Follow blockchain research across journals, conferences, and preprint repositories.
1,684 results · page 26 of 71
Pedro Antonino, Juliandson Ferreira, Augusto Sampaio, A. W. Roscoe · 5 authors
No abstract is available for this record.
Xun Deng, Sidi Mohamed Beillahi, Cyrus Minwalla, Han Du · 6 authors
This paper presents OVer, a framework designed to automatically analyze the behavior of decentralized finance (DeFi) protocols when subjected to a "skewed" oracle input. OVer firstly performs symbolic analysis on the given contract and constructs a model of constraints. Then, the framework leverages an SMT solver to identify parameters that allow its secure operation. Furthermore, guard statements may be generated for smart contracts that may use the oracle values, thus effectively preventing oracle manipulation attacks. Empirical results show that OVer can successfully analyze all 10 benchmarks collected, which encompass a diverse range of DeFi protocols. Additionally, this paper illustrates that current parameters utilized in the majority of benchmarks are inadequate to ensure safety when confronted with significant oracle deviations. It shows that existing ad-hoc control mechanisms such as introducing delays are often in-sufficient or even detrimental to protect the DeFi protocols against the oracle deviation in the real-world.
Paul J. Ennis
This chapter provides a general overview of the Ethereum Execution Layer (EL). We begin by discussing the concept of Ethereum&s;s world state. We discover that the world state is a database mapping addresses to user accounts and application accounts. We take a look at the various transaction types that exist in the Ethereum protocol. We discuss smart contracts and how they are processed by the Ethereum Virtual Machine (EVM). Finally, we introduce the concept of blockchains and how execution layer data is stored.
İqra Mustafa, Alan McGibney, Susan Rea
The concept of smart contracts (SCs) is becoming more prevalent, and their application is gaining traction across many diverse scenarios. However, producing poorly constructed contracts carries significant risks, including the potential for substantial financial loss, a lack of trust in the technology, and the risk of exposure to cyber-attacks. Several tools exist to assist in developing SCs, but their limited functionality increases development complexity. Expert knowledge is required to ensure contract reliability, resilience, and scalability. To overcome these risks and challenges, tools and services based on modeling and formal techniques are required that offer a robust methodology for SC verification and life-cycle management. This study proposes an engineering framework for the generation of a robust and verifiable smart contract (GRV-SC) framework that covers the entire SC life-cycle from design to deployment stages. It adopts SC modeling and automated formal verification methodologies to detect security vulnerabilities and improve resilience, extensibility, and code optimization to mitigate risks associated with SC development. Initially, the framework includes the implementation of a formal approach, using colored Petri nets (CPNs), to model cross-platform Digital Asset Modeling Language (DAML) SCs. It also incorporates a specialized type safety dynamic verifier, which is designed to detect and address new vulnerabilities that can arise in DAML contracts, such as access control and insecure direct object reference (Idor) vulnerabilities. The proposed GRV-SC framework provides a holistic approach to SC life-cycle management and aims to enhance the security, reliability, and adoption of SCs.
Sam Methuselah, Vishal Singh, Neel Raval, Vedant Bisen · 8 authors
Non-fungible tokens (NFTs) are digital assets that represent ownership of a particular item or can represent in-game items or virtual real estate. They are exclusive and limited in quantity, and their ability to be modified and controlled is what makes digital assets so valuable. The objective of the initiative is to develop interactive and immersive gaming experiences by utilizing the unique capabilities of NFTs. This concept is made possible through the use of smart contracts, which decentralize the ownership of NFTs and increase their desirability. The endeavor entails the creation of two online games employing NFTs. “Obstacle Assault” is a side-scrolling game in which players guide a character through obstacles and adversaries to reach the level&s;s conclusion. The game will use NFTs to depict weapons, armor, and power-ups that can be purchased and used to improve the player&s;s character. “Turtle Sidestep” is a puzzle game in which players must guide a turtle through a succession of obstacles in order to reach the level&s;s conclusion. NFTs will be used to depict virtual real estate in this game, allowing players to purchase and own specific locations within the game world.
Fernando Román-García, Juan Hernández‐Serrano, Óscar Esparza
This article introduces the Non-Repudiable Data Exchange (NoRDEx) protocol, designed to ensure non-repudiation in data exchanges. Unlike traditional non-repudiation and fair exchange protocols, NoRDEx can be considered decentralized as it eliminates the need for a centralized Trusted Third Party (TTP) by using a Distributed Ledger Technology (DLT) to store cryptographic proofs without revealing the exchanged message. NoRDEx is an optimistic non-repudiation protocol, as it only uses the DLT in case of a dispute. The protocol has been implemented and tested in real-world environments, with performance assessments covering cost, overhead, and execution time. A formal security analysis using the Syverson Van Oorschot (SVO) logical model demonstrates NoRDEx’s ability to resolve disputes securely.
Mathias Hall-Andersen, Mark Simkin, Benedikt Wagner
No abstract is available for this record.
Dahong Qian, Yiyang Xu, Yuncong Hu
No abstract is available for this record.
Alexandr Kuznetsov, Kateryna Kuznetsova, Anton Yezhov, Valentyn Chernushevych
No abstract is available for this record.
Ana Petrovska, Gabriele Gelardi, Hüseyin Demirci, Emre Koçyiğit · 10 authors
No abstract is available for this record.
Shahriar Ebrahimi, Parisa Hassanizadeh
Remote attestation (RA) protocols have been widely used to evaluate the integrity of software on remote devices.Currently, the state-of-the-art RA protocols lack a crucial feature: transparency.This means that the details of the final attestation verification are not openly accessible or verifiable by the public.Furthermore, the interactivity of these protocols often limits attestation to trusted parties who possess privileged access to confidential device data, such as pre-shared keys and initial measurements.These constraints impede the widespread adoption of these protocols in various applications.In this paper, we introduce zRA, a non-interactive, transparent, and publicly provable RA protocol based on zkSNARKs.zRA enables verification of device attestations without the need for pre-shared keys or access to confidential data, ensuring a trustless and open attestation process.This eliminates the reliance on online services or secure storage on the verifier side.Moreover, zRA does not impose any additional security assumptions beyond the fundamental cryptographic schemes and the essential trust anchor components on the prover side (i.e., ROM and MPU).The zero-knowledge attestation proofs generated by devices have constant size regardless of the network complexity and number of attestations.Moreover, these proofs do not reveal sensitive information regarding internal states of the device, allowing verification by anyone in a public and auditable manner.We conduct an extensive security analysis and demonstrate scalability of zRA compared to prior work.Our analysis suggests that zRA excels especially in peer-to-peer and Pub/Sub network structures.To validate the practicality, we implement an open-source prototype of zRA using the Circom language.We show that zRA can be securely deployed on public permissionless blockchains, serving as an archival platform for attestation data to achieve resilience against DoS attacks.
Xiaoli Zhang, Wenxiang Sun, Zhicheng Xu, Hongbing Cheng · 7 authors
Recently, smart contracts have been widely applied in security-sensitive fields yet are fragile to various vulnerabilities and attacks. Regarding this, existing research efforts either statically scrutinize smart contracts’ code or detect suspicious transaction execution flows. However, they either fail to timely protect contracts or only handle a small subset of well-known vulnerabilities. In the paper, we propose$\mathtt {EVM}$-$\mathtt {Shield}$that secures vulnerable smart contracts in real-time via fine-grained access control over sensitive states. The behind rationale is most of attacks aim to manipulate money-related states (e.g., tokens) for profits. Specifically, transaction-level state access control policies are first defined by developers and then translated into EVM-level policies with contract-aware function-level state access permissions. In policy enforcement,$\mathtt {EVM}$-$\mathtt {Shield}$introduces a hybrid storage analyzer to accurately identify (dynamic-allocated) storage locations for policy-involved states and a multi-stage cache based filter to fast revert bad transactions with unexpected state access behaviors. Finally, we conduct thorough experiments using 12 types of real-world contract vulnerabilities and all open-source smart contracts on the first$8M$blocks of Ethereum. The results demonstrate that$\mathtt {EVM}$-$\mathtt {Shield}$outperforms two state-of-the-art runtime analysis tools in terms of attack detection. Extensive performance evaluations with$185M$real-world transactions show that$\mathtt {EVM}$-$\mathtt {Shield}$can block 100% unexpected state accesses at the cost of 8% throughput degradation (compared with the native EVM).
Saloni Jain, Ashwija Reddy Korenda, Amisha Bagri, Bertrand Cambou · 5 authors
No abstract is available for this record.
Anders Dalskov, Daniel Escudero, Ariel Nof
No abstract is available for this record.
Yongming Fan, Yuquan Xu, Christina Garman
No abstract is available for this record.
Yuncong Zhang, Shi-Feng Sun, Dawu Gu
No abstract is available for this record.
Vincent Jacquot, Benoît Donnet
No abstract is available for this record.
Chao Liu, Cankun Hou, Tianyu Jiang, Jianting Ning · 6 authors
Data-driven landscape across finance, government, and healthcare, the continuous generation of information demands robust solutions for secure storage, efficient dissemination, and fine-grained access control. Blockchain technology emerges as a significant tool, offering decentralized storage while upholding the tenets of data security and accessibility. However, on-chain and off-chain strategies are still confronted with issues such as untrusted off-chain data storage, absence of data ownership, limited access control policy for clients, and a deficiency in data privacy and auditability. To solve these challenges, we propose a permissioned blockchain-based privacy-preserving fine-grained access control on-chain and off-chain system, namely FACOS. We applied three fine-grained access control solutions and comprehensively analyzed them in different aspects, which provides an intuitive perspective for system designers and clients to choose the appropriate access control method for their systems. Compared to similar work that only stores encrypted data in centralized or non-fault-tolerant IPFS systems, we enhanced off-chain data storage security and robustness by utilizing a highly efficient and secure asynchronous Byzantine fault tolerance (BFT) protocol in the off-chain environment. As each of the clients needs to be verified and authorized before accessing the data, we involved the Trusted Execution Environment (TEE)-based solution to verify the credentials of clients. Additionally, our evaluation results demonstrated that our system (https://github.com/cliu717/AsynchronousStorage) offers better scalability and practicality than other state-of-the-art designs. We deployed our system on Alibaba Cloud and Tencent Cloud and conducted multiple evaluations. The results indicate that it takes about 2.79 seconds for a client to execute the protocol for uploading and about 0.96 seconds for downloading. Compared to other decentralized systems, our system exhibits efficient latency for both download and upload operations.
Francesca Stabile, Walter Lúcia, Amr Youssef, Giuseppe Franzè
The proliferation of cloud computing technologies has paved the way for deploying networked encrypted control systems, offering high performance, remote accessibility and privacy. However, in scenarios where the control algorithms run on third-party cloud service providers, the control’s logic might be changed by a malicious agent on the cloud. Consequently, it is imperative to verify the correctness of the control signals received from the cloud. Traditional verification methods, like zero-knowledge proof techniques, are computationally demanding in both proof generation and verification, may require several rounds of interactions between the prover and verifier and, consequently, are inapplicable in real-time control system applications. In this paper, we present a novel computationally inexpensive verifiable computing solution inspired by the probabilistic cut-and-choose approach. The proposed scheme allows the plant’s actuator to validate the computations accomplished by the encrypted cloud-based networked controller without compromising the control scheme’s performance. We showcase the effectiveness and real-time applicability of the proposed verifiable computation scheme using a remotely controlled Khepera-IV differential-drive robot.
Nishant Parekh, Wolfgang Ahrendt, Martin Fabian
Smart contracts are programs stored on a blockchain ledger, thus being immutable after deployment, which makes assessment of their correctness before deployment vital. Extended finite state machines (EFSM) offer a structured framework for modeling complex systems, thus providing a systematic approach to scrutinize smart contract functionalities. This paper describes a methodology to automatically convert from the abstract syntax tree of a smart contract to an EFSM model. A smart contract implementing a casino is the specific use case, and verification of the EFSM model reveals it to be blocking. This blocking represents that a malicious player can lock the funds of the casino so that they can never be retrieved.
Rainer Feichtinger, Robin Fritsch, Lioba Heimbach, Yann Vonlanthen · 5 authors
Decentralized Autonomous Organizations (DAOs) are blockchain-based organizations that facilitate decentralized governance. Today, DAOs not only hold billions of dollars in their treasury but also govern many of the most popular Decentralized Finance (DeFi) protocols. This paper systematically analyses security threats to DAOs, focusing on the types of attacks they face. We study attacks on DAOs that took place in the past, attacks that have been theorized to be possible, and potential attacks that were uncovered and prevented in audits. For each of these (potential) attacks, we describe and categorize the attack vectors utilized into four categories. This reveals that while many attacks on DAOs take advantage of the less tangible and more complex human nature involved in governance, audits tend to focus on code and protocol vulnerabilities. Thus, additionally, the paper examines empirical data on DAO vulnerabilities, outlines risk factors contributing to these attacks, and suggests mitigation strategies to safeguard against such vulnerabilities.
Seonghwan Park, Hayoung Kang, Shangze Han, Jonghee M. Youn · 5 authors
A smart contract is a program executed on a blockchain. However, once the smart contract is deployed on the blockchain, it becomes visible to all participants and remains immutable. Thus, any sensitive information or vulnerabilities in smart contracts can be exposed to potential attackers. To protect the confidentiality of smart contracts, existing studies execute smart contracts in a trusted execution environment (TEE). However, they still suffer from vulnerabilities in smart contracts and potential memory-vulnerability problems. If an attack such as privilege escalation occurs by exploiting this vulnerability, the TEE can have a detrimental effect on the entire system as it has the most privileges in the system. To mitigate the memory vulnerability of the smart contracts in TEE, we propose MECAT, a prototype for memory-safe confidential smart contracts. In essence, MECAT runs smart contracts written in Rust, a memory-safe language, in ARM TrustZone. And MECAT is developed as a software library, allowing developers to easily apply MECAT to their smart contracts. According to our evaluation, MECAT only incurs a 1.36x performance overhead and 0.3% power overhead in single-node environments and can process the 16 clients concurrently in the network made with 8 peer nodes.
Jing Li, Shengyu Tang
No abstract is available for this record.
Arusoaie, Andrei, Bărbieru, Claudiu-Nicu, Captarencu, Oana-Otilia, Felber, Pascal · 9 authors
Ethereum is the dominant blockchain ecosystem capable of executing Turing-complete smart contracts. Rollups gained significant traction as the primary layer 2 (L2) solution meant to bring horizontal scalability to the main Ethereum network (L1). A core component of any rollup is the sequencer, which creates new L2 blocks to be submitted in rollup batches to L1. In most of the current rollup architectures, this component is centralised. As a result, these designs are prone to inconspicuous censorship practices by the sequencer. Trusted execution environments (TEEs) can guarantee the integrity of various sequencer components, which is instrumental in addressing censorship. However, the reaction of the system design to censorship attempts depends on where a TEE is integrated and which components it protects. In particular, this reaction is limited in the case of a monolithic TEE-protected sequencer design. Proposer-Builder Separation (PBS) is a non-monolithic paradigm adopted on L1, which separates the production of blocks from proposing them for inclusion in the blockchain. Recently, PBS has been considered for integration with L2 sequencers, with an impact on alleviating censorship. In this paper, we explore the design space of TEE-integrating PBS and non-PBS sequencer variants. First, we introduce a formal framework for the censorship actions that captures the specificity of the L2 sequencer. Then, we analyse to what extent the different designs address these censorship actions. Our main contribution is a novel design variation that allows for a precise observation of censored transactions. In the presence of TEEs, in a PBS setting, we demonstrate this precise observability, which is necessary to enable resilience to censorship.