Ashish Rajendra Sai, Conor Holmes, Jim Buckley, Andrew Le Gear
Blockchain systems have gained substantial traction recently, partly due to the potential of decentralized immutable mediation of economic activities. Ethereum is a prominent example that has the provision for executing stateful computing scripts known as Smart Contracts. These smart contracts resemble traditional programs, but with immutability being the core differentiating factor. Given their immutability and potential high monetary value, it becomes imperative to develop high-quality smart contracts. Software metrics have traditionally been an essential tool in determining programming quality. Given the similarity between smart contracts (written in Solidity for Ethereum) and object-oriented (OO) programming, OO metrics would appear applicable. In this paper, we empirically evaluate inheritance-based metrics as applied to smart contracts. We adopt this focus because, traditionally, inheritance has been linked to a more complex codebase which we posit is not the case with Solidity based smart contracts. In this work, we evaluate the hypothesis that, due to the differences in the context of smart contracts and OO programs, it may not be appropriate to use the same interpretation of inheritance based metrics for assessment.
Gustavo Grieco, Will Song, Artur Cygan, Josselin Feist · 5 authors
Ethereum smart contracts---autonomous programs that run on a blockchain---often control transactions of financial and intellectual property. Because of the critical role they play, smart contracts need complete, comprehensive, and effective test generation. This paper introduces an open-source smart contract fuzzer called Echidna that makes it easy to automatically generate tests to detect violations in assertions and custom properties. Echidna is easy to install and does not require a complex configuration or deployment of contracts to a local blockchain. It offers responsive feedback, captures many property violations, and its default settings are calibrated based on experimental data. To date, Echidna has been used in more than 10 large paid security audits, and feedback from those audits has driven the features and user experience of Echidna, both in terms of practical usability (e.g., smart contract frameworks like Truffle and Embark) and test generation strategies. Echidna aims to be good at finding real bugs in smart contracts, with minimal user effort and maximal speed.
A proof of work (PoW) blockchain protocol distributes rewards to its participants, called miners, according to their share of the total computational power. Sufficiently large miners can perform selfish mining - deviate from the protocol to gain more than their fair share. Such systems are thus secure if all miners are smaller than a threshold size so their best response is following the protocol. To find the threshold, one has to identify the optimal strategy for miners of different sizes, i.e., solve a Markov Decision Process (MDP). However, because of the PoW difficulty adjustment mechanism, the miners' utility is a non-linear ratio function. We therefore call this an Average Reward Ratio (ARR) MDP. Sapirshtein et al.\ were the first to solve ARR MDPs by solving a series of standard MDPs that converge to the ARR MDP solution. In this work, we present a novel technique for solving an ARR MDP by solving a single standard MDP. The crux of our approach is to augment the MDP such that it terminates randomly, within an expected number of rounds. We call this Probabilistic Termination Optimization (PTO), and the technique applies to any MDP whose utility is a ratio function. We bound the approximation error of PTO - it is inversely proportional to the expected number of rounds before termination, a parameter that we control. Empirically, PTO's complexity is an order of magnitude lower than the state of the art. PTO can be easily applied to different blockchains. We use it to tighten the bound on the threshold for selfish mining in Ethereum.
Abstract Directed Graph based models of a blockchain that capture accounts as nodes and transactions as edges, evolve over time. This temporal nature of a blockchain model enables us to understand the behavior (malicious or benign) of the accounts. Predictive classification of accounts as malicious or benign could help users of the permissionless blockchain platforms to operate in a secure manner. Motivated by this, we introduce temporal features such as burst and attractiveness on top of several already used graph properties such as the node degree and clustering coefficient. Using identified features, we train various Machine Learning (ML) models and identify the algorithm that performs the best in detecting malicious accounts. We then study the behavior of the accounts over different temporal granularities of the dataset before assigning them malicious tags. For the Ethereum blockchain, we identify that for the entire dataset—the ExtraTreesClassifier performs the best among supervised ML algorithms. On the other hand, using cosine similarity on top of the results provided by unsupervised ML algorithms such as K-Means on the entire dataset, we were able to detect 554 more suspicious accounts. Further, using behavior change analysis for accounts, we identify 814 unique suspicious accounts across different temporal granularities.
The temporal nature of modeling accounts as nodes and transactions as\ndirected edges in a directed graph -- for a blockchain, enables us to\nunderstand the behavior (malicious or benign) of the accounts. Predictive\nclassification of accounts as malicious or benign could help users of the\npermissionless blockchain platforms to operate in a secure manner. Motivated by\nthis, we introduce temporal features such as burst and attractiveness on top of\nseveral already used graph properties such as the node degree and clustering\ncoefficient. Using identified features, we train various Machine Learning (ML)\nalgorithms and identify the algorithm that performs the best in detecting which\naccounts are malicious. We then study the behavior of the accounts over\ndifferent temporal granularities of the dataset before assigning them malicious\ntags. For Ethereum blockchain, we identify that for the entire dataset - the\nExtraTreesClassifier performs the best among supervised ML algorithms. On the\nother hand, using cosine similarity on top of the results provided by\nunsupervised ML algorithms such as K-Means on the entire dataset, we were able\nto detect 554 more suspicious accounts. Further, using behavior change analysis\nfor accounts, we identify 814 unique suspicious accounts across different\ntemporal granularities.\n
In che direzione stiamo andando? Come funziona un sistema IoT? L’altra faccia della medaglia. Un mezzo per la diffusione di fiducia: la blockchain. Distributed ledger technology (DLT). La blockchain di bitcoin. L'origine di bitcoin. Bitcoin come mezzo di investimento. Crittografia di bitcoin. Smart contract. Dove si scrivono gli smart contracts: Ethereum. Oltre gli smart contract: altri usi di Ethereum. Metamask, solidity e remix. Come scrivere uno smart contract. Esempi di smart contracts. Smart contract per scrivere messaggi sulla blockchain reale.
The sudden development of the COVID-19 pandemic exposed the limitations in modern healthcare systems to handle public health emergencies. It is evident that adopting innovative technologies such as blockchain can help in effective planning operations and resource deployments. Blockchain technology can play an important role in the healthcare sector such as improved clinical trial data management by reducing delays in regulatory approvals, streamline the communication between diverse stakeholders of the supply chain etc. Moreover, the spread of misinformation has intensely increased during the outbreak and existing platforms lack the ability to validate the authenticity of data, causing people to panic and act irrationally. Thus, developing a blockchain-based tracking system is important to ensure that the information received by the public and government agencies are reliable and trustworthy. In this paper, we focus on blockchain abilities to track the COVID-19 data collected from various sources including news, healthcare professionals, researchers etc, verify and append them in a secure and trusted distributed ledger. Thus, we propose a generic framework using Ethereum smart contracts and oracles to track real-time data related to the number of new cases, deaths and recovered cases obtained from trusted sources. We present detailed algorithms that capture the interactions between stakeholders in the network. The smart contract code was developed and tested in Remix environment. We present the cost and security analysis incurred by the stakeholders and highlight the challenges and future directions of our work. Our work demonstrates that the proposed solution is economically feasible and ensures data integrity, security, transparency, data traceability among stakeholders.
<p>The sudden development of the COVID-19 pandemic exposed the limitations in modern healthcare systems to handle public health emergencies. It is evident that adopting innovative technologies such as blockchain can help in effective planning operations and resource deployments. Blockchain technology can play an important role in the healthcare sector such as improved clinical trial data management by reducing delays in regulatory approvals, streamline the communication between diverse stakeholders of the supply chain etc. Moreover, the spread of misinformation has intensely increased during the outbreak and existing platforms lack the ability to validate the authenticity of data, causing people to panic and act irrationally. Thus, developing a blockchain-based tracking system is important to ensure that the information received by the public and government agencies are reliable and trustworthy. In this paper, we focus on blockchain abilities to track the COVID-19 data collected from various sources including news, healthcare professionals, researchers etc, verify and append them in a secure and trusted distributed ledger. Thus, we propose a generic framework using Ethereum smart contracts and oracles to track real-time data related to the number of new cases, deaths and recovered cases obtained from trusted sources. We present detailed algorithms that capture the interactions between stakeholders in the network. The smart contract code was developed and tested in Remix environment. We present the cost and security analysis incurred by the stakeholders and highlight the challenges and future directions of our work. Our work demonstrates that the proposed solution is economically feasible and ensures data integrity, security, transparency, data traceability among stakeholders. </p>
Federated learning enables the development of a machine learning model among collaborating agents without requiring them to share their underlying data. However, malicious agents who train on random data, or worse, on datasets with the result classes inverted, can weaken the combined model. BlockFLow is an accountable federated learning system that is fully decentralized and privacy-preserving. Its primary goal is to reward agents proportional to the quality of their contribution while protecting the privacy of the underlying datasets and being resilient to malicious adversaries. Specifically, BlockFLow incorporates differential privacy, introduces a novel auditing mechanism for model contribution, and uses Ethereum smart contracts to incentivize good behavior. Unlike existing auditing and accountability methods for federated learning systems, our system does not require a centralized test dataset, sharing of datasets between the agents, or one or more trusted auditors; it is fully decentralized and resilient up to a 50% collusion attack in a malicious trust model. When run on the public Ethereum blockchain, BlockFLow uses the results from the audit to reward parties with cryptocurrency based on the quality of their contribution. We evaluated BlockFLow on two datasets that offer classification tasks solvable via logistic regression models. Our results show that the resultant auditing scores reflect the quality of the honest agents' datasets. Moreover, the scores from dishonest agents are statistically lower than those from the honest agents. These results, along with the reasonable blockchain costs, demonstrate the effectiveness of BlockFLow as an accountable federated learning system.
Ilham Qasse, Josef Spillner, Manar Abu Talib, Qassim Nasir
Repositories are important indicators for liveness and maturity in software development communities. They host user-facing applications or re-usable artefacts to build such applications. While rarely decentralised themselves, they are important for hosting code for decentralized applications. In this study, we investigate public repositories dedicated to decentralised applications, or ĐApps, executing on heterogeneous blockchain platforms. The study is the first to report aggregated metrics on the repository-level and application-level characteristics including ĐApps metadata, associated smart contracts composition and inconsistencies between repositories in both schema and content. The main contributions are data acquisition tools and an evolving public dataset along with an initial analysis to derive key metrics in a reproducible way. Insights provided encompass the dominance of Ethereum, the absence of smart contracts for a significant portion of applications, and unused application advertisement potential by absence from popular repositories. The insights can be exploited by developers to build high-quality and highly popular applications and set up corresponding quality checks.
Patients living in a digitized world can now interact with medical professionals through online services such as chat applications, video conferencing or indirectly through consulting services. These applications need to tackle several fundamental trust issues: 1. Checking and confirming that the person they are interacting with is a real person; 2. Validating that the healthcare professional has competence within the field in question; and 3. Confirming that the healthcare professional has a valid license to practice. In this paper, we present VerifyMed - the first proof-of-concept platform, built on Ethereum, for transparently validating the authorization and competence of medical professionals using blockchain technology. Our platform models trust relationships within the healthcare industry to validate professional clinical authorization. Furthermore, it enables a healthcare professional to build a portfolio of real-life work experience and further validates the competence by storing outcome metrics reported by the patients. The extensive realistic simulations show that with our platform, an average cost for creating a smart contract for a treatment and getting it approved is around 1 USD, and the cost for evaluating a treatment is around 50 cents.
Universal connectivity is still unavailable or expensive for half of the global population, despite being critical for social participation. The deployment of crowdsourced networking infrastructures creates an opportunity for local development, where anyone can deploy a new device. In such infrastructures connectivity offer can expand incrementally and be sustainable through investment and fees resulting from the demand and consumption of content and services, including Internet access, that compensate the cost of the underlying network. While routing coordinates network data flows, economic flows can be coordinated by smart contracts built over a local distributed ledger. We define crowdsourced networks, the concept, architecture, and implementation using a local Ethereum PoA blockchain with Solidity smart contracts that compensate the data traffic contribution and consumption recorded by a traffic monitoring system, on a wireless mesh network. The prototype software has been validated in a controlled mesh network environment. Functional tests show its ability to account and route economic flows with small resource consumption, and therefore confirms these networks can develop organically by the addition of consumer and provider participants to reach the typical scale of most wireless mesh access networks and deliver networking services that aim to be socially and economically sustainable.
Academic publication of latest research results are crucial to advance the development of all disciplines. However, the current academic publication procedure lacks transparency in the review process, and reviewers do not have strong incentives to provide quality reviews for their peers. This may lead to misconducts in the review process, e.g. an anonymous reviewer may give biased comments to a paper without being noticed since the comments are seldom published for evaluation. In addition, it is ironic that the research community has to pay a lot to access papers reviewed by the community for free, though free sharing of research results is important for research advances.To address the above problems, we propose Open-Pub, a decentralized, transparent yet privacy-preserving academic publication scheme based on the blockchain technology. The blockchain promises transparency in the review process and provides an incentive mechanism based on cryptocurrency, but the privacy requirement in the double-blind review process still needs to be fulfilled. To this end, we first design a threshold identity-based group signature (TIBGS) using verifiable secret sharing to protect identity confidentiality. Then we develop a strong double-blind procedure to protect the identities of authors and reviewers. With this strong double-blind procedure, authors can choose to submit papers anonymously, and validators distribute papers anonymously to reviewers on the blockchain according to their research interests. This process is publicly recorded and traceable on the blockchain so as to realize transparent peer preview. To evaluate its efficiency, we implement Open-Pub based on Ethereum and conduct comprehensive experiments to evaluate its performance, including computation costs and processing delay. The experiment results show that Open-Pub is highly efficient in computation and processing anonymous transactions.
Blockchain-based systems open new opportunities for the IT business and society if designed and implemented properly. One of the essential challenges on their way to production readiness are severe privacy concerns and hence stringent compliance regulations. In this paper, we investigate how different privacy-preserving techniques leveraging zero-knowledge proof protocols and anonymous credentials can be used to tackle this issue on the example of a car sharing use case. Our approach considers a blockchain ecosystem enabling different parties including governmental authorities and automobile industry partners to cooperate ensuring end user privacy protection. The implemented proof-of-concept is leveraging Ethereum ZoKrates and Indy technologies respectively. This project is a joint initiative of T-Systems Multimedia Solutions GmbH and BMW Group.
João F. Ferreira, Pedro E. D. Cruz, Thomas Durieux, Abreu, Rui
Over the last few years, there has been substantial research on automated analysis, testing, and debugging of Ethereum smart contracts. However, it is not trivial to compare and reproduce that research. To address this, we present SmartBugs, an extensible and easy-to-use execution framework that simplifies the execution of analysis tools on smart contracts written in Solidity, the primary language used in Ethereum. SmartBugs is currently distributed with support for 10 tools and two datasets of Solidity contracts. The first dataset can be used to evaluate the precision of analysis tools, as it contains 143 annotated vulnerable contracts with 208 tagged vulnerabilities. The second dataset contains 47,518 unique contracts collected through Etherscan. We discuss how SmartBugs supported the largest experimental setup to date both in the number of tools and in execution time. Moreover, we show how it enables easy integration and comparison of analysis tools by presenting a new extension to the tool SmartCheck that improves substantially the detection of vulnerabilities related to the DASP10 categories Bad Randomness, Time Manipulation, and Access Control (identified vulnerabilities increased from 11% to 24%).
Non-fungible tokens are an up and coming application domain for smart contracts. Ethereum is the first blockchain-based decentralized computing platform that has standardized this type of tokens into a well-defined interface, namely ERC721. We propose a framework that provides developers with a smart contract suite that offers complete implementations of the ERC721 standard and common extensions and features frequently encountered in ERC721-based applications. We introduce a specification language that enables customization and configuration of the smart contract suite by including and excluding the supported features and extensions. We evaluate the smart contract suite for its extensibility and reusability and compare the metrics with four reference implementations tackling a similar problem. In addition to this, we evaluate and analyze the effort and efficiency of the specification language in comparison to manual configuration of the smart contract suite. Our contribution lies in examining quality metrics for code extensibility and reusability and determining the more insightful metrics for assessing these quality attributes in the context of Solidity smart contracts. Additionally, from the lines of code metric, We conclude that our specification language offers a simple and efficient alternative to manual smart contract suite customization.
Tokens are often referred to as the killer application of blockchains and cryptocurrencies. Some even believe that basically everything can be tokenized, meaning that it can be represented by a tradable digital token. With decentralized P2P networks that hold and distribute the tokens, one can build various decentralized applications around them. As a digital asset on top of a cryptocurrency, crypto tokens are managed by a smart contract, most commonly on Ethereum. A widespread high-level categorization of tokens distinguishes between payment tokens, security tokens, and utility tokens. The need for clarifying the differences lies in the fact that in most jurisdictions, security tokens are more heavily regulated than other tokens. In this work, we contribute to the detection and classification of crypto tokens from bytecode. First, we examine how ideas on regulation are currently incorporated into respective standards. Then, we discuss methods for identifying deployed token contracts from bytecode. Furthermore, we analyze deployed contracts regarding the standards to which they comply, and the type of token they may represent. Moreover, we investigate the actual usage of tokens. Our empirical analysis uses the transaction data from the Ethereum main chain up to block 8750000, mined on Oct 16, 2019.
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Distributed Ledgers and Blockchains involve decentralized networking technologies such as peer-to-peer networks. Both permissioned and unpermissioned blockchains are designed to tolerate and to overcome the failure of individual nodes, which need to update themselves once they reconnect to the blockchain network. At the same time, it is important to avoid accidental network partitioning, since partitioning can lead to inconsistent "multiple truths" and violate the shared consensus about the global state, which must be maintained across all active and re-emerging nodes. In general, reconciling inconsistent "multiple truths" would require the deletion of information which was persisted to the blockchain (in one of the network partitions), and such removal violates the core blockchain principle of audit-proof and tamper-proof "write once read many" access (WORM). However, current mainstream implementations such as Ethereum do not protect against network partitioning (either by accident or caused by an attack), and there is no research on how the consensus implementations behave in the presence of network partitioning. Given the differences in design and implementation across ledgers and blockchains, a systematic analytic approach must be established before partitioning prevention in specific products is studied. The contribution of this paper is a foundational analysis of enterprise-grade consensus protocols, including design recommendations for partitioning avoidance for Proof-of-Authority in Hyperledger Fabric. We also survey related work and lay out next research steps.
Federated learning enables the development of a machine learning model among\ncollaborating agents without requiring them to share their underlying data.\nHowever, malicious agents who train on random data, or worse, on datasets with\nthe result classes inverted, can weaken the combined model. BlockFLow is an\naccountable federated learning system that is fully decentralized and\nprivacy-preserving. Its primary goal is to reward agents proportional to the\nquality of their contribution while protecting the privacy of the underlying\ndatasets and being resilient to malicious adversaries. Specifically, BlockFLow\nincorporates differential privacy, introduces a novel auditing mechanism for\nmodel contribution, and uses Ethereum smart contracts to incentivize good\nbehavior. Unlike existing auditing and accountability methods for federated\nlearning systems, our system does not require a centralized test dataset,\nsharing of datasets between the agents, or one or more trusted auditors; it is\nfully decentralized and resilient up to a 50% collusion attack in a malicious\ntrust model. When run on the public Ethereum blockchain, BlockFLow uses the\nresults from the audit to reward parties with cryptocurrency based on the\nquality of their contribution. We evaluated BlockFLow on two datasets that\noffer classification tasks solvable via logistic regression models. Our results\nshow that the resultant auditing scores reflect the quality of the honest\nagents' datasets. Moreover, the scores from dishonest agents are statistically\nlower than those from the honest agents. These results, along with the\nreasonable blockchain costs, demonstrate the effectiveness of BlockFLow as an\naccountable federated learning system.\n
David Yakira, Avi Asayag, Ido Grayevsky, Idit Keidar
We study the problem of providing blockchain applications with \emph{economically viable randomness} (EVR), namely, randomness that has significant economic consequences. Applications of EVR include blockchain-based lotteries and gambling. An EVR source guarantees (i) secrecy, assuring that the random bits are kept secret until some predefined condition indicates that they are safe to reveal (e.g., the lottery's ticket sale closes), and (ii) robustness, guaranteeing that the random bits are published once the condition holds. We formalize the EVR problem and solve it on top of an Ethereum-like blockchain abstraction, which supports smart contracts and a transferable native coin. Randomness is generated via a distributed open commit-reveal scheme by game-theoretic agents who strive to maximize their coin holdings. Note that in an economic setting, such agents might profit from breaking secrecy or robustness, and may engage in side agreements (via smart contracts) to this end. Our solution creates an incentive structure that counters such attacks. We prove that following the protocol gives rise to a stable state, called Coalition-Proof Nash Equilibrium, from which no coalition comprised of a subset of the players can agree to deviate. In this stable state, robustness and secrecy are satisfied. Finally, we implement our EVR source over Ethereum.
Mohammad Hossein Chinaei, Hassan Habibi Gharakheili, Vijay Sivaraman
Verification of data generated by wearable sensors is increasingly becoming of concern to health service providers and insurance companies. These devices are typically vulnerable to a wide range of cybersecurity attacks, attempting to manipulate sensing data. Most of these disastrous attacks would remain undetected since neither healthcare servers nor Internet-of-Things (IoT) sensors are aware of the existence of attackers in the middle of communication. Thus, there is a need for a verification framework that various authorities can request a verification service for the local network data of a target IoT device. In this article, we leverage blockchain as a distributed platform to realize an on-demand verification scheme. This allows authorities to automatically transact with connected devices for witnessing services. A public request is made for witness statements on the data of a target IoT that is transmitted on its local network, and subsequently, devices (in close vicinity of the target IoT) offer witnessing service. Our contributions are threefold: 1) we develop a system architecture based on blockchain and smart contract that enables authorities to dynamically avail a verification service for data of a subject device from a distributed set of witnesses which are willing to provide (in a privacy-preserving manner) their local wireless measurement in exchange of monetary return; 2) we then develop a method to optimally select witnesses in such a way that the verification error is minimized subject to monetary cost constraints; and 3) finally, we evaluate the efficacy of our scheme using real Wi-Fi session traces collected from a five-storeyed building with more than thirty access points, representative of a hospital. According to the current pricing schedule of the Ethereum public blockchain, our scheme enables healthcare authorities to verify data transmitted from a typical wearable device with the verification error of the order 0.01% at cost of less than $ 2 for 1-hr witnessing service.