This paper reports on the development and verification of a novel formal symbolic process virtual machine (FSPVM) for verifying the reliability and security of Ethereum smart contracts, denoted as FSPVM-E, completely in Coq proof assistant. It adopts execution-verification isomorphism (EVI), an extension of Curry-Howard isomorphism (CHI), as its fundamental theoretical framework. The current version of FSPVM-E is constructed on a general, extensible, and reusable formal memory (GERM) framework, an extensible and universal formal intermediate programming language Lolisa, which is a large subset of the Solidity programming language using generalized algebraic datatypes, and the corresponding formally verified interpreter of Lolisa, denoted as FEther. It supports the ERC20 standard and can automatically simultaneously symbolically execute the smart contract programs of Ethereum and verify their reliability and security properties using Hoare logic in Coq. In addition, this work, contributes to solving the problems of automation, inconsistency and reusability in higher-order logic theorem proving.
At the beginning of 2018, there is a growing belief that blockchain technologies constitute a revolutionary innovation in how we transfer value electronically. In that vein, blockchain may be a suitable complement to ontologies to achieve a big part of the vision of the semantic Web by Tim Berners-Lee. We believe that if this complementarity is to be achieved blockchain and ontologies must co-evolve. In this paper, we focus on what and how to engineer models, methods, designs, and implementations for this co-evolution. As a first step in this co-evolution, we propose a conceptual design of a governance ontology represented as meta-data tags to be embedded and instantiated in a smart contract at the blockchain protocol level. We develop this design by examining and analyzing smart contracts from the infamous The DAO experiment on the Ethereum blockchain. We believe there are two contributions of this paper: it serves to inform and implore the blockchain and ontology communities to recognize and collaborate with each other; and it outlines a roadmap for engineering artifacts to bridge the gap between blockchain community focus on protocol-level blockchain interoperability and the ontology community focus on semantic-level interoperability.
The interrelatedness between computer systems, networks, code, and traditional law and legal frameworks continues to pose a number of important and vexed questions. This report will consider one area of the relationship: legal recognition of distributed ledger technology (DLT) or blockchain applications. Specifically, registers appended to blockchains (thereby creating “blockchain registries”), and “smart contracts” executed on blockchains
Jawad Ali, Toqeer Ali Syed, Shahrulniza Musa, Ali Zahrani
The Internet of Things (IoT) is undergoing rapid growth in the IT industry, but, it continues to be associated with several security and privacy concerns as a result of its massive scale, decentralised topology, and resource-constrained devices. Blockchain (BC), a distributed ledger technology used in cryptocurrency has attracted significant attention in the realm of IoT security and privacy. However, adopting BC to IoT is not straightforward in most cases, due to overheads and delays caused by BC operations. In this paper, we apply a BC technology known as Hyperledgder Fabric, to an IoT network. This technol-ogy introduces an execute-order technique for transactions that separates the transaction execution from consensus, resulting in increased efficiency. We demonstrate that our proposed IoT-BC architecture is sufficiently secure with regard to fundamental se-curity goals i.e., confidentiality, integrity, and availability. Finally, the simulation results are highlighted that shows the performance overheads associated with our approach are as minimal as those associated with the Hyperledger Fabric framework and negligible in terms of security and privacy.
Yunhua He, Hong Li, Xiuzhen Cheng, Yan Liu · 6 authors
In distributed peer-to-peer (P2P) applications, peers self-organize and cooperate to effectively complete certain tasks such as forwarding files, delivering messages, or uploading data. Nevertheless, users are selfish in nature and they may refuse to cooperate due to their concerns on energy and bandwidth consumption. Thus each user should receive a satisfying reward to compensate its resource consumption for cooperation. However, suitable incentive mechanisms that can meet the diverse requirements of users in dynamic and distributed P2P environments are still missing. On the other hand, we observe that Blockchain is a decentralized secure digital ledger of economic transactions that can be programmed to record not just financial transactions and Blockchain-based cryptocurrencies get more and more market capitalization. Therefore in this paper, we propose a Blockchain based truthful incentive mechanism for distributed P2P applications that applies a cryptocurrency such as Bitcoin to incentivize users for cooperation. In this mechanism, users who help with a successful delivery get rewarded. As users and miners in the Blockchain P2P system may exhibit selfish actions or collude with each other, we propose a secure validation method and a pricing strategy, and integrate them into our incentive mechanism. Through a game theoretical analysis and evaluation study, we demonstrate the effectiveness and security strength of our proposed incentive mechanism.
Electricity is the commonest commodity for most businesses in our world today. The use of electricity has been a breakthrough for the discovery of new technologies and has become the main driving force behind several innovations. With the introduction of smart grid systems, there have been improvements in how utility companies interact with their customers with regards to electricity use. However, since the readings are done via the Internet, there is the tendency for the data to be compromised when it gets into the hands of the wrong people. Moreover, customers mostly do not know why they pay huge amounts and which appliances use more electricity, since they are not privy to the readings. The sovereign blockchain technology, which provides transparency and provenance, is utilized in this paper to mitigate these above mentioned problems. A smart contract, which executes laid down procedures to provide a trust-based system between participants on the network is also implemented. Our system proves very efficient as the user can monitor how the electricity is used, and it also provides a platform where there is no manipulation from either party.
Field of study: Blockchain technology, decentralized autonomous organizations, smart contract and their resistance to attacks and failures. Theoretical and practical significance: Due to the fact that such a form of organization is experimental, participants often face problems of attacks on the organization, the consequences of incorrectly written rules and of fraud. The task of creating decentralized autonomous organizations that are resistant to failures and attacks, and research on the causes of such problems has become relevant for software developers and architects. Goals and objectives of work: Investigation of attack algorithms and development of methods for ensuring the sustainability of decentralized autonomous organizations for attacks on the basis of analysis of the subprocesses of border events and logs using the methods of Process Mining. The methods to be developed should promptly identify and prevent inconsistencies between the alleged and actual behavior of smart contracts that lead to such errors in the operation, such as the content of spam contracts, empty transactions, increased block processing time, etc.
Open access
Economic and Technological Systems Analysis
Advanced Research in Systems and Signal Processing
Abstract: A classic legal problem is whether breach of contract may give rise to a remedy. Under common law this is discussed under the doctrine of excuses. Its civil lawequivalent is the attributability of causes of non-performance of an obligation, and its converse, force majeure. Despite the variety of approaches in various jurisdictions, the general outlines are roughly equivalent as far as translation into smart contracts is concerned: the main issue is what is the cause of non-performance and whether this cause can be attributed. Smart contracts can deal with the general outline of this structure, but may in practice only approximate the refinement that contract law offers. Themain problems are: determining the actual cause of the non-performance by means of automated oracles or the smart contract on its own (without relying on human judgment), dealing with multiple causality and impediments due to the creditor, determining attributability of the cause of non-performance. Smart contracts may offer no more than an approximation of the detailed rules of contract law, by hard-and-fast rules. This may suffice for certain categories of contracts, but may need additional effort to obtain a closer approximation of contract law rules where larger interests are concerned. The related doctrine of withholding performance is similarly difficult to realize appropriately in smart contracts. As regards hardship or unforeseen circumstances, it is best to disallow this in smart contracts,which leaves open the questionwhether partiesmight go to court for relief. The reliance on oracles furthermore opens a weakness to the automatic performance of smart contracts, due to possible liability of oracles for perceived incorrect assessment.
Xiaohong Huang, Cheng Xu, Pengfei Wang, Hongzhe Liu
The Internet of Energy (IoE) provides an effective networking technology for distributed green energy, which allows the connection of energy anywhere at any time. As an important part of the IoE, electric vehicles (EVs), and charging pile management are of great significance to the development of the IoE industry. Previous work has mainly focused on network performance optimization for its management, and few studies have considered the security of the management between EVs and charging piles. Therefore, this paper proposes a decentralized security model based on the lightning network and smart contract in the blockchain ecosystem; this proposed model is called the lightning network and smart contract (LNSC). The overall model involves registration, scheduling, authentication, and charging phases. The new proposed security model can be easily integrated with current scheduling mechanisms to enhance the security of trading between EVs and charging piles. Experimental results according to a realistic infrastructure are presented in this paper. These experimental results demonstrate that our scheme can effectively enhance vehicle security. Different performances of LNSC-based scheduling strategies are also presented.
Carlos Molina-Jiménez, Ellis Solaiman, Ioannis Sfyrakis, Irene C. L. Ng · 5 authors
In this paper we discuss how conventional business contracts can be converted into smart contracts---their electronic equivalents that can be used to systematically monitor and enforce contractual rights, obligations and prohibitions at run time. We explain that emerging blockchain technology is certainly a promising platform for implementing smart contracts but argue that there is a large class of applications, where blockchain is inadequate due to performance, scalability, and consistency requirements, and also due to language expressiveness and cost issues that are hard to solve. We explain that in some situations a centralised approach that does not rely on blockchain is a better alternative due to its simplicity, scalability, and performance. We suggest that in applications where decentralisation and transparency are essential, developers can advantageously combine the two approaches into hybrid solutions where some operations are enforced by enforcers deployed on--blockchains and the rest by enforcers deployed on trusted third parties.
Interacting with Ethereum smart contracts can have potentially devastating financial consequences. In light of this, several regulatory bodies have called for a need to audit smart contracts for security and correctness guarantees. Unfortunately, auditing smart contracts that do not have readily available source code can be challenging, and there are currently few tools available that aid in this process. Such contracts remain opaque to auditors. To address this, we present Erays, a reverse engineering tool for smart contracts without the need for source code. Erays takes in smart contract from the Ethereum blockchain and produces high-level pseudocode suitable for manual analysis. We show how Erays can be used to provide insight into several contract properties, such as code complexity and code reuse in the ecosystem. We then leverage Erays to link contracts with no previously available source code to public source code, thus reducing the overall opacity in the ecosystem. Finally, we demonstrate how Erays can be used for reverse-engineering in four case studies: high-value multi-signature wallets, arbitrage bots, exchange accounts, and finally, a popular smart-contract game, Cryptokitties. We conclude with a discussion regarding the value of reverse engineering in the smart contract ecosystem, and how Erays can be leveraged to address the challenges that lie ahead.
Smart contracts, self-executing agreements based on blockchain technology, have the capacity to create trust in what we term no-trust contracting environments. We argue that using them in such environments is the path to unleash the full potential of smart contracts. Compared to the contract enforcement mechanisms characterized by traditional contract law or relational contracts, smart contracts can offer a superior solution for facilitating trade.
Several lawyers and economists have debated whether smart contracts might offer the prospect of cheaper, faster and better transactions. As we discuss below, contract law scholars caution that they neither replicate the relational context essential for the day-to-day practice of contracting nor offer a superior solution to problems addressed by traditional contract law, such as contract validity and legality. We clarify and systematize the current thinking on the legal nature and reliability of smart contracts, and address the concerns of contract law scholars. While doing that, we suggest a step forward in characterizing contracting environments, contract enforcement mechanisms and the trust relationship underlying contracts.
In this paper, we propose a novel blockchain‐based contractual routing (BCR) protocol for a network of untrusted IoT devices. In contrast to conventional secure routing protocols in which a central authority (CA) is required to facilitate the identification and authentication of each device, the BCR protocol operates in a distributed manner with no CA. The BCR protocol utilizes smart contracts to discover a route to a destination or data gateway within heterogeneous IoT networks. Any intermediary device can guarantee a route from a source IoT device to a destination device or gateway. We compare the performance of BCR with that of the Ad-hoc On‐Demand Distance Vector (AODV) routing protocol in a network of 14 devices. The results show that the routing overhead of the BCR protocol is 5 times lower compared to AODV at the cost of a slightly lower packet delivery ratio. BCR is fairly resistant to both Blackhole and Greyhole attacks. The results show that the BCR protocol enables distributed routing in heterogeneous IoT networks.
Current shareholder engagement systems face large classical inefficiencies. First, due to the large chains of intermediaries in the current securities models, transaction costs are high and shareholder votes and other information are not always correctly transmitted between shareholders and issuers. Recent cases including DNick Holding and T. Rowe Price show the ‘absurdness’ of the current systems. The Shareholder Rights Directive II addresses these problems and the Implementing Regulation already hints at modern technologies to increase the transparency and verifiability of shareholder engagement. Next, the current shareholder engagement system enables different opportunities for different types of shareholders, creating inequalities and hindering shareholder democracy. The solution to these substantial problems lies in a state-of-the-art technology: in this contribution we argue that blockchain technology can solve these current inefficiencies that shareholders and companies face. Using a permissioned blockchain, information can be stored in a verifiable and immutable way, with a consensus mechanism tailored to its purpose. The large amount of initiatives and prototypes of blockchain proxy voting and trading, including the legislative initiatives that were initiated in the past 2 years, show the merits of using this state-of-the-art technology. The Europe Union should incorporate this technology in its legislation, like the CSD regulation, for remaining technology-proof in this globalized market.
Balázs Bodó, Daniel J. Gervais, João Pedro Quintais
This article offers a normative analysis of key blockchain technology concepts from the perspective of copyright law. Some features of blockchain technologies—scarcity, trust, transparency, decentralized public records and smart contracts—seem to make this technology compatible with the fundamentals of copyright. Authors can publish works on blockchain creating a quasi-immutable record of initial ownership, and encode ‘smart’ contracts to license the use of works. Remuneration may happen on online distribution platforms where the smart contracts reside. In theory, such an automated setup allows for the private ordering of copyright. Blockchain technology, like Digital Rights Management 20 years ago, is thus presented as an opportunity to reduce market friction, and increase both licensing efficiency and the autonomy of creators. Yet, some of the old problems remain. The article examines the differences between new, smart-contract-based private ordering regime and the fundamental components of copyright law, such as exceptions and limitations, the doctrine of exhaustion, restrictions on formalities, the public domain and fair remuneration.
There is an immense need of a proof of delivery (PoD) of today's digital media and content, especially those that are subject to payment. Current PoD systems are mostly centralized and heavily dependent on a trusted third party (TTP) especially for payment. Such existing PoD systems often lack security, transparency, and visibility, and are not highly credible, as the TTP can be subject to failure, manipulation, corruption, compromise, and hacking. In this paper, we propose a decentralized PoD solution for PoD of digital assets. Our solution leverages key features of blockchain and Ethereum smart contracts to provide immutable and tamper-proof logs, accountability, and traceability. Ethereum smart contracts are used to orchestrate and govern all interactions and transactions including automatic payments in Ether cryptocurrency between customers, digital-content provider, and the file server hosting the digital content. All entities are incentivized to act honestly, and our solution has a mechanism to handle dispute if arisen among participants. The solution has an off-chain secure download phase involving the file server and customers. Moreover, our solution leverages the benefits of interplanetary file system to store the agreed upon terms and conditions between the smart contract actors. A security analysis of our proposed system has been provided. The full code of the smart contract has been publicly made available on Github.
Open access
Blockchain Technology Applications and Security
FinTech, Crowdfunding, Digital Finance
Advanced Steganography and Watermarking Techniques
Blockchain-based smart contracts are emerging as a disruptive force that may change the way financial statement audits are performed and delivered. With their potential ability to autonomously execute audit procedures on behalf of the auditor and disclose the results of these audit procedures, blockchain-based smart contracts have the potential to improve audit quality and meet the information demands of various vested parties for more timely and transparent audit reporting. This paper proposes the application of smart contracts to auditing as an enabler for improved audit data analytics and close to real-time audit reporting.
The role-based access control (RBAC) framework is a mechanism that describes the access control principle. As a common interaction, an organization provides a service to a user who owns a certain role that was issued by a different organization. Such trans-organizational RBAC is common in face-toface communication but not in a computer network, because it is difficult to establish both the security that prohibits the malicious impersonation of roles and the flexibility that allows small organizations to participate and users to fully control their own roles. In this paper, we present an RBAC using smart contract (RBAC-SC), a platform that makes use of Ethereum's smart contract technology to realize a trans organizational utilization of roles. Ethereum is an open blockchain platform that is designed to be secure, adaptable, and flexible. It pioneered smart contracts, which are decentralized applications that serve as “autonomous agents”running exactly as programmed and are deployed on a blockchain. The RBAC-SC uses smart contracts and blockchain technology as versatile infrastructures to represent the trust and endorsement relationship that are essential in the RBAC and to realize a challenge-response authentication protocol that verifies a user's ownership of roles. We describe the RBAC-SC framework, which is composed of two main parts, namely, the smart contract and the challenge-response protocol, and present a performance analysis. A prototype of the smart contract is created and deployed on Ethereum's Testnet blockchain, and the source code is publicly available.
A smart contract is hard to patch for bugs once it is deployed, irrespective of the money it holds. A recent bug caused losses worth around $50 million of cryptocurrency. We present ZEUS-a framework to verify the correctness and validate the fairness of smart contracts. We consider correctness as adherence to safe programming practices, while fairness is adherence to agreed upon higher-level business logic. ZEUS leverages both abstract interpretation and symbolic model checking, along with the power of constrained horn clauses to quickly verify contracts for safety. We have built a prototype of ZEUS for Ethereum and Fabric blockchain platforms, and evaluated it with over 22.4K smart contracts. Our evaluation indicates that about 94.6% of contracts (containing cryptocurrency worth more than $0.5 billion) are vulnerable. ZEUS is sound with zero false negatives and has a low false positive rate, with an order of magnitude improvement in analysis time as compared to prior art.
Blockchain-based distributed computing platforms enable the trusted execution of computation - defined in the form of smart contracts - without trusted agents. Smart contracts are envisioned to have a variety of applications, ranging from financial to IoT asset tracking. Unfortunately, the development of smart contracts has proven to be extremely error prone. In practice, contracts are riddled with security vulnerabilities comprising a critical issue since bugs are by design non-fixable and contracts may handle financial assets of significant value. To facilitate the development of secure smart contracts, we have created the FSolidM framework, which allows developers to define contracts as finite state machines (FSMs) with rigorous and clear semantics. FSolidM provides an easy-to-use graphical editor for specifying FSMs, a code generator for creating Ethereum smart contracts, and a set of plugins that developers may add to their FSMs to enhance security and functionality.
Alex Biryukov, Dmitry Khovratovich, Sergei Tikhomirov
Identity is a fundamental concept for the financial industry. In order to comply with regulation, financial institutions must verify the identity of their customers. Identities are currently handled in a centralized way, which diminishes users' control over their personal information and threats their privacy. Blockchain systems, especially those with support for smart contracts (e.g., Ethereum), are expected to serve as a basis of more decentralized systems for digital identity management. We propose a design of a privacy-preserving KYC scheme on top of Ethereum. It would let providers of financial services leverage the potential of blockchain technology to increase effciency of customer onboarding while complying with regulation and protecting users' privacy.