As a matter of fact, Ransomware Attack is considered an essential threat to cyber security. This type of intimidation often causes an immense loss. For instance, the electronic records of medical healthcare have been one of the main targets of Ransomware attacks. This could be attributed to the fact that sensitive data belongs to patients. In this paper, we use Blockchain technology to be an appropriate solution for Ransomware attacks. It is believed that the procedures taken by this technology, specifically in the health sector, will create a defense wall that would protect patients' data. We mainly intend in this paper to enhance Medical Healthcare Records (MHR)-based healthcare through the utilization of the Ethereum Network to treat and investigate unusual transactions. In order to achieve this objective, an astute arrangement has been developed so that MHR will be sent via the Ethereum Blockchain network. Thus, MHRs are protected from any Ransomware attacks, especially from those attackers who pretend to be patients and attempt to penetrate the web through their claimed records. Finally, the recommended system could be evaluated through the metrics utilized for evaluating performance, including the cost that reduced the cost to 855304 Wei and the execution time for raising patient records on Ethereum Network compared to the standard system by 60%, immutability, data storage, and estimated time required by attackers to attack the block.
Muhammad Farman Andrijasa, Saiful Adli Ismail, Norulhusna Ahmad
The core of Ethereum is a smart contract, which enables developers to create blockchain-based applications in a secure and inexpensive manner. Everyone has access to the source code of Ethereum-based smart contracts. The smart contract has become a target for numerous attackers due to its transparency. Since 2015, when the first Ethereum block was discovered, many security incidents have occurred. Several code analysis methods have been developed for detecting the re-entrancy vulnerability of smart contracts. However, Existing strategies for detecting cross-contract vulnerability tend to experience both false negative and false positive results. To enhance the re-entrancy detection technique of existing works, we propose a challenge to enhance re-entrancy detection technique for Ethereum blockchain smart cross-contract. We proposed multi-agent deep reinforcement learning fuzzing to provide an exploit generator on cross-contract. We will discover a novel solution for enhancing re-entrancy detection techniques for cross-contract by integrating all these systems.
In this work, we elaborate on the concept of process authenticity, which intuitively corresponds to the validity of all process steps and their proper binding. It represents the most exciting forefront of distributed ledger technology research concerning the primary challenge of reliably connecting distributed ledger networks to the physical context it must operate. More in detail, the paper describes a novel methodological approach to ensure the authenticity of business processes through blockchain and several security mechanisms applied to the digital twins of the actual processes. We illustrate difficulties and opportunities deriving from implementing process authenticity in concrete case studies in which we were involved as software designers belonging to three critical application domains: document dematerialization, e-voting, and healthcare.
With the blooming of blockchain-based smart contracts in decentralized applications, the security problem of smart contracts has become a critical issue, as vulnerable contracts have resulted in severe financial losses. Existing research works have explored vulnerability detection methods based on fuzzing, symbolic execution, formal verification, and static analysis. In this paper, we propose two static analysis approaches called ASGVulDetector and BASGVulDetector for detecting vulnerabilities in Ethereum smart contacts from source-code and bytecode perspectives, respectively. First, we design a novel intermediate representation called abstract semantic graph (ASG) to capture both syntactic and semantic features from the program. ASG is based on syntax information but enriched by code structures, such as control flow and data flow. Then, we apply two different training models, i.e., graph neural network (GNN) and graph matching network (GMN), to learn the embedding of ASG and measure the similarity of the contract pairs. In this way, vulnerable smart contracts can be identified by calculating the similarity to labeled ones. We conduct extensive experiments to evaluate the superiority of our approaches to state-of-the-art competitors. Specifically, ASGVulDetector improves the best of three source-code-only static analysis tools (i.e., SmartCheck, Slither, and DR-GCN) regarding the F1 score by 12.6% on average, while BASGVulDetector improves that of the three detection tools supporting bytecode (i.e., ContractFuzzer, Oyente, and Securify) regarding the F1 score by 25.6% on average. We also investigate the effectiveness and advantages of the GMN model for detecting vulnerabilities in smart contracts.
Smart contracts publicly deployed on blockchain have been shown to contain several vulnerabilities that users can maliciously exploit. To detect smart contract vulnerabilities as categorized in the Smart Contract Weakness Classification (SWC) standard, we propose the SWC-based Analysis Tool (SWAT). It operates by matching patterns in Solidity codes, making it easy to use and allowing any Solidity developers to conveniently check their smart contracts before deploying. We conducted experiments to compare the proposed solution against state-of-the-art tools in identifying 46 SWC registries. SWAT outperformed the existing tools in terms of the number of SWC vulnerabilities supported. Moreover, our solution is memory-efficient as it uses 44.58% less memory than other tools.
Abstract The Ethereum blockchain stores and executes complex logic via smart contracts written in Solidity, a high‐level programming language. The Solidity language (in its early versions) provides features to exercise fine‐grained control over smart contracts, whose usage is discouraged by later‐released Solidity documentation, but nonetheless supported in later versions for backward compatibility. We define these features as low‐level functions. However, the high‐volume of transactions and the improper use of low‐level functions lead to security exploits with heavy financial loss. Consequently, the documentation suggests secure alternatives to the use of low‐level functions. In this article, we first perform an empirical study on the use of low‐level functions in Ethereum smart contracts. We study a smart contract dataset consisting of over 2,100,000 real‐world smart contracts. We find that low‐level functions are widely used and that the majority of these uses are gratuitous. We then propose GoHigh, a source‐to‐source transformation tool to eliminate low‐level function‐related vulnerabilities, by replacing low‐level functions with secure alternatives. Our experimental evaluation on the dataset shows that GoHigh successfully replaces all low‐level functions with 4.9% fewer compiler warnings. Further, no unintended side‐effects are introduced in 80% of the contracts, and the remaining 20% are not verifiable due to their external dependency. GoHigh saves more than 5% of the gas cost of the contract. Finally, GoHigh takes 7 s on average per contract.
Most of the existing smart contract symbolic execution tools perform analysis on bytecode, which loses high-level semantic information presented in source code. This makes interactive analysis tasks—such as visualization and debugging—extremely challenging, and significantly limits the tool usability. In this paper, we present SolSEE, a source-level symbolic execution engine for Solidity smart contracts. We describe the design of SolSEE, highlight its key features, and demonstrate its usages through a Web-based user interface. SolSEE demonstrates advantages over other existing source-level analysis tools in the advanced Solidity language features it supports and analysis flexibility. A demonstration video is available at: https://sites.google.com/view/solsee/.
We propose VetSC, a novel UI-driven, program analysis guided model checking technique that can automatically extract contract semantics in DApps so as to enable targeted safety vetting. To facilitate model checking, we extract business model graphs from contract code that capture its intrinsic business and safety logic. To automatically determine what safety specifications to check, we retrieve textual semantics from DApp user interfaces. To exclude untrusted UI text, we also validate the UI-logic consistency and detect any discrepancies. We have implemented VetSC and applied it to 34 real-world DApps. Experiments have demonstrated that VetSC can accurately interpret smart contract code, enable autonomous safety vetting, and discover safety risks in real-world Dapps. Using our tool, we have successfully discovered 19 new safety risks in the wild, such as expired lottery tickets and double voting.
Smart contracts are increasingly used with blockchain systems for high-value applications. It is highly desired to ensure the quality of smart contract source code before they are deployed. This paper proposes a new deep learning-based tool, MANDO-GURU, that aims to accurately detect vulnerabilities in smart contracts at both coarse-grained contract-level and fine-grained line-level. Using a combination of control-flow graphs and call graphs of Solidity code, we design new heterogeneous graph attention neural networks to encode more structural and potentially semantic relations among different types of nodes and edges of such graphs and use the encoded embeddings of the graphs and nodes to detect vulnerabilities. Our validation of real-world smart contract datasets shows that MANDO-GURU can significantly improve many other vulnerability detection techniques by up to 24% in terms of the F1-score at the contract level, depending on vulnerability types. It is the first learning-based tool for Ethereum smart contracts that identify vulnerabilities at the line level and significantly improves the traditional code analysis-based techniques by up to 63.4%. Our tool is publicly available at https://github.com/MANDO-Project/ge-sc-machine. A test version is currently deployed at http://mandoguru.com, and a demo video of our tool is available at http://mandoguru.com/demo-video.
In recent years, with 5G and other key technology breakthroughs, IoT technology is accelerating penetration into various industries, and the era of Internet of Everything is coming. However, while the industry is promoting the rapid development of industrial IoT, IoT security issues are also coming up. Based on this, this paper proposes a data privacy protection method for the smart IoT platform, which first adopts zero-knowledge identity proof technology to complete the identity access authentication of a large number of IoT terminal devices; then the data is downscaled and aggregated in the intermediate data collection device, and then the processed data is added to the noise based on Laplace distribution, and finally the data is transmitted to the main server, thus realizing the smart IoT platform Data privacy protection in the process of data transmission.
Constant advancements in technology have a significant impact on our everyday lives and the ecosystem in which we live. The growing popularity of cryptocurrencies (e.g., Bitcoin and Ethereum), along with Non-Fungible Tokens (NFTs), which are founded on blockchain technology, has opened the way for these blockchain projects to be integrated into a wide range of other kinds of applications (apps). Today, cryptocurrencies are used as a popular method of payment online; however, their popularity on the dark Web is also increasing. For example, they can be used to buy and perform various illegal activities among criminals due to their anonymity. Web3 cryptocurrency wallets, used to store cryptocurrencies, have not been studied as thoroughly as many other apps from a digital forensic perspective on mobile devices, given the increasing number of these services and apps today for many platforms, including the leading mobile operating systems (i.e., iOS and Android). Therefore, the purpose of this research is to guide investigators to unlock the full potential of popular cryptocurrency Web3 wallets, Trust Wallet and Metamask, to understand what can be recovered, and to look at areas where there are knowledge gaps. We digitally analyzed and forensically examined two mobile wallets that do not require any personal identifiers to register and are widely used for Web3 cryptocurrencies on Android and iOS devices. We review the digital evidence we have collected and discuss the implications of the forensic tools we have used. Finally, we propose a proof of concept extension to the iOS Logs, Events, And Plists Parser (iLEAPP) tool to automatically recover artifacts.
In the past few years, several attacks against the vulnerabilities of EOSIO smart contracts have caused severe financial losses to this prevalent blockchain platform. As a lightweight test-generation approach, grey-box fuzzing can open up the possibility of improving the security of EOSIO smart contracts. However, developing a practical grey-box fuzzer for EOSIO smart contracts from scratch is time-consuming and requires a deep understanding of EOSIO internals. In this work, we proposed AntFuzzer, the first highly extensible grey-box fuzzing framework for EOSIO smart contracts. AntFuzzer implements a novel approach that interfaces AFL to conduct AFL-style grey-box fuzzing on EOSIO smart contracts. Compared to black-box fuzzing tools, AntFuzzer can effectively trigger those hard-to-cover branches. It achieved an improvement in code coverage on 37.5% of smart contracts in our benchmark dataset. AntFuzzer provides unified interfaces for users to easily develop new detection plugins for continually emerging vulnerabilities. We have implemented 6 detection plugins on AntFuzzer to detect major vulnerabilities of EOSIO smart contracts. In our large-scale fuzzing experiments on 4,616 real-world smart contracts, AntFuzzer successfully detected 741 vulnerabilities. The results demonstrate the effectiveness and efficiency of AntFuzzer and our detection pl
Zihan Zhao, Sidi Mohamed Beillahi, Ryan Song, Yuxi Cai · 6 authors
This paper presents SigVM, the first blockchain virtual machine that extends EVM to support an event-driven execution model, enabling developers to build truly decentralized smart contracts. Contracts in SigVM can emit signal events, on which other contracts can listen. Once an event is triggered, corresponding handler functions are automatically executed as signal transactions. We build an end-to-end blockchain platform SigChain and a contract language compiler SigSolid to realize the potential of SigVM. Experimental results show that our benchmark applications can be reimplemented with SigVM in a truly decentralized way, eliminating the dependency on centralized and unreliable mechanisms like off-chain relay servers. The development effort of reimplementing these contracts with SigVM is small, i.e., we modified on average 3.17% of the contract code. The runtime and the gas overhead of SigVM on these contracts is negligible.
Stefanos Chaliasos, Arthur Gervais, Benjamin Livshits
The Solidity programming language is the most widely used language for smart contract development. Improving smart contracts’ correctness, security, and performance has been the driving force for research in vulnerability detection, program analysis, and compiler techniques for Solidity. Similar to system-level languages such as C, Solidity enables the embedding of low-level code in programs, in the form of inline assembly code. Developers use inline assembly for low-level optimizations, extending the Solidity language through libraries, and using blockchain-specific opcodes only available through inline assembly. Nevertheless, inline assembly fragments are not well understood by an average developer and can introduce security threats as well as affect the optimizations that can be applied to programs by the compiler; it also significantly limits the effectiveness of source code static analyzers that operate on the Solidity level. A better understanding of how inline assembly is used in practice could in turn increase the performance, security, and support for inline assembly in Solidity. This paper presents a large-scale quantitative study of the use of inline assembly in 6.8M smart contracts deployed on the Ethereum blockchain. We find that 23% of the analyzed smart contracts contain inline assembly code, and that the use of inline assembly has become more widespread over time. We further performed a manual qualitative analysis for identifying usage patterns of inline assembly in Solidity smart contracts. Our findings are intended to help practitioners understand when they should use inline assembly and guide developers of Solidity tools in prioritizing which parts of inline assembly to implement first. Finally, the insights of this study could be used to enhance the Solidity language, improve the Solidity compiler, and to open up new research directions by driving future researchers to build appropriate methods and techniques for replacing inline assembly in Solidity programs when there is no real necessity to use it.
Sung-Shine Lee, Alexandr Murashkin, Martin Derka, Jan Gorzny
The blockchain ecosystem has evolved into a multi-chain world with various blockchains vying for use. Although each blockchain may have its own native cryptocurrency or digital assets, there are use cases to transfer these assets between blockchains. Systems that bring these digital assets across blockchains are called bridges, and have become important parts of the ecosystem. The designs of bridges vary and range from quite primitive to extremely complex. However, they typically consist of smart contracts holding and releasing digital assets, as well as nodes that help facilitate user interactions between chains. In this paper we first provide a high level break-down of components in a bridge and the different processes for some bridge designs. Then, we analyse past exploits in the blockchain ecosystem that specifically targeted bridges. In doing this, we identify risks associated with bridge components.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Smart contracts running on public blockchains are permissionless and decentralized, attracting both developers and malicious participants. Ethereum, the world’s largest decentralized application platform on which more than 40 million smart contracts are running, is frequently challenged by smart contract vulnerabilities. What’s worse, since the homogeneity of a wide range of smart contracts and the increase in inter-contract dependencies, a vulnerability in a certain smart contract could affect a large number of other contracts in Ethereum. However, little is known about how vulnerable contracts affect other on-chain contracts and which contracts can be affected. Thus, we first present the contract dependency graph (CDG) to perform a vulnerability analysis for Ethereum smart contracts, where CDG characterizes inter-contract dependencies formed by DELEGATECALL-type internal transaction in Ethereum. Then, three generic definitions of security violations against CDG are given for finding respective potential victim contracts affected by different types of vulnerable contracts. Further, we construct the CDG with 195,247 smart contracts active in the latest blocks of the Ethereum and verify the above security violations against CDG by detecting three representative known vulnerabilities. Compared to previous large-scale vulnerability analysis, our analysis scheme marks potential victim contracts that can be affected by different types of vulnerable contracts, and identify their possible risks based on the type of security violation actually occurring. The analysis results show that the proportion of potential victim contracts reaches 14.7%, far more than that of corresponding vulnerable contracts (less than 0.02%) in CDG.
With the popularity of Internet of Things (IoT) technology, the scale of IoT is gradually becoming huge and demand-driven to form multi-domain IoT, and the demand for cross-domain access of devices in multi-domain scenarios has greatly increased. Secure cross-domain authentication is an important step in securing multi-domain IoT. The current cross-domain authentication architecture for IoT devices has limitations such as single point of failure, low authentication efficiency, poor scalability and other limitations. To address these problems, this paper designs a blockchain-based cross-domain authentication scheme for IoT terminals, which adopts an authentication architecture based on a combination of blockchain and edge computing technology to eliminate the problems of traditional cross-domain authentication for IoT devices and achieve distributed authentication. Considering that IoT devices have the characteristics of heterogeneity, massiveness, and limited resources, a lightweight and secure certificateless signature scheme is introduced in the cross-domain authentication process, eliminating complex certificate management and key escrow, and achieving secure and efficient cross-domain authentication of IoT terminals.
V. P. Sriram, Shouvik Sanyal, Madan Mohan Laddunuri, Mathiraj Subramanian · 10 authors
Blockchain technology ensures data security through an integrated system whereby it collects, arranges, stores, and disseminates information in different blocks. This technology thus enables adding the data to the network. Once data has been added to the network, no one can alter the data set either by adding or deleting it. Further, this technology also helps to track and check the changes if anything is made to a blockchain, as the changes remain in the database forever. Since this technology uses lots of systems in a blockchain, it will regularly download its data, arranging, and keeping the copy locally. Locating the data errors and cyberattacks in advance by analyzing the data documented, it employs the consent of various participants and accomplishments in cryptography. With this backdrop, the chapter has attempted to disclose the basics of blockchain technology in data security, why blockchain in cybersecurity, how it ensures cybersecurity, its benefits, its innovative uses, and the future of cybersecurity in the online business platforms.
Smart contracts are pieces of code that reside inside the blockchains and can be triggered to execute any transaction when specifically predefined conditions are satisfied. Being commonly used for commercial transactions in blockchain makes the security of smart contracts particularly important. Over the last few years, we have seen a great deal of academic and practical interest in detecting and fixing the bugs in smart contracts written by Solidity. But little is known about the real bug fixes in Solidity smart contract projects. To understand the bug fixes and enrich the knowledge of bug fixes in real-world projects, we conduct an empirical study on historical bug fixes from 46 real-world Solidity smart contract projects in this paper. We provide a multi-faceted discussion and mainly explore the following four questions: File Type and Amount, Fix Complexity, Bug distribution, and Fix Patches. We distill four findings during the process to explore these four questions. Finally, based on these findings, we provide actionable implications to improve the current approaches to fixing bugs in Solidity smart contracts from three aspects: Automatic repair techniques, Analysis tools, and Solidity developers.
Tommaso Frassetto, Patrick Jauernig, David Koisser, David Kretzler · 7 authors
Smart contracts enable users to execute payments depending on complex program logic. Ethereum is the most notable example of a blockchain that supports smart contracts leveraged for countless applications including games, auctions and financial products. Unfortunately, the traditional method of running contract code on-chain is very expensive, for instance, on the Ethereum platform, fees have dramatically increased, rendering the system unsuitable for complex applications. A prominent solution to address this problem is to execute code off-chain and only use the blockchain as a trust anchor. While there has been significant progress in developing off-chain systems over the last years, current off-chain solutions suffer from various drawbacks including costly blockchain interactions, lack of data privacy, huge capital costs from locked collateral, or supporting only a restricted set of applications. \n \nIn this paper, we present POSE—a practical off-chain protocol for smart contracts that addresses the aforementioned shortcomings of existing solutions. POSE leverages a pool of Trusted Execution Environments (TEEs) to execute the computation efficiently and to swiftly recover from accidental or malicious failures. We show that POSE provides strong security guarantees even if a large subset of parties is corrupted. We evaluate our proof-of-concept implementation with respect to its efficiency and effectiveness.