Blockchain Papers

Rajat Verma, Namrata Dhanda, Vishal Nagar

No abstract is available for this record.

Levy Marlon Souza Santiago, Jauberth Weyll Abijaude, Fabíola Greve

Blockchain is a disruptive technology that offers a secure decentralized network, and allows for direct transactions between distributed entities, without the need for a trusted third party. Smart contracts are executable codes hosted on the blockchain and enable the implementation of several decentralized applications, in different domains. However, due to the complexity of contract construction, it is necessary to seek ways to facilitate and make this innovative development process robust. This paper presents Gifflar, a framework for generating smart contract code on the fly, in such a way that it allows a system to write, compile and implement blockchain contracts with a decentralized application still running. Gifflar is structured in components that implement design patterns to better define the responsibility of each one of the parts and exports a simple interaction module for contract modeling in JSON and automatic code writing using the TypeScript language. As far as we know, this framework is one of the first to generate contracts dynamically at run time. Thus, the work contributes to the state of the art by addressing a new paradigm, where systems can act as smart contract developers.

Keerthi Nelaturu, Sidi Mohamed Beillahi, Fan Long, Andreas Veneris

Smart contracts facilitate the execution of programmable code on a blockchain. The cost for executing smart contract code is metered using gas - the exact amount of which is based on the computational complexity of the underlying smart contract. Hence, it is imperative to optimize smart contract code to reduce gas consumption and, in some instances, to even avoid malicious attacks. In this paper, we propose an approach to optimize the gas consumption of smart contracts, specifically loop control structures. We present a prototype implementation of our approach using off-the-shelf tools for Solidity smart contracts. We experimentally evaluate our technique using 72 Solidity smart contracts. Our evaluation demonstrates the average gas cost savings per transaction to be around 23,943 gas units, or an equivalent 21% decrease in gas costs. Although the approach causes a slight increase in deployment costs due to the additional internal functions, this is only 16,710 gas units on the average, or a 5% of the total deployment cost. As this overhead remains quite reasonable when compared to the gas cost savings for each transaction, it also confirms the efficacy, practicality and effectiveness of the proposed methodology.

Azza Abdullah Alnssayan, Mohammad Mahdi Hassan, Suliman A. Alsuhibany

The digitalization of healthcare-related information service systems has become a trend across the world. However, several crucial services are still provided manually due to a lack of trust in digital solutions. One such service is keeping records of children’s vaccination, which still relies on a paper-based file system in most parts of the world. This approach causes serious data integrity problems. Recently, healthcare has become a potential application area of the blockchain, as it can preserve and protect highly sensitive private medical records while sharing these records in a decentralized manner without losing personal ownership. Therefore, we propose a new digital model to track a child’s vaccination records using blockchain. In particular, this proposed application helps improve the vaccination record-keeping process by ensuring the integrity of the preserved data in a more secure way. In an emerging pandemic situation, our approach can be extended to manage the overall vaccination process effectively.

José Antonio Muñoz Blanco, Antonio J. Tallón‐Ballesteros

No abstract is available for this record.

Amir Ali, Zain Ul Abideen, Kalim Ullah

Ethereum smart contracts have been gaining popularity toward the automation of so many domains, i.e., FinTech, IoT, and supply chain, which are based on blockchain technology. The most critical domain, e.g., FinTech, has been targeted by so many successful attacks due to its financial worth of billions of dollars. In all attacks, the vulnerability in the source code of smart contracts is being exploited and causes the steal of millions of dollars. To find the vulnerability in the source code of smart contracts written in Solidity language, a state-of-the-art work provides a lot of solutions based on dynamic or static analysis. However, these tools have shown a lot of false positives/negatives against the smart contracts having complex logic. Furthermore, the output of these tools is not reported in a standard way with their actual vulnerability names as per standards defined by the Ethereum community. To solve these problems, we have introduced a static analysis tool, SESCon (secure Ethereum smart contract), applying the taint analysis techniques with XPath queries. Our tool outperforms other analyzers and detected up to 90% of the known vulnerability patterns. SESCon also reports the detected vulnerabilities with their titles, descriptions, and remediations as per defined standards by the Ethereum community. SESCon will serve as a foundation for the standardization of vulnerability detection.

Oluwafemi Olukoya

No abstract is available for this record.

Adhitya Bhawiyuga, Achmad Basuki, Nugraha Wiguna Tiera

E-Voting system generally adopts the client-server architecture where the server is the responsible entity of all data in the system. Such a system poses several issues regarding information security such as data integrity of the election result, the confidentiality of voter identity with its vote and the auditability of transactions. This research presents an implementation of blockchain-based Ethereum on the E-Voting system to protect the information security with a distributed storage. The e-Voting system is implemented with three main components: private blockchain network, smart contract, and web service as an interface to manager and voters. The functional evaluation on the data store, display, update, delete, verify voters, authenticate voters, and the integrity of the election process in the private blockchain network are all well-functioning, even without an overvote. The nonfunctional evaluation shows that the system can guarantee the data integrity of the election result, the confidentiality of voter identity with its selection, the auditability of transactions, and the maximum scale of load that system can handle. Based on these results, E-Voting system with a blockchain-based Ethereum give a better alternative than those implemented with a client-server architecture.

Alessio Catalfamo, Armando Ruggeri, Antonio Celesti, Maria Fazio · 5 authors

Nowadays, the increasing complexity of digital applications for social and business activities has required more and more advanced mechanisms to prove the identity of subjects like those based on the Two-Factor Authentication (2FA). Such an approach improves the typical authentication paradigm but it has still some weaknesses. Specifically, it has to deal with the disadvantages of a centralized architecture causing several security threats like denial of service (DoS) and man-in-the-middle (MITM). In fact, an attacker who succeeds in violating the central authentication server could be able to impersonate an authorized user or block the whole service. This work advances the state of art of 2FA solutions by proposing a decentralized Microservices and Blockchain Based One Time Password (MBB-OTP) protocol for security-enhanced authentication able to mitigate the aforementioned threats and to fit different application scenarios. Experiments prove the goodness of our MBB-OTP protocol considering both private and public Blockchain configurations.

Monika di Angelo, Gernot Salzer

Abstract Next to cryptocurrencies, tokens are a widespread application area of blockchains. Tokens are digital assets implemented as small programs on a blockchain. Being programmable makes them versatile and an innovative means for various purposes. Tokens can be used as investment, as a local currency in a decentralized application, or as a tool for building an ecosystem or a community. A high-level categorization of tokens differentiates between payment, security, and utility tokens. In most jurisdictions, security tokens are regulated, and hence, the distinction is of relevance. In this work, we discuss the identification of tokens on Ethereum, the most widely used token platform. The programs on Ethereum are called smart contracts, which—for the sake of interoperability—may provide standardized interfaces. In our approach, we evaluate the publicly available transaction data by first reconstructing interfaces in the low-level code of the smart contracts. Then, we not only check the compliance of a smart contract with an established interface standard for tokens, but also aim at identifying tokens that are not fully compliant. Thus, we discuss various heuristics for token identification in combination with possible definitions of a token. More specifically, we propose indicators for tokens and evaluate them on a large set of token and non-token contracts. Finally, we present first steps toward an automated classification of tokens regarding their purpose.

Mirko Staderini, Andrea Bondavalli

No abstract is available for this record.

Malaw Ndiaye, Karim Konaté

No abstract is available for this record.

Randa Kamal, Ezz El‐Din Hemdan, Nawal El‐Fishway

No abstract is available for this record.

Muhammad Naveed Aman, Uzair Javaid, Biplab Sikdar

One of the important characteristics envisioned for 6G is security function virtualization (SFV). Similar to network function virtualization (NFV) in 5G networks, SFV provides new opportunities for improving security while reducing the security overhead. In particular, it provides an attractive way of solving compatibility issues related to security. Malware in Internet of Things (IoT) systems is gaining popularity among cyber-criminals because of the expected number of IoT devices in 5G and 6G networks. To solve this issue, this article proposes a security framework that exploits softwarization of security functions via SFV to improve trust in IoT systems and contain the propagation of malware. IoT devices are categorized into trusted, vulnerable, and compromised levels using remote attestation. To isolate the devices in the three distinct categories, NFV is used to create separate networks for each category, and a distributed ledger is used to store the state of each device. Virtualized remote attestation routines are employed to avoid any compatibility issues among heterogeneous IoT devices and effectively contain malware propagation. The results show that the proposed framework can reduce the number of infected devices by 66 percent in only 10 seconds.

Di Zhu, Jianmin Pang, Xin Zhou, Wenjie Han

As the mainstream of smart contract research, most Ethereum smart contracts do not open their source code, and the bytecode of smart contracts has attracted the attention of researchers. Based on the similarity measurement of smart contract bytecode, a series of tasks such as vulnerability mining, contract upgrading and malicious contract detection can be carried out. This paper proposes a method to measure the similarity of smart contract bytecode. Firstly, the key opcode combination of smart contract is summarized. When traversing the CFG(control flow graph) constructed by decompilation of smart contract bytecode, the opcodes in the basic block are pattern matched, and the features between the basic blocks are extracted according to the in-out degree, so as to enhance the similarity measurement effect of contract semantics in vector space. The experimental results show that the proposed method is greatly improved compared with the baseline.

Ali Raheem, Rand Raheem, Tom Chen, Ahmed Alkhayyat

Ransomware is one of the malicious software that is designed to prevent access to computer system until a sum of money is paid by the victim to the attacker. During the infection, the computer will either be locked, or the data will be encrypted. Ransoms are often demanded in Bitcoin, a largely anonymous Cryptocurrency. All transactions are recorded in the blockchain and verified by peer-to-peer networks. This paper investigation collects ten recent ransomware families, which use bitcoin as a payment for their ransom. In conjunction, we identified, collected and analysed Bitcoin addresses of users combining information from a clustering model and the blockchain. We used a heuristic clustering algorithm to reveal the hidden node’s payment of ransomware. Finally, we demonstrated the characteristics of ransomware encryption mechanisms that include a view of the infected process and its execution, and the distinctive demands of ransom.

Teng Zhou, Kui Liu, Li Li, Zhe Liu · 6 authors

With the boom of Initial Coin Offerings (ICO) in the financial markets, smart contracts have gained rapid popularity among consumers. Smart contract vulnerabilities however made them a prime target to malicious attacks that are leading to huge losses. The research community is thus applying various software engineering technologies to smart contracts to address them. In general, to detect vulnerabilities in smart contracts, mutation and fuzz based testing approaches have been widely studied and indeed achieved promising performance on benchmark datasets. Generating test inputs with mutation approaches essentially relies on the available test cases in a smart contract program. In our preliminary study, however, we observed that 56.4% of 218 identified open-source smart contract project repositories do not provide any test case for validation. Fuzzing test inputs leads to random values and lacks practical usefulness. Our work addresses this problem: we propose an approach, Smartgift, which generates practical inputs for testing smart contracts by learning from the transaction records of real-world smart contracts. Leveraging a collected set of over 60 thousand transaction records, Smartgift is able to generate relevant test inputs for ~77% smart contract functions, largely outperforming the traditional fuzzing approach (successful for only 60% functions). We further demonstrate the practicality of the test inputs by using them to replace the test inputs of the ContractFuzzer state of the art smart contract vulnerability detector: with inputs by Smartgift, ContractFuzzer can now detect 131 of the 154 vulnerabilities in its benchmark.

Nikolay Ivanov, Qiben Yan

Hardware wallets are designed to withstand malware attacks by isolating their private keys from the cyberspace, but they are vulnerable to the attacks that fake an address stored in a clipboard. To prevent such attacks, a hardware wallet asks the user to verify the recipient address shown on the wallet display. Since crypto addresses are long sequences of random symbols, their manual verification becomes a difficult task. Consequently, many users of hardware wallets elect to verify only a few symbols in the address, and this can be exploited by an attacker. In this work, we introduce EthClipper, an attack that targets owners of hardware wallets on the Ethereum platform. EthClipper malware queries a distributed database of pre-mined accounts in order to select the address with maximum visual similarity to the original one. We design and implement a EthClipper malware, which we test on Trezor, Ledger, and KeepKey wallets. To deliver computation and storage resources for the attack, we implement a distributed service, ClipperCloud, and test it on different deployment environments. Our evaluation shows that with off-the-shelf PCs and NAS storage, an attacker would be able to mine a database capable of matching 25% of the digits in an address to achieve a 50% chance of finding a fitting fake address. For responsible disclosure, we have contacted the manufactures of the hardware wallets used in the attack evaluation, and they all confirm the danger of EthClipper.

Qasem Abu Al‐Haija, Abdulaziz A. Alsulami

The Bitcoin cryptocurrency is a worldwide prevalent virtualized digital currency conceptualized in 2008 as a distributed transactions system. Bitcoin transactions make use of peer-to-peer network nodes without a third-party intermediary, and the transactions can be verified by the node. Although Bitcoin networks have exhibited high efficiency in the financial transaction systems, their payment transactions are vulnerable to several ransomware attacks. For that reason, investigators have been working on developing ransomware payment identification techniques for bitcoin transactions’ networks to prevent such harmful cyberattacks. In this paper, we propose a high performance Bitcoin transaction predictive system that investigates the Bitcoin payment transactions to learn data patterns that can recognize and classify ransomware payments for heterogeneous bitcoin networks. Specifically, our system makes use of two supervised machine learning methods to learn the distinguishing patterns in Bitcoin payment transactions, namely, shallow neural networks (SNN) and optimizable decision trees (ODT). To validate the effectiveness of our solution approach, we evaluate our machine learning based predictive models on a recent Bitcoin transactions dataset in terms of classification accuracy as a key performance indicator and other key evaluation metrics such as the confusion matrix, positive predictive value, true positive rate, and the corresponding prediction errors. As a result, our superlative experimental result was registered to the model-based decision trees scoring 99.9% and 99.4% classification detection (two-class classifier) and accuracy (multiclass classifier), respectively. Hence, the obtained model accuracy results are superior as they surpassed many state-of-the-art models developed to identify ransomware payments in bitcoin transactions.

Shraddha R. Khonde, V. Ulagamuthalvi

Exchange of data in networks necessitates provision of security and confidentiality. Most networks compromised by intruders are those where the exchange of data is at high risk. The main objective of this paper is to present a solution for secure exchange of attack signatures between the nodes of a distributed network. Malicious activities are monitored and detected by the Intrusion Detection System (IDS) that operates with nodes connected to a distributed network. The IDS operates in two phases, where the first phase consists of detection of anomaly attacks using an ensemble of classifiers such as Random forest, Convolutional neural network, and XGBoost along with genetic algorithm to improve the performance of IDS. The novel attacks detected in this phase are converted into signatures and exchanged further through the network using the blockchain framework in the second phase. This phase uses the cryptosystem as part of the blockchain to store data and secure it at a higher level. The blockchain is implemented using the Hyperledger Fabric v1.0 and v2.0, to create a prototype for secure signature transfer. It exchanges signatures in a much more secured manner using the blockchain architecture when implemented with version 2.0 of Hyperledger Fabric. The performance of the proposed blockchain system is evaluated on UNSW NB15 dataset. Blockchain performance has been evaluated in terms of execution time, average latency, throughput and transaction processing time. Experimental evidence of the proposed IDS system demonstrates improved performance with accuracy, detection rate and false alarm rate (FAR) as key parameters used. Accuracy and detection rate increase by 2% and 3% respectively whereas FAR reduces by 1.7%.

Abdul Razaque, Abrar Al Ajlan, Noussaiba Melaoune, Munif Alotaibi · 9 authors

Modern information technology (IT) is well developed, and almost everyone uses the features of IT and services within the Internet. However, people are being affected due to cybersecurity threats. People can adhere to the recommended cybersecurity guidelines, rules, adopted standards, and cybercrime preventive measures to largely mitigate these threats. The ignorance of or lack of cybersecurity knowledge also causes a critical problem regarding confidentiality and privacy. It is not possible to fully avoid cybercrimes that often lead to sufficient business losses and spread forbidden themes (disgust, extremism, child porn, etc.). Therefore, to reduce the risk of cybercrimes, a web-based Blockchain-enabled cybersecurity awareness program (WBCA) process is introduced in this paper. The proposed WBCA trains users to improve their security skills. The proposed program helps with understanding the common behaviors of cybercriminals and improves user knowledge of cybersecurity hygiene, best cybersecurity practices, modern cybersecurity vulnerabilities, and trends. Furthermore, the proposed WBCA uses Blockchain technology to protect the program from potential threats. The proposed program is validated and tested using real-world cybersecurity topics with real users and cybersecurity experts. We anticipate that the proposed program can be extended to other domains, such as national or corporate courses, to increase the cybersecurity awareness level of users. A CentOS-based virtual private server is deployed for testing the proposed WBCA to determine its effectiveness. Finally, WBCA is also compared with other state-of-the-art web-based programs designed for cybersecurity awareness.

Jiachi Chen, Xin Xia, David Lo, John Grundy · 5 authors

No abstract is available for this record.

Lu Liu, Lili Wei, Wuqi Zhang, Ming Wen · 6 authors

Smart contracts are programs stored on blockchains to execute transactions. When input constraints or security properties are violated at runtime, the transaction being executed by a smart contract needs to be reverted to avoid undesirable consequences. On Ethereum, the most popular blockchain that supports smart contracts, developers can choose among three transaction-reverting statements (i.e., require, if…revert, and if…throw) to handle anomalous transactions. While these transaction-reverting statements are vital for preventing smart contracts from exhibiting abnormal behaviors or suffering malicious attacks, there is limited understanding of how they are used in practice. In this work, we perform the first empirical study to characterize transaction-reverting statements in Ethereum smart contracts. We measured the prevalence of these statements in 3,866 verified smart contracts from popular dapps and built a taxonomy of their purposes via manually analyzing 557 transaction-reverting statements. We also compared template contracts and their corresponding custom contracts to understand how developers customize the use of transaction-reverting statements. Finally, we analyzed the security impact of transaction-reverting statements by removing them from smart contracts and comparing the mutated contracts against the original ones. Our study led to important findings. For example, we found that transaction-reverting statements are commonly used to perform seven types of authority verifications or validity checks, and missing such statements may compromise the security of smart contracts. We also found that current smart contract security analyzers cannot effectively handle transaction-reverting statements when detecting security vulnerabilities. Our findings can shed light on further research in the broad area of smart contract quality assurance and provide practical guidance to smart contract developers on the appropriate use of transaction-reverting statements.

Subhasish Goswami, Rabijit Singh, Nayanjeet Saikia, Kaushik Kumar Bora · 5 authors

The use of Ethereum based tokens in blockchain applications have been on the rise in recent times and accordingly, the need for proper analysis of token source codes for security vulnerabilities has become paramount. Existing symbolic analysis tools have demonstrated to be efficient in detecting many of the security vulnerabilities, but by virtue of the complex nature of the analysis they perform to detect vulnerable paths, there is a considerable increase in search time with an increase in depth. Cryptocurrencies have recently achieved the milestone of a USD 2 trillion market cap and with such a high volume of assets involved, the need for an efficient and scalable security vulnerability detection tool in an ever-increasing list of tokens becomes of utmost priority. This paper proposes a deep learning based approach for the prediction of security vulnerabilities in ERC-20 token smart contracts. The proposal proposed by this paper is based on the use of Long Short-Term Memory neural network architecture on smart contract opcodes which are in form of sequential data. The proposed solution achieves an accuracy of 93.26% when tested on ERC-20 smart contracts collected from Ethereum mainnet and thus proves to be an efficient alternative for existing symbolic tools.