Ben Berger, Edward W. Felten, Akaki Mamageishvili, Benny Sudakov
Optimistic rollups rely on fraud proofs -- interactive protocols executed on Ethereum to resolve conflicting claims about the rollup's state -- to scale Ethereum securely. To mitigate against potential censorship of protocol moves, fraud proofs grant participants a significant time window, known as the challenge period, to ensure their moves are processed on chain. Major optimistic rollups today set this period at roughly one week, mainly to guard against strong censorship that undermines Ethereum's own crypto-economic security. However, other forms of censorship are possible, and their implication on optimistic rollup security is not well understood. This paper considers economic censorship attacks, where an attacker censors the defender's transactions by bribing block proposers. At each step, the attacker can either censor the defender -- depleting the defender's time allowance at the cost of the bribe -- or allow the current transaction through while conserving funds for future censorship. We analyze three game theoretic models of these dynamics and determine the challenge period length required to ensure the defender's success, as a function of the number of required protocol moves and the players' available budgets.
Smart contracts are programs that permanently store and automatically execute on the blockchain system such as Ethereum. Due to the non-tamperable nature of the underlying blockchain, smart contracts are difficult to update once deployed, which requires redeploying the contracts and migrating the data. It means that the observation of smart contract evolution in the real world makes more sense. Hence, in this paper, we conducted the first large-scale empirical study to characterize the evolution of smart contracts in Ethereum. For evolution identification, we presented a contract similarity-based search algorithm, digEvolution, and evaluated its effectiveness with five different search strategies. Then we applied this algorithm to 80,152 on-chain contracts we collected from Ethereum, to dig out the evolution among these contracts. We then explored three research questions. We first studied whether the evolution of smart contracts is common (RQ1), then we studied how do the Gas consumption (RQ2) and the vulnerability (RQ3) of smart contracts vary during the evolution. Our research results show that the evolution of smart contracts is not very common. There are some contract components that have vulnerability but still be called by users. The Gas consumption of most smart contracts doesn’t vary during the evolution, contract is Gas-efficient before and after the evolution. The vulnerability of most smart contracts doesn’t vary during the evolution, both are secure before and after the evolution.
Distributed ledger technology (DLT) enable the immutable, transparent, and tamper-proof storage of transaction records in a shared electronic register. Due to these intrinsic properties, DLT has the potential to be highly disruptive to businesses. However, the heterogeneity and intricacy of the underlying technologies impede their more widespread adoption. A primary challenge lies in comprehending the interrelationships between the organizational, economical, and technical dimensions of DLT systems. An integrated perspective on the fundamental concepts of DLT within each dimension can be accomplished through the implementation of domain-specific conceptual modeling languages that explicitly account for intrinsic properties. Conceptual models adhere to well-defined elements and rules for the utilization of these elements. This enables the algorithmic processing of models to generate derivations and new insights.The focus of prior research on modeling support for DLT has been on the technical dimension. However, research on conceptual modeling approaches enabling the joint consideration of organizational, economical, and technical factors is lacking. This situation is undesirable both from a scientific standpoint and from a practical one. To address this gap, this thesis advances the current state-of-the-art in the design of DLT applications by introducing several domain-specific approaches addressing concerns across dimensions. This includes support for the decision-making in organizations, for the design of their business model, its alignment with the underlying DLT systems, and for the development of smart contracts and subsequent generation of functional code. The artifacts are consolidated into a domain-specific conceptual modeling method, facilitating the design of DLT applications and business cases.
ABSTRACT Blockchain technologies have catalyzed the rise of decentralized autonomous organizations (DAOs), which operate in an incentive network fueled by crypto tokens. In essence, these tokens are imbued with either payment rights (i.e., transactional tokens) or ownership rights (i.e., governance tokens). The decentralized organizational paradigm dismantles the traditional management structure and bring new research opportunities to Operations Management (OM). While the performance of DAOs has been largely examined in current OM literature, the effectiveness of their internal incentive mechanisms—specifically the one that uses ownership as rewards to promote user contributions—remains unclear. Focusing on DAO‐enabled virtual communities, we seek to examine whether decentralized ownership provides stronger incentives for user behaviors, such as creation and curation, in comparison to traditional monetary rewards through the lens of psychological ownership theory. We obtained data from Steemit that captures the reward, creation, curation and transaction behaviors of 98,000 users from May 2017 to April 2019. By leveraging the “power‐up” action as a shock that increases user ownership shares, we established a quasi‐experimental setting. Employing the PSM‐DID model, we found that the use of governance tokens is associated with enhanced creation and curation efforts but declined creation novelty, compared to the use of transactional tokens. Our additional analyses further reveal that the incentive effects of governance tokens diminish over time. However, upon the recurrence of the intended choice, these effects become reinforced. Notably, we find that governance token ownership is more strongly associated with curation efforts for users with weaker social ties. Conversely, for users with high reputation scores, their content creation behaviors are less strongly associated with governance token ownership. This study contributes to the burgeoning discourse on blockchain and cryptocurrency from an operational perspective, providing valuable insights for the design of incentive mechanisms in DAOs and advancing our understanding of operational efficiencies and stakeholder engagement in decentralized structures within Operations Management.
DeFi (Decentralized Finance) is one of the most important applications of today's cryptocurrencies and smart contracts. It manages hundreds of billions in Total Value Locked (TVL) on-chain, yet it remains susceptible to common DeFi price manipulation attacks. Despite state-of-the-art (SOTA) systems like DeFiRanger and DeFort, we found that they are less effective to non-standard price models in custom DeFi protocols, which account for 44.2% of the 95 DeFi price manipulation attacks reported over the past three years. In this paper, we introduce the first LLM-based approach, DeFiScope, for detecting DeFi price manipulation attacks in both standard and custom price models. Our insight is that large language models (LLMs) have certain intelligence to abstract price calculation from smart contract source code and infer the trend of token price changes based on the extracted price models. To further strengthen LLMs in this aspect, we leverage Foundry to synthesize on-chain data and use it to fine-tune a DeFi price-specific LLM. Together with the high-level DeFi operations recovered from low-level transaction data, DeFiScope detects various DeFi price manipulations according to systematically mined patterns. Experimental results show that DeFiScope achieves a high recall of 80% on real-world attacks, a precision of 96% on suspicious transactions, and zero false alarms on benign transactions, significantly outperforming SOTA approaches. Moreover, we evaluate DeFiScope's cost-effectiveness and demonstrate its practicality by helping our industry partner confirm 147 real-world price manipulation attacks, including discovering 81 previously unknown historical incidents.
ABSTRACT This paper investigates the current landscape of option trading platforms for cryptocurrencies, encompassing both centralized and decentralized exchanges. Option contracts in cryptocurrency markets offer functionalities akin to traditional markets, providing investors with tools to mitigate risks, particularly those arising from price volatility, while also allowing them to capitalize on future volatility trends. The paper discusses these applications of option contracts in the context of decentralized finance (DeFi), emphasizing their utility in managing market uncertainties. Despite a recent surge in the trading volume of options contracts on cryptocurrencies, decentralized platforms account for less than 1 % of this total volume. Hence, this paper takes a closer look by examining the design choices of these platforms to understand the challenges hindering their growth and adoption. It identifies technical, financial, and adoption‐related challenges that decentralized exchanges face and provides commentary on existing platform responses. Subsequently, the paper analyzes the impact of absent options markets on the inefficiencies of automated market maker liquidity. It examines historical on‐chain data for 14 ERC20 token pairs on Ethereum. The analysis shows 1143 instances in which deeper liquidity levels, as high as more, could have been achieved by establishing an options market.
Anamika Nath, Souhardyo Bhattacharjee, Muhammad Ibrahim Khan
Identity management systems play a crucial role in ensuring security, privacy, and efficiency in various online transactions and interactions. Traditional identity management systems are often centralized, posing significant risks such as single points of failure, data breaches, and privacy concerns. Decentralized identity management systems leveraging blockchain technology and smart contracts offer a promising solution to address these challenges. The system aims to provide a secure, efficient, and privacy-preserving solution for managing digital identities. Through the utilization of blockchain technology, Smart Identity offers immutable and tamper-resistant records of identities, enhancing trust and transparency in digital interactions. In this proposed system, we have used a zero-knowledge-proof mechanism to get the IPFS link from the authenticated documents. These authenticated documents include a national identity card, birth certificate, passport copy, and image, all of which are unique to individual users. Consequently, it has ensured that no one can generate a valid IPFS link more than once. Upon completing the form in the system with a valid IPFS link, the information has been securely stored in the blockchain, and a unique identity has been generated. This identity helps the user with multipurpose work. In this system, we have used Sepolia Testnet for real-time transactions. We have created a blockchain network using the Metamask wallet to deploy our smart contracts. Furthermore, we have designed a model that can create a unique identity and also modify information without violating the rules of blockchain technology. We have also proposed a unique identity creation model using a real-life IPFS link generator system that is also created by our system. Overall, Smart Identity represents a significant step toward the realization of a more secure, user-centric, and decentralized approach to identity management in the digital realm.
Boao Zhang, Ningyu He, Xiaohui Hu, Kai Ma · 5 authors
Price manipulation attack is one of the notorious threats in decentralized finance (DeFi) applications, which allows attackers to exchange tokens at an extensively deviated price from the market. Existing efforts usually rely on reactive methods to identify such kind of attacks after they have happened, e.g., detecting attack transactions in the post-attack stage, which cannot mitigate or prevent price manipulation attacks timely. From the perspective of attackers, they usually need to deploy attack contracts in the pre-attack stage. Thus, if we can identify these attack contracts in a proactive manner, we can raise alarms and mitigate the threats. With the core idea in mind, in this work, we shift our attention from the victims to the attackers. Specifically, we propose SMARTCAT, a novel approach for identifying price manipulation attacks in the pre-attack stage proactively. For generality, it conducts analysis on bytecode and does not require any source code and transaction data. For accuracy, it depicts the control- and data-flow dependency relationships among function calls into a token flow graph. For scalability, it filters out those suspicious paths, in which it conducts inter-contract analysis as necessary. To this end, SMARTCAT can pinpoint attacks in real time once they have been deployed on a chain. The evaluation results illustrate that SMARTCAT significantly outperforms existing baselines with 91.6% recall and ~100% precision. Moreover, SMARTCAT also uncovers 616 attack contracts in-the-wild, accounting for \$9.25M financial losses, with only 19 cases publicly reported. By applying SMARTCAT as a real-time detector in Ethereum and Binance Smart Chain, it has raised 14 alarms 99 seconds after the corresponding deployment on average. These attacks have already led to $641K financial losses, and seven of them are still waiting for their ripe time.
As the Ethereum platform continues to mature and gain widespread usage, it is crucial to maintain high standards of smart contract writing practices. While bad practices in smart contracts may not directly lead to security issues, they do elevate the risk of encountering problems. Therefore, to understand and avoid these bad practices, this paper introduces the first systematic study of bad practices in smart contracts, delving into over 35 specific issues. Specifically, we propose a large language models (LLMs)-based framework, SCALM. It combines Step-Back Prompting and Retrieval-Augmented Generation (RAG) to effectively identify and address various bad practices. Our extensive experiments using multiple LLMs and datasets have shown that SCALM outperforms existing tools in detecting bad practices in smart contracts.
Although aligned with security-based principles, Blockchain networks have maintained some exposure to fraudulent transactions. This paper introduces a novel methodology and framework for effectively characterizing fraud within blockchain networks and a method for prevention. To leverage the transparency of the blockchain, suitable starting data can be acquired to characterize potentially nefarious transactions. The framework presented applies generative AI at two levels: to support the characterization of synthetic training data for scenarios that may yet be deployed and to generate suitable testing scenarios for constructing effective techniques to safeguard transactions.
The traditional, paper-centric infrastructure public-private partnership (PPP) contracts have experienced record numbers of failures and terminations due to contract compliance issues, lack of trust and transparency, and information distortions. While studies on the adoption of blockchain and smart contracts in PPP are still growing, a quantitative survey of global experts on the application areas and potential benefits of Blockchain-enabled smart contracts (BSC) in the context of PPP is lacking. This study comprehensively examined the potential application areas and benefits of BSC adoption in infrastructure PPP projects to understand their impact on the decision to digitalise PPP and ensure sustainable PPP project performance. The snowball sampling technique and questionnaire were used to gather data from experts across countries. Data analysis was done using means analysis, normalisation value, coefficient of variation , Kendall's coefficient of concordance, Kruskal-Wallis test and partial least square-structural equation modelling (PLS-SEM). The study found high awareness and knowledge of the potential benefits of smart contract adoption in infrastructure PPP projects. The leading benefits of BSC adoption in PPP are (1) decentralisation of payments and other transactions, (2) enhancing supply chain visibility and integration, (3) the autonomy in contract administration, (4) prevent misapplication of contractual provisions, and (5) enhances alternative dispute resolution (ADR). The PLS-SEM revealed that six of the eight hypothetical paths were significant. This study advocated for promoting the digitalisation of infrastructure PPP projects. It could serve as an essential resource to policymakers and industry professionals in their quest to improve PPP project performance and minimise failures.
Federico Badaloni, Sebastian Holler, Chrysoula Oikonomou, Pedro Moreno-Sánchez · 5 authors
A smart contract is an interactive program that governs funds in the realm of a single cryptocurrency. Yet, the many existing cryptocurrencies have spurred the design of cross-chain applications that require interactions with multiple cryp-tocurrencies simultaneously. Currently, cross-chain applications are implemented as use-case-specific cryptographic protocols that serve as overlay to synchronize smart contract executions in the different cryptocurrencies. Hence, their design requires substantial expertise, as well as a security analysis in complex cryptographic frameworks. In this work, we present$BitML^{x}$, the first domain-specific language for cross-chain smart contracts, enabling interactions with several users that hold funds across multiple Bitcoin-like cryptocurrencies. We contribute a compiler to automatically translate a$BitML^{x}$contract into one contract per involved cryp-tocurrency and a user strategy that synchronizes the execution of these contracts. We prove that an honest user, who follows the prescribed strategy when interacting with the several contracts, ends up with at least as many funds as in the corresponding execution of the$BitML^{x}$contract. Last, but not least, we implement the$BitML^{x}$compiler and demonstrate its utility in the design of illustrative examples of cross-chain applications such as multi-chain donations or loans across different cryptocurrencies.
Open access
3 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Cristian Gómez, Francisco Javier Pérez Blanco, David Granada, Juan M. Vara
Abstract Despite the increasing interest in blockchain and smart contracts, their inherent complexity has impeded widespread adoption. In order to mitigate this issue, this work introduces , a model-based framework for the development of smart contracts in Solidity that enables the treatment of contracts as models, opening up new possibilities for their enhancement and maintenance. A key benefit of is its ability to impose a development pattern, which contributes to improved code quality and reduced vulnerabilities. The framework’s effectiveness is evaluated through several case studies, showing how model-driven engineering can mitigate contracts inherent complexity and promote better collaboration between developers and domain experts. As this work will demonstrate, when smart contracts are treated as models, a vast array of possibilities unfolds.
Abstracts The operations of built environment-related sectors are often run on centralized organizational structures. This centralized approach could lead to operational challenges that restrict efficiency, hinder transparency, and misalign with the community’s interests. The emergence of decentralized autonomous organization (DAO) presents a promising avenue for addressing these issues by leveraging blockchain technology and decentralized governance models. This paper presents a review of DAO, examining its existing applications, limitations, and potential use cases in the built environment. Seven categories of DAO applications in the built environment were identified and discussed. The study also explores DAO’s fundamentals, including its governance characteristics, operational mechanism, limitations and technical implementation, and corresponding challenges. Finally, this study highlights three potential areas in the built environment for future DAO use cases. This article serves as an essential reference for future academics, professionals, and policy regulators interested in learning more about the integrations of DAO in the built environment.
We examine which decentralized finance architectures enable meaningful regulation by combining financial and computational theory. We show via deduction that a decentralized and permissionless Turing-complete system cannot provably comply with regulations concerning anti-money laundering, know-your-client obligations, some securities restrictions and forms of exchange control. Any system that claims to follow regulations must choose either a form of permission or a less-than-Turing-complete update facility. Compliant decentralized systems can be constructed only by compromising on the richness of permissible changes. Regulatory authorities must accept new tradeoffs that limit their enforcement powers if they want to approve permissionless platforms formally. Our analysis demonstrates that the fundamental constraints of computation theory have direct implications for financial regulation. By mapping regulatory requirements onto computational models, we characterize which types of automated compliance are achievable and which are provably impossible. This framework allows us to move beyond traditional debates about regulatory effectiveness to establish concrete boundaries for automated enforcement.
Danilo Rafael de Lima Cabral, Pedro Antonino, Augusto Sampaio
The Ethereum blockchain has a \emph{gas system} that associates operations with a cost in gas units. Two central concepts of this system are the \emph{gas limit} assigned by the issuer of a transaction and the \emph{gas used} by a transaction. The former is a budget that must not be exhausted before the completion of the transaction execution; otherwise, the execution fails. Therefore, it seems rather essential to determine the \emph{minimum gas limit} that ensures the execution of a transaction will not abort due to the lack of gas. Despite its practical relevance, this concept has not been properly addressed. In the literature, gas used and minimum gas limit are conflated. This paper proposes a precise notion of minimum gas limit and how it can differ from gas used by a transaction; this is also demonstrated with a quantitative study on real transactions of the Ethereum blockchain. Another significant contribution is the proposition of a fairly precise estimator for each of the two metrics. Again, the confusion between these concepts has led to the creation of estimators only for the gas used by a transaction. We demonstrate that the minimum gas limit for the state of the Ethereum blockchain (after the block) $t$ can serve as a near-perfect estimation for the execution of the transaction at block $t + Δ$, where $Δ\leq 11$; the same holds for estimating gas used. These precise estimators can be very valuable in helping the users predict the gas budget of transactions and developers in optimising their smart contracts; over and underestimating gas used and minimum gas limit can lead to a number of practical issues. Overall, this paper serves as an important reference for blockchain developers and users as to how the gas system really works.
Marlena Broniszewska, Wiktor B. Daszczuk, Denny B. Czejdo
Global digitalization has accelerated, leading to continuous online shopping and services growth. However, the centralized nature of traditional e-commerce platforms raises concerns about data control, privacy, and potential single points of failure. Blockchain technology offers a decentralized alternative that addresses these issues, improving online transactions with enhanced privacy and anonymity for users. This article explores the problem of anonymization in web services by developing an anonymous online auction system using blockchain and zero-knowledge proof (ZKP). We propose a solution that employs ZKP in two stages: first, to verify that a user is eligible to participate in the auction, thereby creating a list of potential bidders; second, to prove that a bid is placed by a user from this list without disclosing their identity. This approach allows participants to engage in auctions anonymously, protecting their interests from competitors and sellers. The system eliminates the need for a trusted third party by leveraging the blockchain immutable ledger for transparency, giving users full control over their data and participation. We present the architecture and implementation details of the system, demonstrating its feasibility and potential to enhance privacy and security in online auctions.
Smart contracts enable autonomous execution between contracting parties without a centralized authority, thereby reducing contract management costs and enhancing the transparency and reliability of contracts. However, the absence of such a certification authority increases the risk of fraud. Rug-pull, a typical form of fraud, involves developers hiding backdoor codes in smart contracts to steal funds under certain conditions, causing significant damage to users. A Rug-pull list warns users of potential fraud, but it only identifies risks after damage has occurred. Additionally, existing backdoor code analysis tools are limited in their ability to detect backdoor codes hidden through modifications to existing patterns or suffer from low accuracy because they rely on comparisons with predefined backdoor codes. Therefore, this paper proposes a balance-tracking-based backdoor code detection model to identify backdoor codes in smart contracts. The proposed model detects backdoor codes by extracting functions from Ethereum bytecodes and inspecting the extracted functions to track balance changes. This approach allows for the detection of balance changes even when backdoor codes are concealed. Experimental results verifying the effectiveness of this model demonstrate 98% accuracy, 0.96 recall, and 0.98 precision. These results are expected to contribute significantly to effectively reducing fraud risks such as Rug-pull.