Blockchain Papers

Garima Jain, Nisha Rani

No abstract is available for this record.

Ning Han, Ximeng Li, Guohui Wang, Zhiping Shi · 5 authors

No abstract is available for this record.

Wentian Yan, Jianbo Gao, Zhenhao Wu, Yue Li · 7 authors

Smart contracts are the back-end programs of blockchain-based applications and the execution results are deterministic and publicly visible. Developers are unwilling to release source code of some smart contracts to generate randomness or for security reasons, however, attackers still can use reverse engineering tools to decompile and analyze the code. In this paper, we propose EShield, an automated security enhancement tool for protecting smart contracts against reverse engineering. EShield replaces original instructions of operating jump addresses with anti-patterns to interfere with control flow recovery from bytecode. We have implemented four methods in EShield and conducted an experiment on over 20k smart contracts. The evaluation results show that all the protected smart contracts are resistant to three different reverse engineering tools with little extra gas cost.

Bernhard Beckert, Jonas Schiffl

No abstract is available for this record.

Zaoyu Wei, Jiaqi Wang, Xueqi Shen, Qun Luo

Smart contract has greatly improved the services and capabilities of blockchain, but it has become the weakest link of blockchain security because of its code nature. Therefore, efficient vulnerability detection of smart contract is the key to ensure the security of blockchain system. Oriented to Ethereum smart contract, the study solves the problems of redundant input and low coverage in the smart contract fuzz. In this paper, a taint analysis method based on EVM is proposed to reduce the invalid input, a dangerous operation database is designed to identify the dangerous input, and genetic algorithm is used to optimize the code coverage of the input, which construct the fuzzing framework for smart contract together. Finally, by comparing Oyente and ContractFuzzer, the performance and efficiency of the framework are proved.

Arthur Carvalho, Chaitanya Sambhara, Patrick Young

Since Bitcoin’s meteoric rise, hundreds of cryptocurrencies that people now publicly trade have emerged. As such, the question naturally arises: how have cryptocurrencies evolved over time? Drawing on the theory of polycentric information commons and cryptocurrencies’ historical similarities with another popular information commons (namely, Linux), we make predictions regarding what cryptocurrencies may look like in the future. Specifically, we focus on four important historical similarities: 1) support from online hacker communities, 2) pursuit of freedom, 3) criticism about features and use, and 4) proliferation of forks. We then predict that: 1) cryptocurrencies will become more pragmatic rather than ideological, 2) cryptocurrencies will become more diverse in terms of not only the underlying technology but also the intended audience, and 3) the core technology behind cryptocurrencies, called blockchain, will be successfully used beyond cryptocurrencies.

Pedro Antonino, A. W. Roscoe

The exploitation of smart-contract vulnerabilities can have catastrophic consequences such as the loss of millions of pounds worth of crypto assets. Formal verification can be a useful tool in identifying vulnerabilities and proving that they have been fixed. In this paper, we present a formalisation of Solidity and the Ethereum blockchain using the Solid language and its blockchain; a Solid program is obtained by explicating/desugaring a Solidity program. We make some abstractions that over-approximate the way in which Solidity/Ethereum behave. Based on this formalisation, we create Solidifier: a bounded model checker for Solidity. It translates Solid into Boogie, an intermediate verification language, that is later verified using Corral, a bounded model checker for Boogie. Unlike much of the work in this area, we do not try to find specific behavioural/code patterns that might lead to vulnerabilities. Instead, we provide a tool to find errors/bad states, i.e. program states that do not conform with the intent of the developer. Such a bad state, be it a vulnerability or not, might be reached through the execution of specific known code patterns or through behaviours that have not been anticipated.

Jonas Schiffl, Wolfgang Ahrendt, Bernhard Beckert, Richard Bubel

No abstract is available for this record.

Osama Alkadi, Nour Moustafa, Benjamin Turnbull

This paper reviews the background and related studies in the areas of cloud systems, intrusion detection and blockchain applications against cyber attacks. This work aims to discuss collaborative anomaly detection systems for discovering insider and outsider attacks from cloud centres, including the technologies of virtualisation and containerisation, along with trusting intrusion detection and cloud systems using blockchain. Moreover, the ability to detect such malicious attacks is critical for conducting necessary mitigation, at an early stage, to minimise the impact of disruption and restore cloud operations and their live migration processes. This paper presents an overview of cloud architecture and categorises potential state-of-the-art security events based on their occurrence at different cloud deployment models. Network Intrusion Detection Systems (NIDS) in the cloud, involving types of classification and common detection approaches, are also described. Collaborative NIDSs for cloud-based blockchain applications are also explained to demonstrate how blockchain can address challenges related to data privacy and trust management. A summary of the research challenges and future research directions in these fields is also explained.

Morteza Alizadeh, Karl Andersson, Olov Schelén

Distributed ledgers and blockchain technologies can improve system security and trustworthiness by providing immutable replicated histories of data. Blockchain is a linked list of blocks containing digitally signed transactions, a cryptographic hash of the previous block, and a timestamp stored in a decentralized and distributed network. The Internet of Things (IoT) is one of the application domains in which security based on blockchain is discussed. In this article, we review the structure and architectures of distributed IoT systems and explain the motivations, challenges, and needs of blockchain to secure such systems. However, there are substantial threats and attacks to blockchain that must be understood, as well as suitable approaches to mitigate them. We, therefore, survey the most common attacks to blockchain systems and the solutions to mitigate them, with the objective of assessing how malicious these attacks are in the IoT context.

Ákos Hajdu, Naghmeh Ivaki, Imre Kocsis, Attila Klenik · 8 authors

Blockchain has become particularly popular due to its promise to support business-critical services in very different domains (e.g., retail, supply chains, healthcare). Blockchain systems rely on complex middleware, like Ethereum or Hyperledger Fabric, that allow running smart contracts, which specify business logic in cooperative applications. The presence of software defects or faults in these contracts has notably been the cause of failures, including severe security problems. In this paper, we use a software implemented fault injection (SWIFI) technique to assess the behavior of permissioned blockchain systems in the presence of faulty smart contracts. We emulate the occurrence of general software faults (e.g., missing variable initialization) and also blockchain-specific software faults (e.g., missing require statement on transaction sender) in smart contracts code to observe the impact on the overall system dependability (i.e., reliability and integrity). We also study the effectiveness of formal verification (i.e., done by solc-verify) and runtime protections (e.g., using the assert statement) mechanisms in detection of injected faults. Results indicate that formal verification as well as additional runtime protections have to complement built-in platform checks to guarantee the proper dependability of blockchain systems and applications. The work presented in this paper allows smart contract developers to become aware of possible faults in smart contracts and to understand the impact of their presence. It also provides valuable information for middleware developers to improve the behavior (e.g., overall fault tolerance) of their systems.

Zhenyu Li, Yujue Wang, Sheng Wen, Yong Ding

No abstract is available for this record.

Asma Lahbib, Abderrahim Ait Wakrime, Anis Laouiti, Khalifa Toumi · 5 authors

No abstract is available for this record.

Maria Olsson

With the rise in popularity of cryptocurrencies, distributed ledger technology is a term that has gained traction. The aim of this study is to review and comparethe distributed ledger technologies blockchain and directed acyclic graph, examining their internal structures as well as some platforms and existing areas of application. An implementation, the goal of which is to illustrate the components of a possible distributed ledger solution and how they might interact, has been made in the form of a smart contract deployed on a simulated distributed ledger network. To give some explanation to the foundations of distributed ledger technology, a brief overview is given on the topics of cryptography, underlying data structures, and the frameworks used in this study. The literature study has been conducted by collecting and reviewing primarily scientific articles on the topic of distributed ledger technologies and consensus algorithms, as well as white papers on selected distributed ledger platforms. The construction has been done using the framework Hyperledger Fabric. The result chapter reviews how the implemented smart contract fulfills the concrete goals. The study is concluded with a discussion regarding how distributed ledgers might possibly be used in thef uture, what might be done to further develop the implemented smart contract and some of the ethical concerns surrounding distributed ledger technology.

Fausto Spoto

No abstract is available for this record.

Nan Jia, Queping Kong, Haiping Huang

No abstract is available for this record.

Aboua Ange Kevin N’DA, Santiago Matalonga, Keshav Dahal

No abstract is available for this record.

Ki Byung Kim, JongHyup Lee

We address the absence of reliable tests on contract analyzers of smart contracts and present a systematic method to diversify test cases by combining smart-contract-specific bugs and static analysis barriers in this paper. Using contract analyzers is the most practical solution for building a secure blockchain service, but they are relatively immature and lacking stable performance metrics. Traditionally, performance reports only compare static contract analyzers with pre-defined test cases, such as the Juliet test suite. However, building such test suites is burdensome for smart contracts, which are frequently change. In this paper, we propose an automated method to assess contract analyzers of smart contracts by diversifying test cases. In the experimental results, we identified nine erroneous alarms in the state-of-the-art contract analyzers with automatically generated test cases on five vulnerabilities.

Yulia Yu. Ivanova, Anton Khritankov

With the growing popularity of smart contracts, the problem of validation of their correctness becomes more and more relevant, but at the moment there are no universally recognized tools for their testing. In this paper, we propose to apply the mutational analysis to improve reliability of Solidity smart contracts. We identified wide spread errors in the source code of existing contracts and developed a RegularMutator tool for mutation analysis. It has shown its effectiveness in testing a large smart contracts project. As a result of our analysis, we managed to improve the test suites of the project to find the discovered defects and, increase the quality of the test suite.

Elvira Albert, Pablo Gordillo, Albert Rubio, Maria A. Schett

With the advent of smart contracts that execute on the blockchain ecosystem, a new mode of reasoning is required for developers that must pay meticulous attention to the gas spent by their smart contracts, as well as for optimization tools that must be capable of effectively reducing the gas required by the smart contracts. Super-optimization is a technique which attempts to find the best translation of a block of code by trying all possible sequences of instructions that produce the same result. This paper presents a novel approach for super-optimization of smart contracts based on Max-SMT which is split into two main phases: (i) the extraction of a stack functional specification from the basic blocks of the smart contract, which is simplified using rules that capture the semantics of the arithmetic, bit-wise, relational operations, etc. (ii) the synthesis of optimized blocks which, by means of an efficient Max-SMT encoding, finds the bytecode blocks with minimal gas cost whose stack functional specification is equal (modulo commutativity) to the extracted one. Our experimental results are very promising: we are able to optimize 55.41 % of the blocks, and prove that 34.28 % were already optimal, for more than 61000 blocks from the most called 2500 Ethereum contracts.

Xiaoqi Li, Ting Chen, Xiapu Luo, Tao Zhang · 6 authors

More than eight million smart contracts have been deployed into Ethereum, which is the most popular blockchain that supports smart contract. However, less than 1% of deployed smart contracts are open-source, and it is difficult for users to understand the functionality and internal mechanism of those closed-source contracts. Although a few decompilers for smart contracts have been recently proposed, it is still not easy for users to grasp the semantic information of the contract, not to mention the potential misleading due to decompilation errors. In this paper, we propose the first system named STAN to generate descriptions for the bytecodes of smart contracts to help users comprehend them. In particular, for each interface in a smart contract, STAN can generate four categories of descriptions, including functionality description, usage description, behavior description, and payment description, by leveraging symbolic execution and NLP (Natural Language Processing) techniques. Extensive experiments show that STAN can generate adequate, accurate, and readable descriptions for contract's bytecodes, which have practical value for users.

Emad Badawi, Guy-Vincent Jourdan

Cryptocurrencies have been a target for cybercriminal activities because of the pseudo-anonymity and privacy they offer. Researchers have been actively working on analyzing and developing innovative defensive mechanisms to prevent these activities. A significant challenge facing researchers is collecting datasets to train defensive systems to detect and analyze these cyberattacks. Our aims in this systematic review are to explore and aggregate the state of the art threats that have emerged with cryptocurrencies and the defensive mechanisms that have been proposed. We also discuss the threats type, scale, and how efficient the defensive mechanisms are in providing early detection and prevention. We also list out the resources that have been used to collect datasets, and we identify the publicly available ones. In this study, we extracted 1,221 articles from four top scientific and engineering databases and libraries in Computer Science: IEEE Xplore, ACM Digital Library, Elsevier's Scopus, and Crarivate's Web of Science. We defined inclusion, exclusion, and quality of assessment criteria, and after a detailed review process, 66 publications were included in the final review. Our analysis revealed that the literature contains a significant amount of research to detect and analyze several attack types, such as the high yield investment programs and pump and dump. These attacks have been used to steal millions of USD, abuse millions of connected devices, and have created even more significant loss in denial of services and productivity losses. We have found that the researchers use various sources to collect training datasets. Many authors have made their dataset publicly available. We have created a list of these datasets, which we have made available along with other supplementary websites, tools, and libraries that can be used in the data collection and analysis process.

Mauro C. Argañaraz, Mario Berón, Maria João Varanda Pereira, Pedro Rangel Henriques

Ethereum is the principal ecosystem based on blockchain that provides a suitable environment for coding and executing smart contracts, which have been receiving great attention due to the commercial apps and among the scientific community. The process of writing secure and well performing contracts in the Ethereum platform is a major challenge for developers. It consists of the application of non-conventional programming paradigms due to the inherent characteristics of the execution of distributed computing programs. Furthermore, the errors in the deployed contracts could have serious consequences because of the immediate linkage between the contract code and the financial transactions. The direct handling of the assets means that the errors can be more relevant for security and have greater economic consequences than a mistake in the conventional apps. In this paper, we propose a tool for the detection of vulnerabilities in high-level languages based on automatized static analysis.

Dong‐Her Shih, Ting-Wei Wu, Tzu-Hsin Hsu, Po-Yuan Shih · 5 authors

With advancement in computer technology, financial technology has also evolved. Blockchain technology has evolved over the past decade; however, this has also resulted in some malicious attacks. To earn mining rewards of a blockchain, a new type of attack, called cryptojacking, has emerged in the online world. This attack uses the computer resources of a victim to obtain mining rewards without user confirmation. However, this monetization model was originally intended to replace advertising as a source of revenue for a website. To resolve such problems, a storage verification architecture based on smart contracts was proposed in the study. The decentralized system of blockchain enables users to identify and participate in verification of mining sites through Ethereum smart contracts.