This study provides a comparative financial and statistical analysis between the largest and most trad- ed cryptocurrencies. In particular, the exchange rates of Bitcoin, Litecoin, Ripple and Ethereum were collected from August 2010 until May 2017. The raw annualized volatility of cryptocurrencies is compared as well as to fiat currencies and major exchange rates. The results show that Bitcoin is the least volatile cryptocurrency with low correlations with the altcoins, providing possible diversification benefits to cryptocurrency investing. In addition, our results indicate that Bitcoin is the only cryptocurrency that has causality effects on the other cryptocurrencies.
In this paper, we explore remarkable similarities between multi-transactional behaviors of smart contracts in cryptocurrencies such as Ethereum and classical problems of shared-memory concurrency. We examine two real-world examples from the Ethereum blockchain and analyzing how they are vulnerable to bugs that are closely reminiscent to those that often occur in traditional concurrent programs. We then elaborate on the relation between observable contract behaviors and well-studied concurrency topics, such as atomicity, interference, synchronization, and resource ownership. The described contracts-as-concurrent-objects analogy provides deeper understanding of potential threats for smart contracts, indicate better engineering practices, and enable applications of existing state-of-the-art formal verification techniques.
Smart contracts are computer programs that can be consistently executed by a network of mutually distrusting nodes, without the arbitration of a trusted authority. Because of their resilience to tampering, smart contracts are appealing in many scenarios, especially in those which require transfers of money to respect certain agreed rules (like in financial services and in games). Over the last few years many platforms for smart contracts have been proposed, and some of them have been actually implemented and used. We study how the notion of smart contract is interpreted in some of these platforms. Focussing on the two most widespread ones, Bitcoin and Ethereum, we quantify the usage of smart contracts in relation to their application domain. We also analyse the most common programming patterns in Ethereum, where the source code of smart contracts is available.
Cryptocurrencies, such as bitcoin and ethereum, have not only risen to public attention as novel means of payments, but also as facilitators of initial coin offerings (ICOs, also called token sales). In these entirely online-mediated offerings, entrepreneurs sell tokens registered on a blockchain in exchange for cryptocoins. Buyers receive tokens that can be understood as cryptographically-secured coupons which embody a bundle of rights and obligations. In July 2017, the SEC released an investigative report that highlighted that such tokens can be subject to the full scope of US securities regulation. It is unclear, however, to what extent EU securities regulation is applicable to ICOs and, particularly, whether issuers have to publish and register a prospectus in order to avoid criminal and civil prospectus liability in the EU. In conceptual terms, this depends on whether tokens are considered โsecuritiesโ under the EU prospectus regulation regime. Against this background, this paper develops a nuanced approach that distinguishes between three archetypes of tokens: currency, investment, and utility tokens. It analyzes the differential implications of each of these types, and their hybrid forms, for EU securities regulation, and develops policy proposals for their regulation.
Stefan Dziembowski, Lisa Eckey, Sebastian Faust, Daniel Malinowski
Payment channels emerged recently as an efficient method for performing cheap micropayments in cryptocurrencies. In contrast to traditional on-chain transactions, payment channels have the advantage that they allow for nearly unlimited number of transactions between parties without involving the blockchain. In this work, we introduce Perun, an off-chain channel system that offers a new method for connecting channels that is more efficient than the existing technique of ``routing transactions'' over multiple channels. To this end, Perun introduces a technique called ``virtual payment channels'' that avoids involvement of the intermediary for each individual payment. In this paper we formally model and prove security of this technique in the case of one intermediary, who can be viewed as a ``payment hub'' that has direct channels with several parties. Our scheme works over any cryptocurrency that provides Turing-complete smart contracts. As a proof of concept, we implemented Perun's smart contracts in Ethereum.
Open access
2 source records
Blockchain Technology Applications and Security
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
Ethereum represents the second generation of blockchain technology by providing\nan open and global computing platform which allows the exchange of cryptocurrency\n(Ether) and the development of self-verifying smart contract applications.\nSmart contracts present a foundation for possessing digital assets and a variety of\ndecentralized applications within the blockchain area. Ethereum and smart contracts\nare public, distributed and immutable, as such, they are prone to vulnerabilities\nsourcing from simple coding mistakes of developers.\n\nMotivated by the security breaches and recurring financial losses in smart contracts,\nwe aim to advance the field of security in smart contract programming.\nThe main objective is to aid smart contract developers by providing a taxonomy of\nall known security issues and by inspecting the security code analysis tools used\nto identify those vulnerabilities. Based on previous research as well as attacks on\nEthereum smart contracts, we propose an updated taxonomy which categorizes\nall known vulnerabilities within their architectural and severity level. Our second\nproposed taxonomy is a novel categorization of security tools on Ethereum.\n\nFurthermore, we conduct the investigation of security code analysis tools on\nEthereum by assessing their effectiveness and accuracy. In particular, we analyze\nfour security tools, namely, Oyente, Securify, Remix, and SmartCheck. The results\nindicate that there are overall inconsistencies between the tools on different security\nproperties. SmartCheck outperformed the other tools in terms of effectiveness,\nwhereas Oyente performed the best in terms of accuracy. Furthermore, based on\nthe limitations we identified, we propose future improvements within the user interfaces,\ninterpretation of results, and additional vulnerability checks.
The gas mechanism in Ethereum charges the execution of every operation to ensure that smart contracts running in EVM (Ethereum Virtual Machine) will be eventually terminated. Failing to properly set the gas costs of EVM operations allows attackers to launch DoS attacks on Ethereum. Although Ethereum recently adjusted the gas costs of EVM operations to defend against known DoS attacks, it remains unknown whether the new setting is proper and how to configure it to defend against unknown DoS attacks. In this paper, we make the first step to address this challenging issue by first proposing an emulation-based framework to automatically measure the resource consumptions of EVM operations. The results reveal that Ethereum's new setting is still not proper. Moreover, we obtain an insight that there may always exist exploitable under-priced operations if the cost is fixed. Hence, we propose a novel gas cost mechanism, which dynamically adjusts the costs of EVM operations according to the number of executions, to thwart DoS attacks. This method punishes the operations that are executed much more frequently than before and lead to high gas costs. To make our solution flexible and secure and avoid frequent update of Ethereum client, we design a special smart contract that collaborates with the updated EVM for dynamic parameter adjustment. Experimental results demonstrate that our method can effectively thwart both known and unknown DoS attacks with flexible parameter settings. Moreover, our method only introduces negligible additional gas consumption for benign users.
Ponzi schemes are financial frauds which lure users under the promise of high\nprofits. Actually, users are repaid only with the investments of new users\njoining the scheme: consequently, a Ponzi scheme implodes soon after users stop\njoining it. Originated in the offline world 150 years ago, Ponzi schemes have\nsince then migrated to the digital world, approaching first the Web, and more\nrecently hanging over cryptocurrencies like Bitcoin. Smart contract platforms\nlike Ethereum have provided a new opportunity for scammers, who have now the\npossibility of creating "trustworthy" frauds that still make users lose money,\nbut at least are guaranteed to execute "correctly". We present a comprehensive\nsurvey of Ponzi schemes on Ethereum, analysing their behaviour and their impact\nfrom various viewpoints.\n
The rise of distributed ledger technology, initiated and exemplified by the Bitcoin blockchain, is having an increasing impact on information technology environments in which there is an emphasis on trust and security. Management of electronic health records, where both conformation to legislative regulations and maintenance of public trust are paramount, is an area where the impact of these new technologies may be particularly beneficial. We present a system that enables fine-grained personalized control of third-party access to patients' electronic health records, allowing individuals to specify when and how their records are accessed for research purposes. The use of the smart contract based Ethereum blockchain technology to implement this system allows it to operate in a verifiably secure, trustless, and openly auditable environment, features crucial to health information systems moving forward.
Kentaroh Toyoda, P. Takis Mathiopoulos, Iwao Sasase, Tomoaki Ohtsuki
For more than a decade now, radio frequency identification (RFID) technology has been quite effective in providing anti-counterfeits measures in the supply chain. However, the genuineness of RFID tags cannot be guaranteed in the post supply chain, since these tags can be rather easily cloned in the public space. In this paper, we propose a novel product ownership management system (POMS) of RFID-attached products for anti-counterfeits that can be used in the post supply chain. For this purpose, we leverage the idea of Bitcoin's blockchain that anyone can check the proof of possession of balance. With the proposed POMS, a customer can reject the purchase of counterfeits even with genuine RFID tag information, if the seller does not possess their ownership. We have implemented a proof-of-concept experimental system employing a blockchain-based decentralized application platform, Ethereum, and evaluated its cost performance. Results have shown that, typically, the cost of managing the ownership of a product with up to six transfers is less than U.S. $1.
Ming Li, Jian Weng, Anjia Yang, Wei Lu ยท 9 authors
Crowdsourcing systems which utilize the human intelligence to solve complex tasks have gained considerable interest and adoption in recent years. However, the majority of existing crowdsourcing systems rely on central servers, which are subject to the weaknesses of traditional trust-based model, such as single point of failure. They are also vulnerable to distributed denial of service (DDoS) and Sybil attacks due to malicious users involvement. In addition, high service fees from the crowdsourcing platform may hinder the development of crowdsourcing. How to address these potential issues has both research and substantial value. In this paper, we conceptualize a blockchain-based decentralized framework for crowdsourcing named CrowdBC, in which a requester's task can be solved by a crowd of workers without relying on any third trusted institution, users' privacy can be guaranteed and only low transaction fees are required. In particular, we introduce the architecture of our proposed framework, based on which we give a concrete scheme. We further implement a software prototype on Ethereum public test network with real-world dataset. Experiment results show the feasibility, usability, and scalability of our proposed crowdsourcing system.
Since the start of Bitcoin in 2008[1], blockchain technology emerged as the next revolutionary technology. Though blockchain started off as a core technology of Bitcoin, its use cases are expanding to many other areas including finances, Internet of Things (IoT), security and such[2]. Currently, many private and public sectors are diving into the technology[3]. Aside from that, as software and hardware improve, we would see the beginning of IoT. And those IoT devices need to communicate and synchronize with each other. But in situations where more than thousands or tens of thousands of IoT devices connected, we expect that using current model of server-client may have some limitations and issues while in synchronization. So, we propose using blockchain to build IoT system. Using blockchain, we can control and configure IoT devices. We manage keys using RSA public key cryptosystems where public keys are stored in Ethereum and private keys are saved on individual devices. Specifically, we choose Ethereum as our blockchain platform because using its smart contract, we can write our own Turing-complete code to run on top of Ethereum. Thus, we can easily manage configuration of IoT devices and build key management system. Even though we can simply use account as a key management system, which most of blockchain platform supports, we decide to use Ethereum because we can manage the system in a more fine-grained way. For the proof of a concept, we use a few IoT devices instead of a full system of IoT system, which consists of thousands of IoT devices. But in our later study, we would like to build a fully scaled IoT system using blockchain.
Blockchain is being praised as a technological innovation which allows to revolutionize how society trades and \ninteracts. This reputation is in particular attributable to its \nproperties of allowing mutually mistrusting entities to exchange \nfinancial value and interact without relying on a trusted third \nparty. A blockchain moreover provides an integrity protected \ndata storage and allows to provide process transparency. \nIn this paper we critically analyze whether a blockchain is \nindeed the appropriate technical solution for a particular application scenario. We differentiate between permissionless (e.g., \nBitcoin/Ethereum) and permissioned (e.g. Hyperledger/Corda) \nblockchains and contrast their properties to those of a centrally \nmanaged database. We provide a structured methodology to \ndetermine the appropriate technical solution to solve a particular \napplication problem. Given our methodology, we analyze in depth \nthree use cases โ Supply Chain Management, Interbank and \nInternational Payments, and Decentralized Autonomous Organizations and conclude the article with an outlook for further \nopportunities.
In this paper, we identify a new form of attack, called the Balance attack, against proof-of-work blockchain systems. The novelty of this attack consists of delaying network communications between multiple subgroups of nodes with balanced mining power. Our theoretical analysis captures the precise tradeoff between the network delay and the mining power of the attacker needed to double spend in Ethereum with high probability. We quantify our probabilistic analysis with statistics taken from the R3 consortium, and show that a single machine needs 20 minutes to attack the consortium. Finally, we run an Ethereum private chain in a distributed system with similar settings as R3 to demonstrate the feasibility of the approach, and discuss the application of the Balance attack to Bitcoin. Our results clearly confirm that main proof-of-work blockchain protocols can be badly suited for consortium blockchains.
We present cryptocurrency-based lottery protocols that do not require any collateral from the players. Previous protocols for this task required a security deposit that is $O(N^2)$ times larger than the bet amount, where $N$ is the number of players. Our protocols are based on a tournament bracket construction, and require only $O(\log N)$ rounds. Our lottery protocols thus represent a significant improvement, both because they allow players with little money to participate, and because of the time value of money. The Ethereum-based implementation of our lottery is highly efficient. The Bitcoin implementation requires an $O(2^N)$ off-chain setup phase, which demonstrates that the expressive power of the scripting language can have important implications. We also describe a minimal modification to the Bitcoin protocol that would eliminate the exponential blowup.
Open access
3 source records
Blockchain Technology Applications and Security
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
Pablo Lamela Seijas, Simon Thompson, Darryl McAdams
We give an overview of the scripting languages used in existing cryptocurrencies, and in particular we review in some detail the scripting languages of Bitcoin, Nxt and Ethereum, in the context of a high-level overview of Distributed Ledger Technology and cryptocurrencies. We survey different approaches, and give an overview of critiques of existing languages. We also cover technologies that might be used to underpin extensions and innovations in scripting and contracts, including technologies for verification, such as zero knowledge proofs, proof-carrying code and static analysis, as well as approaches to making systems more efficient, e.g. Merkelized Abstract Syntax Trees.
Ethereum represents new innovation in the fields of cryptocurrency which has become relatively stagnate, promising many things, including an entire programming language and development enviroment built into the network. However the current trend is to write implementations and proof of concepts before doing the rigor involved with proving security. Miller's recent thesis is an attempt to remedy this, and we apply his provable security techniques to the algorithm description of CASPER, the new "proof-of-stake" consensus protocol scheme to be implemented in ethereum. We conclude by stating it satisfies almost all the definitions, except one, leaving room for improvement.