Blockchain Papers

Rita Melo, Pedro Pinto, António Pinto

No abstract is available for this record.

Georgia Osborn, Nathan Alan

Blockchain, or Web3 technology has the potential to disrupt the everyday use of the Internet. The polarised discussion around blockchain technology is notoriously difficult to navigate between the opposing narratives of blockchain evangelists and skeptics. This article focuses on blockchain domain names, a rapidly growing trend using blockchain technology that is currently non-interoperable with the Domain Name System (DNS) and therefore, out of scope of traditional Internet governance. Alternative DNS roots are not new and have previously not become popular due to the lack of supporting browsers. On one view, blockchain domain names are nothing more than another alternative root, insignificant and undeserving of attention. Other narratives regard them as offering an exciting prospect of a decentralised and novel way for managing online naming and addressing. This study explores the burgeoning growth, assesses the challenges of blockchain domain names and provides five recommendations to address them. Although many in traditional Internet communities may be hostile or ignore the blockchain alternative for naming and addressing, we argue that a pragmatic response should be adopted. Even if it is not clear that blockchain domain names solve any problems not currently solved by the DNS, the increase in registrations continues to rise and diverse Internet communities must keep ahead of the trends to understand them and integrate policy implications. Furthermore, the technologies will continue to advance and due to the decentralised nature of the blockchain, developments or changes can be more rapidly implemented than within the DNS.

Martijn de Vos, Georgy Ishmaev, Johan Pouwelse

The popularity of blockchain technology has bootstrapped many “Web3” applications, e.g., Ethereum and IPFS, that apply distributed ledger technology to store transactions. The amount of transactions generated and stored in such Web3 applications is significant and, in its raw form, usually not searchable by users. Existing Web3 transaction indexing and search engines are predominantly centralized and, therefore, can manipulate search results or censor particular queries. With the proliferation of Web3 transactions and applications, a decentralized and censorship-resistant search primitive is becoming essential. We present DeScan, a decentralized and censorship-resistant indexing and search engine for Web3. Users index their local Web3 transactions using custom rules that output triplets. Generated triplets are bundled in a distributed transaction graph that is searchable by other users. To coordinate search and distribute the storage of the transaction graph over peers in the network, we build upon a Skip Graph (SG) data structure. Since the Skip Graph does not provide any resilience against adversarial peers that censor searches, we propose four modifications to improve its robustness. We implement DeScan and conduct experiments with up to 12 800 peers and 10 million Ethereum transactions. Our experiments show that DeScan with our modifications enabled can tolerate 20% adversarial peers and 35% unresponsive peers without disruption. Moreover, we find that searches in DeScan are usually completed well within a second, even when the network grows. Finally, we show that storage and network costs are evenly distributed amongst peers as the network grows.

Rohit Saxena, Deepak Arora, Vishal Nagar

Ethereum is a digital asset whose transactions are kept on a decentralized, globally accessible ledger. An Ethereum Blockchain owner's real identity is concealed behind a pseudonym termed an address. Because of this, Ethereum is frequently used in illegal activities like gambling and ransomware attacks because it is popularly believed to offer the highest level of anonymity. As a result, it is necessary to categorize the various malicious cybercriminal users' activities and addresses in the Ethereum Blockchain. The Blockchain's public data enables an in-depth analysis. Using supervised machine learning models including linear, non-linear, and ensemble learning models based on malicious and non-malicious activities, the classification of Ethereum Blockchain addresses is carried out in this paper. In this research work, cross-validation accuracy, recall, precision, and f1-score have been employed for the assessment. Findings indicate that linear and non-linear machine learning approaches are superior to ensemble learning for classifying Ethereum Blockchain addresses. The results also show that it is possible to discover the Ethereum Blockchain addresses of malicious users.

Vaishali Ravindranath, M. K. Nallakaruppan, M. Lawanya Shri, Balamurugan Balusamy · 5 authors

No abstract is available for this record.

Faiqah Hafidzah Halim, Nor Aimuni Md Rashid, Nur Farahin Mohd Johari, Muhammad Amirul Hazim Abdul Rahman

In Malaysia, private healthcare providers keep computerized records of vaccination data, including personal information, diagnostic results, and vaccine prescriptions. However, such sensitive information is commonly stored using a centralized storage paradigm which subsequently brings about the issue of maintaining user privacy. Concerning this, unauthorized access to crucial information such as identity details and ailments that a patient is suffering from, as well as the misuse of patients' data and medical reports, are common threats to user's (patient) privacy. To overcome this problem, the researchers suggest leveraging IPFS (Interplanetary File System) and blockchain technology to create a decentralized children's immunization record management system. While respecting patient privacy, the proposed system also allows authorized entities, such as healthcare professionals, and provides easy access to medical data (e.g., doctors and nurses). The proposed decentralized system integrates IPFS, blockchain, and AES cryptography to ensure consistency, integrity, and accessibility. A permission Ethereum blockchain allows hospitals and patients within private healthcare providers to connect. We utilized a combination of symmetric and asymmetric key encryption to provide secure storage and selective records access. The proposed system was analyzed using Wireshark to evaluate the overall system's performance in terms of integrity and accessibility while sharing patient records. This project aims to provide automated system keeper using autonomous agents collaboratively with the role of blockchain for further enhancement.

Kangrui Huang, Weili Chen, Zibin Zheng

Blockchain technology has created a new cryptocurrency world and attracted a lot of attention. It also attracts scams, for example, phishing scam, a typical fraud, has been found making a notable amount of money in the blockchain ecosystem, which has a very negative impact. Considering the whole life cycle of a phishing scam, this paper proposes the concept of a phishing gang, that is, a set of accounts that serve for phishing activity and belong to the same entity on the blockchain. As phishers often use multiple accounts to commit phishing scams and money laundering, detecting phishing gangs in the blockchain ecosystem is a real and critical problem. To help deal with this issue, this paper proposes a method of detecting phishing gangs on the Ethereum blockchain. Specifically, we first construct a transaction network with a graph structure by mining the transaction record and the account labels of the Ethereum blockchain. Next, we propose the base and improvement methods of taint analysis, aiming to evaluate the taint score of each account by tracking the fund flow of phishing accounts. Then, with the results of taint analysis and some heuristic means, all accounts in the transaction network are divided into five categories. Based on this, we propose a heuristics algorithm for phishing gang detection. And we also summarize gang patterns and reveal money laundering in phishing activities. Experimental results indicate that the proposed framework can be used to build a uniform platform to monitor every account on the Ethereum blockchain for early warning of phishing scams and detection of the phishers' money laundering and cashing process.

Zainab Ali Kamal, Rana Fareed Ghani

The primary concerns with manual transactions include corruption, lack of transparency, fraud, and mismanagement of distribution operations, all of which are created by traditional centralized applications, necessitating the migration to blockchain technology. In this work, a system is presented to secure and monitor correspondence between several nodes and store it in a decentralized database in order to secure distributed ledger transactions and safeguard against fraud and tampering when transactions are shared by multiple parties. The hashing that blockchain technology delivers in each transaction ensures a high level of security. The hashing associated with each transaction confirms all sending and receiving transactions. When a transaction is sent from one node to another, the other node checks the hash accompanying the transaction to see if it came from a registered node or an external node. Within the blockchain system, the nodes will check transaction correspondences. The system has demonstrated its effectiveness by delivering a more secure messaging system with high credibility and tamper resistance. In addition, the time it takes to authenticate will be in real time. Index Terms— Blockchain, Consensus procedure, Hashing, Blockchain in Governance.

Ebru Aydoğan, Muhammed Fatih Aydemir

The e-commerce sector has grown beyond predictions with the help of the most recent technological developments, changes in consumer preferences, and the COVID-19 pandemic. E-commerce activities assume a subsidiary role of brick-and-mortar shops with the benefits it offers to all parties, which have also resulted in new problems such as privacy, security, transparency, and costs, unlike traditional businesses. Blockchain technology is among the promising technologies in solving the problems of the e-commerce sector with its decentralized structure that does not require third-party intermediaries, and its features (such as privacy, immutability, security, transparency, and auditability). In this study—which examines, under five titles, the benefits that blockchain can offer to e-commerce—it is concluded that blockchain can reshape e-commerce activities by enabling integrated e-commerce systems that include all parties and offering low transaction costs, high transaction speed, traceability of transactions, strong security standards, and low risks. In this direction, blockchain-based e-commerce platforms can push existing e-commerce platforms into the background.

Wuqi Zhang, Lili Wei, Shing-Chi Cheung, Yepang Liu · 7 authors

Front-running attacks have been a major concern on the blockchain. Attackers launch front-running attacks by inserting additional transactions before upcoming victim transactions to manipulate victim transaction executions and make profits. Recent studies have shown that front-running attacks are prevalent on the Ethereum blockchain and have caused millions of US dollars loss. It is the vulnerabilities in smart contracts, which are blockchain programs invoked by transactions, that enable the front-running attack opportunities. Although techniques to detect front-running vulnerabilities have been proposed, their performance on real-world vulnerable contracts is unclear. There is no large-scale benchmark based on real attacks to evaluate their capabilities. We make four contributions in this paper. First, we design an effective algorithm to mine real-world attacks in the blockchain history. The evaluation shows that our mining algorithm is more effective and comprehensive, achieving higher recall in finding real attacks than the previous study. Second, we propose an automated and scalable vulnerability localization approach to localize code snippets in smart contracts that enable front-running attacks. The evaluation also shows that our localization approaches are effective in achieving higher precision in pinpointing vulnerabilities compared to the baseline technique. Third, we build a benchmark consisting of 513 real-world attacks with vulnerable code labeled in 235 distinct smart contracts, which is useful to help understand the nature of front-running attacks, vulnerabilities in smart contracts, and evaluate vulnerability detection techniques. Last but not least, we conduct an empirical evaluation of seven state-of-the-art vulnerability detection techniques on our benchmark. The evaluation experiment reveals the inadequacy of existing techniques in detecting front-running vulnerabilities, with a low recall of$\leq$6.04%. Our further analysis identifies four common limitations in existing techniques: lack of support for inter-contract analysis, inefficient constraint solving for cryptographic operations, improper vulnerability patterns, and lack of token support.

Tahlil Tahlil, Sarmistha Sarna Gomasta, A. B. M. Shawkat Ali

In addition to tanking the economy and society, credential fraud frequently damages the credibility of higher education. As the majority of conventional verification and issuance procedures are arduous, expensive, and obsolete, fraud has proliferated in numerous forms, ranging from paper-based counterfeit certificates to replicas enabled by database manipulation, and has reached exponential quantities. In this paper, the authors propose AlgoCert, a comprehensive credential verification solution that incorporates blockchain, self-sovereign identity (SSI), and decentralized identifier (DID) to introduce a more proficient, attack-resistant system that is user-friendly as well as effective at reducing widespread credential fraud. In addition, AlgoCert leverages stateful smart contracts on the Algorand blockchain and non-transferable non-fungible tokens (NFT), and neither students nor organizations are required to handle credentials in order to use the system. This paper provides a prototype of our solution and detail our attempts to develop a verification service with features, including data security, transcript authentication, and selective data disclosure.

Zhiju Yang, Gaoyuan Man, Songqing Yue

Hacks on blockchains are prevalent nowadays because a wide range of vulnerabilities exists in smart contracts. To deal with the vulnerabilities, security auditing has been emerging and widely adopted for manual code inspection. However, little is known about how manual security auditing impacts the blockchain community. In this work, we investigated security audits on blockchain by answering three research questions covering the type, severity, and resolve status of issues in the audit reports. We in total collected 2,421 security audit reports consisting of the details of 28,782 security issues. We found that manual security auditing has superior merit over static analysis tools in identifying logic-related issues, considering 27.65% of all findings are logical issues. We also found that 87.28% of 2,421 projects have at least one centralization issue that breaks the decentralization primitive of blockchain. Moreover, while 21.17% of issues are of major or critical severity, we surprisingly found that 61.83% of all issues were unresolved or partially resolved. We concluded that while manual security auditing can help identify security vulnerabilities uniquely, project developers need to take serious actions to address and secure their smart contracts.

Krishnaraj Rao N S, K R Raghunadan, Radhakrishna Dodmane, K Bhavya · 6 authors

A blockchain is a decentralized, distributed, and open ledger that is used to record transactions across several computer clusters. Without a change in subsequent blocks, the record cannot be changed. Blockchain is a well-known phrase in the IT industry. There are several issues with Blockchain technology that need to be taken into account, despite the fact that it has many applications in the fields of information technology, banking, and other industries. In this paper, we discussed the major challenges and issues associated with Blockchain technology

Lixuan Luo, Mariano P. Consens

GasTokens are created by smart contracts executing in the Ethereum blockchain to support a form of transaction fee pre-payment. Even though GasTokens had a period of significant activity on Ethereum (regularly surpassing half of the overall weekly smart contract creation and destruction activities), few systematic studies have been conducted on GasToken usage and its effect on the blockchain network. This paper focuses on understanding the adoption of GasTokens on Ethereum since May of 2020. We first analyze the usage patterns, including the creation, destruction, and holding of GasTokens, then report several price findings related to GasTokens, and compare the fees paid by users submitting transactions that create and destroy GasTokens to the fees paid by all the transactions in the network over different time periods. We characterize the benefits obtained by GasToken transaction senders and report the impact of GasToken creations and destructions on the major mining pools.

Fares Ghazzawi, Yury Yanovich

The data from decentralized finance services is openly available once they operate in public blockchains. Although data encryption techniques for transaction exist, they are challenging, increase costs and decrease trust. Therefore, everyone can use the DeFi data. Natively, the data is stored as a transaction log, where we have a byte code of contracts and history of their method calls with parameters. So the problem is to represent it conveniently for analysis. In the paper, we consider a decentralized exchange called UniSwap, overview its operation principles, create a database with the related data and share scripts with the elementary examples. The results help overcome the entering threshold for further data analysis.

Yihang Fu, Zesen Zhuang, Luyao Zhang

Blockchain has empowered computer systems to be more secure using a distributed network. However, the current blockchain design suffers from fairness issues in transaction ordering. Miners are able to reorder transactions to generate profits, the so-called miner extractable value (MEV). Existing research recognizes MEV as a severe security issue and proposes potential solutions, including prominent Flashbots. However, previous studies have mostly analyzed blockchain data, which might not capture the impacts of MEV in a much broader AI society. Thus, in this research, we applied natural language processing (NLP) methods to comprehensively analyze topics in tweets on MEV. We collected more than 20000 tweets with #MEV and #Flashbots hashtags and analyzed their topics. Our results show that the tweets discussed profound topics of ethical concern, including security, equity, emotional sentiments, and the desire for solutions to MEV. We also identify the co-movements of MEV activities on blockchain and social media platforms. Our study contributes to the literature at the interface of blockchain security, MEV solutions, and AI ethics.

Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla

Different malicious activities occur in cryptocurrency-based permissionless blockchains such as Ethereum and Bitcoin. Some activities are due to the exploitation of vulnerabilities which are present in the blockchain infrastructure, some activities target its users through social engineering techniques, while some activities use it to facilitate different malicious activities. Since cryptocurrency-based permissionless blockchains provide pseudonymity to its users, bad actors prefer to carry out transactions related to malicious activities on them. Towards this, we aim at automatically flagging blockchain accounts as suspects that indulge in malicious activities, thus reducing the unintended support that cryptocurrency-based permissionless blockchains provide to malicious actors. We first use the cosine similarity (CS) metrics to study the similarities between the feature vector of accounts associated with different malicious activities and find that most of the malicious activities associated with the Ethereum blockchain behave similarly. We then use the K-Means clustering algorithm to check if accounts associated with similar malicious activities cluster together. We also study the effect of bias on the performance of a machine learning (ML) algorithm, due to the number of accounts associated with malicious activity. We then compare the different state-of-the-art models and identify that Neural Networks (NNs) are resistant to bias associated with a malicious activity and are also robust against adversarial attacks. The previously used ML algorithms for identifying malicious accounts also show bias towards an over-represented malicious activity.

Gayatri Ramakrishnan, Mirza Rehan, G. Sujatha

The Ethereum smart contract language Solidity has caused a breakthrough in the field of blockchain technology with the introduction of logic in contract-form via these smart contracts. Since these contracts are immutable, there is a serious requirement to audit and test these contracts multiple times before they are deployed. There are several cases of financial and reputation damage due to unaudited smart contracts as seen in the cases of the Axie Infinity hack or Wormhole bridge hack which resulted in hundreds of millions of dollar losses. For a developer just getting into web3 development, these hacks might intimidate and drive them away from learning due to the fear of incurring such losses themselves or due to not understanding the reason for hacks. This tool allows a developer to simply paste their contract into a textbox and obtain a list of the contract-based vulnerabilities found via parsing and pattern searching. Mitigation techniques are also suggested line by line to aid the developer in securing the contract. The key difference between this tool and existing technologies is that it is compact and very precise in identifying known contract-based vulnerabilities. Providing developers with a quick and simple interface was the rationale behind the motivation. Tools like parsers and regular expression libraries were used to look for keyword detection methodology. The tool is to be used supplementarily and not as the sole identifier of vulnerabilities since there are multiple layers to web3 security and this tool only identifies smart contract-based vulnerabilities, not off-chain ones. Future additions to this tool may include example vulnerable code snippets and also explanations for the reason they are not safe for deployment as well as mitigations which can be used by any user who is interested in learning web3 security and how hacks happen.

Yinfeng Chen, Yu Guo, Jun Chen, Rongfang Bie

IOTA is an emerging blockchain platform specially designed for the Internet of Things (IoT). It adopts a distributed ledger based on a directed acyclic graph (DAG) structure called the Tangle, achieving high concurrency, incremental scalability, and zero transaction fees. While the DAG-based ledger structure can promise many benefits for IOTA, it also exposes a wide attacking surface for the double-spending attack. By creating fake branches to replace the legitimate ones in the Tangle, the attackers can achieve the purpose of double-spending. Therefore, there is a great need for securing IOTA with preventive strategies. In this work, we present the design of an effective preventive strategy for IOTA that can reduce the Tangle vulnerability against the double-spending attack. Our main idea is to in-vestigate the Tangle vulnerability problem by using the large deviation theory. We provide the Tangle vulnerability probability and the decay speed of the probability. By evaluating the decay speed, we find the key factor related to the robustness level against double-spending attacks. Besides, we define and deduce the security threshold based on the evaluation results that can affect the probability decay speed of the Tangle vulnerability. With the security threshold, IOTA can efficiently inspect illegal Tangle branches to resist double-spending attacks. Finally, the comprehensive theoretical analysis and simulation experiments demonstrate that the proposed strategy is efficient and practical.

Ruijie Luo, Luo Feng, Bingsen Wang, Ting Chen

The smart contracts of Ethereum have brought an essential contribution to the development of blockchain. Nowadays, an increasing number of smart contracts are being deployed on Ethereum, which brings prosperity to Ethereum while also bringing many security risks. According to reports, several attacks due to the smart contract vulnerability have caused huge losses to Ethereum. Therefore, detecting smart contract security vulnerabilities is of great importance. However, the existing work is not sufficient to fully perform this task. For this reason, we propose a variant of the LSTM model to detect smart contract vulnerabilities at the bytecode level. In our variant LSTM model, we interact hidden state of the model with the input sequence multiple times. In this way, the variant model is able to capture more potential features in the bytecode for learning. We used a dataset of 34822 unique smart contracts for training and testing. The results show that the variant LSTM model outperforms the general LSTM model and improves in most metrics.

Mohil Sarvankar, Viraj Wasnik, Aditya Tarade, Payal D. Shah · 6 authors

This paper proposes and emphasizes the requirement of an Blockchain based smart contract for NGO's and startup crowdfunding in the present circumstances. It also highlights the need of an online financial system for indigenous NGO's and seed fund utilization of startups. Conventionally, most charity organizations make use of hard cash for settling its transactions making the process less transparent. However, due to the COVID-19 pandemic, financial system has been largely affected. In this case an online financial transaction cum procurement portal would be crucial for the candidates applying relief in remote locations. The system analyses their eligibility based on their Curriculum Vitae (CV). Proposed system uses Ethereum based smart contract and Truffle Box to build a complete Dapp (decentralized application). Authors have used MetaMask Extension as a cryptocurrency wallet and Ganache blockchain to develop, deploy and test the decentralized application.

Sudeep Krishnan

eCommerce merchants anticipate adoption of cryptocurrencies in a vast scale in the coming years. While the concepts of Web3 are being adopted, business leaders and decision makers need to understand key the elements of Web3 and technological constructs behind the evolution of Web3. This study focuses on defining these constructs of Web3 and explain technological differences as compared to Web 2.0. Using extensive academic, industry, and online information, the study defines major characteristics of Web3, show cases early adopters, use cases, and opportunities in the area. Web3 is still evolving and there are many challenges which needs to be addressed. eCommerce businesses who are going to sustainably change the business models or disrupt with a new Web3 business is likely to succeed in the coming years. The findings of this study are also validated with an expert interview.

Pranav Singh, Sushruta Mishra

No abstract is available for this record.

Neenu Ann Shaji

Cryptocurrency is growing at the top pace, with a total market capitalization exceeding $2.2 trillion and around 100 million crypto users worldwide. After an investment is made, where and how to keep the tokens is determined by the user. The public and private keys of the wallet are used to identify the tokens as well as initiate the transactions. A hot wallet is just a tool that enables users to receive, store and send tokens, and the security of the same mainly depends on the user behavior. Moreover, the hot wallet is more vulnerable to thefts and hacks than the cold wallet as it is connected to the internet. Cryptocurrency uses the Blockchain as the underlying technology. Security issues can be alarming with the drastic rise in the number of apps that help even the novice to start investing in crypto. In this work, we aim to study the security issues faced by the exchange platforms and how well geofencing can mitigate the security risks of the wallet. Here, the coin mixing technique is implemented with user parameters to enforce anonymity and security in the Blockchain and obfuscates the attackers with the randomness in the block.