The tourism industry is increasingly influenced by the evolution of information and communication technologies (ICT), which are revolutionizing the way people travel. In this work we want to investigate the use of innovative IT technologies by DMOs (Destination Management Organizations), focusing on blockchain technology, both from the point of view of research in the field, and in the study of the most relevant software projects. In particular, we intend to verify the benefits offered by these IT tools in the management and monitoring of a destination, without forgetting the implications for the other stakeholders involved. These technologies, in fact, can offer a wide range of services that can be useful throughout the life cycle of the destination.
Javier Rojo, Juan Hernandez, Juan Manuel Murillo, Jose Garcia-Alonso
Today's world is a globalized and connected one, where people are increasingly moving around and interacting with a greater number of services and devices of all kinds, including those that allow them to monitor their health. However, each company, institution or health system usually store its patients' data in an isolated way. Although this approach can have some benefits related with privacy, security, etc., it also implies that each one of them generates different, incomplete and possibly contradictory views of a patient's health data, losing part of the value that this information could bring to the patient. That is the reason why researchers from all over the world are determined to replace the current institution-centered health systems with new patient-centered ones. In these new systems, all the health information of a patient is integrated into a unique global vision. However, some questions are still unanswered. Specifically, who should store and maintain the information of a given patient and how should this information be made available for other systems. To address this situation, this work proposes a new solution towards making the Personal Health Trajectory of patients available for both, the patients themselves and health institutions. By using the concept of blockchains' federation and web services access to the global vision of a person health can be granted to existing and new solutions. To demonstrate the viability of the proposal, an implementation is provided alongside the obtained results in a potential scenario.
Smart contracts have been plagued by security incidents, which resulted in substantial financial losses. Given numerous research efforts in addressing the security issues of smart contracts, we wondered how software practitioners build security into smart contracts in practice. We performed a mixture of qualitative and quantitative studies with 13 interviewees and 156 survey respondents from 35 countries across six continents to understand practitioners' perceptions and practices on smart contract security. Our study uncovers practitioners' motivations and deterrents of smart contract security, as well as how security efforts and strategies fit into the development lifecycle. We also find that blockchain platforms have a statistically significant impact on practitioners' security perceptions and practices of smart contract development. Based on our findings, we highlight future research directions and provide recommendations for practitioners.
Qinghua Lu, Xiwei Xu, H. M. N. Dilum Bandara, Shiping Chen · 5 authors
As the killer application of blockchain technology, blockchain-based payments have attracted extensive attention ranging from hobbyists to corporates to regulatory bodies. Blockchain facilitates fast, secure, and cross-border payments without the need for intermediaries such as banks. Because blockchain technology is still emerging, systematically organised knowledge providing a holistic and comprehensive view on designing payment applications that use blockchain is yet to be established. If such knowledge could be established in the form of a set of blockchain-specific patterns, architects could use those patterns in designing a payment application that leverages blockchain. Therefore, in this paper, we first identify a token's lifecycle and then present 12 patterns that cover critical aspects in enabling the state transitions of a token in blockchain-based payment applications. The lifecycle and the annotated patterns provide a payment-focused systematic view of system interactions and a guide to effective use of the patterns.
Stefan Driessen, Dario Di Nucci, Geert Monsieur, Damian A. Tamburri · 5 authors
Blockchain and smart contract technology are novel approaches to data and code management that facilitate trusted computing by allowing for development in a distributed and decentralized manner. Testing smart contracts comes with its own set of challenges which have not yet been fully identified and explored. Although existing tools can identify and discover known vulnerabilities and their interactions on the Ethereum blockchain through random search or symbolic execution, these tools generally do not produce test suites suitable for human oracles. In this paper, we present AGSOLT (Automated Generator of Solidity Test Suites). We demonstrate its efficiency by implementing two search algorithms to automatically generate test suites for stand-alone Solidity smart contracts, taking into account some of the blockchain-specific challenges. To test AGSOLT, we compared a random search algorithm and a genetic algorithm on a set of 36 real-world smart contracts. We found that AGSOLT is capable of achieving high branch coverage with both approaches and even discovered some errors in some of the most popular Solidity smart contracts on Github.
In this work we propose Dynamit, a monitoring framework to detect reentrancy vulnerabilities in Ethereum smart contracts. The novelty of our framework is that it relies only on transaction metadata and balance data from the blockchain system; our approach requires no domain knowledge, code instrumentation, or special execution environment. Dynamit extracts features from transaction data and uses a machine learning model to classify transactions as benign or harmful. Therefore, not only can we find the contracts that are vulnerable to reentrancy attacks, but we also get an execution trace that reproduces the attack. Using a random forest classifier, our model achieved more than 90 percent accuracy on 105 transactions, showing the potential of our technique.
Alex Auvolat, Yérom-David Bromberg, Davide Frey, François Taı̈ani
Recent works have proposed new Byzantine consensus algorithms for blockchains based on epidemics, a design which enables highly scalable performance at a low cost. These methods however critically depend on a secure random peer sampling service: a service that provides a stream of random network nodes where no attacking entity can become over-represented. To ensure this security property, current epidemic platforms use a Proof-of-Stake system to select peer samples. However such a system limits the openness of the system as only nodes with significant stake can participate in the consensus, leading to an oligopoly situation. Moreover, this design introduces a complex interdependency between the consensus algorithm and the cryptocurrency built upon it. In this paper, we propose a radically different security design for the peer sampling service, based on the distribution of IP addresses to prevent Sybil attacks. We propose a new algorithm, $\scriptstyle{BASALT}$, that implements our design using a stubborn chaotic search to counter attackers' attempts at becoming over-represented. We show in theory and using Monte Carlo simulations that $\scriptstyle{BASALT}$ provides samples which are extremely close to the optimal distribution even in adversarial scenarios such as tentative Eclipse attacks. Live experiments on a production cryptocurrency platform confirm that the samples obtained using $\scriptstyle{BASALT}$ are equitably distributed amongst nodes, allowing for a system which is both open and where no single entity can gain excessive power.
Thomas Eizinger, Philipp Hoenisch, Lucas Soriano del Pino
Blockchain interoperability is a prominent research field which aims to build bridges between otherwise isolated blockchains. With advances in cryptography, novel protocols are published by academia and applied in different applications and products in the industry. In theory, these innovative protocols provide strong privacy and security guarantees by including formal proofs. However, pure theoretical work often lacks the perspective of real world applications. In this work, we describe a number of hardly researched problems which developers encounter when building cross-chain products.
Nami Ashizawa, Naoto Yanai, Jason Paul Cruz, Shingo Okamura
Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting parties. Being the most prominent platform that supports smart contracts, Ethereum has been targeted by many attacks and plagued by security incidents. Consequently, many smart contract vulnerabilities have been discovered in the past decade. To detect and prevent such vulnerabilities, different security analysis tools, including static and dynamic analysis tools, have been created, but their performance decreases drastically when codes to be analyzed are constantly being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool that detects smart contract vulnerabilities. Eth2Vec maintains its robustness against code rewrites; i.e., it can detect vulnerabilities even in rewritten codes. Other machine-learning-based static analysis tools require features, which analysts create manually, as inputs. In contrast, Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable contracts. In doing so, Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned contracts. We performed experiments with existing open databases, such as Etherscan, and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics, i.e., precision, recall, and F1-score.
Smart contracts are distributed, self-enforcing programs executing on top of blockchain networks. They have the potential to revolutionize many industries such as financial institutes and supply chains. However, smart contracts are subject to code-based vulnerabilities, which casts a shadow on its applications. As smart contracts are unpatchable (due to the immutability of blockchain), it is essential that smart contracts are guaranteed to be free of vulnerabilities. Unfortunately, smart contract languages such as Solidity are Turing-complete, which implies that verifying them statically is infeasible. Thus, alternative approaches must be developed to provide the guarantee. In this work, we develop an approach which automatically transforms smart contracts so that they are provably free of 4 common kinds of vulnerabilities. The key idea is to apply run-time verification in an efficient and provably correct manner. Experiment results with 5000 smart contracts show that our approach incurs minor run-time overhead in terms of time (i.e., 14.79%) and gas (i.e., 0.79%).
Blockchain technology has advanced rapidly in recent years and is now widely used in a variety of fields. Blockchain appears to be one of the best solutions for managing massive heterogeneous devices while achieving advanced data security and data reputation, particularly in the field of large-scale IoT (Internet of Things) networks. Despite the numerous advantages, there are still challenges while deploying IoT applications on blockchain systems due to the limited storage, power, and computing capability of IoT devices, and some of these problems are caused by the consensus algorithm, which plays a significant role in blockchain systems by ensuring overall system reliability and robustness. Nonetheless, most existing consensus algorithms are prone to poor node reliability, low transaction per second (TPS) rates, and scalability issues. Aiming at some critical problems in the existing consensus algorithms, this paper proposes the Efficient Byzantine Reputation-based Consensus (EBRC) mechanism to resolve the issues raised above. In comparison to traditional algorithms, we reinvented ways to evaluate node reliability and robustness and manage active nodes. Our experiments show that the EBRC algorithm has lower consensus delay, higher throughput, improved security, and lower verification costs. It offers new reference ideas for solving the Internet of Things+blockchain+Internet court construction problem.
Gabriel de Sousa Matsumura, Luciana Brasil Rebelo dos Santos, Arlindo Flávio da Conceição, Nandamudi L. Vijaykumar
Smart Contracts (SCs) are programs stored in a Blockchain to ensure agreements between two or more parties. Due to the unchangeable essence of Blockchain, failures or errors in SCs become perpetual once published. The reliability of SCs is essential to avoid financial losses. So, SCs must be checked to ensure the absence of errors. Hence, many studies addressed new methods and tools for zero-bug software in SCs. This paper conducted a systematic literature mapping identifying initiatives and tools to analyze SCs and how to deal with the identified vulnerabilities. Besides, this work identifies gaps that may lead to research topics for future work.
Supply chain management, product provenance and quality certification are among the first and most popular applications of blockchain technology, due to the inherent trust and inalterability provided by the blockchain technology. However, the proposed supply chain management systems based on blockchain and smart contract technology tend to be specific to the particular production and production process. In this paper we present a general-purpose approach for the agri-food supply chain management, proposing a system that can be configured for most agri-food productions. The primary purpose is to provide a methodology to facilitate and make more efficient the development of such applications. It is based on general smart contracts and apps interacting with the same smart contracts, which are configured, starting from the description of the specific system to be managed, given using json files. A case study on olive oil production is described, to show how our approach works.
Abstract A smart contract is a program executed on a blockchain, based on which many cryptocurrencies are implemented, and is being used for automating transactions. Due to the large amount of money that smart contracts deal with, there is a surging demand for a method that can statically and formally verify them. This tool paper describes our type-based static verification tool Helmholtz for Michelson, which is a statically typed stack-based language for writing smart contracts that are executed on the blockchain platform Tezos. Helmholtz is designed on top of our extension of Michelson’s type system with refinement types. Helmholtz takes a Michelson program annotated with a user-defined specification written in the form of a refinement type as input; it then typechecks the program against the specification based on the refinement type system, discharging the generated verification conditions with the SMT solver Z3. We briefly introduce our refinement type system for the core calculus Mini-Michelson of Michelson, which incorporates the characteristic features such as compound datatypes (e.g., lists and pairs), higher-order functions, and invocation of another contract. Helmholtz successfully verifies several practical Michelson programs, including one that transfers money to an account and that checks a digital signature.
Blockchain has been increasingly used as a software component to enable decentralisation in software architecture for a variety of applications. Blockchain governance has received considerable attention to ensure the safe and appropriate use and evolution of blockchain, especially after the Ethereum DAO attack in 2016. However, there are no systematic efforts to analyse existing governance solutions. To understand the state-of-the-art of blockchain governance, we conducted a systematic literature review with 37 primary studies. The extracted data from primary studies are synthesised to answer identified research questions. The study results reveal several major findings: 1) governance can improve the adaptability and upgradability of blockchain, whilst the current studies neglect broader ethical responsibilities as the objectives of blockchain governance; 2) governance is along with the development process of a blockchain platform, while ecosystem-level governance process is missing, and; 3) the responsibilities and capabilities of blockchain stakeholders are briefly discussed, whilst the decision rights, accountability, and incentives of blockchain stakeholders are still under studied. We provide actionable guidelines for academia and practitioners to use throughout the lifecycle of blockchain, and identify future trends to support researchers in this area.
Smart Contracts are software programs that are deployed and executed within a blockchain infrastructure. Due to their immutable nature, directly resulting from the specific characteristics of the deploying infrastructure, smart contracts must be thoroughly tested before their release. Testing is one of the main activities that can help to improve the reliability of a smart contract, so as to possibly prevent considerable loss of valuable assets. It is therefore important to provide the testers with tools that permit them to assess the activity they performed. Mutation testing is a powerful approach for assessing the fault-detection capability of a test suite. In this paper, we propose SuMo, a novel mutation testing tool for Ethereum Smart Contracts. SuMo implements a set of 44 mutation operators that were designed starting from the latest Solidity documentation, and from well-known mutation testing tools. These allow to simulate a wide variety of faults that can be made by smart contract developers. The set of operators was designed to limit the generation of stillborn mutants, which slow down the mutation testing process and limit the usability of the tool. We report a first evaluation of SuMo on open-source projects for which test suites were available. The results we got are encouraging, and they suggest that SuMo can effectively help developers to deliver more reliable smart contracts.
Digital finance encompasses digital information feedback on credit credibility and electronic transactions based on digital currencies.In recent years, driven by blockchain technology and cloud computing, digital finance has boomed in developed countries, giving rise to new issues and potential risks.With the transformation of digital finance from 'crypto' to 'cloud', a new trend is emerging.Digital finance driven by cloud computing, whether on public clouds or on-chain clouds, offers a plethora of opportunities, but the migration to native digital finance systems based on cloud infrastructure would be fraught with risk.Cloud computing, with its convenience, flexibility, security and scalability, continues to become a mainstream technology in retail finance.Multi-modal federated machine learning and federated cloud transactions can potentially construct a decentralized market with permissioned access while achieving snapshot privacy.Blockchain will continue its widespread adoption in developer-centric financial backends as technology matures, with larger public chains evolving to handle benchmark trading volumes.On miniambilest, native public and enterprise banks, decentralized exchanges, NFT-backed loans and on-chain credit scores will rise, creating liquidity for illiquid assets and granting borrowing access to previously excluded participants.The rising popularity of cryptocurrencies may, on the contrary, accelerate KYC, AML and the adoption of CBDCs.Security issues in cloud computing may cause significant financial losses, as there have been cases in the past where public cloud services have suffered data breaches.In some cases, thousands of GB of customer financial and transaction data have leaked online and caused significant reputational damage, emphasizing the importance of choosing a reliable cloud service vendor [2].Observations made during web scraping consisting of an analysis of exchange user cases showed that data breaches have exposed customer account information, previous transactions, and even 3D model photos of the vault and keys used to hide hardware wallets in a bank deposit facility.Furthermore, the archive and backup of large-scale retail finance databases in the public cloud may incur long data retrieval delay of over 100ms.The lost backup can also put the entire institution at risk if the vendor service becomes bankrupt, or if a natural disaster damages their facilities.Despite the rapid year-on-year growth of this new financial market, currently, only limited assets, such as the Bitcoin reward for blockchain mining, can be traded on-chain.
Recent advancements in the cloud computing domain have resulted in huge strides toward simplifying the procurement of hardware and software for diverse needs. By moving enterprise workloads to managed cloud offerings (private, public, hybrid), customers are delegating mundane tasks and labor-intensive maintenance activities related to network connectivity, procurement of cloud resource, application deployment, software patches, and upgrades, etc., This often translates to benefits such as high availability and reduced cost. The popularity of container and micro-services-based deployment has made Kubernetes the de-facto standard to deliver applications. However, even with Kubernetes orchestration, cloud service providers frequently have operational scalability issues due to lack of Continuous Integration and Continuous Deployment (CICD) automation and increased demand for human operators when managing a large number of software deployments across multiple data centers/availability zones. Kubernetes solves this in a novel way by creating and managing custom applications using Operators. Agile methodology advocates incremental CICD which are adopted by cloud providers. However, ironically, it is this same continuous delivery feature of application updates, Kubernetes cluster upgrades, etc., that is also a bane to cloud providers. In this paper, we will demonstrate the use of IBM open-source project Razee as a scalable continuous deployment framework to deploy open-source RStudio and Nginx Operators. We will discuss how IBM Watson SaaS application Operator, Blockchain applications, and Kubernetes resources updates, etc., can be deployed similarly and the use of Operators to perform application life cycle management. We assert that using Razee in conjunction with Operators on Kubernetes simplifies application life cycle management and increases scalability.
Decentralized systems have been widely developed and applied to address security and privacy issues in centralized systems, especially since the advancement of distributed ledger technology. However, it is challenging to ensure their correct functioning with respect to their designs and minimize the technical risk before the delivery. Although formal methods have made significant progress over the past decades, a feasible solution based on formal methods from a development process perspective has not been well developed. In this paper, we formulate an iterative and incremental development process, named formalism-driven development (FDD), for developing provably correct decentralized systems under the guidance of formal methods. We also present a framework named Seniz, to practicalize FDD with a new modeling language and scaffolds. Furthermore, we conduct case studies to demonstrate the effectiveness of FDD in practice with the support of Seniz.
Beyond an emerging popular web applications runtime supported in almost all commodity browsers, WebAssembly (WASM) is further regarded to be the next-generation execution environment for blockchain-based applications. Indeed, many popular blockchain platforms such as EOSIO and NEAR have adopted WASM-based execution engines. Most recently, WASM has been favored by Ethereum, the largest smart contract platform, to replace the state-of-the-art EVM. However, whether and how well current WASM outperforms EVM on blockchain clients is still unknown. This article conducts the first measurement study to understand the performance on WASM VMs and EVM for executing smart contracts for blockchain-based applications. To our surprise, the current WASM VM does not provide expected satisfactory performance. The overhead introduced by WASM is really non-trivial. Our results shed the light on challenges when deploying WASM in practice, and provide insightful implications for improvement space.
Rafael Belchior, Sérgio Guerreiro, André Vasconcelos, Miguel Correia
The complexity of a business environment often causes organizations to produce several inconsistent views on the same business process, leading to fragmentation and inefficiencies. Business process view integration attempts to produce an integrated view from different views of the same model, facilitating the management of models. To study trends around business process view integration, we conduct a systematic literature review to summarize findings since the 1970s, up to its potential novel applications. With a starting corpus of 798 documents, this survey draws up a systematic inventory of solutions used in academia and in the industry. By narrowing it down to 51 articles, we discuss in-depth 15 business process integration techniques papers. After that, we classify existing solutions according to their practicality. Our study shows that most integrated views are constructed by annotation, using formal merging rules. Finally, we explore possible future research directions. We highlight the application of view integration to the blockchain research area, where stakeholders can have different views on the same blockchain. We expect that this study contributes to interdisciplinary research across view integration.
This paper presents an autonomous driving that achieves physical layer security. Proposed vehicle communication is implemented based on Proof-of-Nonce (PoN) blockchain algorithm. PoN blockchain algorithm is a consensus algorithm that can be implemented in light weight. We propose a more secure vehicle communication scheme while achieving physical layer security by defecting PoN algorithm and secrecy capacity. By generating a block only when secrecy capacity is greater than or equal to the reference value, traffic information can be provided only to vehicles with physical layer security. This vehicle communication scheme can secure sufficient safety even from hackers based on quantum computing.
Giuseppe Antonio Pierro, Roberto Tonelli, Michele Marchesi
Many empirical software engineering studies show that there is a great need for repositories where source code is acquired, filtered and classified. During the last few years, Ethereum block explorer services have emerged as a popular project to explore and search Ethereum blockchain data such as transactions, addresses, tokens, smart-contracts' source code, prices and other activities taking place on the Ethereum blockchain. Despite the availability of this kind of services, retrieving specific information useful to empirical software engineering studies, such as the study of smart-contracts' software metrics might require many sub-tasks, such as searching specific transactions in a block, parsing files in HTML format and filtering the smart-contracts to remove duplicated code or unused smart-contracts. In this paper we afford this problem creating Smart Corpus', a Corpus of Smart Contracts in an organized reasoned and up to date repository where Solidity source code and other metadata about Ethereum smart contracts can easily and systematically be retrieved. We present the Smart Corpus' design and its initial implementation and we show how the data-set of smart contracts' source code in a variety of programming languages can be queried and processed, get useful information on smart contracts and their software metrics. The Smart Corpus aims to create a smart-contracts' repository where smart contracts data (source code, ABI and byte-code) are freely and immediately available and also classified based on the main software metrics identified in the scientific literature. Smart-contracts source code has been validated by EtherScan and each contract comes with its own associated software metrics as computed by the freely available software PASO. Moreover, Smart Corpus can be easily extended, as the number of new smart-contracts increases day by day.
Blockchain technology supports building transparent and decentralized systems in which the executed transactions can be easily traceable. Suppose one such system is intended to manage and process personal data. In that case, complementary mechanisms are required that make it possible for the system to comply, for instance, with data protection regulations. This work studies the integration of off-chain capabilities in blockchain-based solutions. In particular, we have focused on mechanisms that support safely moving data or computational operations outside the core blockchain network. We have carried out a thorough analysis of the European data protection regulation and discussed the weaknesses and strengths regarding the security and privacy requirements established by that regulation of solutions built using traditional blockchain technology.As a direct consequence of this study, we have conceived, and present in this paper, a system architecture for the design of privacy-aware solutions that use that kind of technology and put forward a systematic approach for performing a security and privacy threat analysis of one such solution. We illustrate the use of the proposed methodological tools, presenting and discussing the high-level design and security and privacy assessment of a system that provides services to handle, store, and validate digital academic certificates.