Connected Vehicles (CVs), an integral part of the future of intelligent transportation systems, use communication and sensing technologies to communicate among vehicles and infrastructure. However, as vehicles become interconnected, the vulnerability of their components to anomalies and deliberate malicious activity increases. In both cases, it is vital to detect and exclude anomalous data from the decision-making process. While deep learning techniques are gaining popularity for anomaly detection due to their adaptability, they are computationally expensive and require long training times. To overcome this challenge, this paper uses a directed acyclic graph (DAG) based distributed ledger technique and combines it with social psychology principles of ability, integrity, and benevolence to calculate the reputation of vehicles. We introduce the probability of malevolence, a measure of quality, which is a function of the error measurements (between ground truth and reported values) and reputation metrics. We introduce various anomalies such as bias, noise, short, multi-short, drift, multi-drift, stuck-at, and parasite chain attack in the simulated data from the Intelligent Driver Module framework on road topology such as uphill, ring, on-ramp, off-ramp, and road-works to validate the efficacy of the proposed framework in identifying the anomalies. Simulation results show that the malevolence factor serves as an efficient metric for automatically determining the types of anomalies in the CV network.
Ethereum intelligent contract security must be guaranteed since these decentralized apps oversee large-scale financial transactions independently. To strengthen the dependability and credibility of Ethereum smart contracts, this paper assesses existing methods for finding weaknesses in them. The primary goals are to evaluate how well hybrid approaches, formal verification, dynamic analysis, and static analysis find vulnerabilities. Methodologically, a thorough assessment of available resources and instruments was carried out to evaluate the advantages and disadvantages of each approach. Important discoveries show that although static analysis covers a large area, it ignores runtime-specific problems and produces false positives. While highly effective in finding runtime vulnerabilities, dynamic analysis is resource-intensive. High assurance is provided by formal verification, although it is complex and resource-intensive. Hybrid approaches combine several approaches to provide a well-rounded strategy but must be used carefully. The policy implications emphasize that to limit risks effectively, it is crucial to embrace multifaceted security techniques, set explicit norms, and promote easily accessible verification tools. This research advances our knowledge of smart contract security and guides policymakers and developers on securing blockchain applications.
Cryptocurrency represented by Bitcoin is a very popular topic in recent years. However, the prosperity of cryptocurrency drives an increasing number of applications published. Some malicious or vulnerable programs are also detected and reported these years. To do a deeper study into security of cryptocurrency application, this paper learns common vulnerabilities, threat models inside normal applications, and taint analysis, a useful vulnerability-detecting tool, concludes a common and useful methodology for threat detection in application programs, especially Android apps. This approach uses static taint analysis to detect vulnerabilities inside a given Android application, classify them into common vulnerability categories and then make conclusions. This paper does research in analyzing statistics of threats in common cryptocurrency apps in Google play store and draw conclusions on the status of cryptocurrency software as well. Finally, some suggestions are provided at the end of this paper. These recommendations apply to application programmers, app store administrators, scholars and experts in related area, government officer and users. This set of analysis process can be applied to analyze any type of application programs.
A smart contract is often used to handle financial transactions. Unlike traditional programs, contract codes cannot be changed after deployment. It is crucial to test smart contracts thoroughly before deployment. In this paper, we present a fuzzing approach to testing smart contracts. Our fuzzing approach utilizes constraint solving, selective state exploration, and combinatorial testing to improve code coverage. Constraint solving generates test inputs that meet preconditions in a smart contract. Selective state exploration allows different state-dependent behaviors to be exercised while alleviating the state explosion problem. Combinatorial testing is used to exercise parameter interactions in a systematic manner. We implemented our approach in a tool called MagicMirror and evaluated our approach using more than 2,000 contracts. The experimental results show that MagicMirror effectively achieves high code coverage and detects vulnerabilities.
The use of blockchains for automated and adversarial trading has become commonplace. However, due to the transparent nature of blockchains, an adversary is able to observe any pending, not-yet-mined transactions, along with their execution logic. This transparency further enables a new type of adversary, which copies and front-runs profitable pending transactions in real-time, yielding significant financial gains. Shedding light on such "copy-paste" malpractice, this paper introduces the Blockchain Imitation Game and proposes a generalized imitation attack methodology called Ape. Leveraging dynamic program analysis techniques, Ape supports the automatic synthesis of adversarial smart contracts. Over a timeframe of one year (1st of August, 2021 to 31st of July, 2022), Ape could have yielded 148.96M USD in profit on Ethereum, and 42.70M USD on BNB Smart Chain (BSC). Not only as a malicious attack, we further show the potential of transaction and contract imitation as a defensive strategy. Within one year, we find that Ape could have successfully imitated 13 and 22 known Decentralized Finance (DeFi) attacks on Ethereum and BSC, respectively. Our findings suggest that blockchain validators can imitate attacks in real-time to prevent intrusions in DeFi.
A smart contract is a concept of computer protocols that helps to facilitate blockchain technology. This blockchain-based smart contract is a public ledger of all participating transactions. It is considered a self-executable application and contains predetermined rules. It also operates by decentralizing networks that are shared between all parties, and this execution of contracts between parties could be securely done without a middleman or a third party. With blockchain technology, developers could provide an efficient framework and ensure security issues. While the new blockchain has successfully been developed to prevent the problems of fraud and hacking, there is still a considerable risk concerning security and confidentiality. Therefore, we should not underestimate this matter. This study aims to review the potential risks that may take place on blockchain-based smart contracts. In addition, the options that may assist application developers in order to provide viable guidance, and to avoiding these security vulnerabilities.
As the healthcare industry increasingly relies on digital technology and the Internet of Things (IoT) to improve patient care and streamline operations, the vulnerability to ransomware attacks has become a significant concern. In response to this pressing issue, we present SFMR-SH (Secure Framework for Mitigating Ransomware Attacks in Smart Healthcare), a groundbreaking approach that integrates IoT devices with blockchain technology to fortify healthcare data security. SFMR-SH leverages blockchain's inherent properties, including immutability and transparency, to create an impervious fortress for sensitive patient data. Through comprehensive simulations employing machine learning algorithms (KNN, SVM, Random Forest, Gradient Boosting, and XGB), we assess the framework's ability to detect and mitigate ransomware attacks. Results underscore the framework's effectiveness, achieving an impressive detection accuracy of 99.33%. This research represents a significant stride in fortifying smart healthcare systems, providing a secure environment amid the escalating threat landscape, and ensuring the uninterrupted delivery of vital healthcare services. Our findings highlight the exceptional promise of SFMR-SH in revolutionizing healthcare data security, safeguarding patient privacy, and fortifying the future of smart healthcare systems in an increasingly digitalized healthcare landscape.
This research develops a methodology to identify transactions through data-driven tracking and analysis of ransomware-Bitcoin payment networks [30]. We demonstrate the methodology by applying the GraphSAGE embedding algorithm to the WannaCry ransomware-Bitcoin cash-out network. The paper takes a data-driven approach to building a machine learning system that allows analysts to define features relevant to ransomware-Bitcoin payment networks.
Fernando Richter Vidal, Naghmeh Ivaki, Nuno Laranjeiro
Abstract Smart contracts are nowadays at the core of most blockchain systems. Like all computer programs, smart contracts are subject to the presence of residual faults, including severe security vulnerabilities. However, the key distinction lies in how these vulnerabilities are addressed. In smart contracts, when a vulnerability is identified, the affected contract must be terminated within the blockchain, as due to the immutable nature of blockchains, it is impossible to patch a contract once deployed. In this context, research efforts have been focused on proactively preventing the deployment of smart contracts containing vulnerabilities, mainly through the development of vulnerability detection tools. Along with these efforts, several heterogeneous vulnerability classification schemes appeared (e.g., most notably DASP and SWC). At the time of writing, these are mostly outdated initiatives, even though new smart contract vulnerabilities are consistently uncovered. In this paper, we propose OpenSCV, a new and Open hierarchical taxonomy for Smart Contract vulnerabilities, which is open to community contributions and matches the current state of the practice while being prepared to handle future modifications and evolution. The taxonomy was built based on the analysis of the existing research on vulnerability classification, community-maintained classification schemes, and research on smart contract vulnerability detection. We show how OpenSCV covers the announced detection ability of the current vulnerability detection tools and highlight its usefulness in smart contract vulnerability research. To validate OpenSCV, we performed an expert-based analysis wherein we invited multiple experts engaged in smart contract security research to participate in a questionnaire. The feedback from these experts indicated that the categories in OpenSCV are representative, clear, easily understandable, comprehensive, and highly useful. Regarding the vulnerabilities, the experts confirmed that they are easily understandable.
A smart contract is a self-executing program on a blockchain to ensure an immutable and transparent agreement without the involvement of intermediaries. Despite its growing popularity for many blockchain platforms like Ethereum, no technical means is available even when a smart contract requires to be protected from being copied. One promising direction to claim a software ownership is software watermarking. However, applying existing software watermarking techniques is challenging because of the unique properties of a smart contract, such as a code size constraint, non-free execution cost, and no support for dynamic allocation under a virtual machine environment. This paper introduces a novel software watermarking scheme, dubbed Smartmark, aiming to protect the ownership of a smart contract against a pirate activity. Smartmark builds the control flow graph of a target contract runtime bytecode, and locates a collection of bytes that are randomly elected for representing a watermark. We implement a full-fledged prototype for Ethereum, applying Smartmark to 27,824 unique smart contract bytecodes. Our empirical results demonstrate that Smartmark can effectively embed a watermark into a smart contract and verify its presence, meeting the requirements of credibility and imperceptibility while incurring an acceptable performance degradation. Besides, our security analysis shows that Smartmark is resilient against viable watermarking corruption attacks; e.g., a large number of dummy opcodes are needed to disable a watermark effectively, resulting in producing an illegitimate smart contract clone that is not economical.
Shaima AL Amri, Leonardo Aniello, Vladimiro Sassone
The Ethereum blockchain is one of the main public platforms to run smart contracts and enable decentralised applications. Since data stored in a blockchain is considered immutable, smart contracts deployed in Ethereum are regarded as tamper-proof and therefore offer strong protection against attacks aiming at tinkering with the execution flow of an application. Yet, like any other software, a smart contract needs to be maintained over time to fix bugs or add new features. Deploying every updated version as a brand-new smart contract in Ethereum leads to problems such as migrating the contract state from the old version and enabling clients to point to the new version in a timely fashion. The OpenZeppelin framework addresses this limitation by providing libraries that enable the deployment of upgradeable smart contracts. This is achieved by relying on proxies that act as intermediaries between clients and smart contracts, allowing the latter to be updated transparently. In this paper, we present the upgradeable smart contract patterns supported by OpenZeppelin and compare them in terms of security, cost, and performance. To show this paradigm’s prevalence in Ethereum, we also analyse the usage of OpenZeppelin Upgradeable smart contracts over the last four years.
Recent years have witnessed the availability of richer and richer datasets in a variety of domains, where signals often have a multi-modal nature, blending temporal, relational and semantic information. Within this context, several works have shown that standard network models are sometimes not sufficient to properly capture the complexity of real-world interacting systems. For this reason, different attempts have been made to enrich the network language, leading to the emerging field of higher-order networks. In this work, we investigate the possibility of applying methods from higher-order networks to extract information from the online trade of Non-fungible tokens (NFTs), leveraging on their intrinsic temporal and non-Markovian nature. While NFTs as a technology open up the realms for many exciting applications, its future is marred by challenges of proof of ownership, scams, wash trading and possible money laundering. We demonstrate that by investigating time-respecting non-Markovian paths exhibited by NFT trades, we provide a practical path-based approach to fraud detection.
Monika di Angelo, Thomas Durieux, João F. Ferreira, Gernot Salzer
Abstract Blockchain programs (also known as smart contracts) manage valuable assets like cryptocurrencies and tokens, and implement protocols in domains like decentralized finance (DeFi) and supply-chain management. These types of applications require a high level of security that is hard to achieve due to the transparency of public blockchains. Numerous tools support developers and auditors in the task of detecting weaknesses. As a young technology, blockchains and utilities evolve fast, making it challenging for tools and developers to keep up with the pace. In this work, we study the robustness of code analysis tools and the evolution of weakness detection on a dataset representing six years of blockchain activity. We focus on Ethereum as the crypto ecosystem with the largest number of developers and deployed programs. We investigate the behavior of single tools as well as the agreement of several tools addressing similar weaknesses. Our study is the first that is based on the entire body of deployed bytecode on Ethereum’s main chain. We achieve this coverage by considering bytecodes as equivalent if they share the same skeleton. The skeleton of a bytecode is obtained by omitting functionally irrelevant parts. This reduces the 48 million contracts deployed on Ethereum up to January 2022 to 248 328 contracts with distinct skeletons. For bulk execution, we utilize the open-source framework SmartBugs that facilitates the analysis of Solidity smart contracts, and enhance it to accept also bytecode as the only input. Moreover, we integrate six further tools for bytecode analysis. The execution of the 12 tools included in our study on the dataset took 30 CPU years. While the tools report a total of 1 307 486 potential weaknesses, we observe a decrease in reported weaknesses over time, as well as a degradation of tools to varying degrees.
Haoyu Wang, Zan Wang, Shuang Liu, Jun Sun · 7 authors
Abstract Smart contracts are distributed self‐enforcing programs which execute on top of blockchain networks. They have the potential to revolutionize many industries and have already been adopted for applications such as distributed finance and crowdfunding. Because smart contracts are immutable once they are deployed, it is important to identify and eliminate code vulnerabilities in smart contracts systematically. In this work, we propose sFuzz2.0 , a storage‐access‐pattern guided adaptive fuzzer based on sFuzz. sFuzz2.0 is motivated by the fact that certain vulnerabilities only manifest in the presence of certain function call sequences (as well as particular arguments). Given that there are exponentially many function call sequences, sFuzz randomly generates sequences without guidance. As a result, the probability of discovering those vulnerabilities is negligible. sFuzz2.0 tackles the problem with two approaches, that is, by generating function call sequences that trigger different storage‐access patterns passively (i.e., by prioritizing seeds which cover new patterns) or actively (i.e., by actively seeking out different patterns). The experiment results suggest that the passive strategy outperforms sFuzz by achieving better code coverage (i.e., 37.53%) and discovering more vulnerabilities (i.e., 20.49%).
Paweł Weichbroth, Kacper Wereszko, Helena Anacka, Jolanta Kowal
[Context] The goal of security is to protect digital assets, devices, and services from being disrupted, exploited or stolen by unauthorized users. It is also about having reliable information available at the right time. [Motivation] Since the inception in 2009 of the first cryptocurrency, few studies have been undertaken to analyze and review the state-of-the-art research and current developments with respect to the security of cryptocurrencies. [Purpose] We aim to provide both theoretical and empirical insights into the security landscape, in particular focusing on both technical solutions and human-related facets. [Methodology] We used an integrative review which could help in building science and scholarly research, the basis for conceptual and empirical models. [Results] Successful defense against cyberattacks depends on technical measures on the one hand, as well as on self-education and training with the aim to develop competence, knowledge, skills and social abilities, on the other. [Contribution] Our findings provide a comprehensive review for the major achievements and developments of the recent progress on the security of cryptocurrencies. [Future research] Since there is increasing interest in adoption of the current solutions within the central bank digital currencies, the future research should explore the development and inception of effective measures against social engineering attacks, which still remain the main concern.
Luca Olivieri, Thomas Wiben Jensen, Luca Negrini, Fausto Spoto
Smart contracts are immutable code deployed in a blockchain, whose execution modifies its global state. Code im-mutability leads to immutable bugs. To prevent such bugs, static program analysis infers information about the behavior of the code, statically, before code execution and deployment. This paper introduces MichelsonLiSA, a static analyzer based on abstract interpretation for the verification of smart contracts written in the Michelson low-level language of the Tezos blockchain. It applies MichelsonLiSA to the identification of security issues arising from cross-contract invocations.
In this paper, we investigate the use of deep learning techniques to identify and classify smart contract code vulnerabilities. We collected a large-scale dataset of smart contracts that we used to train different Convolutional Neural Networks (CNNs) models. In particular, we used two variants of 2-dimensional CNNs working on RGB images corresponding to contract byte-code, a 1-dimensional CNN working on the bytecode directly, and a Long Short-Term Memory (LSTM) neural network. Given a set of vulnerability detectors, we employed five classes of vulnerabilities. Our results show that CNNs provide a good level of accuracy and demonstrate the viability of using deep learning techniques to identify smart contract vulnerabilities.
Ömer Aslan, Semih Serkant Aktuğ, Merve Ozkan-Okay, Abdullah Asım Yılmaz · 5 authors
Internet usage has grown exponentially, with individuals and companies performing multiple daily transactions in cyberspace rather than in the real world. The coronavirus (COVID-19) pandemic has accelerated this process. As a result of the widespread usage of the digital environment, traditional crimes have also shifted to the digital space. Emerging technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and cryptocurrencies are raising security concerns in cyberspace. Recently, cyber criminals have started to use cyber attacks as a service to automate attacks and leverage their impact. Attackers exploit vulnerabilities that exist in hardware, software, and communication layers. Various types of cyber attacks include distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware. Due to new-generation attacks and evasion techniques, traditional protection systems such as firewalls, intrusion detection systems, antivirus software, access control lists, etc., are no longer effective in detecting these sophisticated attacks. Therefore, there is an urgent need to find innovative and more feasible solutions to prevent cyber attacks. The paper first extensively explains the main reasons for cyber attacks. Then, it reviews the most recent attacks, attack patterns, and detection techniques. Thirdly, the article discusses contemporary technical and nontechnical solutions for recognizing attacks in advance. Using trending technologies such as machine learning, deep learning, cloud platforms, big data, and blockchain can be a promising solution for current and future cyber attacks. These technological solutions may assist in detecting malware, intrusion detection, spam identification, DNS attack classification, fraud detection, recognizing hidden channels, and distinguishing advanced persistent threats. However, some promising solutions, especially machine learning and deep learning, are not resistant to evasion techniques, which must be considered when proposing solutions against intelligent cyber attacks.
Hyperledger Fabric is a distributed ledger solution platform based on a modular architecture. The cryptographic algorithm is the core of the platform to ensure the security and tamper-resistant of the data on the chain. However, the original Fabric platform lacks the protection of user’s keys and cryptographic operations. To this end, this paper proposes a data privacy protection method for Hyperledger Fabric based on Trustzone technology, which places the user‘s key and the cryptographic operation process of private data in the trusted execution environment for protection. The experimental results based on the existing blockchain network show that the scheme can effectively ensure the security of data encryption process and key static storage, greatly reduce the trusted computing base and the attack surface. The performance loss is within an acceptable range.
Casimer DeCusatis, Brian Gormanly, John Iacino, Reed Percelay · 6 authors
Blockchain, smart contracts, and related concepts have emerged in recent years as a promising technology for cryptocurrency, NFTs, and other areas. However, there are still many security issues that must be addressed as these technologies evolve. This paper reviews some of the leading social engineering attacks on smart contracts, as well as several vulnerabilities which result from insecure code development. A smart contract test bed is constructed using Solidity and a Metamask wallet to evaluate vulnerabilities such as insecure arithmetic, denial of service, and re-entrancy attacks. Cross-chain vulnerabilities and potential vulnerabilities resulting from layer 2 side-chain processing were also investigated. Mitigation best practices are proposed based on the experimental results.
As zero-knowledge proofs gain increasing adoption, the cryptography community has designed domain-specific languages (DSLs) that facilitate the construction of zero-knowledge proofs (ZKPs). Many of these DSLs, such as Circom, facilitate the construction of arithmetic circuits, which are essentially polynomial equations over a finite field. In particular, given a program in a zero-knowledge proof DSL, the compiler automatically produces the corresponding arithmetic circuit. However, a common and serious problem is that the generated circuit may be underconstrained, either due to a bug in the program or a bug in the compiler itself. Underconstrained circuits admit multiple witnesses for a given input, so a malicious party can generate bogus witnesses, thereby causing the verifier to accept a proof that it should not. Because of the increasing prevalence of such arithmetic circuits in blockchain applications, several million dollars worth of cryptocurrency have been stolen due to underconstrained arithmetic circuits. Motivated by this problem, we propose a new technique for finding ZKP bugs caused by underconstrained polynomial equations over finite fields. Our method performs semantic reasoning over the finite field equations generated by the compiler to prove whether or not each signal is uniquely determined by the input. Our proposed approach combines SMT solving with lightweight uniqueness inference to effectively reason about underconstrained circuits. We have implemented our proposed approach in a tool called QED 2 and evaluate it on 163 Circom circuits. Our evaluation shows that QED 2 can successfully solve 70% of these benchmarks, meaning that it either verifies the uniqueness of the output signals or finds a pair of witnesses that demonstrate non-uniqueness of the circuit. Furthermore, QED 2 has found 8 previously unknown vulnerabilities in widely-used circuits.
In recent years, Internet of Things (IoT) technology has gained a lot of attention. With the development of IoT technology, it comes the need for devices with different trust domains to interact and collaborate. In order to protect the security and reliability of the communication between devices in different trust domains, it raises the concerns about the technology of cross-domain authentication. Traditional cross-domain authentication methods may lead to heavy key management overhead or depend on trusted third parties, while existing blockchain-based cross-domain authentication schemes do not prevent the possibility of mischief by malicious domain managers. In this article, we design an efficient Blockchain and trusted execution environment (TEE)-assisted secure device authentication scheme for cross-domain IoT system, called blockchain and TEE-assisted authentication. Our solution solves the problem that managers are not fully trusted, which in turns protect the security and reliability in the blockchain-based cross-domain communication. Specifically, blockchain is introduced to build trust between different domains, the identity-based signatures are used to verify the identity information of devices and the TEE is introduced to prevent the possibility of mischief by domain managers. Finally, our experiments show that the introduction of TEE has greatly improved system security with a low-efficiency reduction, which proves that our scheme can achieve highly secure distributed IoT authentication.