimarisine, uzlaşma protokolüne ve işlemlere yönelik saldırı tipleri araştırılmıştır. Bu bölümde, %51 saldırısı, Çift harcama, Finney, Vector76, Kaba Kuvvet, Sybil, Eclipse, Denge gibi saldırılar açıklanmış ve çözümler önerilmiştir. Daha sonra, Bencil madencilik ve Blok Atma, Blok Tutma(BWH), Blok Tutma Sonrası Çatallanma(FAW), Havuz sıçrama saldırısı, Cezalandırıcı Çatallanma ile Kara Listeye Alma, Köpük saldırısı ve Rüşvet Saldırısı gibi madencilik havuzuna karşı saldırılar incelenmiş ve savunma stratejileri sunulmuştur. Son bölümde de blok zinciri altyapısında kullanılan kriptografi’nin geleceği üzerinde tartışılmış ve Post Kuantum Kriptografi’nin etkilerinden bahsedilmiştir
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
In the traditional educational understanding, individuals follow the path of getting graduate or post-graduate education if they wish, after continuing their education from kindergarten to high school. Today, by getting out of this stereotype, every literate person can choose different learning environments. Now, learning any subject is up to the tip of the fingers of an individual without depending on a school building with four walls or on certain time frame. In this study, it is aimed to verify digital certificates given to the participants at the Turkish stage of the International Informatics and Computational Thinking event by using Ethereum Block Chain based smart contract. The tasks in the event were transmitted to the students in Turkey via using exam module of the Moodle Learning Management System. For this study, first a smart contract was developed in which the certificate information could be stored on the Ethereum blockchain and could be check for control purposes if necessary. Then the certificate module developed by the researcher in 2014 which uses block structure in the Moodle Learning Management System was updated and then provided to work in accordance with the smart contract in the Ethereum blockchain.
We investigate a family of bugs in blockchain-based smart contracts, which we call event-ordering (or EO) bugs. These bugs are intimately related to the dynamic ordering of contract events, i.e., calls of its functions on the blockchain, and enable potential exploits of millions of USD worth of Ether. Known examples of such bugs and prior techniques to detect them have been restricted to a small number of event orderings, typicall 1 or 2. Our work provides a new formulation of this general class of EO bugs as finding concurrency properties arising in long permutations of such events. The technical challenge in detecting our formulation of EO bugs is the inherent combinatorial blowup in path and state space analysis, even for simple contracts. We propose the first use of partial-order reduction techniques, using happen-before relations extracted automatically for contracts, along with several other optimizations built on a dynamic symbolic execution technique. We build an automatic tool called ETHRACER that requires no hints from users and runs directly on Ethereum bytecode. It flags 7-11% of over ten thousand contracts analyzed in roughly 18.5 minutes per contract, providing compact event traces that human analysts can run as witnesses. These witnesses are so compact that confirmations require only a few minutes of human effort. Half of the flagged contracts have subtle EO bugs, including in ERC-20 contracts that carry hundreds of millions of dollars worth of Ether. Thus, ETHRACER is effective at detecting a subtle yet dangerous class of bugs which existing tools miss.
Daejun Park, Yi Zhang, Manasvi Saxena, Philip Daian · 5 authors
In this paper, we present a formal verification tool for the Ethereum Virtual Machine (EVM) bytecode. To precisely reason about all possible behaviors of the EVM bytecode, we adopted KEVM, a complete formal semantics of the EVM, and instantiated the K-framework's reachability logic theorem prover to generate a correct-by-construction deductive verifier for the EVM. We further optimized the verifier by introducing EVM-specific abstractions and lemmas to improve its scalability. Our EVM verifier has been used to verify various high-profile smart contracts including the ERC20 token, Ethereum Casper, and DappHub MakerDAO contracts.
Neville Grech, Michael Kong, Anton Jurisevic, Lexi Brent · 6 authors
Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged inter-communicating programs that capture the transaction logic of an account. Unlike programs in mainstream languages, a gas limit restricts the execution of an Ethereum smart contract: execution proceeds as long as gas is available. Thus, gas is a valuable resource that can be manipulated by an attacker to provoke unwanted behavior in a victim's smart contract (e.g., wasting or blocking funds of said victim). Gas-focused vulnerabilities exploit undesired behavior when a contract (directly or through other interacting contracts) runs out of gas. Such vulnerabilities are among the hardest for programmers to protect against, as out-of-gas behavior may be uncommon in non-attack scenarios and reasoning about it is far from trivial. In this paper, we classify and identify gas-focused vulnerabilities, and present MadMax: a static program analysis technique to automatically detect gas-focused vulnerabilities with very high confidence. Our approach combines a control-flow-analysis-based decompiler and declarative program-structure queries. The combined analysis captures high-level domain-specific concepts (such as "dynamic data structure storage" and "safely resumable loops") and achieves high precision and scalability. MadMax analyzes the entirety of smart contracts in the Ethereum blockchain in just 10 hours (with decompilation timeouts in 8% of the cases) and flags contracts with a (highly volatile) monetary value of over $2.8B as vulnerable. Manual inspection of a sample of flagged contracts shows that 81% of the sampled warnings do indeed lead to vulnerabilities, which we report on in our experiment.
Simona Ibba, Andrea Pinna, Maria Ilaria Lunesu, Michele Marchesi · 5 authors
An ICO (Initial Coin Offering) is an innovative way to fund projects based on blockchain. The funding is based on the selling of tokens by means of decentralized applications called smart contracts written in Solidity, a programming language specific for Ethereum blockchain. The ICOs work in a volatile context and it is crucial that the team is capable of handling constant changes. The Agile methods, proven practices enabling to develop software in presence of changing requirements, could be a means for managing uncertainty. The main goals of this work are to understand software engineering activities related to ICOs, recognize the ICOs developed using Agile methods, and make a comparison between ICOs and Agile ICOs. In addition, we perform a deeper analysis of Agile ICOs concerning project planning, software development, and code features. Our work shows that the roles of the people involved in an ICO can be compared to the typical roles of the SCRUM methodology. The majority of Agile ICOs use tool of testing before storing smart contract on blockchain. Finally, the application of volumetric and complexity software metrics shows that the files of Agile ICOs is on average shorter and less complex than in other smart contracts.
Ethereum Private Sidechains are permissioned Ethereum blockchains which allow authorised participants to interact privately using Smart Contracts. Permissioned blockchains are appropriate for use in scenarios in which the list of blockchain participants and the code and state of contracts on the blockchain must be kept secret. Ethereum Registration Authorities are a system of Smart Contracts which can be used to resolve bootstrap information based on domain names to allow Ethereum Private Sidechains to be established between parties which have not previously interacted. This paper presents the architecture, design, and gas usage of a reference implementation for the Ethereum Registration Authority system. It analyses the security properties of the system and shows that it is secure, decentralized, and censorship resistant. The reference implementation gas usage is analysed and shown to be independent of the length of domain name and number of entries in the Smart Contracts.
Ji-Sun Park, Taek-Young Youn, Hye-Bin Kim, Kyung-Hyune Rhee · 5 authors
Internet of Things (IoT)-based devices, especially those used for home automation, consist of their own sensors and generate many logs during a process. Enterprises producing IoT devices convert these log data into more useful data through secondary processing; thus, they require data from the device users. Recently, a platform for data sharing has been developed because the demand for IoT data increases. Several IoT data marketplaces are based on peer-to-peer (P2P) networks, and in this type of marketplace, it is difficult for an enterprise to trust a data owner or the data they want to trade. Therefore, in this study, we propose a review system that can confirm the reputation of a data owner or the data traded in the P2P data marketplace. The traditional server-client review systems have many drawbacks, such as security vulnerability or server administrator's malicious behavior. However, the review system developed in this study is based on Ethereum smart contracts; thus, this system is running on the P2P network and is more flexible for the network problem. Moreover, the integrity and immutability of the registered reviews are assured because of the blockchain public ledger. In addition, a certain amount of gas is essential for all functions to be processed by Ethereum transactions. Accordingly, we tested and analyzed the performance of our proposed model in terms of gas required.
Interest in cryptocurrencies has skyrocketed since their introduction a decade ago, with hundreds of billions of dollars now invested across a landscape of thousands of different cryptocurrencies. While there is significant diversity, there is also a significant number of scams as people seek to exploit the current popularity. In this paper, we seek to identify the extent of innovation in the cryptocurrency landscape using the open-source repositories associated with each one. Among other findings, we observe that while many cryptocurrencies are largely unchanged copies of Bitcoin, the use of Ethereum as a platform has enabled the deployment of cryptocurrencies with more diverse functionalities.
Blockchain and Tangle are data structures used to create an immutable public record of data insured by a network of peer-to-peer participants who maintain a set of constantly growing data records known as ledgers. Blockchain and Tangle technologies are a decentralized solution that guarantees the exchange of large amounts of trusted messages, among billions of connected IoT devices, which are very valuable as they are valid and complete. This highly encrypted and secure peer-to-peer messaging mechanism is adopted in this project to manage the processing of IoT transactions and the coordination between the devices that interact with the process. To maintain private transactions, secure and trustless, the distributed consensus algorithms are responsible for validating and choosing transactions and recording them in the global ledger. The results showed that the speed of the consensus algorithms can affect the creation in real time of reliable stories that track the events of the IoT networks. After incorporating Complex Event Processing that allows selecting only those high level events, it is possible to get an improvement in many situations. The result is a Middleware system that provides a framework for the construction of large-scale computer applications that use Complex Events Processing and different decentralized ledgers such as the blockchain of Ethereum or IOTA Tangle, for secure data storage.
Alexander Ivanov, Yevhenii Babichenko, Hlib Kanunnikov, Paul Karpus · 8 authors
Blockchain as a technology is rapidly developing, finding more and more new entry points into everyday life. This is one of the elements of the technical Revolution 4.0, and it is used in the field of supply, maintenance of various types of registers, access to software products, combating DDOS attacks, distributed storage, fundraising for projects, IoT, etc.Nowadays, there are many blockchainplatforms in the world. They have one technological root but different applications. There are many prerequisites to the fact that in the future the number of new decentralized applications will increase. Therefore, it is important to develop a methodology for determining the optimal blockchainbased platform to solve a specific problem. As an example, consider the worldfamous platforms Ethereum, Nem, and Stellar. Each of them allows to develop decentralized applications, issue tokens, and execute transactions. At the same time, the key features of these blockchainbased platforms are not similar to one another. These very features will be considered in the article.Purpose. Identify the key parameters that characterize the blockchainbased platforms. This will provide an opportunity to present a complex blockchain technology in the form of a simple and understandable architecture. Based on these parameters and using the expertise of the article’s authors, we will be able to develop a methodology to be used to solve the problems of choosing the optimal blockchainbased platform for solving the problem of developing smart contracts and issuing tokens.Methods. Analysis of the complexity of using blockchainbased platforms. Implementation of token issuance, use of test and public networks, execution of transactions, analysis of the development team and the community, analysis of the user interface and the developer interface.Discussion. By developing a platform comparison methodology to determine optimal characteristics, we can take the development process to a new level. This will allow to quickly and effectively solve the tasks.Results. Creation of a methodology for comparison blockchainbased platforms.
Growing consumer awareness as well as manufacturers' internal quality\nrequirements lead to novel demands on supply chain traceability. Existing\ncentralized solutions suffer from isolated data storage and lacking trust when\nmultiple parties are involved. Decentralized blockchain-based approaches\nattempt to overcome these shortcomings by creating digital representations of\nphysical goods to facilitate tracking across multiple entities. However, they\ncurrently do not capture the transformation of goods in manufacturing\nprocesses. Therefore, the relation between ingredients and product is lost,\nlimiting the ability to trace a product's provenance. We propose a\nblockchain-based supply chain traceability system using smart contracts. In\nsuch contracts, manufacturers define the composition of products in the form of\nrecipes. Each ingredient of the recipe is a non-fungible token that corresponds\nto a batch of physical goods. When the recipe is applied, its ingredients are\nconsumed and a new token is produced. This mechanism preserves the traceability\nof product transformations. The system is implemented for the Ethereum Virtual\nMachine and is applicable to any blockchain configuration that supports it. Our\nevaluation reveals that the gas costs scale linearly with the number of\nproducts considered in the system. This leads to the conclusion that the\nsolution can handle complex use cases.\n
Open access
Blockchain Technology Applications and Security
Innovative Microfluidic and Catalytic Techniques Innovation
Blockchain technology shows significant results and huge potential for serving as an interweaving fabric that goes through every industry and market, allowing decentralized and secure value exchange, thus connecting our civilization like never before. The standard approach for asset value predictions is based on market analysis with an LSTM neural network. Blockchain technologies, however, give us access to vast amounts of public data, such as the executed transactions and the account balance distribution. We explore whether analyzing this data with modern Deep Leaning techniques results in higher accuracies than the standard approach. During a series of experiments on the Ethereum blockchain, we achieved $4$ times error reduction with blockchain data than an LSTM approach with trade volume data. By utilizing blockchain account distribution histograms, spatial dataset modeling, and a Convolutional architecture, the error was reduced further by 26\%. The proposed methodologies are implemented in an open source cryptocurrency prediction framework, allowing them to be used in other analysis contexts.
Blockchain technology adds records to a list using cryptographic links. Therefore, the security of blockchain smart contracts is among the most popular contemporary research topics. To improve the theorem-proving technology in this field, we are developing an extensible hybrid verification tool chain, denoted as FSPVM-E, for Ethereum smart contract verification. This hybrid system extends the proof assistants in Coq, a formal proof-management system. Combining symbolic execution with higher-order theorem-proving, it solves consistency, automation, and reusability problems by standard theorem-proving approaches. This article completes the FSPVM-E by developing its proof engine. FSPVM-E is an extensible definitional interpreter based on our previous work FEther, which is totally developed in the Coq proof assistant. It supports almost all semantics of the Solidity programing language, and simultaneously executes multiple types of symbols. FEther also contains a set of automatic strategies that execute and verify the smart contracts in Coq with a high level of automation. The functional correctness of FEther was verified in Coq. In standard tutorials, the execution efficiency of FEther far exceeded that of the interpreters developed in Coq.