Blockchain Papers

Hyunsu Mun, Soohyun Kim, Youngseok Lee

No abstract is available for this record.

Przemysław Rodwald

No abstract is available for this record.

Nga Tang Thi Quynh, Ha Xuan Son, Trieu Hai Le, Hung Nguyen Duc Huy · 10 authors

No abstract is available for this record.

Dunjie Zhang, Jinyin Chen, Xiaosong Lu

With the popularity of blockchain technology, the financial security issues of blockchain transaction networks have become increasingly serious. Phishing scam detection methods will protect possible victims and build a healthier blockchain ecosystem. Usually, the existing works define phishing scam detection as a node classification task by learning the potential features of users through graph embedding methods such as random walk or graph neural network (GNN). However, these detection methods are suffered from high complexity due to the large scale of the blockchain transaction network, ignoring temporal information of the transaction. Addressing this problem, we defined the transaction pattern graphs for users and transformed the phishing scam detection into a graph classification task. To extract richer information from the input graph, we proposed a multi-channel graph classification model (MCGC) with multiple feature extraction channels for GNN. The transaction pattern graphs and MCGC are more able to detect potential phishing scammers by extracting the transaction pattern features of the target users. Extensive experiments on seven benchmark and Ethereum datasets demonstrate that the proposed MCGC can not only achieve state-of-the-art performance in the graph classification task but also achieve effective phishing scam detection based on the target users' transaction pattern graphs.

Nikolay Ivanov, Hanqing Guo, Qiben Yan

The developers of Ethereum smart contracts often implement administrating patterns, such as censoring certain users, creating or destroying balances on demand, destroying smart contracts, or injecting arbitrary code. These routines turn an ERC20 token into an administrated token - the type of Ethereum smart contract that we scrutinize in this research. We discover that many smart contracts are administrated, and the owners of these tokens carry lesser social and legal responsibilities compared to the traditional centralized actors that those tokens intend to disrupt. This entails two major problems: a) the owners of the tokens have the ability to quickly steal all the funds and disappear from the market; and b) if the private key of the owner's account is stolen, all the assets might immediately turn into the property of the attacker. We develop a pattern recognition framework based on 9 syntactic features characterizing administrated ERC20 tokens, which we use to analyze existing smart contracts deployed on Ethereum Mainnet. Our analysis of 84,062 unique Ethereum smart contracts reveals that nearly 58% of them are administrated ERC20 tokens, which accounts for almost 90% of all ERC20 tokens deployed on Ethereum. To protect users from the frivolousness of unregulated token owners without depriving the ability of these owners to properly manage their tokens, we introduce SafelyAdministrated - a library that enforces a responsible ownership and management of ERC20 tokens. The library introduces three mechanisms: deferred maintenance, board of trustees and safe pause. We implement and test SafelyAdministrated in the form of Solidity abstract contract, which is ready to be used by the next generation of safely administrated ERC20 tokens.

Diana Hawashin, Dunia J. Mahboobeh, Khaled Salah, Raja Jayaraman · 7 authors

Today’s a large number of blood donation management systems fall short in providing traceability, immutability, transparency, audit, privacy, and security features. Also, they are vulnerable to the single point of failure problem due to centralization. In this paper, we propose a private Ethereum blockchain-based solution to automate blood donation management in a manner that is decentralized, transparent, traceable, auditable, private, secure, and trustworthy. The proposed solution stores non-critical and large data off-chain using the decentralized storage of the InterPlanetary File System (IPFS). We present the system architecture, sequence diagrams, entity-relationship diagram, and algorithms to briefly explain the working principles of our blood donation management solution. We evaluate the performance of our solution in terms of efficiency and effectiveness through performing security analysis. We make our smart contract code publicly available on Github1.

Yijun Xia, Jieli Liu, Jiatao Zheng, Jiajing Wu · 5 authors

No abstract is available for this record.

Khaled Gubran Al-Hashedi, Pritheega Magalingam, Nurazean Maarop, Ganthan Narayana Samy · 5 authors

No abstract is available for this record.

Meng Shen, Jinpeng Zhang, Liehuang Zhu, Ke Xu · 5 authors

Decentralized Applications (DApps) are increasingly developed and deployed on blockchain platforms such as Ethereum. DApp fingerprinting can identify users' visits to specific DApps by analyzing the resulting network traffic, revealing much sensitive information about the users, such as their real identities, financial conditions and religious or political preferences. DApps deployed on the same platform usually adopt the same communication interface and similar traffic encryption settings, making the resulting traffic less discriminative. Existing encrypted traffic classification methods either require hand-crafted and fine-tuning features or suffer from low accuracy. It remains a challenging task to conduct DApp fingerprinting in an accurate and efficient way. In this paper, we present GraphDApp, a novel DApp fingerprinting method using Graph Neural Networks (GNNs). We propose a graph structure named Traffic Interaction Graph (TIG) as an information-rich representation of encrypted DApp flows, which implicitly reserves multiple dimensional features in bidirectional client-server interactions. Using TIG, we turn DApp fingerprinting into a graph classification problem and design a powerful GNN-based classifier. We collect real-world traffic datasets from 1,300 DApps with more than 169,000 flows. The experimental results show that GraphDApp is superior to the other state-of-the-art methods in terms of classification accuracy in both closed- and open-world scenarios. In addition, GraphDApp maintains its high accuracy when being applied to the traditional mobile application classification.

Ashish Sharma, Chavikant, Takshi Singh, Tushar Aggarwal · 6 authors

In recent years, the use of the internet to vote has become popular and several governments in Europe and worldwide are intending to experiment with it. Online voting is becoming more popular in today’s culture. Many people are currently benefiting from cold digital technologies. Unlike the election system, it makes far more frequent use of paper. A standard (offline) method poses a security and transparency risk to popular elections. National elections are still centralized, with only one political party in authority. One of the main issues with traditional election systems is the organization that has complete control over the website and system, which might disrupt the database of many opportunities. Because we accept a separate system and the complete database is handled by many people, blockchain technology is one of the answers. The blockchain technology has been employed in a Bitcoin system called as a separate Bank. One of the most fraudulent sources on a website can be reduced by using a blockchain in the distribution of information on electronic voting systems. This research examines the use of a blockchain algorithm to record vote results at all polling sites. It’s no longer necessary to print ballot sheets or open polling stations. The goal of this research is to look into the use of blockchain as an electronic voting mechanism.In this paper, an e-trust voting system is divided into blockchain. The classification system means that the calculation depends on the blockchain segmentation. The voter does not have to trust the election administration in an unreliable system, and the trust is divided among all voters. The entire protocol affects system accuracy. Furthermore, all voters will have cryptographic assurance that their privacy will be safeguarded. The article covers the needs for developing electronic voting systems and identifies legal and technical barriers to employing blockchain as a monitoring service for such systems.

Simin Ghesmati, Walid Fdhila, Edgar Weippl

The Bitcoin blockchain was the first publicly verifiable, and distributed ledger, where it is possible for everyone to download and check the full history of all data records from the genesis block. These properties lead to the emergence of new types of applications and the redesign of traditional systems that no longer respond to current business needs (e.g., transparency, protection against censorship, decentralization). One particular application is the use of blockchain technology to enable decentralized and self-sovereign identities including new mechanisms for creating, resolving, and revoking them. The public availability of data records has, in turn, paved the way for new kinds of attacks that combine sophisticated heuristics with auxiliary information to compromise users’ privacy and deanonymize their identities. In this paper, we review and categorize Bitcoin privacy attacks, investigate their impact on one of the Bitcoin-based identity methods namely did:btcr, and analyze and discuss its privacy properties.

Rohit Saxena, Deepak Arora, Vishal Nagar, Satyasundara Mahapatra

No abstract is available for this record.

Jaswant Pakki, Yan Shoshitaishvili, Ruoyu Wang, Tiffany Bao · 5 authors

No abstract is available for this record.

Shengmin Xu, Jianting Ning, Jinhua Ma, Xinyi Huang · 5 authors

As an immutable append-only distributed ledger, blockchain allows a group of participants to reach a consensus in an untrustworthy ecosystem. Immutability is a blockchain feature that persists data forever, but it is no longer legal in reality. Blockchain has unchangeable improper contents that violate laws. Moreover, data regulation toward “the right to be forgotten” requires blockchain must be modifiable. To address this problem, redactable blockchain has been introduced to relax immutability in a controlled way. However, once a participant is authorized, she/he can rewrite any content and no penalty for the malicious behavior that hinders the wide deployment of redactable blockchain in practice. In this paper, we introduce a new notion, dubbed k-time modifiable and epoch-based redactable blockchain (KERB) with a monetary penalty to control rewriting privileges and penalize malicious behaviors. Our solution is built up from simple building blocks: digital signatures and chameleon hashes. We give a formal definition and security models of KERB, and present a generic construction along with formal proofs. The extensive comparison and experimental analysis illustrate that our solution enjoys superior functionalities and performances than the state-of-the-art solutions.

Claudia Antal, Tudor Cioara, Marcel Antal, Ionut Anghel

In the context of the COVID-19 pandemic, the rapid roll-out of a vaccine and the implementation of a worldwide immunization campaign is critical, but its success will depend on the availability of an operational and transparent distribution chain that can be audited by all relevant stakeholders. In this paper, we discuss how blockchain technology can be used for assuring the transparent tracing of COVID-19 vaccine registration, storage and delivery, and side effects self-reporting. We present such system implementation in which blockchain technology is used for assuring data integrity and immutability in case of beneficiary registration for vaccination, eliminating identity thefts and impersonations. Smart contracts are defined to monitor and track the proper vaccine distribution conditions against the safe handling rules defined by vaccine producers enabling the awareness of all network peers. For vaccine administration, a transparent and tamper-proof side effects self-reporting solution is provided considering person identification and administrated vaccine association. A prototype was implemented using the Ethereum test network, Ropsten, considering the COVID-19 vaccine distribution tracking conditions. The results obtained for each on-chain operation can be checked and validated on the Etherscan, demonstrating various aspects of the proposed system such as immunization actors and safe rules registration, vaccine tracking, and administration. In terms of throughput and scalability, the proposed blockchain system shows promising results.

Mubashar Iqbal, Raimundas Matulevičius

The first step to realise the true potential of blockchain systems is to explain the associated security risks and vulnerabilities. These risks and vulnerabilities, exploited by the threat agent to affect the valuable assets and services. In this work, we use a security risk management (SRM) domain model and develop a framework to explore two security risks - Sybil and Double-spending - that are observed and considered most concerning security risks within blockchain systems. The framework illustrates the protected assets or assets to secure, the classification of threats that the attacker can trigger using Sybil attack, the identification of threats that cause Double-spending, the vulnerabilities of identified threats, and their countermeasures. We evaluated a newly built framework by exploring Sybil and Double-spending risks in Ethereum-based healthcare applications. We also recognise the various other security and implementation challenges of blockchain that hinder the acceptance of blockchain-enabled solutions. Furthermore, we discuss the permissioned blockchain systems making an appearance in industry-level enterprises and how permissioned blockchain systems control these challenges. We conclude the paper and outline the future work that aims to build an ontology-based blockchain security reference model. The results of this work could help blockchain developers, practitioners, and other associated stakeholders to communicate about Sybil and Double-spending risks, what security countermeasures should be introduced, and what security and implementation challenges are emerging in blockchain systems.

Fredy Andrés Aponte-Novoa, Ana Lucila Sandoval Orozco, Ricardo Villanueva-Polanco, Pedro M. Wightman

The applications that use blockchain are cryptocurrencies, decentralized finance applications, video games and many others. Most of these applications trust that the blockchain will prevent issues like fraud, thanks to the built-in cryptographic mechanisms provided by the data structure and the consensus protocol. However, blockchains suffers from what is called a 51% attack or majority attack, which is considered a high risk for the integrity of these blockchains, where if a miner, or a group of them, has more than half the computing capability of the network, it can rewrite the blockchain. Even though this attack is possible in theory, it is regarded as hard-achievable in practice, due to the assumption that, with enough active members, it is very complicated to have that much computing power; however, this assumption has not been studied with enough detail. In this work, a detailed characterization of the miners in the Bitcoin and Crypto Ethereum blockchains is presented, with the aim of proving the computing distribution assumption and to creating profiles that may allow the detection of anomalous behaviors and prevent 51% attacks. The results of the analysis show that, in the last years, there has been an increasing concentration of hash rate power in a very small set of miners, which generates a real risk for current blockchains. Also, that there is a pattern in mining among the main miners, which makes it possible to identify out-of-normal behavior.

Jinhuan Wang, Pengtao Chen, Shanqing Yu, Qi Xuan

Blockchain technology and, in particular, blockchain-based transaction offers us information that has never been seen before in the financial world. In contrast to fiat currencies, transactions through virtual currencies like Bitcoin are completely public. And these transactions of cryptocurrencies are permanently recorded on Blockchain and are available at any time. Therefore, this allows us to build transaction networks (TN) to analyze illegal phenomenons such as phishing scams in blockchain from a network perspective. In this paper, we propose a Transaction SubGraph Network (TSGN) based classification model to identify phishing accounts in Ethereum. Firstly we extract transaction subgraphs for each address and then expand these subgraphs into corresponding TSGNs based on the different mapping mechanisms. We find that TSGNs can provide more potential information to benefit the identification of phishing accounts. Moreover, Directed-TSGNs, by introducing direction attributes, can retain the transaction flow information that captures the significant topological pattern of phishing scams. By comparing with the TSGN, Directed-TSGN indeed has much lower time complexity, benefiting the graph representation learning. Experimental results demonstrate that, combined with network representation algorithms, the TSGN model can capture more features to enhance the classification algorithm and improve phishing nodes' identification accuracy in the Ethereum networks.

Christof Ferreira Torres, Antonio Ken Iannillo, Arthur Gervais, Radu State

In recent years, Ethereum gained tremendously in popularity, growing from a daily transaction average of 10K in January 2016 to an average of 500K in January 2020. Similarly, smart contracts began to carry more value, making them appealing targets for attackers. As a result, they started to become victims of attacks, costing millions of dollars. In response to these attacks, both academia and industry proposed a plethora of tools to scan smart contracts for vulnerabilities before deploying them on the blockchain. However, most of these tools solely focus on detecting vulnerabilities and not attacks, let alone quantifying or tracing the number of stolen assets. In this paper, we present Horus, a framework that empowers the automated detection and investigation of smart contract attacks based on logic-driven and graph-driven analysis of transactions. Horus provides quick means to quantify and trace the flow of stolen assets across the Ethereum blockchain. We perform a large-scale analysis of all the smart contracts deployed on Ethereum until May 2020. We identified 1,888 attacked smart contracts and 8,095 adversarial transactions in the wild. Our investigation shows that the number of attacks did not necessarily decrease over the past few years, but for some vulnerabilities remained constant. Finally, we also demonstrate the practicality of our framework via an in-depth analysis on the recent Uniswap and Lendf.me attacks.

Salam Al-E’mari, Mohammed Anbar, Yousef Sanjalawe, Selvakumar Manickam

No abstract is available for this record.

Christof Ferreira Torres, Ramiro Daniel Camino, Radu State

Ethereum prospered the inception of a plethora of smart contract applications, ranging from gambling games to decentralized finance. However, Ethereum is also considered a highly adversarial environment, where vulnerable smart contracts will eventually be exploited. Recently, Ethereum's pool of pending transaction has become a far more aggressive environment. In the hope of making some profit, attackers continuously monitor the transaction pool and try to frontrun their victims' transactions by either displacing or suppressing them, or strategically inserting their transactions. This paper aims to shed some light into what is known as a dark forest and uncover these predators' actions. We present a methodology to efficiently measure the three types of frontrunning: displacement, insertion, and suppression. We perform a large-scale analysis on more than 11M blocks and identify almost 200K attacks with an accumulated profit of 18.41M USD for the attackers, providing evidence that frontrunning is both, lucrative and a prevalent issue.

Shanqing Yu, Jie Jin, Yunyi Xie, Jie Shen · 5 authors

With the rapid growth of blockchain, an increasing number of users have been attracted and many implementations have been refreshed in different fields. Especially in the cryptocurrency investment field, blockchain technology has shown vigorous vitality. However, along with the rise of online business, numerous fraudulent activities, e.g., money laundering, bribery, phishing, and others, emerge as the main threat to trading security. Due to the openness of Ethereum, researchers can easily access Ethereum transaction records and smart contracts, which brings unprecedented opportunities for Ethereum scams detection and analysis. This paper mainly focuses on the Ponzi scheme, a typical fraud, which has caused large property damage to the users in Ethereum. By verifying Ponzi contracts to maintain Ethereum's sustainable development, we model Ponzi scheme identification and detection as a node classification task. In this paper, we first collect target contracts' transactions to establish transaction networks and propose a detecting model based on graph convolutional network (GCN) to precisely distinguishPonzi contracts. Experiments on different real-world Ethereum datasets demonstrate that our proposed model has promising results compared with general machine learning methods to detect Ponzi schemes.

Efthimios-Enias Gojka, Niclas Kannengießer, Benjamin Sturm, Jan Bartsch · 5 authors

No abstract is available for this record.

Alexander Mühle, Andreas Grüner, Christoph Meinel

In the public mind, Bitcoin has often been associated with censorship circumvention and evasion of surveillance measures, specifically in the context of monetary transactions. However, this perceived anonymity is a false sense of security as both on-chain transactions and the underlying message exchange in the peer-to-peer network are attack vectors for deanonymisation and monitoring, as shown in other research. Nonetheless, there has been an increase in Bitcoin usage not only for end-users but also in the context of cybercrime in the form of cryptojacking and ransomware. So there are a number of reasons why proxies might be used in the Bitcoin network, either as a privacy-preserving measure of end-users or as obfuscation in cybercrime.