The development of electronic voting applications remains an active area of research and this has led to the proposal and implementation of many models based on blockchains. However, most of the proposed models are partially decentralized solutions, in which the blockchain is used as a storage media for votes while the application is written in programming tools such as HTML, CSS, and JavaScript. This makes them vulnerable to attacks such as Denial of Service (DoS) attacks, Single Point of Failure (SPF), and fraudulent record modification. In this paper, we propose a fully decentralized electronic voting application, SEVA, in which we placed the whole application (code and data) in Ethereum to protect the application from vulnerabilities. Additionally, we propose a new consensus algorithm, Proof of Smart Vote (PoSV) for SEVA, as a viable energy-saving alternative to the energy-intensive Proof of Work (PoW). We implemented and evaluated SEVA with PoSV and compared it with a partially decentralized model of the application.
Many threshold systems require some kind of secret sharing during their set-up phase. There has been several recent work in doing secret sharing in a distributed manner through the use of Blockchain so that one does not have to rely on trusted third parties nor strong assumptions about the communication medium. This paper continues this line of work and presents a new protocol for distributed key generation (DKG). We develop a new technique that leverages the mainchain of a popular blockchain platform like Bitcoin, together with a mixing service and a group signature scheme, to provide anonymity and traceability; we connect this to a sidechain, pegged to the mainchain, that brings a better scalability. We implemented the technique on the joint platform Bitcoin/RootStock and use CoinJoin/CoinShuffle as the mixing service. The evaluation section shows a decrease by 99 % in the execution cost of our protocol compared to the same implementation on a smart-contract-friendly blockchain such as Ethereum.
A Service Level Agreement (SLA) is a special kind of legal contract that binds a vendor to its customers where the vendor commits to provide certain services in exchange for certain payments from the customers. However, when customers do not get the services that they have subscribed for, it becomes a laborious job for customers to contact or visit the company and claim the correct amount of compensation or service credits. On the other hand, a Smart Contract is a contract that is a computer program that also binds multiple parties into given agreements but is a set of precise rules and is self-enforceable and self-executable. In this paper, we have introduced a novel work where we use fuzzy logic inside the Ethereum-based smart contract for two significant objectives. The first objective is to make the claim of the compensation easier and faster for customers by translating the SLA into a smart contract. The second objective is to make the smart contract even smarter and intelligent by implementing fuzzy logic so that customers who have a hard time understanding the legal jargon and ambiguities of the legal contract and SLA to find out if the compensation amount they are getting when the service is poor is good enough. Since fuzzy logic models semantics of linguistic expressions by capturing vagueness in the fuzzy sets, it becomes easier to solve the problem of contractual ambiguities and expedite the process of claiming compensation when implemented in a Blockchain-based smart contract.
Ethereum is essentially a transaction-driven state machine, and a smart contract is a piece of executable code on Ethereum. Compared with the scripting language on Bitcoin, the smart contract language solidity, which is Turing-complete and the ex-pressive capabilities are very powerful. However, this attribute also brings many potential security threats, vulnerabilities, and various other issues. In this paper, we propose a novel smart contract security technology, named Jyane, to detect the Reentrancy vulnerability, which is one of the most threatening vulnerabilities to smart contracts. More importantly, Our tool-Jyane is the first path profiling solution for smart contracts. Firstly, we use EVM (Ethereum Virtual Machine) binary bytecode to construct control flow graphs (CFG), then use the improved Ball-Larus Path profiling algorithm (BLPP) to generate IDs for acyclic paths. Finally, after profiling the constructed paths, the suspicious paths can be detected successfully. We evaluate Jyane and other technology through comprehensive test and comparison; the results show that Jyane can profile the actual execution path of smart contracts to detect vulnerabilities with a low false-positive rate accurately. From the results of the evaluation, Jyane marked 27 of 1,226 Ethereum smart contracts selected in 2016 and 2017 as vulnerable contracts, included the vulnerability of the DAO contract which once led to a $60 million loss. Furthermore, compared with some other existing detection tools, Jyane shows broader detection range for Reentrancy vulnerabilities with lower time overhead.
Alkhansaa A. Abuhashim, Hassan A. Shafei, Chiu C. Tan
This paper proposes a global blockchain-based vaccination certification. To facilitate issuing and verifying certificates globally, the framework is lightweight on the user's side. The essential certification operations, issuing certificate, verifying certificate, and verifying vaccine, are implemented preserving user's privacy. Our framework's smart contracts design is implemented on the Ethereum blockchain test network to support indexing and querying the certification data. The experimental results show the effectiveness of the proposed approach in improving the performance of the primary functionalities. The results show the retrieving time of certificate information is efficient no matter how long the chain is, compared with scanning the blocks to find the target data.
This paper proposes a blockchain-based traceability system of photos. Thanks to a novel scheme that securely chains certificates of image data originating from a trusted origin certificate, the system authenticates the provenance of original and converted images, e.g., which digital camera created it. The system requires a Public Key Infrastructure (PKI) of digital cameras to authenticate the trusted origin certificate signed by the certified digital camera. It does not require a PKI of image conversion software. The proposed solution is suitable for the traceability system of photos on the Internet as the scheme of chaining certificates applies to any image conversion software, including open source-based photo editing applications and cloud server software that converts image data of photos. We have implemented a prototype of the traceability system using Ethereum as a permissioned blockchain and evaluated the system's feasibility.
Advanced Steganography and Watermarking Techniques
The healthcare sector is constantly improving patient health record systems. However, these systems face a significant challenge when confronted with patient health record (PHR) data due to its sensitivity. In addition, patient’s data is stored and spread generally across various healthcare facilities and among providers. This arrangement of distributed data becomes problematic whenever patients want to access their health records and then share them with their care provider, which yields a lack of interoperability among various healthcare systems. Moreover, most patient health record systems adopt a centralized management structure and deploy PHRs to the cloud, which raises privacy concerns when sharing patient information over a network. Therefore, it is vital to design a framework that considers patient privacy and data security when sharing sensitive information with healthcare facilities and providers. This paper proposes a blockchain framework for secured patient health records sharing that allows patients to have full access and control over their health records. With this novel approach, our framework applies the Ethereum blockchain smart contracts, the Inter-Planetary File System (IPFS) as an off-chain storage system, and the NuCypher protocol, which functions as key management and blockchain-based proxy re-encryption to create a secured on-demand patient health records sharing system effectively. Results show that the proposed framework is more secure than other schemes, and the PHRs will not be accessible to unauthorized providers or users. In addition, all encrypted data will only be accessible to and readable by verified entities set by the patient.
Blockchain technology has a lot of potentials to solve non-financial applications though it is derived from peer-to-peer financial transactions. In the last decade, both from industry and academician much research is already done on Blockchain technology its usability to the different non-financial applications. The Blockchain is the secure decentralized network and integrated with other emerging technology like fog computing, cloud computing, and Machine learning to address many challenges existing in different domains. The Internet of Things (IoT) has been used to automate the system which provides efficient and reliable services with minimum human interaction. IoT is integrated with smart agriculture for different purposes like sensing the moisture content, monitoring water level, growth of the plant, etc. However, the authors have identified various challenges including security and privacy issues in IoT enabled smart agriculture systems. In this work, Blockchain assisted trust model for smart agriculture is proposed. The proposed Blockchain based trust model uses Ethereum network and smart contract prototype to addressed some of the security issues in IoT enabled smart agriculture.
Ayusee Swain, K. P. Swain, S. R. Samal, Snigdha Pattnaik · 8 authors
With growing energy demand and advancement in technologies, it is essential to ensure security to the energy usage data and transparency in the transactions while optimizing costs and improving the efficiency of the processes. For this purpose, we have presented one of the emerging technologies called Blockchain technology, which is a highly immutable and cryptographically secured distributed ledger system, using which important transaction data, energy records and contracts are digitally maintained in real-time across a peer-to-peer network. In the current work, a blockchain-based prototype is proposed by integrating AMI and Ethereum smart contract to come up with a peer-to-peer monitoring system that will ensure transparency in energy usage and automation of the billing process. By this work, we aim to provide solutions to the major issues associated with the existing infrastructure of energy monitoring and billing systems like the manual intervention of billing process, overdue bill payment, illegal tapping of power lines and unethical selling of units by the electricity board.
Dragoş Vicoveanu, Oana Geman, Carina Balcoș, Marius Prelipceanu
Abstract The recent use of digital Distributed Ledger Technology (DLT) in the healthcare domain can surpass the existing limitations in the centralized IT systems, such as the lack of security, access control or immutability of the electronic health information. If we discuss about clinical information, this innovative informatics advance gives back the control to the data owner. In decentralized environments, smart contracts allow trustable agreements grounded by irreversible transactions, which permit transparency and traceability. Moreover, smart contracts are the living heart of the decentralized applications that run on DTL. In this work, our attention is focused on medical equipments that helps health staff to diagnose and treat patients keeping much of their clinical data taken in dynamics. Hence, we propose a smart contract-based decentralized application framework for the management of devices, targeting also medical services, meant to facilitate the interaction of the involved entities. Our testing environment is the Ethereum platform, extensively used recently in the healthcare domain, being itself a smart operating system that allows decentralized applications to run on it.
This paper used two frames based on the Multivariate General Autoregressive Conditional Heteroscedasticity (MGARCH) model, namely the Dynamic Conditional Correlation (DCC) and the Baba, Engle, Kraft, and Kroner (BEKK) models. DCC parameters confirmed the significant results to assess the spillover effects for return volatilities of five cryptocurrencies (Bitcoin, Dogecoin, Ethereum, Monero, and Peercoin). It indicated that cryptocurrency market returns would be volatile, connected with the time-varying pattern. Most ARCH and GARCH effects were significant in estimating the three pairs of return-mining profitability, return-Tweet, and mining profitability-Tweet. For the cryptocurrency return and profitability pair, returns depended on future price returns and cross-volatility spillover and were greater than their own volatility spillover effect. Moreover, the BEKK diagonal model was found to be the best model for return-mining profitability. The research community can also gain valuable insights into cryptocurrency investment models, offering wider future areas of research.
The paper aims to clarify the relationship between Internet-of-Things devices and Ethereum blockchain. It proposes the arrangement to ensure information transmission among parties in an open system of IoT must be secure using Ethereum. The accompanying joining strategy utilized terminal gadgets as system innovation and Ethereum blockchain stage that delivered back-end, which guarantees high security, accessibility, and protection, supplanting conventional back-end frameworks. The following issues should be considered to prevent the malicious hub from attacking, resist distributed denial-of-service attacks, and prevent firmware backdoor access. This paper proposed a system in which the Peer-to-Peer authentication model, where every IoT node in the system must be authenticated and verified by the proposed framework. The paper provides empirical insights into IoT nodes manufactured in bulk, and they are remaining with their default username and password.
Wanqing Jie, Arthur Sandor Voundi Koe, Pengfei Huang, Shiwen Zhang
The security of smart contracts has drawn attention in recent years due to their immutability and ability to hold assets. Existing machine learning and deep learning methods addressing vulnerabilities in smart contracts often partially combine pooled features from first the contract source code, second, the build based approach made of features extracted during source code compilation, and third, the bytecode approach relying on features obtained from the Ethereum virtual machine bytecode analysis. Together those three approaches form the full-stack, and they are usually being conducted under static analysis thanks to its speed of execution. However, to the best of our knowledge, no single work has yet simultaneously undertaken a full-stack intralayer and cross-layer features fusion for smart contracts vulnerability assessment under static analysis, without making use of expert-based patterns nor without manually fusing the various features extracted from shuffled partial combinations of layers in the full-stack. This paper introduces a full-stack hierarchical fusion of static features for smart contracts vulnerability detection. In our construction, we associate each layer of the full-stack to a modality and leverage automatic intramodality and crossmodality pooled features fusion from state-of-the-art artificial neural networks and deep neural networks. Additionally, our models are applied to the hierarchy of power set layers in the full-stack, without any expert-based rule. Furthermore, our work aims to assess the increase in vulnerability detection performance and provide guidance for future research on smart contracts vulnerability detection.
Jigna J. Hathaliya, Rajesh Gupta, Sudeep Tanwar, Priyanka Sharma
In-Patient Monitoring, data sharing is fundamental step to get the comprehension from earlier research-oriented work. Traditional data-sharing policies rely on third-party holders that can compromise the system transparency, trust, and integrity. To solve the aforementioned issues, we have proposed a smart contract-based secure data sharing scheme in healthcare 5.0 by leveraging the advantages of the interplanetary file system (IPFS). The proposed scheme achieves data confidentiality, integrity, and access control rules by implementing active entities’ access control policy written in a smart contract. Entities are first authenticated using digital signatures. Afterwards, the completion of treatment initiated the transaction and transferred the amount to the requested entities. This scheme integrates Ethereum blockchain (BCN), decentralized storage, and incentive schemes. In this scheme, smart contracts are written in solidity language and deployed on the Ethereum-based test network. The proposed scheme achieves data integrity, confidentiality, authentication, and non-repudiation. The result section calculates the communication and computation cost of 1408 bits and 0.112 ms, respectively.
Bo Gao, Siyuan Shen, Ling Shi, Jiaying Li · 6 authors
Smart contracts are computerized transaction protocols built on top of blockchain networks. Users are charged with fees, a.k.a. gas in Ethereum, when they create, deploy or execute smart contracts. Since smart contracts may contain vulnerabilities which may result in huge financial loss, developers and smart contract compilers often insert codes for security checks. The trouble is that those codes consume gas every time they are executed. Many of the inserted codes are however redundant. In this work, we present sOptimize, a tool that optimizes smart contract gas consumption automatically without compromising functionality or security. sOptimize works on smart contract bytecode, statically identifies 3 kinds of code patterns, and further removes them through verification-assisted techniques. The resulting code is guaranteed to be equivalent to the original one and can be directly deployed on blockchain. We evaluate sOptimize on a collection of 1,152 real-world smart contracts and show that it optimizes 43% of them, and the reduction on gas consumption is about 2.0% while in deployment and 1.2% in transactions, the amount can be as high as 954,201 gas units per contract.
Vladislav Pascari, Larisa Gagarina, Valentin V. Sliusar
The most promising way to increase voters’ confidence in the remote electronic voting (REV) procedure is a voting method based on Ethereum blockchain platform. However, the existing solutions using this method faced a range of problems: ensuring the secrecy of the vote and openness of the procedure for society, pressure on the voter and a guarantee of the reliability of the whole system. In this work, a method for constructing a REV is proposed that solves these problems. It is similar in structure to the traditional voting method, using the same principle and processes. The Ethereum blockchain based REV process is described in detail. It was shown that received votes are securely stored in the Ethereum blockchain network, and the correctness of the vote addressing to the selected candidate can always be checked in real time. The description of smart contract algorithm that implements the transfer of vote from voter to candidate using transactions and determines the winner who received the highest number of votes was provided. It was demonstrated that keccak256 hashing algorithm and secp256k1 elliptic curve signatures ensure transactions’ maximum protection, reliability, and non-rollability. The developed REV technique based on Ethereum blockchain platform increases the efficiency of data security and confidentiality, transparency and anonymity of the voting procedure, and solves the problem of coercion. The results of the work have been implemented programmatically and can be used not only in the electoral system, but also wherever there is need of remote voting.
Traditional paper certificates have difficulties in preservation and management, causes tampering and forgery. A secure decentralized-based platform could mitigate the risk with-out any third-party intervention using Ethereum in the core. This work proposed a novel architecture to generate digital certificates using a distributed ledger automatically. Further, it authenticates the same using private keys with trusted certificate authorities. The framework is tested on FU540 (RISC-V) architecture. A detailed mechanism for generating and authenticating certificates is validated on FU540 board with blockchain integration. Mechanism flow starts with the admin. It adds the source organization blocks having the user detail records to the distributed ledger. Verifiers put the request to the source authorizer to perform verifications. This protocol could protect private information and identify the inter mediators who tried to diversify
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Nowadays, smart contracts manage more and more digital assets and have become an attractive target for adversaries. To prevent smart contracts from malicious attacks, a thorough test is indispensable and must be finished before deployment because smart contracts cannot be modified after being deployed. Fuzzing is an important testing approach, but most existing smart contract fuzzers can hardly solve the constraints which involve deeply nested conditional statements, resulting in low coverage. To address this problem, we propose Targy, an efficient targeted mutation strategy based on dynamic taint analysis. We obtain the taint flow by dynamic taint propagation, and generate a more accurate mutation strategy for the input parameters of functions to simultaneously satisfy all conditional statements. We implemented Targy on sFuzz with 3.6 thousand smart contracts running on Ethereum. The numbers of covered branches and detected vulnerabilities increase by 6% and 7% respectively, and the average time required for covering a branch is reduced by 11 %.
A Service Level Agreement (SLA) is a special kind of legal contract that binds a vendor to its customers where the vendor commits to provide certain services in exchange for certain payment from the customers. On the other hand, a Smart Contract is a contract that is a computer program that also binds multiple parties into given agreements but is a set of a precise rules and is self-enforceable and self-executable. Since almost all legal contracts are ambiguous by nature and are complex to read and understand, we perform a novel study on how we can replace the traditional vague legal contract with the smart contact and the effect of the ambiguity on the smart contract by performing a thorough analysis on SLAs by measuring their ambiguities in various aspects. We take several samples of real SLAs from six different popular broadband vendors. We use four random SLAs to train the machine learning model to classify and then detect ambiguous words in two unseen SLAs which were the SLAs of Ziply Fiber and Century Link. As different people form different interpretations while reading the ambiguous legal contracts, we generate various human interpretations from the machine detected ambiguous words and convert all those generated interpretations into Smart Contracts to perform testing in Ethereum-based Blockchain to identify the most ambiguous as well as accurate interpretation of the SLA. From our analysis and observation, we were able to find out the most ambiguous interpretation of SLAs and we concluded that the SLA of Ziply Fiber was more ambiguous in general compared to the SLA of Century Link. Moreover, our proposed approach to detect ambiguous terms and to translate an ambiguous legal contract to a smart legal contract using a formal language to measure the degree of ambiguity can be extrapolated and replicated to legal contracts from other types of industries as well.
Com o avanço da tecnologia e o aparecimento da rede blockchain diversas plataformas e aplicações ganharam destaques, entre elas a plataforma Ethereum. Esta tecnologia é responsável pela criação e execução dos contratos inteligentes. O artigo apresenta os conceitos, funcionalidades e funcionamento dos contratos inteligentes e suas aplicações, assim como as principais características das tecnologias que envolvem os contratos inteligentes.
Júlia Almeida Valadares, Vinícius Cunha Oliveira, José Eduardo de Azevedo Sousa, Heder S. Bernardino · 7 authors
Ethereum is one of the largest blockchain platforms currently that has become a digital business environment for users. This platform is designed to allow decentralized transactions between anonymous users. Thus, the development of methods to identify user behavior profiles, keeping their identities anonymous, has the potential to leverage business on this platform. In this work, we investigate the use of machine learning to classify a user profile as professional or common based on the attributes of their transactions. This classification is challenging due to the small fraction of publicly labeled users in Ethereum and still the considerably smaller fraction of professional users. To conduct this investigation, we train models considering carefully balanced sets of transactions with labeled users. Our results show high performance models for the classification of profiles, achieving a performance greater than 90% for accuracy, precision, and other related measures. In addition, we have identified the most relevant features in transactions for this classification.
Deepesh Chaudhari, Rachit Agarwal, Sandeep K. Shukla
The temporal aspect of blockchain transactions enables us to study the address's behavior and detect if it is involved in any illicit activity. However, due to the concept of change addresses (used to thwart replay attacks), temporal aspects are not directly applicable in the Bitcoin blockchain. Several pre-processing steps should be performed before such temporal aspects are utilized. We are motivated to study the Bitcoin transaction network and use the temporal features such as burst, attractiveness, and inter-event time along with several graph-based properties such as the degree of node and clustering coefficient to validate the applicability of already existing approaches known for other cryptocurrency blockchains on the Bitcoin blockchain. We generate the temporal and non-temporal feature set and train the Machine Learning (ML) algorithm over different temporal granularities to validate the state-of-the-art methods. We study the behavior of the addresses over different time granularities of the dataset. We identify that after applying change-address clustering, in Bitcoin, existing temporal features can be extracted and ML approaches can be applied. A comparative analysis of results show that the behavior of addresses in Ethereum and Bitcoin is similar with respect to in-degree, out-degree and inter-event time. Further, we identify 3 suspects that showed malicious behavior across different temporal granularities. These suspects are not marked as malicious in Bitcoin.
The rapid adoption of blockchain technologies and particularly smart contracts has been overshadowed by numerous security concerns. Over the past few years, a number of reports exposed smart contracts vulnerabilities and exploits, which mainly stem from the immaturity of the field, and consequently a lack of knowledge and tools for automated analysis and verification of smart contracts. The restricting properties of the blockchain environment, such as the immutability of deployed contracts, encumber the analysis and mitigation of vulnerabilities and bugs in deployed contracts. To address these challenges, we propose EtherProv, a novel provenance tracking system that leverages static and dynamic analysis synergy to enable detection and mitigation of known security issues in Ethereum smart contracts. EtherProv leverages Solidity source code static and dynamic analysis data through contract bytecode instrumentation. The collected data is transformed into a unified, high-level representation, which can be queried using concise and descriptive Datalog queries. Within the provenance framework, EtherProv is able to analyze contracts' execution flow over time, to detect vulnerabilities within a single contract execution flow and across multiple interacting contracts, and to mitigate new security threats in already deployed contracts. Our evaluation shows that EtherProv can efficiently and precisely identify vulnerable contracts with an average contract instrumentation gas overhead of 18.9%.
Many popular blockchain platforms support smart contracts for building decentralized applications. However, the vulnerabilities within smart contracts have demonstrated to lead to serious financial loss to their end users. In particular, the smart contracts on EOSIO smart contract platform have resulted in the loss of around 380K EOS tokens, which was around 1.9 million worth of USD at the time of attack. The EOSIO smart contract platform is based on the Wasm VM, which is also the underlying system supporting other smart contract platforms as well as Web application. In this work, we present WANA, an extensible smart contract vulnerability detection tool based on the symbolic execution for Wasm bytecode. WANA proposes a set of algorithms to detect the vulnerabilities in EOSIO smart contracts based on Wasm bytecode analysis. Our experimental analysis shows that WANA can effectively and efficiently detect vulnerabilities in EOSIO smart contracts. Furthermore, our case study also demonstrates that WANA can be extended to effectively detect vulnerabilities in Ethereum smart contracts.