Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to USD 60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of USD 30 million and the freezing of USD 150 million worth of Ether.
Guilherme Pinto, João Pedro Dias, Hugo Sereno Ferreira
The Internet of Things is progressively getting broader, evol-ving its scope while creating new markets and adding more to the existing ones. However, both generation and analysis of large amounts of data, which are integral to this concept, may require the proper protection and privacy-awareness of some sensitive information. In order to control the access to this data, allowing devices to verify the reliability of their own interactions with other endpoints of the network is a crucial step to ensure this required safeness. Through the implementation of a blockchain-based Public Key Infrastructure connected to the Keybase platform, it is possible to achieve a simple protocol that binds devices' public keys to their owner accounts, which are respectively supported by identity proofs. The records of this blockchain represent digital signatures performed by this Keybase users on their respective devices' public keys, claiming their ownership. Resorting to this distributed and decentralized PKI, any device is able to autonomously verify the entity in control of a certain node of the network and prevent future interactions with unverified parties.
Matteo Signorini, Matteo Pontecorvi, Waël Kanoun, Roberto Di Pietro
Anomaly detection tools play a role of paramount importance in protecting networks and systems from unforeseen attacks, usually by automatically recognizing and filtering out anomalous activities. Over the years, different approaches have been designed, all focused on lowering the false positive rate. However, no proposal has addressed attacks targeting blockchain-based systems. In this paper we present BAD: the first Blockchain Anomaly Detection solution. BAD leverages blockchain meta-data, named forks, in order to collect potentially malicious activities in the network/system. BAD enjoys the following features: (i) it is distributed (thus avoiding any central point of failure), (ii) it is tamper-proof (making not possible for a malicious software to remove or to alter its own traces), (iii) it is trusted (any behavioral data is collected and verified by the majority of the network) and (iv) it is private (avoiding any third party to collect/analyze/store sensitive information). Our proposal is validated via both experimental results and theoretical complexity analysis, that highlight the quality and viability of our Blockchain Anomaly Detection solution.
Hao Dai, H. P. Young, Thomas J S Durant, Guannan Gong · 8 authors
The governance of data used for biomedical research and clinical trials is an important requirement for generating accurate results. To improve the visibility of data quality and analysis, we developed TrialChain, a blockchain-based platform that can be used to validate data integrity from large, biomedical research studies. We implemented a private blockchain using the MultiChain platform and integrated it with a data science platform deployed within a large research center. An administrative web application was built with Python to manage the platform, which was built with a microservice architecture using Docker. The TrialChain platform was integrated during data acquisition into our existing data science platform. Using NiFi, data were hashed and logged within the local blockchain infrastructure. To provide public validation, the local blockchain state was periodically synchronized to the public Ethereum network. The use of a combined private/public blockchain platform allows for both public validation of results while maintaining additional security and lower cost for blockchain transactions. Original data and modifications due to downstream analysis can be logged within TrialChain and data assets or results can be rapidly validated when needed using API calls to the platform. The TrialChain platform provides a data governance solution to audit the acquisition and analysis of biomedical research data. The platform provides cryptographic assurance of data authenticity and can also be used to document data analysis.
Bitcoin is the first secure decentralized electronic currency system. However, it is known to be inefficient due to its proof-of-work (PoW) consensus algorithm and has the potential hazard of double spending. In this paper, we aim to reduce the probability of double spending by decreasing the probability of consecutive winning. We first formalize a PoW-based decentralized secure network model in order to present a quantitative analysis. Next, to resolve the risk of double spending, we propose the personalized difficulty adjustment (PDA) mechanism which modifies the difficulty of each participant such that those who win more blocks in the past few rounds have a smaller probability to win in the next round. To analyze the performance of the PDA mechanism, we observe that the system can be modeled by a high-order Markov chain. Finally, we show that PDA effectively decreases the probability of consecutive winning and results in a more trustworthy PoW-based system.
Decentralised random number generation algorithms suffer from the Last Actor Problem, in which the last participant to reveal their share can manipulate the generated random value by withholding their share. This paper proposes an encrypted share threshold scheme which prevents this attack.
Gihan J. Mendis, Yifu Wu, Jin Wei, Moein Sabounchi · 5 authors
Thanks to the advances in machine learning, data-driven analysis tools have become valuable solutions for various applications. However, there still remain essential challenges to develop effective data-driven methods because of the need to acquire a large amount of data and to have sufficient computing power to handle the data. In many instances these challenges are addressed by relying on a dominant cloud computing vendor, but, although commercial cloud vendors provide valuable platforms for data analytics, they can suffer from a lack of transparency, security, and privacy-perservation. Furthermore, reliance on cloud servers prevents applying big data analytics in environments where the computing power is scattered. To address these challenges, a decentralize, secure, and privacy-preserving computing paradigm is proposed to enable an asynchronized cooperative computing process amongst scattered and untrustworthy computing nodes that may have limited computing power and computing intelligence. This paradigm is designed by exploring blockchain, decentralized learning, homomorphic encryption, and software defined networking(SDN) techniques. The performance of the proposed paradigm is evaluated via different scenarios in the simulation section.
This paper presents LinBFT, a novel Byzantine fault tolerance (BFT) protocol for blockchain systems that achieves amortized O(n) communication volume per block under reasonable conditions (where n is the number of participants), while satisfying determinist guarantees on safety and liveness. This significantly improves previous results, which either incurs quadratic communication complexity, or only satisfies safety in a probabilistic sense. LinBFT is based on the popular PBFT protocol, and cuts down its $O(n^4)$ complexity with three tricks, each by $O(n)$: linear view change, threshold signatures, and verifiable random functions. All three are known, i.e., the solutions are right in front of our eyes, and yet LinBFT is the first $O(n)$ solution with deterministic security guarantees. Further, LinBFT also addresses issues that are specific to permission-less, public blockchain systems, such as anonymous participants without a public-key infrastructure, proof-of-stake with slashing, rotating leader, and a dynamic participant set. In addition, LinBFT contains no proof-of-work module, reaches consensus for every block, and tolerates changing honesty of the participants for different blocks.
Regio A. Michelin, Ali Dorri, Roben Castagna Lunardi, Marco Steger · 7 authors
There is increased interest in smart vehicles acting as both data consumers and producers in smart cities. Vehicles can use smart city data for decision-making, such as dynamic routing based on traffic conditions. Moreover, the multitude of embedded sensors in vehicles can collectively produce a rich data set of the urban landscape that can be used to provide a range of services. Key to the success of this vision is a scalable and private architecture for trusted data sharing. This paper proposes a framework called SpeedyChain, that leverages blockchain technology to allow smart vehicles to share their data while maintaining privacy, integrity, resilience and non-repudiation in a decentralized, and tamper-resistant manner. Differently from traditional blockchain usage (e.g., Bitcoin and Ethereum), the proposed framework uses a blockchain design that decouples the data stored in the transactions from the block header, thus allowing for fast addition of data to the blocks. Furthermore, an expiration time for each block to avoid large sized blocks is proposed. This paper also presents an evaluation of the proposed framework in a network emulator to demonstrate its benefits.
Blockchain and Cryptocurrencies are gaining unprecedented popularity and understanding. Meanwhile, Ethereum is gaining a significant popularity in the blockchain community, mainly due to the fact that it is designed in a way that enables developers to write smart contract and decentralized applications (Dapps). This new paradigm of applications opens the door to many possibilities and opportunities. However, the security of Ethereum smart contracts has not received much attention; several Ethereum smart contracts malfunctioning have recently been reported. Unlike many previous works that have applied static and dynamic analyses to find bugs in smart contracts, we do not attempt to define and extract any features; instead we focus on reducing the expert's labor costs. We first present a new in-depth analysis of potential attacks methodology and then translate the bytecode of solidity into RGB color code. After that, we transform them to a fixed-sized encoded image. Finally, the encoded image is fed to convolutional neural network (CNN) for automatic feature extraction and learning, detecting compiler bugs of Ethereum smart contract.
Benjamin Johnson, Áron Lászka, Jens Großklags, Tyler Moore
Cryptocurrency exchanges are frequently targeted and compromised by cyber-attacks, which may lead to significant losses for the depositors and closure of the affected exchanges. These risks threaten the viability of the entire public blockchain ecosystem since exchanges serve as major gateways for participation in public blockchain technologies. In this paper, we develop an economic model to capture the short-term incentives of cryptocurrency exchanges with respect to making security investments and establishing transaction fees. Using the model, we derive conclusions regarding an exchange's optimal economic decisions, and illustrate key features of these conclusions using graphs based on real-world data. Our security investment model exhibits horizontal scaling properties with respect to reducing exposure to losses, and may be of special interest to exchanges operating in markets with high price volatility.
Many studies have been done to improve the performance of centrally controlled business processes and enhance the integration between different parties of these collaborations. However, the most serious issues of collaborative business processes remained unsolved in these studies - lack of trust and divided data on various confidential ledgers. Blockchain technology has enormous potential to become a new substantial integration method for untrusted collaborative businesses. Using the governing consensus mechanism, blockchain eliminates the necessity of the trusted third party. It provides a distributed shared ledger which facilitates the job of the process monitoring for the parties. The smart contract, as a crucial tool, is used to define the guaranteed autonomous programs. In addition, the privacy of the data can be ensured by using a permissioned blockchain that handles the access control because, in this way, only verifiable participants can have access to the state of the business process and its related information. In this study, the applicability of execution of a real-world untrusted business process on the permissioned blockchain is investigated. Moreover, we determine the advantages of using the permissioned access-controller blockchain as the infrastructure for the collaborative business processes, through implementing the process of Order Processing on the Hyperledger Fabric blockchain platform.
Using blockchain as a decentralized backend infrastructure has been attracting many startups entrepreneurs' and developers' attention. Blockchain records transactions permanently and protects them from undesirable tampering. It provides a reliable tamper-proof database which can be considered as a trustable resource for tracking previous system's state. In this paper, we present our access control application based on Hyperledger Fabric Blockchain and Hyperledger Composer to control access to physical places. The system components and modular architecture are illustrated, and we have extracted metadata include historian transactions' details arising from our demo test. Finally, the performance metrics and resources consumption are provided using Hyperledger Caliper, a benchmark framework for measuring Hyperledger blockchains performance.
Uchi Ugobame Uchibeke, Kevin A. Schneider, Sara Hosseinzadeh Kassani, Ralph Deters
In recent years, the advancement in modern technologies has not only resulted in an explosion of huge data sets being captured and recorded in different fields, but also given rise to concerns in the security and protection of data during storage, transmission, processing, and access. The blockchain is a distributed ledger that records transactions in a secure, flexible, verifiable and permanent way. Transactions in a blockchain can be an exchange of an asset, the execution of the terms of a smart contract, or an update to a record. In this paper, we have developed a blockchain access control ecosystem that gives asset owners the sovereign right to effectively manage access control of large data sets and protect against data breaches. The Linux Foundation's Hyperledger Fabric blockchain is used to run the business network while the Hyperledger composer modeling tool is used to implement the smart contracts or transaction processing functions that run on the blockchain network.
John R. Adler, Ryan Berryhill, Andreas Veneris, Zissis Poulos · 6 authors
The public blockchain was originally conceived to process monetary transactions in a peer-to-peer network while preventing double-spending. It has since been extended to numerous other applications including execution of programs that exist on the blockchain called "smart contracts." Smart contracts have a major limitation, namely they only operate on data that is on the blockchain. Trusted entities called oracles attest to external data in order to bring it onto the blockchain but they do so without the robust security guarantees that blockchains generally provide. This has the potential to turn oracles into centralized points-of-failure. To address this concern, this paper introduces Astraea, a decentralized oracle based on a voting game that decides the truth or falsity of propositions. Players fall into two roles: voters and certifiers. Voters play a low-risk/low-reward role that is resistant to adversarial manipulation while certifiers play a high-risk/high-reward role so they are required to play with a high degree of accuracy. This paper also presents a formal analysis of the parameters behind the system to measure the probability of an adversary with bounded funds being able to successfully manipulate the oracle's decision, that shows that the same parameters can be set to make manipulation arbitrarily difficult---a desirable feature for the system. Further, this analysis demonstrates that under those conditions a Nash equilibrium exists where all rational players are forced to behave honestly.
We propose a decentralized routing algorithm that can be implemented in Bitcoin Lightning Network. All nodes in the network contribute equally to path searching. The algorithm is inspired from ant path searching algorithms.
TrueBit is a protocol that uses interactive verification to allow a resource-constrained computation environment like a blockchain to perform much larger computations than usual in a trusted way. As long as a single honest participant is present to verify the computation, an invalid computation cannot get accepted. In TrueBit, the presence of such a verifier is incentivised by randomly injected forced errors. Additionally, in order to counter sybil attacks, the reward for finding an error drops off exponentially with the number of challengers. The main drawback of this mechanism is that it makes it very hard to predict whether participation will be profitable or not. To even out the rewards, we propose to randomly select multiple solvers from a pool and evenly share the fees among them, while still allowing outside challengers. Furthermore, a proof of independent execution will make it harder to establish computation pools which share computation results.
Blockchain is one of the most popular topics for discussion now. However, most experts still see this technology as only part of Bitcoin, other crypto-currencies or money transfer systems. Often, new solutions, proposed by young researchers, are blocked by reviewers, only because these solutions can not be used for Bitcoins. However, Blockchain technology is more universal and can be used also in other areas, for example, in IoT, WSN and mobile devices. This paper considers the implementation of Blockchain technology in sensor networks as an element of IoT. The concept of "Rolling Blockchain" was proposed, which can be used to build WSN with the participation of Smart Cars, as nodes of the network. The order of block formation and structure in the chain is proposed and a mathematical model is created for it. We estimate the optimal number of WSN nodes, the number of connections between nodes, for specified network reliability values, was performed.
Owing to Satoshi Nakamoto's brilliant idea, a P2P public ledger is shown to be implementable in anonymous network. Any Internet user can then join the anonymous network and contribute to the P2P public ledger by providing their computing power or proof-of-work. The proof-of-work is a clever implementation of one-CPU-one-vote by anonymous participants, and it protects the Bitcoin ledger from illegal modification. To compensate the nodes for their work, a cryptocurrency called Bitcoin is issued and given to nodes. However, the very nature of anonymity of the ledger and the cryptocurrency prevent the technology from being used in fiat money economy. Cryptocurrencies are not traceable even if they are used for money laundering or tax evasion, and the value of cryptocurrencies is not stable but fluctuates wildly. In this white paper, we introduce Gruut, a P2P ledger to implement a universal financial platform for fiat money. For this purpose, we introduce a new consensus algorithm called `proof-of-population,' which is one instance of `proof of public collaboration.' It can be used for multiple purposes; as a P2P ledger for banks, as a powerful tool for payment, including micropayment, and as a tool for any type of financial transactions. Even better, it distributes the profit obtained from transaction fee, currently dominated by a third party, to peers that cannot be centralized. Energy requirements of Gruut are so low that it is possible to run our software on a smartphone or on a personal computer without a graphic card.
Thomas Locher, Sebastian Obermeier, Yvonne-Anne Pignolet
The functionality that distributed ledger technology provides, i.e., an immutable and fraud-resistant registry with validation and verification mechanisms, has traditionally been implemented with a trusted third party. Due to the distributed nature of ledger technology, there is a strong recent trend towards using ledgers to implement novel decentralized applications for a wide range of use cases, e.g., in the financial sector and sharing economy. While there can be several arguments for the use of a ledger, the key question is whether it can fully replace any single trusted party in the system as otherwise a (potentially simpler) solution can be built around the trusted party. In this paper, we introduce an abstract view on ledger use cases and present two fundamental criteria that must be met for any use case to be implemented using a ledger-based approach without having to rely on any particular party in the system. Moreover, we evaluate several ledger use cases that have recently received considerable attention according to these criteria, revealing that often participants need to trust each other despite using a distributed ledger. Consequently, the potential of using a ledger as a replacement for a trusted party is limited for these use cases.
Akshaya Mani, Tavish Vaidya, David Dworken, Micah Sherr
Open proxies forward traffic on behalf of any Internet user. Listed on open proxy aggregator sites, they are often used to bypass geographic region restrictions or circumvent censorship. Open proxies sometimes also provide a weak form of anonymity by concealing the requestor's IP address. To better understand their behavior and performance, we conducted a comprehensive study of open proxies, encompassing more than 107,000 listed open proxies and 13M proxy requests over a 50 day period. While previous studies have focused on malicious open proxies' manipulation of HTML content to insert/modify ads, we provide a more broad study that examines the availability, success rates, diversity, and also (mis)behavior of proxies. Our results show that listed open proxies suffer poor availability--more than 92% of open proxies that appear on aggregator sites are unresponsive to proxy requests. Much more troubling, we find numerous examples of malicious open proxies in which HTML content is manipulated to mine cryptocurrency (that is, cryptojacking). We additionally detect TLS man-in-the-middle (MitM) attacks, and discover numerous instances in which binaries fetched through proxies were modified to include remote access trojans and other forms of malware. As a point of comparison, we conduct and discuss a similar measurement study of the behavior of Tor exit relays. We find no instances in which Tor relays performed TLS MitM or manipulated content, suggesting that Tor offers a far more reliable and safe form of proxied communication.
Alexander Chepurnoy, Vasily Kharin, Dmitry Meshkov
Turing-completeness of smart contract languages in blockchain systems is often associated with a variety of language features (such as loops). In opposite, we show that Turing-completeness of a blockchain system can be achieved through unwinding the recursive calls between multiple transactions and blocks instead of using a single one. We prove it by constructing a simple universal Turing machine using a small set of language features in the unspent transaction output (UTXO) model, with explicitly given relations between input and output transaction states. Neither unbounded loops nor possibly infinite validation time are needed in this approach.
The Enterprise Ethereum Client Specification by the Enterprise Ethereum Alliance defines the requirements which Ethereum Clients offering private smart contract capabilities should comply with. This specification though ground breaking, misses some important blockchain requirements and does not fully consider the requirements of Ethereum Clients offering Private Sidechain capabilities. This paper presents the case for Private Sidechains and defines requirements to be complied with to deliver this technology. The capabilities of three blockchain clients have been analysed based on the requirements: Quorum, Parity, and Hyperledger Fabric. Quorum and Hyperledger Fabric operate as private consortium blockchains where as Parity delivers private transaction capabilities on top of Ethereum MainNet. These differing approaches has led to different strengths and weaknesses which has resulted in each client not complying with one or more key requirement. In particular, none of the reviewed blockchain clients support the ability to determine bootstrap information to establish on-demand blockchains and none of the clients support secure management and pinning from Ethereum MainNet. This paper presents Ethereum Private Sidechains and a range of technologies which allow it to deliver on complex sidechain requirements. Ethereum Registration Authorities are presented, which allow entities which have not previously interacted to securely obtain information to bootstrap a sidechain, and a Management and Pinning strategy is described which allows the state of a sidechain to be securely pinned to Ethereum MainNet without compromising privacy.
This paper presents a comprehensive survey of the existing blockchain protocols for the Internet of Things (IoT) networks. We start by describing the blockchains and summarizing the existing surveys that deal with blockchain technologies. Then, we provide an overview of the application domains of blockchain technologies in IoT, e.g., Internet of Vehicles, Internet of Energy, Internet of Cloud, Edge computing, etc. Moreover, we provide a classification of threat models, which are considered by blockchain protocols in IoT networks, into five main categories, namely identity-based attacks, manipulation-based attacks, cryptanalytic attacks, reputation-based attacks, and service-based attacks. In addition, we provide a taxonomy and a side-by-side comparison of the state-of-the-art methods toward secure and privacy-preserving blockchain technologies with respect to the blockchain model, specific security goals, performance, limitations, computation complexity, and communication overhead. Based on the current survey, we highlight open research challenges and discuss possible future research directions in the blockchain technologies for IoT.