An increasing number of people, organizations and corporations are expressing their interest in the decentralization technology of the blockchain. The creation of the blockchain marks the time when we start building distributed peer-to-peer networks consisting of non-trusting members that interact with each other without a trusted intermediary but in a verifiable manner. In this paper, we propose a decentralized application (DApp) based on blockchain technology for sharing Internet of Things (IoT) sensors' data, and demonstrate various challenges addressed during the development process. This application combines blockchain technology with IoT and operates through smart contracts that are executed on the Ethereum blockchain. More specifically the application is a platform for sharing (buying and selling) measurements of IoT weather sensors and operates on the Ethereum blockchain, acting as a marketplace for IoT sensor data. This application applies the Sensing-as-a-Service (S2aaS) business model combined with blockchain.
Information asymmetry exists amongst stakeholders in the current food supply chain. Lack of standardization in data format, lack of regulations, and siloed, legacy information systems exasperate the problem. Global agriculture trade is increasing creating a greater need for traceability in the global supply chain. This paper introduces Harvest Network, a theoretical end-to-end, vis a vie “farm-to-fork”, food traceability application integrating the Ethereum blockchain and IoT devices exchanging GS1 message standards. The goal is to create a distributed ledger accessible for all stakeholders in the supply chain. Our design effort creates a basic framework (artefact) for building a prototype or simulation using existing technologies and protocols [1]. The next step is for industry practitioners and researchers to apply AGILE methods for creating working prototypes and advanced projects that bring about greater transparency.
Ethereum smart contract makes developers can deploy decentralized applications to inherit features from blockchain, such as decentralization and openness. Although Ethereum provided a decentralized platform, Ethereum Virtual Machine for smart contracts, it lacks of ability to fetch off-chain data. The general solution is Oracle data carrier. However, Oracle results in rising deployment costs. It requires Ethereum smart contract developers to follow format in programing contract, this constraint decreases the readability of smart contract. This paper proposes an off-chain data fetching architecture which is cost-effective and highly elastic for smart contract. It also compatible with exited contract, which makes Ethereum smart contract owner able to automate the reply process.
Puneet Puneet, Aman Chaudhary, Nitin Singh Chauhan, Abhishek Kumar
In centralized environments, the results of voting events have always been questionable and perceived differently by voters. Most existing E-Voting systems are based on centralized servers where the voters must trust the organizing authority for the integrity of the results. In this paper we propose a novel approach for a decentralized trustless voting platform that relies on Blockchain technology to solve the trust issues. The main features of this system include ensuring data integrity and transparency, and enforcing one vote per mobile phone number for every poll with ensured privacy. To accomplish this, the Ethereum Virtual Machine (EVM) is used as the Blockchain runtime environment, on which transparent, consistent and deterministic smart contracts will be deployed by organizers for each voting event to run the voting rules. Users are authenticated through their mobile phone numbers without the need of a third party server. Results showed that the system is feasible and may offer a step towards ideal environments for such experience.
3 source records
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Ethereum is the second most valuable cryptocurrency today, with a current market cap of over $68B. What sets Ethereum apart from other cryptocurrencies is that it uses the blockchain to not only store a record of transactions, but also smart contracts and a history of calls made to those contracts. Thus, Ethereum represents a new form of distributed system: one where users can implement contracts that can provide functionality such as voting protocols, crowdfunding projects, betting agreements, and many more. However, despite the massive investment, little is known about how contracts in Ethereum are actually created and used.
Ethereum, the second-largest cryptocurrency valued at a peak of $138 billion in 2018, is a decentralized, Turing-complete computing platform. Although the stability and security of Ethereum---and blockchain systems in general---have been widely-studied, most analysis has focused on application level features of these systems such as cryptographic mining challenges, smart contract semantics, or block mining operators. Little attention has been paid to the underlying peer-to-peer (P2P) networks that are responsible for information propagation and that enable blockchain consensus. In this work, we develop NodeFinder to measure this previously opaque network at scale and illuminate the properties of its nodes. We analyze the Ethereum network from two vantage points: a three-month long view of nodes on the P2P network, and a single day snapshot of the Ethereum Mainnet peers. We uncover a noisy DEVp2p ecosystem in which fewer than half of all nodes contribute to the Ethereum Mainnet. Through a comparison with other previously studied P2P networks including BitTorrent, Gnutella, and Bitcoin, we find that Ethereum differs in both network size and geographical distribution.
Son zamanlarda; blok zinciri tabanlı kripto para ödeme sistemleri(bitcoin, ethereum) oldukça popüler olmuştur. Merkezi olmayan eşler arası(P2P) ağ yapısına sahip olan bu sistemde tüm işlemler, sadece ekleme yapılabilen bir ana defterde(ledger) tutulmaktadır. Madenciler ise bu ağ yapısındaki düğümleri oluşturmaktadır, her madenci defterin yerel kopyasına sahiptir. Blok zincirinde, PoW uzlaşma protokolü işlemi onaylamakta ve zincire yeni blok eklenmesine izin vermektedir. Ödülü almak için, madenciler eşler arası ağda işlemi tamamlamak için birbirleriyle yarışırlar. Ödül sistemi, blok zinciri kullanan bitcoin’i popülerleştirmiş, fakat aynı zamanda saldırganların blok zincirine ilgisini artırmıştır. Saldırganlar tarafından blok zincirinin madenci havuzuna ve ağ yapısının güvenliğine farklı saldırılar yapılmıştır. Bu makalede, blok zinciri alt yapısına karşı mevcut saldırılar sunulmuştur. İlk bölümlerde, P2P mimarisine, uzlaşma protokolüne ve işlemlere yönelik saldırı tipleri araştırılmıştır. Bu bölümde, %51 saldırısı, Çift harcama, Finney, Vector76, Kaba Kuvvet, Sybil, Eclipse, Denge gibi saldırılar açıklanmış ve çözümler önerilmiştir. Daha sonra, Bencil madencilik ve Blok Atma, Blok Tutma(BWH), Blok Tutma Sonrası Çatallanma(FAW), Havuz sıçrama saldırısı, Cezalandırıcı Çatallanma ile Kara Listeye Alma, Köpük saldırısı ve Rüşvet Saldırısı gibi madencilik havuzuna karşı saldırılar incelenmiş ve savunma stratejileri sunulmuştur. Son bölümde de blok zinciri altyapısında kullanılan kriptografi’nin geleceği üzerinde tartışılmış ve Post Kuantum Kriptografi’nin etkilerinden bahsedilmiştir
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
In the traditional educational understanding, individuals follow the path of getting graduate or post-graduate education if they wish, after continuing their education from kindergarten to high school. Today, by getting out of this stereotype, every literate person can choose different learning environments. Now, learning any subject is up to the tip of the fingers of an individual without depending on a school building with four walls or on certain time frame. In this study, it is aimed to verify digital certificates given to the participants at the Turkish stage of the International Informatics and Computational Thinking event by using Ethereum Block Chain based smart contract. The tasks in the event were transmitted to the students in Turkey via using exam module of the Moodle Learning Management System. For this study, first a smart contract was developed in which the certificate information could be stored on the Ethereum blockchain and could be check for control purposes if necessary. Then the certificate module developed by the researcher in 2014 which uses block structure in the Moodle Learning Management System was updated and then provided to work in accordance with the smart contract in the Ethereum blockchain.
We investigate a family of bugs in blockchain-based smart contracts, which we call event-ordering (or EO) bugs. These bugs are intimately related to the dynamic ordering of contract events, i.e., calls of its functions on the blockchain, and enable potential exploits of millions of USD worth of Ether. Known examples of such bugs and prior techniques to detect them have been restricted to a small number of event orderings, typicall 1 or 2. Our work provides a new formulation of this general class of EO bugs as finding concurrency properties arising in long permutations of such events. The technical challenge in detecting our formulation of EO bugs is the inherent combinatorial blowup in path and state space analysis, even for simple contracts. We propose the first use of partial-order reduction techniques, using happen-before relations extracted automatically for contracts, along with several other optimizations built on a dynamic symbolic execution technique. We build an automatic tool called ETHRACER that requires no hints from users and runs directly on Ethereum bytecode. It flags 7-11% of over ten thousand contracts analyzed in roughly 18.5 minutes per contract, providing compact event traces that human analysts can run as witnesses. These witnesses are so compact that confirmations require only a few minutes of human effort. Half of the flagged contracts have subtle EO bugs, including in ERC-20 contracts that carry hundreds of millions of dollars worth of Ether. Thus, ETHRACER is effective at detecting a subtle yet dangerous class of bugs which existing tools miss.
The Ethereum ecosystem has created a prosperity of smart contract applications in public blockchains, with transparent, traceable and programmable transactions. However, the flexibility that everybody can write and deploy smart contracts on Ethereum causes a large collection of similar contracts, i.e., clones. In practice, smart contract clones may amplify severe threats like security attacks, resource waste etc.
Daejun Park, Yi Zhang, Manasvi Saxena, Philip Daian · 5 authors
In this paper, we present a formal verification tool for the Ethereum Virtual Machine (EVM) bytecode. To precisely reason about all possible behaviors of the EVM bytecode, we adopted KEVM, a complete formal semantics of the EVM, and instantiated the K-framework's reachability logic theorem prover to generate a correct-by-construction deductive verifier for the EVM. We further optimized the verifier by introducing EVM-specific abstractions and lemmas to improve its scalability. Our EVM verifier has been used to verify various high-profile smart contracts including the ERC20 token, Ethereum Casper, and DappHub MakerDAO contracts.
Data provenance and data integrity are among the key concerns in IoT based environments such as smart cities, smart grids, and vehicular networks etc. Many IoT devices suffer from both impersonation and data tampering attacks due to their architectural and computational limitations, which are unable to provide adequate level of security. This paper aims to provide and enforce data provenance and data integrity in IoT environments by using Physical Unclonable Functions (PUFs) and Ethereum, a blockchain variant with smart contracts. PUFs provide unique hardware fingerprints to establish data provenance while Ethereum provides a decentralized digital ledger which is able to withstand data tampering attacks.
Physical Unclonable Functions (PUFs) and Hardware Security
Neville Grech, Michael Kong, Anton Jurisevic, Lexi Brent · 6 authors
Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged inter-communicating programs that capture the transaction logic of an account. Unlike programs in mainstream languages, a gas limit restricts the execution of an Ethereum smart contract: execution proceeds as long as gas is available. Thus, gas is a valuable resource that can be manipulated by an attacker to provoke unwanted behavior in a victim's smart contract (e.g., wasting or blocking funds of said victim). Gas-focused vulnerabilities exploit undesired behavior when a contract (directly or through other interacting contracts) runs out of gas. Such vulnerabilities are among the hardest for programmers to protect against, as out-of-gas behavior may be uncommon in non-attack scenarios and reasoning about it is far from trivial. In this paper, we classify and identify gas-focused vulnerabilities, and present MadMax: a static program analysis technique to automatically detect gas-focused vulnerabilities with very high confidence. Our approach combines a control-flow-analysis-based decompiler and declarative program-structure queries. The combined analysis captures high-level domain-specific concepts (such as "dynamic data structure storage" and "safely resumable loops") and achieves high precision and scalability. MadMax analyzes the entirety of smart contracts in the Ethereum blockchain in just 10 hours (with decompilation timeouts in 8% of the cases) and flags contracts with a (highly volatile) monetary value of over $2.8B as vulnerable. Manual inspection of a sample of flagged contracts shows that 81% of the sampled warnings do indeed lead to vulnerabilities, which we report on in our experiment.
Simona Ibba, Andrea Pinna, Maria Ilaria Lunesu, Michele Marchesi · 5 authors
An ICO (Initial Coin Offering) is an innovative way to fund projects based on blockchain. The funding is based on the selling of tokens by means of decentralized applications called smart contracts written in Solidity, a programming language specific for Ethereum blockchain. The ICOs work in a volatile context and it is crucial that the team is capable of handling constant changes. The Agile methods, proven practices enabling to develop software in presence of changing requirements, could be a means for managing uncertainty. The main goals of this work are to understand software engineering activities related to ICOs, recognize the ICOs developed using Agile methods, and make a comparison between ICOs and Agile ICOs. In addition, we perform a deeper analysis of Agile ICOs concerning project planning, software development, and code features. Our work shows that the roles of the people involved in an ICO can be compared to the typical roles of the SCRUM methodology. The majority of Agile ICOs use tool of testing before storing smart contract on blockchain. Finally, the application of volumetric and complexity software metrics shows that the files of Agile ICOs is on average shorter and less complex than in other smart contracts.
Muhammad Mehar, Charles Louis Shier, Alana Giambattista, Elgar Gong · 8 authors
In spring 2016, the Distributed Autonomous Organization (The DAO) was created on Ethereum. As with Bitcoin, Ethereum uses a P2P network, where distributed ledgers are implemented as daisy-chained blocks of data. Ethereum's native cryptocurrency, Ethers are spent to execute pieces of code called smart contracts. Investors paid their Ethers for the DAO to operate and received the opportunity to vote on and become investors in venture projects proposed by Ethereum-based startups. Transactions and settlements between investors and startups are executed autonomously. The DAO experiment failed shortly after inception as an anonymous hacker stole over $50M USD worth of Ethers out of the $168M invested. The Ethereum community voted to return (or fork) the state of the network to one prior to the hack, returning Ethers back to investors and shuttering the DAO. However, this action arguably represented as a bailout—ironically, Bitcoin was conceived as a reaction against the 2008 bailout of US banks—and violated the ledger immutability and “code is law” ethos of the blockchain community.
Chengjun Cai, Jian Weng, Xingliang Yuan, Cong Wang
Blockchain has led the trend of decentralized applications and shown great use beyond cryptocurrencies. Decentralized storage such as Storj and Sia leverages blockchain to establish an open platform for sharing economy, which provides private and reliable file-outsourcing services. However, the ubiquitous keyword search function over encrypted files is yet to be supported. To enable this function, we first apply searchable encryption techniques to the decentralized setting. But this primitive can hardly ensure the service integrity. The reason is that decentralized storage commonly faces severe threats from both clients and service peers. Service peers may return partial or incorrect results, while clients may intentionally slander the service peers to avoid payments. To address these threats, we utilize the smart contract to record the logs of encrypted search (aka evidence) on the blockchain, and devise a fair protocol to handle disputes and issue fair payments. Using a dynamic-efficient searchable encryption scheme as an instantiation, we craft a concrete scheme that preserves encrypted search capability and enforces ecosystem healthiness, so that service peers are incentivized to make real efforts and jointly guarantee service reliability. We implement our scheme in Python and Solidity, and test its search performance and transaction costs on Ethereum.
Ethereum Private Sidechains are permissioned Ethereum blockchains which allow authorised participants to interact privately using Smart Contracts. Permissioned blockchains are appropriate for use in scenarios in which the list of blockchain participants and the code and state of contracts on the blockchain must be kept secret. Ethereum Registration Authorities are a system of Smart Contracts which can be used to resolve bootstrap information based on domain names to allow Ethereum Private Sidechains to be established between parties which have not previously interacted. This paper presents the architecture, design, and gas usage of a reference implementation for the Ethereum Registration Authority system. It analyses the security properties of the system and shows that it is secure, decentralized, and censorship resistant. The reference implementation gas usage is analysed and shown to be independent of the length of domain name and number of entries in the Smart Contracts.
Ji-Sun Park, Taek-Young Youn, Hye-Bin Kim, Kyung-Hyune Rhee · 5 authors
Internet of Things (IoT)-based devices, especially those used for home automation, consist of their own sensors and generate many logs during a process. Enterprises producing IoT devices convert these log data into more useful data through secondary processing; thus, they require data from the device users. Recently, a platform for data sharing has been developed because the demand for IoT data increases. Several IoT data marketplaces are based on peer-to-peer (P2P) networks, and in this type of marketplace, it is difficult for an enterprise to trust a data owner or the data they want to trade. Therefore, in this study, we propose a review system that can confirm the reputation of a data owner or the data traded in the P2P data marketplace. The traditional server-client review systems have many drawbacks, such as security vulnerability or server administrator's malicious behavior. However, the review system developed in this study is based on Ethereum smart contracts; thus, this system is running on the P2P network and is more flexible for the network problem. Moreover, the integrity and immutability of the registered reviews are assured because of the blockchain public ledger. In addition, a certain amount of gas is essential for all functions to be processed by Ethereum transactions. Accordingly, we tested and analyzed the performance of our proposed model in terms of gas required.
Interest in cryptocurrencies has skyrocketed since their introduction a decade ago, with hundreds of billions of dollars now invested across a landscape of thousands of different cryptocurrencies. While there is significant diversity, there is also a significant number of scams as people seek to exploit the current popularity. In this paper, we seek to identify the extent of innovation in the cryptocurrency landscape using the open-source repositories associated with each one. Among other findings, we observe that while many cryptocurrencies are largely unchanged copies of Bitcoin, the use of Ethereum as a platform has enabled the deployment of cryptocurrencies with more diverse functionalities.
Blockchain and Tangle are data structures used to create an immutable public record of data insured by a network of peer-to-peer participants who maintain a set of constantly growing data records known as ledgers. Blockchain and Tangle technologies are a decentralized solution that guarantees the exchange of large amounts of trusted messages, among billions of connected IoT devices, which are very valuable as they are valid and complete. This highly encrypted and secure peer-to-peer messaging mechanism is adopted in this project to manage the processing of IoT transactions and the coordination between the devices that interact with the process. To maintain private transactions, secure and trustless, the distributed consensus algorithms are responsible for validating and choosing transactions and recording them in the global ledger. The results showed that the speed of the consensus algorithms can affect the creation in real time of reliable stories that track the events of the IoT networks. After incorporating Complex Event Processing that allows selecting only those high level events, it is possible to get an improvement in many situations. The result is a Middleware system that provides a framework for the construction of large-scale computer applications that use Complex Events Processing and different decentralized ledgers such as the blockchain of Ethereum or IOTA Tangle, for secure data storage.