Blockchain Papers

Ahmed Lekssays, Luca Landa, Barbara Carminati, Elena Ferrari

No abstract is available for this record.

Wenjun Fan, Sang‐Yoon Chang, Xiaobo Zhou, Shouhuai Xu

Bitcoin is a representative cryptocurrency system using a permissionless peer-to-peer (P2P) network as its communication infrastructure. A number of attacks against Bitcoin have been discovered over the past years, including the Eclipse and EREBUS Attacks. In this paper, we present a new attack against Bitcoin’s P2P networking, dubbed ConMan because it leverages connection manipulation. ConMan achieves the same effect as the Eclipse and EREBUS Attacks in isolating a target (i.e., victim) node from the rest of the Bitcoin network. However, ConMan is different from these attacks because it is an active and deterministic attack, and is more effective and efficient. We validate ConMan through proof-of-concept exploitation in an environment that is coupled with real-world Bitcoin node functions. Experimental results show that ConMan only needs a few minutes to fully control the peer connections of a target node, which is in sharp contrast to the tens of days that are needed by the Eclipse and EREBUS Attacks. Further, we propose several countermeasures against ConMan. Some of them would be effective but incompatible with the design principles of Bitcoin, while the anomaly detection approach is positively achievable. We disclosed ConMan to the Bitcoin Core team and received their feedback, which confirms ConMan and the proposed countermeasures.

Manxiang Yang, Baopeng Ye, Yuling Chen, Tao Li · 6 authors

There are some problems such as behavior deception and service swing while utilizing distributed k-anonymity technology to construct an anonymous domain. If the malicious nodes submit a false location coordinate to take participate in the process of constructing, the coordinate of the honest node will be leaked, and the attacker will increase the reputation illegally. To tackle those problems, we propose a de-swinging scheme based on the smart contract for location privacy protection. Primarily, a de-swinging reputation evaluation method (DREM) is introduced, in which participants prefer to choose nodes with high reputations to complete the construction process of the anonymous domain. In this method, we design a penalty factor to curb malicious behavior. Besides, based on our proposed DREM, a cridible cloaking area is constructed to protect the location privacy of the request nodes. We utilize smart contract to calculate reputation automatically during the process of construction. Finally, the security analysis and simulation results indicate that our proposed scheme can effectively resist malicious attacks, detect malicious nodes quickly, encourage nodes to participate honestly in the construction of anonymous domain.

Kexin Zou, Jinqiao Shi, Yue Gao, Xuebin Wang · 7 authors

Bitcoin is a virtual encrypted digital currency based on a peer-to-peer network. In recent years, for higher anonymity, more and more Bitcoin users try to use Tor hidden services for identity and location hiding. However, previous studies have shown that Tor are vulnerable to traffic fingerprinting attack, which can identify different websites by identifying traffic patterns using statistical features of traffic. Our work shows that traffic fingerprinting attack is also effective for the Bitcoin hidden nodes detection. In this paper, we proposed a novel lightweight Bitcoin hidden service traffic fingerprinting, using a random decision forest classifier with features from TLS packet size and direction. We test our attack on a novel dataset, including a foreground set of Bitcoin hidden node traffic and a background set of different hidden service websites and various Tor applications traffic. We can detect Bitcoin hidden node from different Tor clients and website hidden services with a precision of 0.989 and a recall of 0.987, which is higher than the previous model.

Yuxing Tang, Zihao Li, YanXu Bai

Smart contract is one of the key technologies of the blockchain and is becoming more and more popular. But at the same time, the economic losses caused by the vulnerabilities of smart contracts have also emerged in recent years. One of the most famous smart contract security issues is reentrancy. There have been many related reports and researches on reentrancy. However, the existing methods only pay attention to offensive reentrancy one-sidedly, but do not conduct a systematic and comprehensive analysis of reentrancy and some existing reentrant detection methods for smart contracts often have high false positives(FPs). We proposed a more accuracy and comprehensive detection and analysis method of reentrancy from real Ethereum transactions. In general, we used Datalog-based formulation to detect reentrant transactions in real world of Ethereum, and compared the detection results with other tools. We finally detected 2,712 reentrant transactions and 10 vulnerable smart contracts with zero false positive, furthermore, we found that many vulnerable contracts detected by other tools did not trigger real reentrant transactions. We summarized the problems in the existing detection tools and gave effective preventive measures. In addition, we also analyzed the detected benign reentrancy to further confirm the above findings, and the discovery that benign reentrancy also has its certain application scenario.

Basilius Bias Astho Christyono, Moeljono Widjaja, Arya Wicaksana

Current advances in information technology have brought about significant changes, including ways to carry out elections using computer technology known as e-voting. Blockchain underlies the popularity of the digital currency Bitcoin and some other digital money, sparking the start of a new era of Internet use, including electronic voting (e-voting) system. In this work, we proposed designing and implementing an evoting system powered by the Ethereum blockchain. We used real-world data from the Indonesian Election Commission (KPU) with 26 candidates and 15,725 voters from the Jelupang sub-district. The testing and evaluation results using three miners in the blockchain show that the system could commit around 23 transactions per second. All 15,725 votes are committed to the blockchain successfully within 12.75 minutes. The total time required for creating all blockchain accounts is 13.4 hours.

Javier Díaz-Santiso, Paula Fraga‐Lamas

The emergence of the current pandemic has led to a new reality in which bureaucratic formalities have been affected in terms of health security, procedures, resource management, among others. Specifically, in the electoral processes, where the difficulty of fulfilling the social distance and the mobility restrictions reopen the debate on the implementation of other more advanced and modern alternatives, such as electronic voting (e-voting). This article presents the design and implementation of a decentralized e-voting system that has the potential to provide a higher level of transparency, security, and cost-efficiency. Hyperledger Fabric blockchain and smart contracts are used to cast votes, which are then recorded in an immutable way, giving voters anonymity and trust in the fairness of the election process. In addition, promising results of the performance of the e-voting system in terms of latency and transaction load are presented.

Meng-Hsuan Fu, An-Shyang Lee

Ballots are often hold for fair decisions such as party theme selecting, however, the existing traditional ballot has some problems involving amount of human resources, cost of places, equipment, time and traffic, and repeated procedures. In order to solve the issues aforementioned, a ballot blockchain system is designed and implemented based on the smart contract of Ethereum. It is designed on the core blockchain technologies of the decentralized ledger technology, using a secure hash algorithm, anonymous user, incorruptible data, and adopting a public blockchain. The ballot blockchain system is implemented based on the MetaMask verification and the Remix interface development environment. The smart contract plays the role of the decision-maker for controlling ballot activities instead of numerous human tasks. All ballot transactions are recorded in the ballot blockchain permanently when the ballot completed. The aim of the ballot blockchain system is to achieve a fair, less time-consuming, secured, and transparent environment.

Jean-Philippe Eisenbarth, Thibault Cholez, Olivier Perrin

The Bitcoin peer-to-peer network ensures the consensus between the different nodes responsible for the propagation of the blocks containing the validated bitcoin transactions. The quality and safety of this network are therefore particularly essential. In this work, we present a study of the public nodes that form the backbone of the Bitcoin p2p network. We analyze the results of our measurement campaign that was made following a well-defined and reproducible methodology. In particular we analyze several criteria that can affect the network resilience: distribution and security assessment of the clients' versions, churn, detection of Sybil nodes, dynamicity and popularity of peers. We also investigate the countermeasures deployed to prevent an accurate inference of the network topology and show their effectiveness.

Eduardo Takeo Ueda, Marcelo Moro Da Silva, Anderson Silva, Norisvaldo Ferraz · 8 authors

Transparency and security in an electoral process are fundamental to the legitimacy of the results and the confidence of voters. Thus, it is necessary to assess opportunities to improve traditional voting systems. Among the main problems is the lack of transparency, due to the impossibility of a voter checking their vote and the lack of access to the source from which the results are obtained. Another problem is mobility, due to the impossibility of performing remote voting, as traditional voting systems continue to require the physical presence of the voter in an electoral zone. Thus, the objective of this work is to propose a voting system that is functional, transparent, safe, and accessible to everyone. Voters can vote through a mobile application with biometric authentication using fingerprint and password access. In our proposal, votes are registered in an Ethereum Blockchain through a Smart Contract, allowing the voter to check their vote. The results are expected to collaborate with the evolution of studies necessary to improve traditional voting systems, especially in fundamental aspects such as security, transparency, and mobility.

Yonatan Sompolinsky, Shai Wyborski, Aviv Zohar

In 2008 Satoshi Nakamoto invented the basis for blockchain-based distributed ledgers. The core concept of this system is an open and anonymous network of nodes, or miners, which together maintain a public ledger of transactions. The ledger takes the form of a chain of blocks, the blockchain, where each block is a batch of new transactions collected from users. One primary problem with Satoshi's blockchain is its highly limited scalability. The security of Satoshi's longest chain rule, more generally known as the Bitcoin protocol, requires that all honest nodes be aware of each other's blocks very soon after the block's creation. To this end, the throughput of the system is artificially suppressed so that each block fully propagates before the next one is created, and that very few "orphan blocks" that fork the chain be created spontaneously.

H S Govinda, Yogesh Chandrakant, D S Girish, S. Lokesh · 6 authors

Online voting system the most suitable replacement for the older generations paper ballot system and the nowadays trending Electronic Voting Machines (EVM). Every year by year the technology tries to reach its peak with immense exploration by revolutionizing the technology which makes the human life with more coloring. Today's Internet gives us access to a wide range of resources, information easily in a second. Among other such experiments is Blockchain. With its special features such as consistency and architecture, many companies, applications are increasingly moving towards them. One major usage of blockchain can be found in electronic-voting system. We can ensure the transparency of the election by placing all messages or details in the Ethereum blockchain, which keeps the privacy of each voter protected with maximum security and provides an effective sign-up process. Blockchain advantages on online-voting systems includes nonchangeable feature called immutable ledger of votes casted using time stamp method, security of voting system, instant validation of votes and counting of votes and updating in public ledger which does not depending upon the number of nodes in the blockchain network.

Tomislav Stipanić

U ovom diplomskom radu je izrađena mobilna aplikacije za glasovanje koristeći blockchain tehnologiju. Aplikacija pruža funkcionalnost kreiranja vlastitih izbora i glasovanje na drugim izborima preko skeniranja QR koda ili unosom adrese glasovanja. Za autentikaciju je korišten Firebase servis dok je za pohranu podataka korišten ethereum blockchain uz pomoć alata Truffle, Ganache, web3 i Solidity programskog jezika. Mobilna aplikacija je kreirana unutar Flutter programskog okvira po DDD arhitekturalnom dizajnu programske podrške. Kroz rad je opisano i trenutno stanje elektroničkog glasovanja i njegove tehnologije, doprinos blockchaina konceptu mobilnog glasovanja i sigurnosne mane ovakvog načina glasovanja.

Gaurav Sharma, Denis Verstraeten, Vishal Saraswat, Jean‐Michel Dricot · 5 authors

In a competitive market, online auction systems enable optimal trading of digital products and services. Bidders can participate in existing blockchain-based auctions while protecting the confidentiality of their bids in a decentralized, transparent, secure, and auditable manner. However, in a competitive market, parties would prefer not to disclose their interests to competitors, and to remain anonymous during auctions. In this paper, we firstly analyze the specific requirements for blockchain-based anonymous fair auctions. We present a formal model tailored to study auction systems that facilitate anonymity, as well as a generic protocol for achieving bid confidentiality and bidder anonymity using existing cryptographic primitives such as designated verifier ring signature. We demonstrate that it is secure using the security model we presented. Towards the end, we demonstrate through extensive simulation results on Ethereum blockchain that the proposed protocol is practical and has minimal associated overhead. Furthermore, we discuss the complexity and vulnerabilities that a blockchain environment might introduce during implementation.

Jaya Singh, Ayush Sinha, Priyanka Goli, Venkatesan Subramanian · 6 authors

No abstract is available for this record.

Johann Stockinger, Bernhard Haslhofer, Pedro Moreno-Sánchez, Matteo Maffei

We present a first measurement study on two popular wallets with built-in distributed CoinJoin functionality, Wasabi and Samourai, in the context of the broader Bitcoin ecosystem. By applying two novel heuristics, we can effectively pinpoint 25,070 Wasabi and 134,569 Samourai transactions within the first 689,255 (2021-07-01) blocks. Our study reveals a somewhat steady adoption of these services and found a growing trend with a total amount of 190,777.11 mixed BTC with a value of ca. 3.02 B USD. Within the recent six months, we measured an average monthly mixing throughput of 5410.98 BTC (ca. 240.14 M USD). Among all actors, which were directly or indirectly involved in CoinJoins, we also found a lower-bound of 32 distinct exchanges and traced a lower-bound of 6683.19 BTC (ca. 95.98 M USD) mixed coins received by exchanges. Our analysis further shows that linking heuristics over Wasabi and Samourai transactions allows us to narrow down the anonymity set provided by these wallets over time. Furthermore, we estimate the number of mixing outputs that are handled in Wasabi and Samourai correspondingly over time. Overall, this is the first paper to provide a comprehensive picture of the adoption of distributed CoinJoin and to discuss implications for end-users, cryptoasset exchanges, and regulatory bodies.

Rainer Stütz, Johann Stockinger, Pedro Moreno-Sánchez, Bernhard Haslhofer · 5 authors

We present a first measurement study on the adoption and actual privacy of two popular decentralized CoinJoin implementations, Wasabi and Samourai, in the broader Bitcoin ecosystem. By applying highly accurate (> 99%) algorithms we can effectively detect 30,251 Wasabi and 223,597 Samourai transactions within the block range 530,500 to 725,348 (2018-07-05 to 2022-02-28). We also found a steady adoption of these services with a total value of mixed coins of ca. 4.74 B USD and average monthly mixing amounts of ca. 172.93 M USD) for Wasabi and ca. 41.72 M USD for Samourai. Furthermore, we could trace ca. 322 M USD directly received by cryptoasset exchanges and ca. 1.16 B USD indirectly received via two hops. Our analysis further shows that the traceability of addresses during the pre-mixing and post-mixing narrows down the anonymity set provided by these coin mixing services. It also shows that the selection of addresses for the CoinJoin transaction can harm anonymity. Overall, this is the first paper to provide a comprehensive picture of the adoption and privacy of distributed CoinJoin transactions. Understanding this picture is particularly interesting in the light of ongoing regulatory efforts that will, on the one hand, affect compliance measures implemented in cryptocurrency exchanges and, on the other hand, the privacy of end-users.

Liu Su, Jian Wang

Ethereum is a public blockchain platform with smart contract. However, it has transaction privacy issues due to the openness of the underlying ledger. Decentralized mixing schemes are presented to hide transaction relationship and transferred amount, but suffer from high transaction cost and long transaction latency. To overcome the two challenges, we propose the idea of batch accounting, adopting batch processing at the time of accounting. For further realization, we introduce payment channel technology into decentralized mixer. Since intermediate transactions between two parties do not need network consensus, our scheme can reduce both transaction cost and transaction latency. Moreover, we provide informal definitions and proofs of our scheme's security. Finally, our scheme is implemented based on zk-SNARKs and Ganache, and experimental results show that the higher number of transactions in batch, the better our scheme performs.

Chaitanya Rahalkar, Anushka Virgaonkar

Bitcoin and many other similar Cryptocurrencies have been in existence for\nover a decade, prominently focusing on decentralized, pseudo-anonymous\nledger-based transactions. Many protocol improvements and changes have resulted\nin new variants of Cryptocurrencies that are known for their peculiar\ncharacteristics. For instance, Storjcoin is a Proof-of-Storage-based\nCryptocurrency that incentivizes its peers based on the amount of storage owned\nby them. Cryptocurrencies like Monero strive for user privacy by using\nprivacy-centric cryptographic algorithms. While Cryptocurrencies strive to\nmaintain peer transparency by making the transactions and the entire ledger\npublic, user privacy is compromised at times. Monero and many other\nprivacy-centric Cryptocurrencies have significantly improved from the original\nBitcoin protocol after several problems were found in the protocol. Most of\nthese deficiencies were related to the privacy of users. Even though Bitcoin\nclaims to have pseudo-anonymous user identities, many attacks have managed to\nsuccessfully de-anonymize users. In this paper, we present some well-known\nattacks and analysis techniques that have compromised the privacy of Bitcoin\nand many other similar Cryptocurrencies. We also analyze and study different\nprivacy-preserving algorithms and the problems these algorithms manage to\nsolve. Lastly, we touch upon the ethics, impact, legality, and acceptance of\nimposing these privacy algorithms.\n

Philipp Winter, Anna Harbluk Lorimer, Peter Snyder, Benjamin Livshits

Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems but the accuracy of these hopes has to date been understudied; people moving to DeFi sites to improve their privacy and security may actually end up with less of both. In this work, we improve the state of DeFi by conducting the first measurement of the privacy and security properties of popular DeFi applications. We find that DeFi applications suffer from the same kinds of privacy and security risks that frequent other parts of the Web. For example, we find that one common tracker has the ability to record Ethereum addresses on over 56% of websites analyzed. Further, we find that many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., name or demographic information) or phish users. This work also proposes remedies to the vulnerabilities we identify, in the form of improvements to the most common cryptocurrency wallet. Our wallet modification replaces the user's real Ethereum address with site-specific addresses, making it harder for DeFi sites and third parties to (i) learn the user's real address and (ii) track them across sites.

Philipp Winter, Anna Harbluk Lorimer, Peter J. Snyder, Benjamin Livshits

Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems. However, people moving to DeFi sites in hopes of improving their security and privacy may end up with less of both as recent attacks have demonstrated. In this work, we improve the understanding of DeFi by conducting the first Web measurements of the security, privacy, and decentralization properties of popular DeFi front ends. We find that DeFi applications -- or dapps -- suffer from the same security and privacy risks that frequent other parts of the Web but those risks are greatly exacerbated considering the money that is involved in DeFi. Our results show that a common tracker can observe user behavior on over 56% of websites we analyzed and many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., user name or demographic information), or phish users by initiating fake Ethereum transactions. Lastly, we establish that despite claims to the opposite, because of companies like Amazon and Cloudflare operating significant Web infrastructure, DeFi as a whole is considerably less decentralized than previously believed.

Adhitya Bhawiyuga, Achmad Basuki, Nugraha Wiguna Tiera

E-Voting system generally adopts the client-server architecture where the server is the responsible entity of all data in the system. Such a system poses several issues regarding information security such as data integrity of the election result, the confidentiality of voter identity with its vote and the auditability of transactions. This research presents an implementation of blockchain-based Ethereum on the E-Voting system to protect the information security with a distributed storage. The e-Voting system is implemented with three main components: private blockchain network, smart contract, and web service as an interface to manager and voters. The functional evaluation on the data store, display, update, delete, verify voters, authenticate voters, and the integrity of the election process in the private blockchain network are all well-functioning, even without an overvote. The nonfunctional evaluation shows that the system can guarantee the data integrity of the election result, the confidentiality of voter identity with its selection, the auditability of transactions, and the maximum scale of load that system can handle. Based on these results, E-Voting system with a blockchain-based Ethereum give a better alternative than those implemented with a client-server architecture.

Chong-Gee Koa, Swee‐Huay Heng, Ji‐Jian Chin

Public Key Infrastructure (PKI) is the fundamental of secure digital communications. It provides a secure means to authenticate identities over the Internet. Symmetric or asymmetric encryption schemes are widely used in identity authentication in any kind of PKI. The conventional PKI has several drawbacks due to the centralized and non-transparent design. Several recent research works utilize blockchain technology to overcome the limitations of conventional implementations of PKI. Blockchain-based PKI integrates blockchain technology with PKI to form a new type of decentralized PKI (DPKI). Several works utilize the currency property in blockchains to implement the reward-and-punishment mechanism. In this paper, we propose a smart contract-based PKI which utilizes the Ethereum smart contract to build a new type of blockchain-based PKI with the reward-and-punishment mechanism using ERC-20 tokens. It has several advantages over previous implementations of similar research that use Ethereum’s main currency—Ether.

Ya Chen, Chao Liu, Yu Wang, Yazhe Wang

Traditional accounts and passwords mechanism usually needs to register multiple accounts for adopting different scenarios, which makes it difficult to manage passwords and handle privacy leakage issues. On the other hand, users have no real control over their identities under centralized trusted authorities or insecure third-party operators. In this paper, we propose a self-sovereign decentralized identity platform called SSIChain. SSIChain uses distributed infrastructure blockchain to replace authorities and third-party operators. In the proposed platform, the DID and a credential represent an user's digital identity. We define DID chaincode and credential protocol to cover the full lifecycle of a user's digital identity. We build a complete consortium blockchain and application environment, and implement a prototype as an App for Android-based phones. Moreover, we detect that SSIChain only takes at most 2.1 seconds for authentication with high TPS, which can meet users' demands for identity management well.