Ben Biedermann, Matthew Scerri, Victoria Kozlova, Joshua Ellul
The terms self-sovereign identity (SSI) and decen-tralised identity are often used interchangeably, which results in increasing ambiguity when solutions are being investigated and compared. This article aims to provide a clear distinction between the two concepts in relation to the revised Regulation as Regards establishing the European Digital Identity Framework (eIDAS 2.0) by providing a systematisation of knowledge of technological developments that led up to implementation of eIDAS 2.0. Applying an inductive exploratory approach, relevant literature was selected iteratively in waves over a nine months time frame and covers literature between 2005 and 2024. The review found that the decentralised identity sector emerged adjacent to the OpenID Connect (OIDC) paradigm of Open Authentication, whereas SSI denotes the sector's shift towards blockchain-based solutions. In this study, it is shown that the interchangeable use of SSI and decentralised identity coincides with novel protocols over OIDC. While the first part of this paper distinguishes OIDC from decentralised identity, the second part addresses the incompatibility between OIDC under eIDAS 2.0 and Web3. The paper closes by suggesting further research for establishing a digital identity bridge for connecting applications on public-permissionless ledgers with data originating from eIDAS 2.0 and being presented using OIDC.
Implementing provable fairness in the minting process of non-fungible tokens (NFTs) enables the procedural generation of NFT metadata that can be verified in a decentralized manner, even when stored off-chain. Until now, smart contracts have required additional on-chain data, such as integrity digests, to support the verification of off-chain NFT metadata. Due to the high costs of on-chain data storage, most NFTs do not implement such validation methods, reducing trust in the NFT's off-chain metadata and increasing reliance on centralization. We propose a new method, inspired by the virtual ecology design of sandbox massively multiplayer online role-playing games (MMORPGs). This method utilizes a 256-bit unsigned integer representing a seed value, a Web3-compatible implementation of a pseudorandom number generator (W3PRNG), and an executable ruleset containing attribute definitions and their probability spaces to procedurally generate NFTs. This methodology provides users with a provably fair way of generating NFTs in an open-ended minting smart contract by imitating Proof-of-Work mining, including an arbitrary amount of work to be performed while initializing the PRNG. Due to the extremely large state space of 2^256 possible seeds, any implementation makes the NFT's economy inherently inflationary, offering more attractive features and higher utility in Web3 and Metaverse design than existing fixed supply NFT collections. Furthermore, such a system implicitly guarantees the veracity of off-chain metadata based on the on-chain seed value and the smart contract's immutable integrity configuration. (First published to the Future of Gaming Discord community in November, 2022)
Hao Luo, Yuhao Lin, Yan Xiao, Xuejiao Hu ยท 8 authors
Smart contract is a kind of self-executing code based on blockchain technology with a wide range of application scenarios, but the traditional generation method relies on manual coding and expert auditing, which has a high threshold and low efficiency. Although Large Language Models (LLMs) show great potential in programming tasks, they still face challenges in smart contract generation w.r.t. effectiveness and security. To solve these problems, we propose FSM-SCG, a smart contract generation framework based on finite state machine (FSM) and LLMs, which significantly improves the quality of the generated code by abstracting user requirements to generate FSM, guiding LLMs to generate smart contracts, and iteratively optimizing the code with the feedback of compilation and security checks. The experimental results show that FSM-SCG significantly improves the quality of smart contract generation. Compared to the best baseline, FSM-SCG improves the compilation success rate of generated smart contract code by at most 48%, and reduces the average vulnerability risk score by approximately 68%.
Zhiyang Chen, Ye Liu, Sidi Mohamed Beillahi, Yi Li ยท 5 authors
Smart contracts, self-executing programs on the blockchain, facilitate reliable value exchanges without centralized oversight. Despite the recent focus on dynamic analysis of their transaction histories in both industry and academia, no open-source tool currently offers comprehensive tracking of complete transaction information to extract user-desired data such as invariant-related data. This paper introduces OpenTracer, designed to address this gap. OpenTracer guarantees comprehensive tracking of every execution step, providing complete transaction information. OpenTracer has been employed to analyze 350,800 Ethereum transactions, successfully inferring 23 different types of invariant from predefined templates. The tool is fully open-sourced, serving as a valuable resource for developers and researchers aiming to extract or validate new invariants from transaction traces. A demonstration video of OpenTracer is available at https://youtu.be/vTdmjWdYd30. The source code of OpenTracer is available at https://github.com/jeffchen006/OpenTracer.
M. Albrecht, Matilda Backendal, Daniele Coppola, Kenneth G. Paterson
Nextcloud is a leading cloud storage platform with more than 20 million users. Nextcloud offers an end-to-end encryption (E2EE) feature that is claimed to be able โto keep extremely sensitive data fully secure even in case of a full server breachโ. They also claim that the Nextcloud server โhas Zero Knowledge, that is, never has access to any of the data or keys in unencrypted formโ. This is achieved by having encryption and decryption operations that are done using file keys that are only available to Nextcloud clients, with those file keys being protected by a key hierarchy that ultimately relies on long passphrases known exclusively to the users. We provide the first detailed documentation and security analysis of Nextcloud's E2EE feature. Nextcloud's strong security claims motivate conducting the analysis in the setting where the server itself is considered malicious. We present three distinct attacks against the E2EE security guarantees in this setting. Each one enables the confidentiality and integrity of all user files to be compromised. All three attacks are fully practical and we have built proof-of-concept implementations for each. The vulnerabilities make it trivial for a malicious Nextcloud server to access and manipulate users' data. We have responsibly disclosed the three vulnerabilities to N extcloud. The second and third vulnerabilities have been remediated. The first was addressed by temporarily disabling file sharing from the E2EE feature until a redesign of the feature can be made. We reflect on broader lessons that can be learned for designers of E2EE systems.
Dincy R. Arikkat, Mert Cihangiroglu, Mauro Conti, Rafidha Rehiman K. A. ยท 7 authors
The rise of IT-dependent operations in modern organizations has heightened their vulnerability to cyberattacks. Organizations are inadvertently enlarging their vulnerability to cyber threats by integrating more interconnected devices into their operations, which makes these threats both more sophisticated and more common. Consequently, organizations have been compelled to seek innovative approaches to mitigate the menaces inherent in their infrastructure. In response, considerable research efforts have been directed towards creating effective solutions for sharing Cyber Threat Intelligence (CTI). Current information-sharing methods lack privacy safeguards, leaving organizations vulnerable to proprietary and confidential data leaks. To tackle this problem, we designed a novel framework called SeCTIS (Secure Cyber Threat Intelligence Sharing), integrating Swarm Learning and Blockchain technologies to enable businesses to collaborate, preserving the privacy of their CTI data. Moreover, our approach provides a way to assess the data and model quality and the trustworthiness of all the participants leveraging some validators through Zero Knowledge Proofs. Extensive experimentation has confirmed the accuracy and performance of our framework. Furthermore, our detailed attack model analyzes its resistance to attacks that could impact data and model quality. โข Definition of a Swarm Learning approach for collaborative CTI. โข Definition of a Blockchain-based solution for privacy preservation in CTI sharing. โข Secure CTI validation using a consensus mechanism and Zero-Knowledge Proof.
Decentralized finance (DeFi) protocols are crypto projects developed on the blockchain to manage digital assets. Attacks on DeFi have been frequent and have resulted in losses exceeding \$77 billion. However, detection methods for malicious DeFi events are still lacking. In this paper, we propose DeFiTail, the first framework that utilizes deep learning to detect access control and flash loan exploits that may occur on DeFi. Since the DeFi protocol events involve invocations with multi-account transactions, which requires execution path unification with different contracts. Moreover, to mitigate the impact of mistakes in Control Flow Graph (CFG) connections, we validate the data path by employing the symbolic execution stack. Furthermore, we feed the data paths through our model to achieve the inspection of DeFi protocols. Experimental results indicate that DeFiTail achieves the highest accuracy, with 98.39% in access control and 97.43% in flash loan exploits. DeFiTail also demonstrates an enhanced capability to detect malicious contracts, identifying 86.67% accuracy from the CVE dataset.
Traditional covert transmission (CT) approaches have been hindering CT application while blockchain technology offers new avenue. Current blockchain-based CT approaches require off-chain negotiation of critical information and often overlook the dynamic updating of session keys, which increases the risk of message and key leakage. Additionally, in some approaches the covert transactions exhibit obvious characteristics that can be easily detected by third-parties. Moreover, most approaches do not address the issue of decreased reliability of message transmission in blockchain attack scenarios. Bitcoin-and Ethereum-based approaches also have the issue of transaction linkability, which can be tackled by Monero-based approaches because of the privacy protection mechanisms in Monero. However, Monero-based CT has the problem of sender repudiation. In this paper, we propose a novel$M$onero-$B$ased CT approach (MBCT), which enables on-chain session key dynamically updating without off-chain negotiation. MBCT can assure confidentiality of on-chain session key, non-repudiation of transmission parties, reliability of message transmission under blockchain attack, unlinkability and obscurity of covert transactions. They are achieved by the three components in MBCT, namely, a sender authentication method, a dynamically on-chain session key updating method and a state feedback method. We implement MBCT in Monero-0.18.1.0 and the experiment results demonstrate its high embedding capacity of MBCT.
Haoxian Chen, Lan Lu, Brendan Massey, Yuepeng Wang ยท 5 authors
Smart contracts manage a large number of digital assets nowadays. Bugs in these contracts have led to significant financial loss. Verifying the correctness of smart contracts is, therefore, an important task. This paper presents an automated safety verification tool, DCV, that targets declarative smart contracts written in De-Con, a logic-based domain-specific language for smart contract implementation and specification. DCV proves safety properties by mathematical induction and can automatically infer inductive invariants using heuristic patterns, without annotations from the developer. Our evaluation on 23 benchmark contracts shows that DCV is effective in verifying smart contracts adapted from public repositories, and can verify contracts not supported by other tools. Furthermore, DCV significantly outperforms baseline tools in verification time.
Abstract: As a consequence of mass unemployment being the byproduct of COVID-19, people around the world discovered investment in cryptocurrency as a means to tackle their declining financial condition. Subsequently, the prominence of Ethereum as a platform for crypto transactions also gave rise to fraudulent transactions. The need to detect these frauds exists even today. This study proposes a token-based approach to detect fraud in Ethereum transactions incorporating the ERC20 standard, by employing machine learning techniques. After cleaning and preprocessing of the dataset, the transaction data was fed to Random Forest (RF), AdaBoost, Extra Trees (ET), Gradient Boosting (GB) and Extreme Gradient Boosting (XGB) classifiers in search of the most suitable model for fraud detection. Meticulous evaluation revealed that RF, ET and XGB classifiers yielded the highest accuracy of 95%. The proposed token-based approach hence presents a novel and efficient solution for fraud detection, with room for improvement and scalability.
Kushal Patil, Asit Khobragade, Aditya Awati, Bharati Nikose
This paper presents the Blockchain-Based Decentralised File Sharing System (BBDFS),also called DecentraShare a complete, production-ready system that solves thethree fundamental weaknesses of cloud-based le sharing: lack of privacy, absence oftamper evidence, and susceptibility to censorship. The system integrates three tech-nologies: the InterPlanetary File System (IPFS) for peer-to-peer distributed storage,Ethereum-compatible smart contracts deployed on the Polygon Proof-of-Stake net-work for programmable access control, and AES-256-GCM symmetric encryptionperformed entirely inside the user's browser via the Web Crypto API.When a le is uploaded, it is encrypted locally before leaving the user's device the backend server never receives plaintext content. A content identier (CID)returned by IPFS is anchored on the blockchain alongside a SHA-256 integrity hash.Three Solidity 0.8.19 smart contracts FileRegistry.sol, AccessControl.sol,and IntegrityLedger.sol manage ownership, per-wallet permission grants andrevocations, and a chained integrity audit log respectively. A stateless Node.js 20/ Express 4.18 backend exposes 19 REST API endpoints, while real-time Server-Sent Events (SSE) deliver access notications to recipients within a median of 18milliseconds.Performance evaluation over 1,500 independent le-transfer trials demonstrates amedian upload latency of 2.58 seconds for 1MB payloads, on-chain conrmationwithin 2.1 seconds on Polygon, and 99.97% data retrievability under normal operat-ing conditions. Gas optimisation reduced smart contract deployment cost by 46.7%over naive reference implementations. Comparative analysis against Storj, Filecoin,Swarm, and AWS S3 conrms that BBDFS is the only evaluated system simultane-ously providing end-to-end encryption, on-chain access control, and tamper-evidentauditing.
The advent of large language models (LLMs) has marked a significant milestone in the realm of artificial intelligence, with their capabilities often matching or surpassing human expertise in various domains. Among these achievements, their adeptness in translation tasks stands out, closely mimicking the intricate and preliminary processes undertaken by human translators to ensure the fidelity and quality of the translated content. Despite the advancements in utilizing LLMs for translating programming code across different languages, the domain of smart contract translation, particularly into languages not previously encountered by the LLM, remains largely unexplored. In our research, we present a pioneering approach, SolMover, which harnesses the synergy of two distinct LLMs within a unified framework. This framework is designed to grasp coding principles and apply this understanding to the translation of code into an unfamiliar language. Our study delves into the capacity of LLMs to mimic human learning processes, offering an in-depth evaluation of our methodology for converting smart contracts written in Solidity to Move, a language with limited resources. The framework employs one LLM to decipher coding conventions for the new language, creating a blueprint for the second LLM, which, lacking planning abilities, possesses coding expertise. The empirical evidence from our experiments suggests that SolMover substantially enhances performance compared to gpt-3.5-turbo-1106, and achieves superior results over competitors such as Palm2 and Mixtral-8x7B-Instruct. Additionally, our analysis highlights the efficacy of our bug mitigation strategy in elevating code quality across all models, even outside the SolMover framework.
Koteswara Rao Kodepogu, Mudigonda Dharmateja, J. M. S. V. Ravi Kumar, Muraboina Hari Pavan Gopi Krishna ยท 5 authors
In this exploration, our paper delves into the intricate implementation of robust authentication and transaction management within educational blockchain systems.Our project showcases a commitment to privacy and integrity, safeguarding interactions through advanced cryptographic techniques.The multifaceted capabilities of blockchain technology are showcased through the seamless maintenance of student records, the facilitation of secure voting processes, and the optimization of token transfers, collectively contributing to an ecosystem characterized by enhanced security, transparency, and efficiency.Our study uncovers insights into blockchain's transformative potential in education, redefining paradigms by introducing security measures and transparency to student-admin interactions.We highlight the successful implementation of blockchainbased authentication and transaction management systems, leading to enhanced educational processes.Additionally, we briefly outline our research design and methodology, emphasizing the rigorous approach to exploring blockchain applications.
Classical double entry accounting has provided the foundation for accounting within the firm for many centuries. The digitally signed receipt, an innovation from financial cryptography, gives rise to exactly duplicated entries for each of 3 parties or roles, the outcome of which we call triple entry accounting. This presents a challenge to double entry bookkeeping by expanding the use of accounting from inside firms to activity between the firms. When applied to digital cash and digital assets, the approach of negotiating a single signed receipt between parties lowers costs by delivering reliable data to support stronger accounting, and makes much stronger governance possible in a way that positively impacts on the future needs of corporate and public accounting. By turning the opinions of firm owners into facts agreed between firms, triple entry bookkeeping creates the bulletproof accounting layer to support aggressive uses and adversarial users such as are found in the Bitcoin system of transactions.
Daniel Melero Martinez, Mohammed ElโHajj, Dipti Kapoor Sarmah
Motivated by the need for an equitable and decentralized music streaming service, this paper presents a comprehensive solution focused on ensuring fair compensation for creators of musical content. It is anchored in five critical design principles: Security, scalability, anonymity, legality, and user incentivization. The implementation utilizes the IoTA distributed ledger technology to align closely with these essential criteria. Thereby offering valuable insights on the inherent challenges and possibilities of this innovative technology. The proposed solution consists of four primary components: a user-friendly mobile application enabling intuitive music playback, a distribution software that simplifies the dissemination of music, a website facilitating music management, and a smart contract that forms the decentralized foundation for handling payments and storing metadata. The study also incorporates a detailed analysis of the platform's scalability, focusing on its ability to accommodate an expanding user base and increasing data volume, ensuring sustained performance and security. Significant strides have been made in designing user-centric interfaces for decentralized music streaming, establishing a robust validation system to safeguard intellectual property rights, and pioneering novel strategies to optimize music distribution within the platform.
Marco Marcozzi, Ernestas Filatovas, Linas Stripinis, Remigijus Paulaviฤius
The consensus protocol plays a vital role in the performance and security of a specific Distributed Ledger Technology (DLT) solution. Currently, the traditional classification of consensus algorithms relies on subjective criteria, such as protocol families (Proof of Work, Proof of Stake, etc.) or other protocol features. However, such classifications often result in representatives with strongly different characteristics belonging to the same category. To address this challenge, a quantitative data-driven classification methodology that leverages machine learningโspecifically, clusteringโis introduced here to achieve unbiased grouping of analyzed consensus protocols implemented in various platforms. When different clustering techniques were used on the analyzed DLT dataset, an average consistency of 78% was achieved, while some instances exhibited a match of 100%, and the lowest consistency observed was 55%.
Jan 1, 2024ยทProceedings of the 3rd International Conference on Bigdata Blockchain and Economy Management, ICBBEM 2024, March 29โ31, 2024, Wuhan, China
Smart contracts, as a type of contract technology on the blockchain, can effectively address many shortcomings of traditional contract systems in digital environments, including opaque contract execution, regulatory difficulties, and low dispute resolution efficiency, provide publishers with a more
Ethereum smart contracts leverage blockchain technology to facilitate the transfer of values directly between participants on a network, eliminating the need for a central authority. These contracts are deployed on decentralized applications that operate on top of the blockchain. By doing so, they provide individuals with the ability to create agreements in a transparent and secure environment, minimizing conflicts and promoting trust. It has been observed that there are bugs in the smart contractโs codes as these are provided by various programmers across the globe. The attackers exploit these security loopholes and pose a significant threat to applications, which subsequently result in financial losses to users. Discovering vulnerability in each contract is an important but time-consuming task. Therefore, we require to provide a security layer to each smart-contract such that it will make the exploitation a bit difficult task for attackers. The use of encryption and obfuscation techniques improves the security layer. The main focus of this research is source code obfuscation, which can increase security by up to 75%. The code obfuscation in security is mainly used by attackers to hide their malicious intent. We, in this approach suggest this method for increasing the complexity of smart contracts so that these cannot be exploited easily. We evaluate the impact of adding security layer to smart contract. The evaluation was done with various static and dynamic tools that identify the vulnerability in smart contracts. We achieved promising results which show that Obfuscation technique enhances the security and complexity of codes up to 75% which are stored on public blockchain.
In recent years, non-fungible tokens (NFTs) have rapidly emerged as a novel business model based on blockchain technology. However, this phenomenon also challenges the existing copyright protection system. This research develops game models between creators and collectors in the NFT market, considering different platform reputation mechanisms. First, the potential for individuals to achieve cooperative equilibrium in repeated games is explored, and then the group evolutionary stability in evolutionary games is analyzed. The findings indicate that platforms with reputation systems are more effective in encouraging creators to consistently produce original works, which is beneficial for copyright protection. For individuals, the degree of importance that creators place on future profits plays a crucial role in fostering long-term cooperation. In this context, reputation systems can lower the threshold for cooperation by reducing the required emphasis on future gains, thereby fostering greater cooperation. For groups, in the absence of reputation systems, creators tend to adopt non-original strategies. Conversely, a reputation system can encourage originality when sufficient incentives and a critical mass of initial original creators are present. The research offers a game-theoretic perspective on copyright protection in the NFT market, offering theoretical insights for designing effective reputation systems on NFT platforms and serving as a reference for policymakers.
Maznun Arifa Mohammadan Makhtar, Novia Admodisastro, Mohd Anuar Mat Isa, Daniel Hafiz Abdullah ยท 5 authors
People are now widely adopting digital assets in various applications, integrating them into almost every aspect of their lives. Electronic books, or e-books, are one of the digital assets that result from the transformation of physical reading material into the digital world. Nowadays, blockchain is used in many industries because it provides immutable and transparent records. E-book publishers may take this opportunity to adopt blockchain technology for e-book data management. However, blockchain storage is limited; thus, storing the e-book files in blockchain is not recommended. A decentralized storage system, such as InterPlanetary Files Systems (IPFS), is an alternative way to store large files like e-books. IPFS can facilitate the storage of e-book files while the metadata is stored in the blockchain. The e-book metadata should be stored in a structured way for effective search and retrieval. E-book metadata could be added, deleted, and updated occasionally. Nevertheless, some data structures often struggle with dynamic collections of records. This paper proposes a linked list-based smart contract on Ethereum that integrates with IPFS for the e-book management system. We demonstrate the implementation of a linked list smart contract for insertion, deletion, update, retrieval, and traversal of the e-bookโs metadata. The result shows that a linked list-based smart contract with IPFS could offer a robust solution for e-book data management. This solution provides more opportunities to explore further security and cryptography approaches toward a secure e-book management system.