Recently, public interest in the blockchain technology has surged and various applications based on the technology have emerged. However, there has been little study on architectural evaluations of popular block chain platforms that can help the developers choose an appropriate architecture matching their needs. In this paper, we reconstruct and evaluate the architecture of Hyperledger and Ethereum, which are representative open source platforms for blockchain. The evaluation results indicate that Hyperledger is strong in modifiability and performance whereas Ethereum is better in security.
Christopher Ehmke, Florian Wessling, Christoph M. Friedrich
The expansion of blockchain technologies from financial applications to other fields intensifies the problem of an increasing size of data stored in the blockchain. Unfortunately, new participants of the blockchain network are required to download the whole blockchain to gain an overview about the state of the system and to validate incoming transactions. Approaches like IOTA, SegWit or the Lightning Network try to solve the scalability issues of blockchain applications. Unfortunately, they focus on strategies slowing down the blockchain's growth instead of reducing the problems arising from a growing chain or introduce new concepts to oust the linear blockchain altogether. The approach proposed in this paper is based on the idea of Ethereum to keep the state of the system explicitly in the current block but further pursues this by including the relevant part of the current system state in new transactions as well. This enables other participants to validate incoming transactions without having to download the whole blockchain initially. Following this idea use cases can be supported that require scalable blockchain technology but not necessarily an indefinite and complete transaction history.
Smart contracts enabled a new way to perform cryptocurrency transactions over blockchains. While this emerging technique introduces free-of-conflicts and transparency, smart contract itself is vulnerable. As a special form of computer program, smart contract can hardly get rid of bugs. Even worse, an exploitable security bug can lead to catastrophic consequences, e.g., loss of cryptocurrency/money. In this demo paper, we focus on the most common type of security bugs in smart contracts, i.e., reentrancy bug, which caused the famous DAO attack with a loss of 60 million US dollars. We presented ReGuard, an fuzzing-based analyzer to automatically detect reentrancy bugs in Ethereum smart contracts. Specifically, ReGuard performs fuzz testing on smart contracts by iteratively generating random but diverse transactions. Based on the runtime traces, ReGuard further dynamically identifies reentrancy vulnerabilities. In the preliminary evaluation, we have analyzed 5 existing Ethereum contracts. ReGuard automatically flagged 7 previously unreported reentrancy bugs. A demo video of ReGuard is at https://youtu.be/XxJ3_-cmUiY.
Sergei Tikhomirov, Ekaterina Voskresenskaya, Ivan Ivanitskiy, Ramil Takhaviev · 6 authors
Ethereum is a major blockchain-based platform for smart contracts - Turing complete programs that are executed in a decentralized network and usually manipulate digital units of value. Solidity is the most mature high-level smart contract language. Ethereum is a hostile execution environment, where anonymous attackers exploit bugs for immediate financial gain. Developers have a very limited ability to patch deployed contracts. Hackers steal up to tens of millions of dollars from flawed contracts, a well-known example being "The DAO", broken in June 2016. Advice on secure Ethereum programming practices is spread out across blogs, papers, and tutorials. Many sources are outdated due to a rapid pace of development in this field. Automated vulnerability detection tools, which help detect potentially problematic language constructs, are still underdeveloped in this area.
Being a new kind of software leveraging blockchain to execute real contracts, smart contracts are in great demand due to many advantages. Ethereum is the largest blockchain platform that supports smart contracts by running them in its virtual machine. To ensure that a smart contract will terminate eventually and prevent abuse of resources, Ethereum charges the developers for deploying smart contracts and the users for executing smart contracts. Although our previous work shows that under-optimized smart contracts may cost more money than necessary, it just lists 7 anti-patterns and the detection method for 3 of them. In this paper, we conduct the first in-depth investigation on such under-optimized smart contracts. We first identify 24 anti-patterns from the execution traces of real smart contracts. Then, we design and develop GasReducer, the first tool to automatically detect all these anti-patterns from the bytecode of smart contracts and replace them with efficient code through bytecode-to-bytecode optimization. Using GasReducer to analyze all smart contracts and their execution traces, we detect 9,490,768 and 557,565,754 anti-pattern instances in deploying and invoking smart contracts, respectively.
Blockchain-based decentralized cryptocurrency platforms are currently one of the hottest topics in technology. Although most of the interest is generated by cryptocurrency related activities, it is becoming apparent that a much wider spectrum of applications can leverage the blockchain technology. The primary concepts enabling such general use of the blockchain are the so-called smart contracts, which are special programs that run on the blockchain. One of the most popular blockchain platforms that supports smart contracts is Ethereum. As smart contracts typically handle money, ensuring their low number of faults and vulnerabilities are essential. To aid smart contract developers and help to mature the technology, we need analysis tools and studies for smart contracts. As an initiative for this, we propose the adoption of some well-known OO metrics for Solidity smart contracts. Furthermore, we analyze more than 40 thousand Solidity source files with our prototype tool. The results suggest that smart contract programs are short, neither overly complex nor coupled too much, do not rely heavily on inheritance, and either quite well-commented or not commented at all. Moreover, smart contracts could benefit from an external library and dependency management mechanism, as more than 85% of the defined libraries in Solidity files code the same functionalities.
Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse
Blockchains store a massive amount of heterogeneous data which will only grow in time. When searching for data on the Ethereum platform, one is required to either access the records (blocks) directly by using a unique identifier, or sequentially search several records to find the desired information. Therefore, we propose the Ethereum Query Language (EQL), a query language that allows users to retrieve information from the blockchain by writing SQL-like queries. The queries provide a rich syntax to specify data elements to search information scattered through several records. We claim that EQL makes it easier to search, acquire, format, and present information from the blockchain.
Grigory O. Krylov, A. Yu. Lisitsyn, Leonid I. Polyakov
The article provides a comparative analysis of the volatility of the leading national fiat currencies and their transnational anonymous analogues, which received the slang name “cryptocurrency”.Volatility is the most important financial indicator in the management of financial flows, as a measure of the risk of using a financial instrument at a specified period of time. Cryptocurrency mining technology is available to the general public and has become an innovative phenomenon. The latest fi phenomena need to be investigated, so it is necessary to conduct a multilateral scientific analysis, identification and comparison of cryptocurrency with fi currency. The aim of this study is to obtain new estimates of cryptocurrency based on the use of tools such as GARCH-model, simple historical volatility (SHV) and developed by the author’s toolkit, which is based on the Chaikin method. The methodological basis of the research is logical, econometric, economic and statistical methods of analysis, technical and fundamental analysis, and method of scientific visualization. The calculated volatility estimates are based on the Central Bank’s data on currency rates and investigated using named three models. The article for the first time presents the results of comparison of volatility of the leading fiat currencies (uS dollar, euro, Chinese yuan and Japanese yen) and the most popular today so-called cryptocurrencies (bicoin, litecoin, ethereum, and monero). Estimation of volatility showed that the volatility of bitcoin is significantly higher than fiat money. In this regard, it is concluded that the recognition of cryptocurrency, in particular bitcoin, as a real money is premature, not only due to the lack of regulations of a certain cryptocurrency as a legal tender, but also on the grounds of violation of essential requirements for the properties of the currency, such as a low level of volatility.
The efficiency of decentralized book systems like Bitcoin and Ethereum has always been a challenge. It is usually measured by three major factors: scalability, throughput, and latency. Scalability refers to how the system capacity is increased by adding more physical resources. Throughput measures the volume of transactions for a given period of time, where most current solutions attempt to improve such as NEO, EOS, etc. Latency measures the processing time of any single transaction. In current blockchain based systems, the block generation rate is the main latency bottleneck. Off-chain processes such as state channels are the most recent work that can integrate partial inbound transactions, reducing latency. Unfortunately, the state channel introduces more issues at the same time, such as cross-channel synchronization, which makes the state channel unavailable for full adoption of current blockchain solutions. In order to solve the efficiency problem, we proposed an end-to-end solution called ALZA, which links the dedicated high-throughput blockchain with self-organizing payment fields. This mechanism allows arbitrary set of users to create payment fields that process extremely low latency transactions within each field. Therefore, users can make transactions almost immediately. Since all transactions are conducted within fields, transaction costs will be reduced by several orders of magnitude. In addition, ALZA distributes main ledger to each client through an innovative replication mechanism. Therefore, the system will be significantly more robust to blockchain system failures. In theory, ALZA can complete millions of transactions in one second, which naturally supports high-frequency trading.
This paper describes the proof of concept of a blockchain based organization of a local low voltage energy community. The focus of the concept is efficient use of shared resources to minimize external dependence, and not energy trading. A previously proposed control algorithm, which exploits the power dependency of the efficiency of electrical energy storages, is implemented as a smart contract on a private instance of an Ethereum blockchain to coordinate the operation. It is implemented using four connected Raspberry Pis representing the participating households with pre-given electrical load and photovoltaic conversion as well as a battery. Each household runs an Ethereum full node and an interfacing software. Only the energy technology components are simulated, while the blockchain is actually running on the Raspberry Pis in order to mind the full complexity of the technology. The practicability is proved in a test run and positive effects on the efficiency and the self-sufficiency within the community are observed. A first cost-benefit estimate is given and a further research agenda is presented.
Starting with BitTorrent and then Bitcoin, decentralized technologies have been on the rise over the last 15+ years, gaining significant momentum in the last 2+ years with the advent of platform ecosystems such as the Blockchain platform Ethereum. New projects have evolved from decentralized games to marketplaces to open funding models to decentralized autonomous organizations. The hype around cryptocurrency and the valuation of innovative projects drove the market cap of cryptocurrencies to over a trillion dollars at one point in 2017. These high valued technologies are now enabling something new: globally scaled and decentralized business models. Despite their valuation and the hype, these new business ecosystems are frail. This is not only because the underlying technology is rapidly evolving, but also because competitive markets see a profit opportunity in exponential cryptocurrency returns. This extracts value from these ecosystems, which could lead to their collapse, if unchecked. In this paper, we explore novel ways for decentralized economies to protect themselves from, and coexist with, competitive markets at a global scale utilizing decentralized technologies such as Blockchain.
Termination of smart contracts is crucial for any blockchain system's security and consistency, especially for those supporting Turing-complete smart contract languages. Resource-constrained blockchain systems, like Ethereum and Hyperledger Fabric, could prevent smart contracts from terminating properly when the pre-allocated resources are not sufficient. The Zen system utilizes the dependent type system of the programming language F* to prove the termination of smart contracts for all inputs during compilation time. Since the smart contract execution usually depends on the current blockchain state and user inputs, this approach is not always successful. In this work, we propose a lazy approach by statically proving conditional termination and non-termination of a smart contract to determine input conditions under which the contract terminates or not. Prior to the execution of the smart contract, the proof-carrying blockchain system will check that its current state and the contract's input satisfy the termination conditions in order to determine if the contract is qualified (i.e., eventually terminating) to run on the chain.
Yandamuri, Sravya, Abraham, Ittai, Nayak, Kartik, Reiter, Michael K.
A smart contract on a blockchain cannot keep a secret because its data is replicated on all nodes in a network. To remedy this problem, it has been suggested to combine blockchains with trusted execution environments (TEEs), such as Intel SGX, for executing applications that demand privacy. Untrusted blockchain nodes cannot get access to the data and computations inside the TEE. This paper first explores some pitfalls that arise from the combination of TEEs with blockchains. Since TEEs are, in principle, stateless they are susceptible to rollback attacks, which should be prevented to maintain privacy for the application. However, in blockchains with non-final consensus protocols, such as the proof-of-work in Ethereum and others, the contract execution must handle rollbacks by design. This implies that TEEs for securing blockchain execution cannot be directly used for such blockchains; this approach works only when the consensus decisions are final. Second, this work introduces an architecture and a prototype for smart-contract execution within Intel SGX technology for Hyperledger Fabric, a prominent platform for enterprise blockchain applications. Our system resolves difficulties posed by the execute-order-validate architecture of Fabric and prevents rollback attacks on TEE-based execution as far as possible. For increasing security, our design encapsulates each application on the blockchain within its own enclave that shields it from the host system. An evaluation shows that the overhead moving execution into SGX is within 10%-20% for a sealed-bid auction application.
Yackolley Amoussou-Guenou, Antonella Del Pozzo, Maria Potop-Butucaru, Sara Tucci-Piergiovanni
Tendermint-core blockchains (e.g. Cosmos) are considered today one of the most viable alternatives for the highly energy consuming proof-of-work blockchains such as Bitcoin and Ethereum. Their particularity is that they aim at offering strong consistency (no forks) in an open system combining two ingredients (i) a set of validators that generate blocks via a variant of Practical Byzantine Fault Tolerant (PBFT) consensus protocol and (ii) a selection strategy that dynamically selects nodes to be validators for the next block via a proof-of-stake mechanism. However,the exact assumptions on the system model under which Tendermint underlying algorithms are correct and the exact properties Tendermint verifies have never been formally analyzed. The contribution of this paper is two-fold. First, while formalizing Tendermint algorithms we precisely characterize the system model and the exact problem solved by Tendermint. We prove that in eventual synchronous systems a modified version of Tendermint solves (i) under additional assumptions, a variant of one-shot consensus for the validation of one single block and (ii) a variant of the repeated consensus problem for multiple blocks. These results hold even if the set of validators is hit by Byzantine failures, provided that for each one-shot consensus instance less than one third of the validators is Byzantine. Our second contribution relates to the fairness of the rewarding mechanism. It is common knowledge that in permisionless blockchain systems the main threat is the tragedy of commons that may yield the system to collapse if the rewarding mechanism is not adequate. Ad minimum the rewarding mechanism must be fair, i.e.distributing the rewards in proportion to the merit of participants. We prove, for the first time in blockchain systems, that in repeated-consensus based blockchains there exists an (eventual) fair rewarding mechanism if and only if the system is (eventual) synchronous. We also show that the original Tendermint rewarding is not fair, however, a modification of the original protocol makes it eventually fair.
This article presents a new method for managing digital reuse rights of research data, which leverages technologies such as the blockchain and smart contracts. This allows, on one hand, the creation of a permanent record on the agreements between the authors of the data and the reusers, with the possibility of verifying compliance at any time, and on the other hand, a higher level of granularity on defining the conditions of reuse. A practical implementation of such a workflow using the Solidity smart contract language is included, along with a brief analysis over the Ethereum blockchain network.
Valentina Lenarduzzi, Maria Ilaria Lunesu, Michele Marchesi, Roberto Tonelli
We present an application of Blockchain technology and Smart Contracts to the management of Agile projects, using Scrum or Lean-Kanban processes. In our application the duties of the Product Owner for certifying the correctness of the outcomes are delegated to one or more Smart Contracts deployed on the Ethereum Blockchain and written in Solidity. An agreement with the Customer can also allow the Smart Contracts to automatically enable payments, to introduce penalties or grants on the basis of the outcome. Product Owner duties and work can thus be relieved allowing to allocate resources on more profitable and productive tasks. Other possibilities are examined as well.
Roberto Tonelli, Andrea Pinna, Gavina Baralla, Simona Ibba
We propose a model of software architecture where microservices are implemented by mean of Smart Contracts deployed in a blockchain, discussing similarities among the two paradigms and presenting an example of the implementation of an e-commerce platform.
Freya Sheer Hardwick, Raja Naeem Akram, Konstantinos Markantonakis
At a time when society is in constant transition to keep up with technological advancement, we are seeing traditional paradigms being increasingly challenged. The fundamentals of governance are one such paradigm. As society's values have shifted, so have expectations of government shifted from the traditional model to something commonly referred to as `open governance'. Though a disputed term, we take open governance to mean a concept, which encourages and facilitates openness, accountability, and responsiveness to citizens. For the success of open governance initiatives, there are some technologies, such as the internet, that are crucial. These technologies enable access to both the data and to engagement activities between citizens and government. There are also other technologies, like blockchain and smart contacts, which could be utilised to assist open governance. A sound starting point would be moving from a system where information is tediously released by a government, on an `as they please' basis, to an infrastructure where critical actions are captured with strong integrity, non-repudiation and evidential guarantees. With an added dimension that facilitates these actions record be accessible to public scrutiny in near real-time. One candidate technology for capturing such actions is blockchain. Initially, blockchains were mainly used to facilitate cryptocurrencies as a record of transactions. The notable example being bitcoin. However, in recent years, blockchains utility is being recognised through smart contracts - potentially a vital building block to realising open and transparent government activities. In this paper, we employ the concept of smart contracts to government tendering activities. The proposed scheme is based on smart contracts, enabling a fair, transparent and independently verifiable (auditable) government tendering scheme. The scheme is then implemented on the Ethereum platform to evaluate the performance and financial cost implications, along with an evaluation of the potential security and auditability challenges.
Parinya Ekparinya, Vincent Gramoli, Guillaume Jourjon
Recently, several works conjectured the vulnerabilities of mainstream blockchains under several network attacks. All these attacks translate into showing that the assumptions of these blockchains can be violated in theory or under simulation at best. Unfortunately, previous results typically omit both the nature of the network under which the blockchain code runs and whether blockchains are private, consortium or public. In this paper, we study the public Ethereum blockchain as well as a consortium and private blockchains and quantify the feasibility of man-in-the-middle and double spending attacks against them. To this end, we list important properties of the Ethereum public blockchain topology, we deploy VMs with constrained CPU quantum to mimic the top-10 mining pools of Ethereum and we develop full-fledged attacks, that first partition the network through BGP hijacking or ARP spoofing before issuing a Balance Attack to steal coins. Our results demonstrate that attacking Ethereum is remarkably devastating in a consortium or private context as the adversary can multiply her digital assets by 200, 000x in 10 hours through BGP hijacking whereas it would be almost impossible in a public context.
OpenLitterMap rewards users with Littercoin for producing open data on litter. Open data on the geospatial characteristics of litter provide means of invoking and evaluating responses to plastic pollution. OpenLitterMap currently works as a web app on all devices with native mobile apps in development. The stack includes the integration of the Laravel PHP Framework on the backend; Vue for frontend reactivity; NativeScript-Vue for mobile apps; Bulma for CSS; Leaflet for web-mapping; Turf.js for geospatial analysis; the Ethereum Blockchain for tokenization; Stripe; ChartJS; AWS; and more. Anywhere from a single cigarette butt to the contents of an entire beach or street clean can be logged in a single geotagged photo. Alternatively, a simple index may be used if litter is incalculable. The open data includes an increasing 100+ pre-defined types of litter; 20+ corporate brands; verification status; coordinates; timestamp; phone model; the latest OpenStreetMap address at each location; and the litter presence as a Boolean. To date, 100% of all submitted data (~ 8200 photos, ~ 28,000 litter from over 150 contributors) has been manually verified which is being used to develop machine learning algorithms.
Die Autoren gehen der Frage nach, ob Kryptowährungen als Sachen im Sinne des ZGB aufgefasst und daran namentlich Eigentumsrechte begründet werden können. Dabei werden zunächst technische Grundlagen der sog. Blockchain-Technologie und der drei nach Markkapitalisierung grössten Kryptowährungen Bitcoin (BTC), Ethereum (Ether, ETH) und Ripple (XRP) dargestellt. Sodann wird untersucht, ob diese Kryptowährungen die Eigenschaften erfüllen, welche für die Qualifikation eines Objektes als Sache im Sinne des ZGB vorliegen müssen, und welches die Folgen einer solchen Qualifikation sind. Im Sinne einer modernen Auslegung des Sachbegriffs schliessen sich die Autoren der Auffassung an, wonach Kryptowährungen grundsätzlich als Sache und damit als Gegenstand des Eigentums zu behandeln sind.
Eric Zhang, C Hendrik, Yang Liu, Archit Sharma · 5 authors
In this paper we present the initial design of Minerva consensus protocol for Truechain and other technical details. Currently, it is widely believed in the blockchain community that a public chain cannot simultaneously achieve high performance, decentralization and security. This is true in the case of a Nakamoto chain (low performance) or a delegated proof of stake chain (partially centralized), which are the most popular block chain solutions at time of writing. Our consensus design enjoys the same consistency, liveness, transaction finality and security guarantee, a de-facto with the Hybrid Consensus. We go on to propose the idea of a new virtual machine on top of Ethereum which adds permissioned-chain based transaction processing capabilities in a permissionless setting. We also use the idea of data sharding and speculative transactions, and evaluation of smart contracts in a sharding friendly virtual machine. Finally, we will briefly discuss our fundamentally ASIC resistant mining algorithm, Truehash.
Under the background of rapid development of distributed renewable energy (DRE) and demand response (DR), the traditional DR will develop into integrated demand response (IDR). The current centralized trading of electricity market model is unable to meet the trading needs of scattered IDR resources. As the decentralized and distributed accounting mode, the blockchain technology fits the requirement of IDR resources to participate in energy market. The blockchain-based DRE transaction platform can support the credible transaction and settlement between the IDR resources, and promote the development of DER. Corresponding to the transaction principle, the frame of blockchain-based IDR resources transaction scheme was proposed. The transactions between DER and DR are taken for example to explain the detail trading process. Finally, the smart contracts of the transactions are designed and deployed on Ethereum private blockchain to prove the validity of the proposed transaction scheme.
With the price of Bitcoin ascending to new heights in 2017, the rocketing valuation of cryptocurrencies continues its momentum into 2018. Evidence of the massive growth of these digital assets can be seen in the massive spikes in new clients at companies like Coinbase, adding 100,000 users in a 24-hour period, and Binance, which recently expanded its user base by 240,000 users in just one hour. The financial industry and Silicon Valley are not the only groups who have caught the cryptocurrency fever. Malicious actors have discovered that cryptocurrency newbies are unwitting targets that offer a consistent stream of revenue. Through our global network visibility, Cisco has observed many of these attacks originating from bulletproof hosting infrastructures located in the Eastern European region. This area is a hotbed for crypto theft and other computer crimes such as ransomware, botnets, DDoS services and credit card fraud. Some criminals have even extended beyond the digital world by kidnapping and demanding ransoms in Bitcoin, such as the case in the reported kidnapping and ransom of Pavel Lerner. Lerner was a lead analyst at Ukraine-based digital currency exchange, Exmo, who was released by his kidnappers after a $1 million Bitcoin payment was made. The event illustrates the desperate lengths some criminals will go in order to steal cryptocurrency. Joining the Enterprise Ethereum Alliance in 2017, Cisco is committed to protecting these new crypto technologies. Over the past year Cisco researchers have teamed up with the Ukraine Cyber Police to track a Bitcoin phishing operation dubbed the "Coinhoarder" campaign that has been tied to the theft of tens of millions of dollars worth of Bitcoin. Credential phishing continues to be one of the biggest security challenges for internet users, and cryptocurrency phishers have found it to be a very lucrative form of attack. In 2017, Chainalysis reported Ethereum phishing as being the number one source of theft in that ecosystem with estimates placing the total amount stolen at $115 million. Google also recently published a research paper stating credential phishing is one of their top security challenges. Cisco has been proactive in detecting phishing domains in predictive fashion to help protect our customers. Additionally, we have been working with security personnel at top cryptocurrency wallets and exchanges, such as Blockchain.info and Coinbase, to help protect the cryptocurrency community members from having their tokens stolen.