Nowadays, the authenticating procedure for transactions is still complicated, and the current Value-Added Tax (VAT) administration system works as centralized server, which consists of high-risk attacks from hackers. Therefore, only a few countries use digital technologies to calculate and manage the VAT payment despite of their benefits. In this paper, by combining decentralized storage network (DSN) with the smart contract (SC), we propose a new model based on Blockchain technology to authenticate the transaction, calculate Value-Added Tax and approve VAT payment. This system runs in a host computer (host PC) for encrypting and decrypting data. The smart contract is implemented in Remix Integrated Development Environment (IDE) based on the Ethereum platform. Experiential results show that the new model not only saves the cost for authenticating transactions but also protects the data from hacker’s attacks due to consensus property of the Blockchain technology.
Blockchain has attracted wide attention. A smart contract is a program that runs on the blockchain, and there is evidence that most of the smart contracts on the Ethereum are highly similar, as they share lots of repetitive code. In this study, we empirically study the repetitiveness of the smart contracts via cluster analysis and try to extract the differentiated code from the similar contracts. Differentiated code is defined as the source code except the repeated ones in two similar smart contracts, which usually illustrates how a software feature is implemented or a programming issue is solved. Then, differentiated code might be used to guide the update of a smart contract in its next version. In this paper, to support the update of a target smart contract, we apply syntax and semantic similarities to discover its similar smart contracts from more than 120,000 smart contracts, and recommend the differentiated code to the target smart contract. The promising experimental results demonstrated the differentiated code can effectively support smart contract update.
Neville Grech, Lexi Brent, Bernhard Scholz, Yannis Smaragdakis
The rise of smart contracts - autonomous applications running on blockchains - has led to a growing number of threats, necessitating sophisticated program analysis. However, smart contracts, which transact valuable tokens and cryptocurrencies, are compiled to very low-level bytecode. This bytecode is the ultimate semantics and means of enforcement of the contract. We present the Gigahorse toolchain. At its core is a reverse compiler (i.e., a decompiler) that decompiles smart contracts from Ethereum Virtual Machine (EVM) bytecode into a highlevel 3-address code representation. The new intermediate representation of smart contracts makes implicit data- and control-flow dependencies of the EVM bytecode explicit. Decompilation obviates the need for a contract's source and allows the analysis of both new and deployed contracts. Gigahorse advances the state of the art on several fronts. It gives the highest analysis precision and completeness among decompilers for Ethereum smart contracts - e.g., Gigahorse can decompile over 99.98% of deployed contracts, compared to 88% for the recently-published Vandal decompiler and under 50% for the state-of-the-practice Porosity decompiler. Importantly, Gigahorse offers a full-featured toolchain for further analyses (and a “batteries included” approach, with multiple clients already implemented), together with the highest performance and scalability. Key to these improvements is Gigahorse's use of a declarative, logic-based specification, which allows high-level insights to inform low-level decompilation.
This paper describes Slither, a static analysis framework designed to provide rich information about Ethereum smart contracts. It works by converting Solidity smart contracts into an intermediate representation called SlithIR. SlithIR uses Static Single Assignment (SSA) form and a reduced instruction set to ease implementation of analyses while preserving semantic information that would be lost in transforming Solidity to bytecode. Slither allows for the application of commonly used program analysis techniques like dataflow and taint tracking. Our framework has four main use cases: (1) automated detection of vulnerabilities, (2) automated detection of code optimization opportunities, (3) improvement of the user's understanding of the contracts, and (4) assistance with code review. In this paper, we present an overview of Slither, detail the design of its intermediate representation, and evaluate its capabilities on real-world contracts. We show that Slither's bug detection is fast, accurate, and outperforms other static analysis tools at finding issues in Ethereum smart contracts in terms of speed, robustness, and balance of detection and false positives. We compared tools using a large dataset of smart contracts and manually reviewed results for 1000 of the most used contracts.
Juan Plazuelo Pascual, Carlos Tardon Rubio, Juan Toro Cebada, Angel Hernando Veciana
This document analyzes price discovery in cryptocurrency markets by comparing centralized and decentralized exchanges, as well as spot and futures markets. The study focuses first on Ethereum (ETH) and then applies a similar approach to Bitcoin (BTC). Chapter 1 outlines the theoretical framework, emphasizing the structural differences between centralized exchanges and decentralized finance mechanisms, especially Automated Market Makers (AMMs). It also explains how to construct an order book from a liquidity pool in a decentralized setting for comparison with centralized exchanges. Chapter 2 describes the methodological tools used: Hasbrouck's Information Share, Gonzalo and Granger's Permanent-Transitory decomposition, and the Hayashi-Yoshida estimator. These are applied to explore lead-lag dynamics, cointegration, and price discovery across market types. Chapter 3 presents the empirical analysis. For ETH, it compares price dynamics on Binance and Uniswap v2 over a one-year period, focusing on five key events in 2024. For BTC, it analyzes the relationship between spot and futures prices on the CME. The study estimates lead-lag effects and cointegration in both cases. Results show that centralized markets typically lead in ETH price discovery. In futures markets, while they tend to lead overall, high-volatility periods produce mixed outcomes. The findings have key implications for traders and institutions regarding liquidity, arbitrage, and market efficiency. Various metrics are used to benchmark the performance of modified AMMs and to understand the interaction between decentralized and centralized structures.
Building trustless cross-blockchain trading protocols is challenging. Centralized exchanges thus remain the preferred route to execute transfers across blockchains. However, these services require trust and therefore undermine the very nature of the blockchains on which they operate. To overcome this, several decentralized exchanges have recently emerged which offer support for atomic cross-chain swaps (ACCS). ACCS enable the trustless exchange of cryptocurrencies across blockchains, and are the only known mechanism to do so. However, ACCS suffer significant limitations; they are slow, inefficient and costly, meaning that they are rarely used in practice. We present XCLAIM: the first generic framework for achieving trustless and efficient cross-chain exchanges using cryptocurrency-backed assets (CbAs). XCLAIM offers protocols for issuing, transferring, swapping and redeeming CbAs securely in a non-interactive manner on existing blockchains. We instantiate XCLAIM between Bitcoin and Ethereum and evaluate our implementation; it costs less than USD 0.50 to issue an arbitrary amount of Bitcoin-backed tokens on Ethereum. We show XCLAIM is not only faster, but also significantly cheaper than atomic cross-chain swaps. Finally, XCLAIM is compatible with the majority of existing blockchains without modification, and enables several novel cryptocurrency applications, such as cross-chain payment channels and efficient multi-party swaps.
Xuan Luo, Wei Cai, Zehua Wang, Xiuhua Li · 5 authors
Traditional centralized token exchange (CEX) is criticized for its security and privacy issues, since crypto currency users are required to surrender their private keys to the exchange. In contrast, decentralized token exchange (DEX) solves this issue by introducing additional trading gas fee and latency to the system. Hybrid decentralized token exchange (HEX) has been proposed to combine the advantages of CEX and DEX. However, existing HEX is still suffering from two issues. The first issue is that it is unfriendly for a trader who needs to exchange tokens frequently within a certain period of time, due to the fact that it is time-consuming and expensive. The second issue is the potential network congestion in Ethereum caused by excessive simultaneous transactions from the exchange. In this paper, we propose a payment channel based HEX, which extends existing solutions by adding a new payment channel layer to benefit frequent traders and alleviate network congestion.
Elizabeth Reilly, Matthew Maloney, Michael Siegel, Gregory Falco
Smart cities and advanced energy delivery systems are examples of IoT rich environments. These systems are responsible for communicating critical data about urban infrastructure that keeps our modern cities functioning. Today, IoT devices lack communication protocols with data integrity as a priority. Without data integrity, these systems are at risk of actuating urban environments on compromised data. Attackers can use this IoT communication flaw to wage cyber-physical attacks. We designed and developed an integrity-first communication protocol for IoT that is distributed and scalable based on the Ethereum blockchain. Our light client ensures data communication integrity for systems that require it most.
The Ethereum ecosystem has introduced a pervasive blockchain platform with programmable transactions. Everyone is allowed to develop and deploy smart contracts. Such flexibility can lead to a large collection of similar contracts, i.e., clones, especially when Ethereum applications are highly domain-specific and may share similar functionalities within the same domain, e.g., token contracts often provide interfaces for money transfer and balance inquiry. While smart contract clones have a wide range of impact across different applications, e.g., security, they are relatively little studied. Although clone detection has been a long-standing research topic, blockchain smart contracts introduce new challenges, e.g., syntactic diversity due to trade-off between storage and execution, understanding high-level business logic etc.. In this paper, we highlighted the very first attempt to clone detection of Ethereum smart contracts. To overcome the new challenges, we introduce the concept of smart contract birthmark, i.e., a semantic-preserving and computable representation for smart contract bytecode. The birthmark captures high-level semantics by effectively sketching symbolic execution traces (e.g., data access dependencies, path conditions) and maintain syntactic regularities (e.g., type and number of instructions) as well. Then, the clone detection problem is reduced to a computation of statistical similarity between two contract birthmarks. We have implemented a clone detector called EClone and evaluated it on Ethereum. The empirical results demonstrated the potential of EClone in accurately identifying clones. We have also extended EClone for vulnerability search and managed to detect CVE-2018-10376 instances.
Leonor Maria Cabrita Augusto, Rubén D. Costa, José Carlos Ferreira, Ricardo Jardim‐Gonçalves
Over the last few years, interest has emerged in blockchain, a decentralized ledger technology (DLT) created for use in cryptocurrencies, but with a great potential to be used in other application domains. One of them is supply chain management, tracking and tracing, whichare key processes to the logistics industry, made difficult due to lack of standards or trust between actors, miscommunication, fraud, bureaucratic delays, among other issues. In order to overcome some of these challenges, the solution presented in this article proposes a blockchain system application created with Ethereum smart contracts technology, to be used in supply chain and logistics for tracking and tracing products through the storage of valuabledata in a trustworthy and decentralized system. The technical solution presented here implements methods for automated tracking, certification and authentication, and integrates the communication of blockchain with IoT devices, which play a role in monitoring products and automating the tracking and clearance processes. We validate our approach by developing an application that highlights the benefits of these technologies applied to logistics, ultimatelygiving insight into the capabilities, qualities, but also limitations a system like this can have.
Smart contracts are designed to facilitate the performance of trackable and irreversible transactions without the need for third party involvement. Therefore, as a result of this lack of oversight, it is essential that these smart contracts are written and properly tested. In this paper, we examine some of the prominent risks and challenges involved with writing and implementing smart contracts and discuss how each of these challenges can be overcome. We focus on contracts executed on Ethereum, the most prominent smart contract platform.
Ningyu He, Lei Wu, Haoyu Wang, Yao Guo · 5 authors
In this paper, we present the first large-scale and systematic study to characterize the code reuse practice in the Ethereum smart contract ecosystem. We first performed a detailed similarity comparison study on a dataset of 10 million contracts we had harvested, and then we further conducted a qualitative analysis to characterize the diversity of the ecosystem, understand the correlation between code reuse and vulnerabilities, and detect the plagiarist DApps. Our analysis revealed that over 96% of the contracts had duplicates, while a large number of them were similar, which suggests that the ecosystem is highly homogeneous. Our results also suggested that roughly 9.7% of the similar contract pairs have exactly the same vulnerabilities, which we assume were introduced by code clones. In addition, we identified 41 DApps clusters, involving 73 plagiarized DApps which had caused huge financial loss to the original creators, accounting for 1/3 of the original market volume.
In Ethereum blockchain, the user needs to set a Gas price to get a transaction processed and approved by Miners. To have the transaction executed, the Gas price has to be greater than or equal to the lowest Ethereum transaction fees. This paper presents a set of data sampled every 15 seconds, from December 1st, 2018 to December 15, 2018, coming from different blockchain web APIs. The aim of the paper is to investigate whether and to what extent different variables-such as the number of pending transactions, the value of the USD/Ether pair, average electricity prices around the world, and the number of miners-influence the Ethereum transaction fees. This study is relevant from an economic perspective because more and more companies in different economic fields are adopting Ethereum blockchain. From historical data analysis, we found that only some of these variables do have an influence. For example, the number of pending transactions and the number of miners have a major influence on Ethereum transaction fees when compared to the other variables.
Oscar Delgado-Mohatar, Julián Fiérrez, Rubén Tolosana, Rubén Vera-Rodríguez
We explore practical tradeoffs in blockchain-based biometric template storage. We first discuss opportunities and challenges in the integration of blockchain and biometrics, with emphasis in biometric template storage and protection, a key problem in biometrics still largely unsolved. Blockchain technologies provide excellent architectures and practical tools for securing and managing the sensitive and private data stored in biometric templates, but at a cost. We explore experimentally the key tradeoffs involved in that integration, namely: latency, processing time, economic cost, and biometric performance. We experimentally study those factors by implementing a smart contract on Ethereum for biometric template storage, whose cost-performance is evaluated by varying the complexity of state-of-the-art schemes for face and handwritten signature biometrics. We report our experiments using popular benchmarks in biometrics research, including deep learning approaches and databases captured in the wild. As a result, we experimentally show that straightforward schemes for data storage in blockchain (i.e., direct and hash-based) may be prohibitive for biometric template storage using state-of-the-art biometric methods. A good cost-performance tradeoff is shown by using a blockchain approach based on Merkle trees.
Data owners upload large files to cloud storage servers, but malicious servers may potentially tamper data. To check integrity of remote data, Proof-of-retrievability (PoR) schemes were introduced. Existing PoR protocols assume that data owners and third-party auditors are honest and audit only the potentially malicious cloud server to check integrity of stored data. In this article, we consider a system where any party may attempt to cheat others and consider collusion cases. We design a protocol, Cumulus, that is secure under such adversarial assumptions and use blockchain smart contracts to act as mediator in case of dispute and payment settlement. We use state channels to reduce blockchain interactions in order to build a practical audit solution. The security of the protocol has been proven in Universal Composability (UC) framework. Finally, we illustrate several applications of our basic protocol and evaluate practicality of our approach via a prototype implementation for fairly selling large files over the Ethereum platform. We evaluate the prototype and show that our scheme has comparable performance.
Data owners upload large files to cloud storage servers, but malicious servers may potentially tamper data. To check integrity of remote data, Proof of Retrievability (PoR) schemes were introduced. Existing PoR protocols assume that data owners and third-party auditors are honest and audit only the potentially malicious cloud server to check integrity of stored data. In this paper we consider a system where any party may attempt to cheat others and consider collusion cases. We design a protocol that is secure under such adversarial assumptions and use blockchain smart contracts to act as mediator in case of dispute and payment settlement. We use state channels to reduce blockchain interactions in order to build a practical audit solution. We implement and evaluate a prototype using Ethereum as the blockchain platform and show that our scheme has comparable performance.
BACKGROUND: Huge amounts of health-related data are generated every moment with the rapid development of Internet of Things (IoT) and wearable technologies. These big health data contain great value and can bring benefit to all stakeholders in the health care ecosystem. Currently, most of these data are siloed and fragmented in different health care systems or public and private databases. It prevents the fulfillment of intelligent health care inspired by these big data. Security and privacy concerns and the lack of ensured authenticity trails of data bring even more obstacles to health data sharing. With a decentralized and consensus-driven nature, distributed ledger technologies (DLTs) provide reliable solutions such as blockchain, Ethereum, and IOTA Tangle to facilitate the health care data sharing. OBJECTIVE: This study aimed to develop a health-related data sharing system by integrating IoT and DLT to enable secure, fee-less, tamper-resistant, highly-scalable, and granularly-controllable health data exchange, as well as build a prototype and conduct experiments to verify the feasibility of the proposed solution. METHODS: The health-related data are generated by 2 types of IoT devices: wearable devices and stationary air quality sensors. The data sharing mechanism is enabled by IOTA's distributed ledger, the Tangle, which is a directed acyclic graph. Masked Authenticated Messaging (MAM) is adopted to facilitate data communications among different parties. Merkle Hash Tree is used for data encryption and verification. RESULTS: A prototype system was built according to the proposed solution. It uses a smartwatch and multiple air sensors as the sensing layer; a smartphone and a single-board computer (Raspberry Pi) as the gateway; and a local server for data publishing. The prototype was applied to the remote diagnosis of tremor disease. The results proved that the solution could enable costless data integrity and flexible access management during data sharing. CONCLUSIONS: DLT integrated with IoT technologies could greatly improve the health-related data sharing. The proposed solution based on IOTA Tangle and MAM could overcome many challenges faced by other traditional blockchain-based solutions in terms of cost, efficiency, scalability, and flexibility in data access management. This study also showed the possibility of fully decentralized health data sharing by replacing the local server with edge computing devices.
Peter Robinson, Raghavendra Ramesh, Sandra Johnson
Public blockchains such as Ethereum and Bitcoin do not give enterprises the privacy they need for many of their business processes. Consequently consortiums are exploring private blockchains to keep their membership and transactions private. Ethereum Private Sidechains is a private blockchain technology which allows many blockchains to be operated in parallel. Communication is needed between Ethereum Private Sidechains to allow a function in a contract on one sidechain to execute function calls which return values from, or update the state of, another sidechain. We propose a crosschain technique which allows transactions to be executed atomically across sidechains, introduce a new mechanism for proving values across sidechains, describe a transaction locking mechanism which works in the context of blockchain to enable atomic transactions, and a methodology for providing a global time-out across sidechains. We outline the programming model to be used with this technology and provide as an example, a variable amount atomic swap contract for exchanging value between sidechains. Although this paper presents Atomic Crosschain Transaction technology in the context of Ethereum Private Sidechains, we discuss how this technology can be readily applied to many blockchain systems to provide cross-blockchain transactions.
A bug or error is a common problem that any software or computer program may encounter. It can occur from badly writing the program, a typing error or bad memory management. However, errors can become a significant issue if the unsafe program is used for critical systems. Therefore, formal methods for these kinds of systems are greatly required. In this paper, we use a formal language that performs deductive verification on an Ethereum Blockchain application based on smart contracts, which are self-executing digital contracts. Blockchain systems manipulate cryptocurrency and transaction information. Therefore , if a bug occurs in the blockchain, serious consequences such as a loss of money can happen. Thus, the aim of this paper is to propose a language dedicated to deductive verification, called Why3, as a new language for writing formal and verified smart contracts, thereby avoiding attacks exploiting such contract execution vulnerabilities. We first write a Why3 smart contracts program; next we formulate specifications to be proved as absence of RunTime Error properties and functional properties, then we verify the behavior of the program using the Why3 system. Finally we compile the Why3 contracts to the Ethereum Virtual Machine (EVM). Moreover, we give a set of generic mathematical statements that allows verifying functional properties suited to any type of smart contracts holding cryptocurrency, showing that Why3 can be a suitable language to write smart contracts. To illustrate our approach, we describe its application to a realistic industrial use case.
Past security incidents of smart contracts on the Ethereum blockchain has proved to be disastrous - incurring losses of upwards of a few hundred million USD to date. As the attacks occurred due to semantic errors in smart contracts itself, specialized security tools which employed traditional software techniques such as symbolic analysis proved to be valuable in the detection of such vulnerable contracts; however its coverage and efficiency is limited by factors such as the depth of its search which comes at a cost of execution time. Meanwhile, the adoption of smart contracts on Ethereum has increased 176-fold since December 2015 – if these tools fail to keep up with the growth of contracts, similar incidents on a greater scale might occur in the future. In this project, we aim to contribute to the security landscape of smart contracts by proposing an efficient smart contract vulnerability detection system. We explored the approach of machine learning to vulnerability detection in smart contracts and trained a long-short term memory (LSTM) model on approximately 1.7 million contracts obtained from Google's BigQuery dataset and achieved encouraging results. We observed a detection accuracy of 99.40%, with a recall score of 89.81% in detecting vulnerable smart contracts, accompanied with significantly better performance with the model taking less than a tenth of the time required to classify a contract compared to that of a prominent symbolic tool such as Maian. In addition, a web application was developed to demonstrate the efficiency of our approach in classifying smart contracts at scale.
This study examines whether the market efficiencies of major cryptocurrencies (e.g., Bitcoin, Ethereum, and Ripple) change over time based on the adaptive market hypothesis (AMH) of Lo (2004). In particular, we measure the degree of market efficiency using Ito et al.'s (2014, 2016, 2017) generalized least squares-based time-varying model. The empirical results show that (1) the degree of market efficiency varies with time in cryptocurrency markets, (2) the market efficiency level of Bitcoin is higher than that of the other markets over most periods, and (3) the market efficiency of cryptocurrencies has evolved. We conclude that the results support the AMH for the established cryptocurrency market.