The detection of smart contracts vulnerability is a valuable research problem because smart contracts hold a huge amount of cryptocurrency. In the past, popular detection tools were mainly based on some traditional techniques such as fuzzing and symbolic execution, which rely on fixed expert features or patterns and often miss many vulnerabilities. Recent machine learning approaches alleviate this issue but do not notice the semantic information in the source code. In this paper, we develop a system called SVChecker to classify the smart contract source code written in Solidity. To show the superiority of our system, we conduct experiments on more than 40,000 smart contracts collected from Ethereum. Empirically, our experimental results demonstrate that our system outperforms all popular detection tools.
Ethereum is a blockchain platform that enables the use of smart contracts. Smart contracts will execute a set of instructions without an intermediary party when called upon. The possibility to make calls to another contract or exchange cryptocurrency allows for potential exploits to occur, most notable reentrancy. The Solidity language for coding smart contracts has syntactic constructs created to be safer alternatives, and guards to aid in securing code against exploits. In this paper, we collect a total of 26,799 verified Solidity smart contracts from Etherscan, to analyze the language constructs used in calling another contract or exchanging ether. We also analyze the usage of guards to make the code more secure. For instance, even though call is the unsafest function, it is still used by 50% of the contracts in our dataset. The safe method transfer is used by approximately one-third of contracts, and send is rarely used. We noticed that contracts using call have a higher average and median size in Lines of Code than normal. We also found an increased percentage of call contracts using more guards. Moreover, 97% of all contracts are using the require guard, with 23 uses of require on average per contract. This may be an indication that Solidity developers are using more guards to prevent exploits in their contracts
Blockchain is an emerging technology based on a distributed digital ledger system. Decentralized trust is one of the key factors behind the blockchain-based system. The transparency of such a system is better than a conventional centralized ledger system. By using a blockchain-based transaction system, any business organization can harness key benefits like data integrity, confidentiality, and anonymity without involving any third party in control of the transactions. Since the blockchain is used in numerous applications, the horizon is expanding at an unprecedented pace. It was found that tracking COVID vaccination in a transparent and accountable way is an emerging need, especially after the pandemic outbreak around the world. The blockchain platform is a good match for such applications. In this study, a blockchain-based COVID-19 testing and vaccination tracking system, called COVAC, has been designed to manage the COVID testing and vaccination process for local organizations. The âPrototype Software Development" approach was used to determine the system requirements according to the practical knowledge obtained through the vaccine monitoring and screening tests process and then communicated with local healthcare facilities to determine whether these requirements were satisfied. The blockchain-based implementation ensured the system transparency, integrity, and security of data on COVID-19 testing and vaccination
Many existing timed-release encryption schemes uses time-lock puzzles to avoid relying on a trusted timeserver or a key holder which could be a weak spot in data security. However, it is unavoidable to consume massive computing power for solving time-lock puzzles and it is difficult for encryptors to predict the amount of time to solve a puzzle by decryptors. In this study, an efficient dual-purpose proof-of-work consensus allows users to release a time-locked content, which is encrypted by an asymmetric key encryption scheme on a blockchain, without trust in any third-party agents. The release time is predictable as the block time in a proof-of-work blockchain is adaptively controlled. The mining work is reproposed so that once a new block was mined on the blockchain network, time-lock puzzles were also solved immediately. No additional work is required to reveal the time-locked contents and the encryption is secured by monetary incentive mechanisms since it would be very costly to arrange an attack attempt, which must overtake the total hash rate of the whole blockchain network.
E-voting plays a vital role in modern social life. However, traditional e-voting systems usually rely on a trusted third party and therefore non-verifiable and prone to a single point of failure. In recent years, many researchers have tried to turn to blockchain to eliminate the vulnerabilities of e-voting systems. However, blockchain-based e-voting brings new problems in protecting votersâ privacy and ballotsâ confidentiality, and causes a great performance degradation. In this paper, we propose AvecVoting, an anonymous and verifiable blockchain-based e-voting scheme, providing both strong security and high performance. Specifically, we utilize threshold encryption and one-time ring signature to protect votersâ privacy and ballotsâ confidentiality. Furthermore, to improve the performance, we introduce the concept "counter" to count the ballots. Through the carefully designed RandomSortition and reputation-based PayOff algorithms based on smart contracts, AvecVoting can achieve correct counting even when some counters are untrustworthy. Our security and performance analyses show that AvecVoting provides strong security such as anonymity, non-repeatability, confidentiality, verifiability, etc., and meanwhile overcome the performance issues caused by blockchain and provides good efficiency in both voting and counting stages.
Boutaina Jebari, Khalil Ibrahimi, Mohammed Jouhari, Mounir Ghogho
Selfish mining is an attack on blockchain networks, where a minority mining pool deviates from the original mining protocol and keeps some blocks private. The goal of the attacking pool is to waste the computational power of the other miners and increase their revenue. In this paper, we use a new approach to analyze the profitability of such attacks. Using game theory, we model the interactions between pools to derive the utility of mining strategies. We simulate the game for a Bitcoin blockchain and analyze the profitability of an attack, in terms of the monetary award instead of the relative revenue. We express the utility to include the cost of a strategy and revisit existing selfish mining strategies to discuss possible outcomes of the game. Depending on the game parameterization, we highlight scenarios where the system could be compromised. To the best of our knowledge, this is the first work that models the selfish mining attack as a stochastic game.
Zheyuan He, Zhou Liao, Luo Feng, Dijun Liu ¡ 6 authors
The development of blockchain has promoted the prosperity of the cryptocurrency ecosystem. The majority of cryptocurrencies are ERC20 tokens implemented based on Ethereum contracts. The major role of ERC20 tokens is to carry out various trades and loans in decentralized applications (DApps). To participate in DApps, users must grant the DApps permission to spend tokens on user behalf. However, if the authorization logic of token contract is flawed implementation, the holder of token will suffer tremendous financial losses. In this work, we detect the authentication implementation of the flaws in ERC20 token, which has not been done before. We find the authentication process of the token is implemented by operating the authentication data structure of the token. Therefore, we capture the operations of the authentication data structure in token contract to infer authentication behaviors and detect authentication defects. However, itâs not a simple task as most smart contracts are not open source and the bytecode of token contract lacks type information. To tackle these problems, we utilize symbolic execution on the token bytecode, then identify the authentication data structure and capture the operations by parsing the symbolic expressions, and finally detect authentication defects through the inferred authentication behavior. To best our knowledge, this is the first work to detect the flaws in the implementation of authentication in ERC20 Token. To automate the analysis, we implement our approach in a new tool named TokenCat and use it to inspect 245,822 tokens. As a result, the TokenCat found 491 ERC20 token authentication implementation flaws with 94% precision.
The current practice of informal cyber threat intelligence (CTI) sharing among organizations is characterized with the use of emails and social media exchanges among individuals. This model is highly subjective and dependent on a specific individualâs social networks. Financial institutions have CTI at their disposal that could protect each other from computer hacks and fraud. The effective sharing of this intelligence among financial institutions could reduce the high income leakages that is brought about by cyber-attacks. The challenge is how to share this intelligence confidentially and anonymously since the financial institutions are competitors, have a huge reputation to protect and thrive on business secrecy. This research proposes a new way of sharing cyber threat intelligence by using Ethereum smart contract blockchain technology. This will be accomplished by hashing the device identity and replacing the hashed device identity by an on-chain verifiable random function to protect the identity of the participating nodes or the financial institutions in the blockchain network when passing information.
Roman Matzutt, Vincent Ahlrichs, Jan Pennekamp, Roman Karwacik ¡ 5 authors
Blockchains gained tremendous attention for their capability to provide immutable and decentralized event ledgers that can facilitate interactions between mutually distrusting parties. However, precisely this immutability and the openness of permissionless blockchains raised concerns about the consequences of illicit content being irreversibly stored on them. Related work coined the notion of redactable blockchains, which allow for removing illicit content from their history without affecting the blockchain's integrity. While honest users can safely prune identified content, current approaches either create trust issues by empowering fixed third parties to rewrite history, cannot react quickly to reported content due to using lengthy public votings, or create large per-redaction overheads.In this paper, we instead propose to outsource redactions to small and periodically exchanged juries, whose members can only jointly redact transactions using chameleon hash functions and threshold cryptography. Multiple juries are active at the same time to swiftly redact reported content. They oversee their activities via a global redaction log, which provides transparency and allows for appealing and reversing a rogue jury's decisions. Hence, our approach establishes a framework for the swift and transparent moderation of blockchain content. Our evaluation shows that our moderation scheme can be realized with feasible per-block and per-redaction overheads, i.e., the redaction capabilities do not impede the blockchain's normal operation.
The Internet has become one of the most important technologies in the world, and hackers use various methods to launch cyber attacks to profit from it. Phishing is one of famous social engineering attacks, it is often used to steal user data, including login credentials and credit card numbers. Although the Transport Layer Security certificate is used to verify the trust of websites, there are still a series of vulnerabilities. The demand for trusted IP addresses has led a lot of research, including IP whitelisting, DNS filtering and so on. However, these technologies still have many shortcomings. In view of this, we proposed a novel mechanism for verifying websites using blockchain technology. The URL and IP address of a permissioned website are recorded in blockchain through a specific smart contract. A DNS query is executed through a smart contract designed to avoid URL redirection attacks. With the help of immutable nature of blockchian, phishing websites can be detected. The mechanism will not add any load to users and provides tamper-proof functions based on the characteristics of blockchain. The comparison of related works shows that the proposed mechanism is more secure. We also provided a reference implementation of the proposed mechanism on Ethereum Quorum simulation platform, which proves the effectiveness and practicability of the mechanism.
Torgin Mackinga, Tejaswi Nadahalli, Roger Wattenhofer
Blockchain "on-chain" oracles are critical to the functioning of many Decentralized Finance (DeFi) protocols. We analyze these oracles for manipulation resistance. Specifically, we analyze the cost of manipulating on-chain time-weighted average price (TWAP) oracles that use the arithmetic mean. It has been assumed that manipulating a TWAP oracle with the well-known multi-block attack is expensive and scales linearly with the length of the TWAP. We question this assumption with two novel results. First, we describe a single-block attack that works under the same setting as the multi-block attack but costs less to execute. Second, we describe a multi-block MEV (MMEV) style attack where the attacker colludes with a miner/proposer who can mine/propose two blocks in a row. This MMEV style attack makes oracle manipulation orders of magnitude cheaper than previously known attacks. In the proof-of-work setting, MMEV can be done by selfish mining even with very low shares of hashpower.
Online advertising, which depends on consumersâ click, creates revenue for media sites, publishers, and advertisers. However, click fraud by criminals, i.e., the ad is clicked either by malicious machines or hiring people, threatens this advertising system. To solve the problem, many schemes are proposed which are mainly based on machine learning or statistical analysis. Although these schemes mitigate the problem of click fraud, several problems still exist. For example, some fraudulent clicks are still in the wild since their schemes only discover the fraudulent clicks with a probability approaching but not 100%. Also, the process of detecting a click fraud is executed by a single publisher, which makes a chance for the publisher to obtain illegal income by deceiving advertisers and media sites. Besides, the identity privacy of consumers is also exposed because the schemes deal with the plain text of consumersâ real identity. Therefore, in this paper, a blockchain-based click fraud detection and prevention scheme (BCFDPS) for online advertising is proposed to deal with the above problems. Specifically, the BCFDPS mainly introduces bilinear pairing to implicitly verify whether a consumerâs real digital identity is contained in a click message to significantly avoid click fraud and employs a consortium blockchain to ensure the transparency of the detection and prevention process. In our scheme, the clicks by machines or fraud ones by a human can be accurately detected and prevented by media sites, publishers, and advertisers. Furthermore, ciphertext-policy attribute-based encryption is adopted to protect the identity privacy of consumers. The implementation and evaluation results show that compared with the existing click fraud detection and prevention schemes based on machine learning and statistical analysis, BCFDPS achieves detection of each fraudulent click with a probability of 100% and consumes lower computation cost; furthermore, BCFDPS adds functions of consumersâ privacy protection and click fraud detection and prevention, compared to the existing blockchain-based online advertising scheme, by introducing limited communication cost ( 4,984 bytes) at lower storage cost.
Open access
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Nowadays, Blockchain technology has also drawn mammoth attention as it is currently triggering multiple projects. This technology is the prevalent technology that allows Bitcoin to operate. Bitcoin has already cemented itself as a popular virtual currency, and it will soon become a pressing requirement for citizens. Furthermore, with digital currencies proliferating all over the world, security must not be overlooked, especially when there have been numerous attacks and security vulnerabilities on bitcoin's blockchain. However, the lucrative system has drawn opponents and attackers who are continually attempting to exploit flaws in the technology in order to get profit. This paper contemplates the bitcoin's transaction process, with a focus on obscuring the true identities of clients and their coins prior to transacting, and then elucidating on the following: SHA-256 function, the primary threats to Bitcoin's security, along with some countermeasures to be undertaken.
2 source records
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Nowadays, Blockchain-based rating/review systems are gaining popularity as a backbone for recommender systems due to the inherent cryptographically secured decentralised architecture, immutability, user anonymity, and inclusion of smart contracts. However, the existing Blockchain-based rating/review systems address resistance to the standard attacks, i.e. collusion attack, user threatening, and unfair rating. Still, they do not present security analyses of smart contracts that may result in substantial threats to the users of the systems. This manuscript presents an in-depth study of twelve publicly available security analysis tools and standard vulnerabilities in smart contracts and reviews. The experimental setup uses a two-step approach for selecting the security analysis tool. The first step identifies the seven tools their proposers or independent researchers have compared, and the second step proposes a new method for selecting tools based on continuous improvement. Our experimental results show security issues in 51.72% of the analysed smart contracts of four Blockchain-based rating/review systems. 6.67% of vulnerable smart contracts exhibit high-level severity threats that raise an alarming condition for the current state of system developments.
Miners of a blockchain exchange information about blocks and transactions with one another via a peer-to-peer (P2P) network. The speed at which they learn of new blocks and transactions in the network determines the likelihood of forks in the chain, which in turn has implications for the efficiency as well as security of proof-of-work (PoW) blockchains. Despite the importance of information propagation delays in a blockchain's peer-to-peer network, little is known about them. The last known empirical study was conducted, for instance, by Decker and Wattenhofer in 2013 [11].
The traceability of drugs remains a significant issue, especially with the number of products proposed on the Web. Detecting counterfeit products is a challenge, given what these products could represent as a danger to health and the economy. Several studies have been made in the literature and tried to propose solutions. However, several limitations remain. In this context, this paper presents our framework, ChainDrugTrac, for the traceability and detection of counterfeit pharmaceutical products. After studying existing work and identifying the limits, our contributions could be resumed around 1) proposing architecture for drug traceability based on the blockchain and 2) developing a blockchain-based prototype supporting the proposed architecture. The prototype has been implemented to evaluate our proposal and show its effectiveness.
Blacklists are a widely-used Internet security mechanism to protect Internet users from financial scams, malicious web pages, and other cyber attacks based on blacklisted URLs. This demo introduces PhishChain, a transparent and decentralized system for blacklisting phishing URLs. At present, public/private domain blacklists, such as PhishTank, CryptoScamDB, and APWG, are maintained by a centralized authority, but operate in a crowd sourcing fashion to create a manually verified blacklist periodically. In addition to being a single point of failure, the blacklisting process utilized by such systems is not transparent. We utilize the blockchain technology to support transparency and decentralization, where no single authority is controlling the blacklist and all operations are recorded in an immutable distributed ledger. Further, we design a page rank based truth discovery algorithm to assign a phishing score to each URL based on crowd sourced assessment of URLs. As an incentive for voluntary participation, we assign skill points to each user based on their participation in URL verification.
In recent years, phishing scams have become the most serious type of crime involved in Ethereum, the second-largest blockchain platform. The existing phishing scams detection technology on Ethereum mostly uses traditional machine learning or network representation learning to mine the key information from the transaction network to identify phishing addresses. However, these methods adopt the last transaction record or even completely ignore these records, and only manual-designed features are taken for the node representation. In this paper, we propose a Temporal Transaction Aggregation Graph Network (TTAGN) to enhance phishing scams detection performance on Ethereum. Specifically, in the temporal edges representation module, we model the temporal relationship of historical transaction records between nodes to construct the edge representation of the Ethereum transaction network. Moreover, the edge representations around the node are aggregated to fuse topological interactive relationships into its representation, also named as trading features, in the edge2node module. We further combine trading features with common statistical and structural features obtained by graph neural networks to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TTAGN (92.8% AUC, and 81.6% F1-score) outperforms the state-of-the-art methods, and the effectiveness of temporal edges representation and edge2node module is also demonstrated.
While blockchain technology triggers new industrial and technological revolutions, it also brings new challenges. Recently, a large number of new scams with a "blockchain" sock-puppet continue to emerge, such as Ponzi schemes, money laundering, etc., seriously threatening financial security. Existing fraud detection methods in blockchain mainly concentrate on manual feature and graph analytics, which first construct a homogeneous transaction graph using partial blockchain data and then use graph analytics to detect anomaly, resulting in a loss of pattern information. In this paper, we mainly focus on Ponzi scheme detection and propose HFAug, a generic Heterogeneous Feature Augmentation module that can capture the heterogeneous information associated with account behavior patterns and can be combined with existing Ponzi detection methods. HFAug learns the metapath-based behavior characteristics in an auxiliary heterogeneous interaction graph, and aggregates the heterogeneous features to corresponding account nodes in the homogeneous one where the Ponzi detection methods are performed. Comprehensive experimental results demonstrate that our HFAug can help existing Ponzi detection methods achieve significant performance improvement on Ethereum datasets, suggesting the effectiveness of heterogeneous information on detecting Ponzi schemes.
Recently, network representation learning has been widely used to mine and analyze network characteristics, and it is also applied to blockchain, but most of the embedding methods in blockchain ignore the heterogeneity of network, so it is difficult to accurately describe the characteristics of the transaction. As smart society evolves, Ethereum makes smart contracts reality, while the mine of transaction characteristics appearing on the Ethereum platform is scarce; thus, there is an urgent need to mine Ethereum from contract and transfer. In this article, we propose a heterogeneous network representation learning method to mine implicit information inside Ethereum transactions. Specifically, we construct an Ethereum transaction network by collecting transaction data from normal and phishing Ethereum accounts. Then, we propose a walk strategy that combines timestamps and transaction amounts to represent the information that occurs at the time of a transaction. To mine the types of nodes and edges, we use a heterogeneous network representation learning method to map the transaction network to a low-dimensional space. Finally, we improve the accuracy of the embedding results in the node classification task, which has important implications for Ethereum mining as well as identity recognition.
The âBitcoin Generator Scamâ (BGS) is a cyberattack in which scammers promise to provide victims with free cryptocurrencies in exchange for a small mining fee. In this paper, we present a data-driven system to detect, track, and analyze the BGS. It works as follows: we first formulate search queries related to BGS and use search engines to find potential instances of the scam. We then use a crawler to access these pages and a classifier to differentiate actual scam instances from benign pages. Last, we automatically monitor the BGS instances to extract the cryptocurrency addresses used in the scam. A unique feature of our system is that it proactively searches for and detects the scam pages. Thus, we can find addresses that have not yet received any transactions. Our data collection project spanned 16 months, from November 2019 to February 2021. We uncovered more than 8,000 cryptocurrency addresses directly associated with the scam, hosted on over 1,000 domains. Overall, these addresses have received around 8.7 million USD, with an average of 49.24 USD per transaction. Over 70% of the active addresses that we are capturing are detected before they receive any transactions, that is, before anyone is victimized. We also present some post-processing analysis of the dataset that we have captured to aggregate attacks that can be reasonably confidently linked to the same attacker or group. Our system is one of the first academic feeds to the APWG eCrime Exchange database. It has been actively and automatically feeding the database since November 2020.
In recent years, vaccine safety incidents have occurred frequently. To protect vaccine safety, researchers have proposed to use blockchain to secure the vaccine circulation process. Technically, blockchain has some limitations in solving vaccine and other supply chain problems, such as large on-chain storage consumption and low throughput. To better alleviate these restrictions, we propose an improved, blockchain-based, storage-efficient vaccine safety protection scheme in this work. Specifically, we first model the vaccine circulation process. We then design a system to protect vaccine circulation using blockchain, cloud, and cryptographic mechanisms. The proposed system leverages the cloud to implement the vaccine circulation model. Correspondingly, it uses the blockchain to store circulating data certificates and signatures. We evaluated the proposed conceptual model using a consortium blockchain. The experimental results show that the proposed system is efficient.
Cryptocurrencies have dramatically increased adoption in mainstream applications in various fields such as financial and online services, however, there are still a few amounts of cryptocurrency transactions that involve illicit or criminal activities. It is essential to identify and monitor addresses associated with illegal behaviors to ensure the security and stability of the cryptocurrency ecosystem. In this paper, we propose a framework to build a dataset comprising Bitcoin transactions between 12 July 2019 and 26 May 2021. This dataset (hereafter referred to as BABD-13) contains 13 types of Bitcoin addresses, 5 categories of indicators with 148 features, and 544,462 labeled data, which is the largest labeled Bitcoin address behavior dataset publicly available to our knowledge. We also propose a novel and efficient subgraph generation algorithm called BTC-SubGen to extract a${k}$-hop subgraph from the entire Bitcoin transaction graph constructed by the directed heterogeneous multigraph starting from a specific Bitcoin address node. We then conduct 13-class classification tasks on BABD-13 by five machine learning models namely${k}$-nearest neighbors algorithm, decision tree, random forest, multilayer perceptron, and XGBoost, the results show that the accuracy rates are between 93.24% and 97.13%. In addition, we study the relations and importance of the proposed features and analyze how they affect the effect of machine learning models. Finally, we conduct a preliminary analysis of the behavior patterns of different types of Bitcoin addresses using concrete features and find several meaningful and explainable modes.
Mamoona Humayun, N. Z. Jhanjhi, Mahmood Niazi, Fathi Amsaad ¡ 5 authors
The purpose of this study is to overcome coordination flaws and enhance end-to-end security in the drug distribution market (DDM). One of the major issues in drug market coordination management is the absence of a centralized monitoring system to provide adequate market control and offer real-time prices, availability, and authentication data. Further, tampering is another serious issue affecting the DDM, and as a consequence, there is a significant global market for counterfeit drugs. This vast counterfeit drug business presents a security risk to the distribution system. This study presents a blockchain-based solution to challenges such as coordination failure, secure drug delivery, and pharmaceutical authenticity. To optimize the drug distribution process (DDP), a framework for drug distribution is presented. The proposed framework is evaluated using mathematical modeling and a real-life case study. According to our results, the proposed technique helps to maintain market equilibrium by guaranteeing that there is adequate demand while maintaining supply. Using the suggested framework, massive data created by the medication supply chain would be appropriately handled, allowing market forces to be better regulated and no manufactured shortages to inflate medicine prices. The proposed framework calls for the Drug Regulatory Authority (DRA) to authenticate users on blockchain and to monitor end-to-end DDP. Using the proposed framework, big data generated through drug supply chain will be properly managed; thus, market forces will be better controlled, and no artificial shortages will be generated to raise drug costs.