Blockchain Papers

J J Lohith, Anusree Manoj K, Guru Nanma P, Pooja Srinivasan

No abstract is available for this record.

Mehmet Parlak

In case of an accident between two autonomous vehicles equipped with emerging technologies, how do we apportion liability among the various players? A special liability regime has not even yet been established for damages that may arise due to the accidents of autonomous vehicles. Would the immutable, time-stamped sensor records of vehicles on distributed ledger help define the intertwined relations of liability subjects right through the accident? What if the synthetic media created through deepfake gets involved in the insurance claims? While integrating AI-powered anomaly or deepfake detection into automated insurance claims processing helps to prevent insurance fraud, it is only a matter of time before deepfake becomes nearly undetectable even to elaborate forensic tools. This paper proposes a blockchain-based insurtech decentralized application to check the authenticity and provenance of the accident footage and also to decentralize the loss-adjusting process through a hybrid of decentralized and centralized databases using smart contracts.

Songyan Ji, Jin Wu, Junfu Qiu, Jian Dong

No abstract is available for this record.

Zibin Zheng, Neng Zhang, Jianzhong Su, Zhijie Zhong · 6 authors

Smart contracts are programs deployed on a blockchain and are immutable once deployed. Reentrancy, one of the most important vulnerabilities in smart contracts, has caused millions of dollars in financial loss. Many reentrancy detection approaches have been proposed. It is necessary to investigate the performance of these approaches to provide useful guidelines for their application. In this work, we conduct a large-scale empirical study on the capability of five well-known or recent reentrancy detection tools such as Mythril and Sailfish. We collect 230,548 verified smart contracts from Etherscan and use detection tools to analyze 139,424 contracts after deduplication, which results in 21,212 contracts with reentrancy issues. Then, we manually examine the defective functions located by the tools in the contracts. From the examination results, we obtain 34 true positive contracts with reentrancy and 21,178 false positive contracts without reentrancy. We also analyze the causes of the true and false positives. Finally, we evaluate the tools based on the two kinds of contracts. The results show that more than 99.8% of the reentrant contracts detected by the tools are false positives with eight types of causes, and the tools can only detect the reentrancy issues caused by call.value(), 58.8% of which can be revealed by the Ethereum's official IDE, Remix. Furthermore, we collect real-world reentrancy attacks reported in the past two years and find that the tools fail to find any issues in the corresponding contracts. Based on the findings, existing works on reentrancy detection appear to have very limited capability, and researchers should turn the rudder to discover and detect new reentrancy patterns except those related to call.value().

Haoyu Wang, Zan Wang, Shuang Liu, Jun Sun · 7 authors

Abstract Smart contracts are distributed self‐enforcing programs which execute on top of blockchain networks. They have the potential to revolutionize many industries and have already been adopted for applications such as distributed finance and crowdfunding. Because smart contracts are immutable once they are deployed, it is important to identify and eliminate code vulnerabilities in smart contracts systematically. In this work, we propose sFuzz2.0 , a storage‐access‐pattern guided adaptive fuzzer based on sFuzz. sFuzz2.0 is motivated by the fact that certain vulnerabilities only manifest in the presence of certain function call sequences (as well as particular arguments). Given that there are exponentially many function call sequences, sFuzz randomly generates sequences without guidance. As a result, the probability of discovering those vulnerabilities is negligible. sFuzz2.0 tackles the problem with two approaches, that is, by generating function call sequences that trigger different storage‐access patterns passively (i.e., by prioritizing seeds which cover new patterns) or actively (i.e., by actively seeking out different patterns). The experiment results suggest that the passive strategy outperforms sFuzz by achieving better code coverage (i.e., 37.53%) and discovering more vulnerabilities (i.e., 20.49%).

Steven A. Wright

Deep learning, big data, IoT and blockchain are individually very important research topics of today’s technology, and their combination has the potential to generate additional synergy. Such synergy could enable decentralized and intelligent automated applications to achieve safety, security and optimize performance and economy. Deep learning, big data, IoT and blockchain all rely on infrastructure capabilities in computing and communications that are increasingly decentralized. Edge computing deployments and architectures are commencing with 5G and expected to accelerate in 6G. Existing application domains like healthcare and finance are starting to explore the integration of these technologies. Newly emerging application areas such as the metaverse may well require native support of decentralized deep learning to achieve their potential. But the path of new technology development is never smooth. New challenges have been identified and additional architectural frameworks have been developed to overcome some of these issues. Decentralizing deep learning enables increased scale for AI implementations, but also enables improvements in privacy and trustworthiness. The plethora of literature emerging on decentralized deep learning prompts the need for rationale criteria to support design decisions for implementation to utilize decentralized deep learning

Chihiro Kado, Naoto Yanai, Jason Paul Cruz, Shingo Okamura

Vulnerabilities are an important issue in Ethereum smart contracts. Although various vulnerability analysis tools have been developed, the effectiveness of compilers themselves in eliminating vulnerable code has not been investigated to the best of the author's knowledge. In this paper, we investigate how many vulnerable contracts are created in Ethereum smart contracts for each compiler version. In particular, we collected 503,572 contracts whose Solidity source codes are publicly available in the Ethereum blockchain and then analyzed the vulnerabilities of these contracts. Focused on three vulnerabilities with high severity, i.e., Locked Money, Using tx.origin, and Unchecked Call, we confirm that the appearance rates of these vulnerabilities are decreased by major updates of the Solidity compiler. We then found the following insights. First, the appearance rate for Locked Money is decreased after version v0.6, and second, that of Using tx.origin is quite limited independently of the compiler update. Third, the appearance rate for Unchecked Call is decreased by v0.8, but it is still high due to several factors, such as code cloning. Thus, countermeasures are needed for Unchecked Call.

Martina Rossini, Mirco Zichichi, Stefano Ferretti

In this paper, we investigate the use of deep learning techniques to identify and classify smart contract code vulnerabilities. We collected a large-scale dataset of smart contracts that we used to train different Convolutional Neural Networks (CNNs) models. In particular, we used two variants of 2-dimensional CNNs working on RGB images corresponding to contract byte-code, a 1-dimensional CNN working on the bytecode directly, and a Long Short-Term Memory (LSTM) neural network. Given a set of vulnerability detectors, we employed five classes of vulnerabilities. Our results show that CNNs provide a good level of accuracy and demonstrate the viability of using deep learning techniques to identify smart contract vulnerabilities.

Jiahao Li

Despite the rapid growth of smart contracts, they are suffering numerous security vulnerabilities due to the absence of reliable development and testing. In this article, we apply the metamorphic testing technique to detect smart contract vulnerabilities. Based on the anomalies we observed in vulnerable smart contracts, we define five metamorphic relations to detect abnormal gas consumption and account interaction inconsistency of the target smart contract. Through dynamically executing transactions and checking the final violation of metamorphic relations, we determine whether a smart contract is vulnerable. We evaluate our approach on a benchmark of 67 manually annotated smart contracts. The experimental results show that our approach achieves a higher detection rate (TPR, true positive rate) with a lower misreport rate (FDR, false discovery rate) than the other three state-of-the-art tools. These results further suggest that metamorphic testing is a promising method for detecting smart contract vulnerabilities.

Scott Aaronson, Shih‐Han Hung

We propose an application for near-term quantum devices: namely, generating cryptographically certified random bits, to use (for example) in proof-of-stake cryptocurrencies. Our protocol repurposes the existing "quantum supremacy" experiments, based on random circuit sampling, that Google and USTC have successfully carried out starting in 2019. We show that, whenever the outputs of these experiments pass the now-standard Linear Cross-Entropy Benchmark (LXEB), under plausible hardness assumptions they necessarily contain $Ω(n)$ min-entropy, where $n$ is the number of qubits. To achieve a net gain in randomness, we use a small random seed to produce pseudorandom challenge circuits. In response to the challenge circuits, the quantum computer generates output strings that, after verification, can then be fed into a randomness extractor to produce certified nearly-uniform bits -- thereby "bootstrapping" from pseudorandomness to genuine randomness. We prove our protocol sound in two senses: (i) under a hardness assumption called Long List Quantum Supremacy Verification, which we justify in the random oracle model, and (ii) unconditionally in the random oracle model against an eavesdropper who could share arbitrary entanglement with the device. (Note that our protocol's output is unpredictable even to a computationally unbounded adversary who can see the random oracle.) Currently, the central drawback of our protocol is the exponential cost of verification, which in practice will limit its implementation to at most $n\sim 60$ qubits, a regime where attacks are expensive but not impossible. Modulo that drawback, our protocol appears to be the only practical application of quantum computing that both requires a QC and is physically realizable today.

Jie Cai, Bin Li, Jiale Zhangv, Xiaobing Sun · 5 authors

Existing smart contract vulnerability detection efforts heavily rely on fixed rules defined by experts, which are inefficient and inflexible. To overcome the limitations of existing vulnerability detection approaches, we propose a GNN based approach. First, we construct a graph representation for a smart contract function with syntactic and semantic features by combining abstract syntax tree (AST), control flow graph (CFG), and program dependency graph (PDG). To further strengthen the presentation ability of our approach, we perform program slicing to normalize the graph and eliminate the redundant information unrelated to vulnerabilities. Then, we use a Bidirectional Gated Graph Neural-Network model with hybrid attention pooling to identify potential vulnerabilities in smart contract functions. Experiment results show that our approach can achieve 89.2% precision and 92.9% recall in smart contract vulnerability detection on our dataset and reveal the effectiveness and efficiency of our approach.

Elnaz Rabieinejad, Abbas Yazdinejad, Reza M. Parizi, Ali Dehghantanha

Ethereum blockchain has shown great potential in providing the next generation of the decentralized platform beyond crypto payments. Recently, it has attracted researchers and industry players to experiment with developing various Web3 applications for the Internet of Things (IoT), Defi, Metaverse, and many more. Although Ethereum provides a secure platform for developing decentralized applications, it is not immune to security risks and has been a victim of numerous cyber attacks. Adversarial attacks are a new cyber threat to systems that have been rising. Adversarial attacks can disrupt and exploit decentralized applications running on the Ethereum platform by creating fake accounts and transactions. Detecting adversarial attacks is challenging because the fake materials (e.g., accounts and transactions) as malicious payloads are similar to benign data. This article proposes a model using Generative Adversarial Networks (GAN) and Deep Recurrent Neural Networks (RNN) for cyber threat hunting in the Ethereum blockchain. Firstly, we employ GAN to generate fake transactions using genuine Ethereum transactions as the first phase of the proposed model. Then in the second phase, we utilize bi-directional Long Short-Term Memory (LSTM) to identify adversarial transactions in a hunting exercise. The results of the first phase evaluation show that the GAN can generate transactions identical to the actual Ethereum transactions with an accuracy of 82.51%. Also, the results of the second phase show 99.98% accuracy in identifying adversarial transactions.

Giampaolo Bella, Pietro Biondi, Stefano Bognanni, Sergio Esposito

Attackers may attempt exploiting Internet of Things (IoT) devices to operate them unduly as well as to gather personal data of the legitimate device owners’. Vulnerability Assessment and Penetration Testing (VAPT) sessions help to verify the effectiveness of the adopted security measures. However, VAPT over IoT devices, namely VAPT targeted at IoT devices, is an open research challenge due to the variety of target technologies and to the creativity it may require. Therefore, this article aims at guiding penetration testers to conduct VAPT sessions over IoT devices by means of a new cyber Kill Chain (KC) termed PETIoT. Several practical applications of PETIoT confirm that it is general, while its main novelty lies in the combination of attack and defence steps. PETIoT is demonstrated on a relevant example, the best-selling IP camera on Amazon Italy, the TAPO C200 by TP-Link, assuming an attacker who sits on the same network as the device’s in order to assess all the network interfaces of the device. Additional knowledge is generated in terms of three zero-day vulnerabilities found and practically exploited on the camera, one of these with High severity and the other two with Medium severity by the CVSS standard. These are camera Denial of Service (DoS), motion detection breach and video stream breach. The application of PETIoT culminates with the proof-of-concept of a home-made fix, based on an inexpensive Raspberry Pi 4 Model B device, for the last vulnerability. Ultimately, our responsible disclosure with the camera vendor led to the release of a firmware update that fixes all found vulnerabilities, confirming that PetIoT has valid impact in real-world scenarios.

Hanna Kim, Jian Cui, Eugene Jang, Chanhee Lee · 7 authors

As Non-Fungible Tokens (NFTs) continue to grow in popularity, NFT users have become targets of phishing attacks by cybercriminals, called \textit{NFT drainers}. Over the last year, \$100 million worth of NFTs were stolen by drainers, and their presence remains a serious threat to the NFT trading space. However, no work has yet comprehensively investigated the behaviors of drainers in the NFT ecosystem. In this paper, we present the first study on the trading behavior of NFT drainers and introduce the first dedicated NFT drainer detection system. We collect 127M NFT transaction data from the Ethereum blockchain and 1,135 drainer accounts from five sources for the year 2022. We find that drainers exhibit significantly different transactional and social contexts from those of regular users. With these insights, we design \textit{DRAINCLoG}, an automatic drainer detection system utilizing Graph Neural Networks. This system effectively captures the multifaceted web of interactions within the NFT space through two distinct graphs: the NFT-User graph for transaction contexts and the User graph for social contexts. Evaluations using real-world NFT transaction data underscore the robustness and precision of our model. Additionally, we analyze the security of \textit{DRAINCLoG} under a wide variety of evasion attacks.

Dylan Paulin, Raphaël Joud, Christine Hennebert, Pierre-Alain Moëllic · 6 authors

Abstract In areas of activity where the notion of accountability is strong, the adoption of artificial intelligence (AI) is limited by the opacity and lack of understanding of its behavior, all the more so in the embedded domain where neural networks are compressed and executed on microcontrollers. While the NIST introduced in 2021 several principles allowing the AI explainability, this paper introduces a novel scheme, HistoTrust, combining secure hardware and blockchain technology to bring trust in the traceability of AI behavior and allow its explainability. HistoTrust attests in an Ethereum ledger all the relevant data produced by a physical device, especially the heuristics inferred by AI. Thus, the audition of the ledger allows security verifications and AI behavior analysis.

Xiangyun Tang, Meng Shen, Qi Li, Liehuang Zhu · 6 authors

Federated learning (FL) protects training data in clients by collaboratively training local machine learning models of clients for a global model, instead of directly feeding the training data to the server. However, existing studies show that FL is vulnerable to various attacks, resulting in training data leakage or interfering with the model training. Specifically, an adversary can analyze local gradients and the global model to infer clients’ data, and poison local gradients to generate an inaccurate global model. It is extremely challenging to guarantee strong privacy protection of training data while ensuring the robustness of model training. None of the existing studies can achieve the goal. In this paper, we propose a robust privacy-preserving federated learning framework (PILE), which protects the privacy of local gradients and global models, while ensuring their correctness by gradient verification where the server verifies the computation process of local gradients. In PILE, we develop a verifiable perturbation scheme that makes confidential local gradients verifiable for gradient verification. In particular, we build two building blocks of zero-knowledge proofs for the gradient verification without revealing both local gradients and global models. We perform rigorous theoretical analysis that proves the security of PILE and evaluate PILE on both passive and active membership inference attacks. The experiment results show that the attack accuracy under PILE is between$[50.3\%,50.9\%]$, which is close to the random guesses. Particularly, compared to prior defenses that incur the accuracy losses ranging from 2% to 13%, the accuracy loss of PILE is negligible, i.e., only$\pm 0.3\%$accuracy loss.

Gueltoum Bendiab, Amina Hameurlaine, Georgios Germanos, Nicholas Kolokotronis · 5 authors

The arrival of autonomous vehicles (AVs) promises many great benefits, including increased safety and reduced energy consumption, pollution, and congestion. However, these engines have many security and privacy issues that could undermine the expected benefits if not addressed. AVs will provide new opportunities for hackers to carry out malicious attacks, posing a great threat to the future of mobility and data protection. The research trend in this field indicates that combining Blockchain and AI could bring strong protection for AVs against malicious attacks. Blockchain and AI have different working paradigms, but when merged, they can empower each other, and solve many security and privacy issues of AVs. AI can optimise the construction of the Blockchain to make it more efficient, secure and energy-saving, where Blockchain provides data immutability and trust mechanism for AI-based solutions and makes them more transparent, trustful, and explainable. Although some research is being conducted on this area, the topic of applying Blockchain and AI for securing AVs is not deeply investigated. In this paper, we explore the possible application of an amalgamation of Blockchain and AI solutions for securing AVs. We first introduce a classification of security and privacy threats that may arise from the application of AVs. Then, we provide an overview of recent literature regarding Blockchain and AI usage for securing AVs. Finally, we highlight limitations and challenges that may face the integration of Blockchain and AI with AVs based on our systemic review and suggest potential future directions for research in this field.

Abdulatif Alabdulatif, Muneerah Al Asqah, Tarek Moulahi, Salah Zidi

Machine learning-based (ML) systems are becoming the primary means of achieving the highest levels of productivity and effectiveness. Incorporating other advanced technologies, such as the Internet of Things (IoT), or e-Health systems, has made ML the first choice to help automate systems and predict future events. The execution environment of ML is always presenting contrasting types of threats, such as adversarial poisoning of training datasets or model parameters manipulation. Blockchain technology is known as a decentralized network of blocks that symbolizes means of protecting block content integrity and ensuring secure execution of operations.Existing studies partially incorporated Blockchain into the learning process. This paper proposes a more extensive secure way to protect the decision process of the learning model. Using smart contracts, this study executed the model’s decision by the reversal engineering of the learning model’s decision function from the extracted learning parameters. We deploy Support Vector Machine (SVM) and Multi-Layer Perceptron (MLP) classifiers decision functions on-chain for more comprehensive integration of Blockchain. The effectiveness of this proposed approach is measured by applying a case study of medical records. In a safe environment, SVM prediction scores were found to be higher than MLP. However, MLP had higher time efficiency.

Fatemeh Stodt, Jan Stodt, Christoph Reich

ML-based applications already play an important role in factories in areas such as visual quality inspection, process optimization, and maintenance prediction and will become even more important in the future. For ML to be used in an industrial setting in a safe and effective way, the different steps needed to use ML must be put together in an ML pipeline. The development of ML pipelines is usually conducted by several and changing external stakeholders because they are very complex constructs, and confidence in their work is not always clear. Thus, end-to-end trust in the ML pipeline is not granted automatically. This is because the components and processes in ML pipelines are not transparent. This can also cause problems with certification in areas where safety is very important, such as the medical field, where procedures and their results must be recorded in detail. In addition, there are security challenges, such as attacks on the model and the ML pipeline, that are difficult to detect. This paper provides an overview of ML security challenges that can arise in production environments and presents a framework on how to address data security and transparency in ML pipelines. The framework is presented using visual quality inspection as an example. The presented framework provides: (a) a tamper-proof data history, which achieves accountability and supports quality audits; (b) an increase in trust by protocol for the used ML pipeline, by rating the experts and entities involved in the ML pipeline and certifying legitimacy for participation; and (c) certification of the pipeline infrastructure, the ML model, data collection, and labelling. After describing the details of the new approach, the mitigation of the previously described security attacks will be demonstrated, and a conclusion will be drawn.

K. Vignesh Saravanan, P. Jothi Thilaga, S. Kavi Priya, K. Vijayalakshmi

No abstract is available for this record.

Zhenzhou Tian, Fanfan Wang

No abstract is available for this record.

Hui Zhao, Xing Li, Keke Gai

No abstract is available for this record.

Tang Gui, Wuzheng Tan, Mei Cai

In the big data era, machine learning has devel-oped prominently and is widely used in real-world systems. Yet, machine learning raises fairness concerns, which incurs discrimination against groups determined by sensitive attributes such as gender and race. Many researchers have focused on developing fairness audit technique of machine learning model that enable users to protect themselves from discrimination. Existing solutions, however, rely on additional external trust as-sumptions, either on third-party entities or external components, that significantly lower the security. In this study, we propose a trustless verifiable fairness audit framework that assesses the fairness of ML algorithms while addressing potential security issues such as data privacy, model secrecy, and trustworthiness. With succinctness and non-interactive of zero knowledge proof, our framework not only guarantees audit integrity, but also clearly enhance security, enabling fair ML models to be publicly auditable and any client to verify audit results without extra trust assumption. Our evaluation on various machine learning models and real-world datasets shows that our framework achieves practical performance.

Yiming Jiang, Jiangfan Zhang

Distributed detection over a blockchain-aided Internet of Things (BIoT) network in the presence of attacks is considered, where the integrated blockchain is employed to secure data exchanges over the BIoT as well as data storage at the agents of the BIoT. We consider a general adversary model where attackers jointly exploit the vulnerability of IoT devices and that of the blockchain employed in the BIoT. The optimal attacking strategy which minimizes the Kullback-Leibler divergence is pursued. It can be shown that this optimization problem is nonconvex, and hence it is generally intractable to find the globally optimal solution to such a problem. To overcome this issue, we first propose a relaxation method that can convert the original nonconvex optimization problem into a convex optimization problem, and then the analytic expression for the optimal solution to the relaxed convex optimization problem is derived. The optimal value of the relaxed convex optimization problem provides a detection performance guarantee for the BIoT in the presence of attacks. In addition, we develop a coordinate descent algorithm which is based on a capped water-filling method to solve the relaxed convex optimization problem, and moreover, we show that the convergence of the proposed coordinate descent algorithm can be guaranteed.