Blockchain Papers

Aung Htein Maw, Sridhar Adepu, Aditya P. Mathur

No abstract is available for this record.

Uros Hercog, Andraž Povše

Determining the trust of an individual Bitcoin wallet is a difficult problem. There are no ratings, that offer vendors or exchanges meaningful information about the level of the taint of Bitcoins they are receiving. Lack of such information places exchanges liable in an event when the received Bitcoins are stolen or ill-gotten. In this paper, we try to solve this problem by introducing a Bitcoin address taint score called TaintRank. It provides insight into a specific wallet by taking the addresses it interacted with throughout history into consideration. This ranking method provides such Bitcoin exchange companies insight with whom they are trading.

Monika di Angelo, Gernot Salzer

Smart contracts on a blockchain are programs running in a distributed, transparent, and trustless environment, being one of the major assets of this new technology. They give rise to innovative applications and business models, with their potential and lasting impact still open. In this situation, it is interesting to understand what smart contracts are actually doing. While public announcements, by their nature, make promises of what smart contracts might achieve, the openly available data of blockchains provides a more balanced view on what is actually going on. In this paper, we analyze the activities of smart contracts on the Ethereum blockchain, the most prominent platform for smart contracts with all blockchain data visible. However, contracts operate behind the scenes. Their activities are only accessible by looking beyond the mere blockchain data that records external transactions. We also use all internal messages caused by contracts interacting with other addresses. In particular, we investigate the activities of smart contracts in their quantitative and temporal aspects. Based on lifespan and activity patterns, we identify particular groups like mayflies, loners, breeders, busy bees, sleepers, self-destructed and bonkers contracts and visualize their temporal characteristics. To gain insights into the purpose of these smart contracts we perform a basic analysis of code and message content including deployment code. We consider data up to Ethereum block 6900000 (end of 2018).

Yingying Wang, Guoqiang Li

Blockchain provides a decentralized trade means, which has attracted both academic and industrial researchers' attention. It was first proposed as the basic structure of bitcoin. In practice, it could be hacked for gaining profit or performing some illegal transactions, hence, a question about how to detect these potential risks has been raised. This paper builds a model for blockchain core protocol, and adopts the trace semantics, i.e. a sequence of actions, which can record any possible conditions that the running protocol may reach. Also, as an application of DDoS attack on blockchain, triangle attack is shown and can be formalized and detected by the contradiction to the security property. Furthermore, some advice to defend the triangle attack are presented.

Pinchen Cui, Ujjwal Guin

The success and widespread use of Internet of Things (IoT) bring remarkable contributions and economic benefits in various fields. However, the increasing number of devices also raises security concerns. The prevalence of Botnet of Things (BoT) has been observed and it has been recently reported that the launched attacks affect multiple domains and have caused unacceptable losses. As majority of IoT devices are manufactured off-shore, ensuring their identity becomes one of the major challenges. Cloned devices, with backdoors for malicious purposes, can provide an undue advantage of the adversary to compromise a system even though proper security measures are in place. In this paper, we propose a novel blockchain-based framework to provide traceability of hardware. A unique identity for every IoT device is ensured using a physically unclonable function (PUF). The blockchain provides the verification of these devices by comparing these unique IDs. HyperLedger is selected to implement the blockchain-based framework, and its performance is being evaluated and analyzed.

Víctor Gabriel Reyes-Macedo, Moisés Salinas-Rosales, Gina Gallegos-García

A ransomware is a kind of malware used for digital extortion purposes, where victims must make a payment with acryptocurrency in exchange of information or compromised systems. This article presents a method to analyze thedynamic of Bitcoin transactions related to ransomware, through the representation of the blockchain as a directednetwork, and the measurement of the corresponding parameters, as well as statistical analysis and a transaction tracking.

Bo Wu, Ke Xu, Qi Li, Zhuotao Liu · 9 authors

Internet of Things (IoT) devices achieve the rapid development and have been widely deployed recently. Meanwhile, inherent vulnerabilities of IoT systems (including firmware and software) have been continually uncovered and thus the systems are always exposed to various attacks. The root cause of the issue is that IoT systems always have design flaws and implementation bugs. In particular, the released systems (e.g., by third-party marketplaces and IoT vendors) may be maliciously repackaged with malware. Unfortunately, IoT consumers are not able to effectively capture such vulnerabilities because of the limited detection capabilities. In this paper, we propose SmartCrowd, a blockchain-based platform that aims to outsource security detection of IoT systems to distributed detectors with strong detection incentives. SmartCrowd enables built-in accountability for IoT providers and authoritative references of detection results for IoT consumers. By building smart contracts, we can incentivize the efficient and high-coverage security detection of IoT systems, while providing decentralized and automated incentives for both IoT providers releasing secure IoT systems and detectors uncovering vulnerabilities. We present the security and theoretical analysis that demonstrates the security of SmartCrowd and the incentives for participators. We prototype SmartCrowd by using Ethereum and the experimental results show that SmartCrowd has both technical feasibility and financial benefits, which can be applied to build a secure IoT ecosystem.

Sooyeon Lee, Eun-Sun Cho

When a Solidity smart contract has a problem in calling a function of another contract, the "fallback function" of the contract is supposed to be executed automatically. However, in many cases, a fallback function is arbitrarily created and called, with their behaviors unknown to developers, so that its execution is vulnerable to exploits by attackers. To reduce these risks, this paper proposes a method that provides developers with new keywords by modifying existing Solidity compiler and Ethereum Virtual Machine (EVM). Developers mark their intention using the newly introduced keywords, and the modified existing Solidity compiler and EVM uses flags and conditional statements to prevent calls of fallback functions to reduce the risk of calls to fallback functions.

N Anita., M. Vijayalakshmi

Blockchain technology has attracted various areas like corporations, education, government, and healthcare because of its unhackable security features. In spite of common arguments about the occurrence of Blockchain technology in terms of security and privacy, in reality, several attacks can be launched against them. This paper presents a comprehensive survey of the most vulnerable Blockchain attacks and the different approaches proposed against these attacks. This paper also provides taxonomy of attacks, which are most challengeable to Blockchain security key features. Additionally, a review of the countermeasures, which have offered solutions to avoid these attacks, has been presented.

Xiupei Mei, Imran Ashraf, Bo Jiang, W. K. Chan

Smart contracts are code to keep agreements in the form of data or smart contracts residing in a blockchain system. Making data corruptions to these data records may lead to insert unwanted agreements, corrupt an existing one, or remove the latter ones mistakenly. This paper reports the progress of our progress in developing a fuzz testing service with client side support. It will present the overall approach of the testing services followed by a discussion on the road ahead.

Patrick L. Chapman, Dianxiang Xu, Lin Deng, Yin Xiong

Blockchain in recent years has exploded in popularity with Ethereum being one of the leading blockchain platforms. Solidity is a widely used scripting language for creating smart contracts in Ethereum applications. Quality assurance in Solidity contracts is of critical importance because bugs or vulnerabilities can lead to a considerable loss of financial assets. However, it is unclear what level of quality assurance is provided in many of these applications. Mutation testing is the process of intentionally injecting faults into a target program and then running the provided test suite against the various injected faults. Mutation testing is used to evaluate the effectiveness of a test suite, measuring the test suite’s capability of covering certain types of faults. This thesis presents Deviant, the first implementation of a mutation testing tool for Solidity smart contracts. Deviant implements mutation operators that cover the unique features of Solidity according to our constructed fault model, in addition to traditional mutation operators that exist for other programming languages. Deviant has been applied to five open-source Solidity projects: MetaCoin [30], MultiSigWallet [31], Alice [29], aragonOS [32], and OpenZeppelin [33]. Experimental results show that the provided test suites result in low mutation scores. These results indicate that the provided tests cannot ensure high-level assurance of code quality. Such evaluation results offer important guidelines for Solidity developers to implement more effective tests in order to deliver trustworthy code and reduce the risk of financial loss.

Gbadebo Ayoade, Erick Bauman, Latifur Khan, Kevin W. Hamlen

An Ethereum bytecode rewriting and validation architecture is proposed and evaluated for securing smart contracts in decentralized cryptocurrency systems without access to contract source code. This addresses a wave of smart contract vulnerabilities that have been exploited by cybercriminals in recent years to steal millions of dollars from victims. Such attacks have motivated various best practices proposals for helping developers write safer contracts; but as the number of programming languages used to develop smart contracts increases, implementing these best practices can be cumbersome and hard to enforce across the development tool chain. Automated hardening at the bytecode level bypasses this source-level heterogeneity to enforce safety and code integrity properties of contracts independently of the sources whence they were derived. In addition, a binary code verification tool implemented atop the Coq interactive theorem prover establishes input-output equivalence between the original code and the modified code. Evaluation demonstrates that the system can enforce policies that protect against integer overflow and underflow vulnerabilities in real Ethereum contract bytecode, and overhead is measured in terms of instruction counts.

Mehmet Demir, Manar H. Alalfi, Ozgur Turetken, Alexander Ferworn

The popularity of blockchain technology encourages organizations to use more blockchain features in mission-critical processes such as trading, access control, and computational public safety. Automation of processes with smart contracts is one of these features that significantly enlarge the scope of a blockchain implementation. Smart contracts help automate business processes by modeling business activities on the distributed ledger. Smart contracts are significantly different from other programs from a defect fixing and security issue handling perspective. The opportunity of fixing such issues is only available in the narrow window before registering the contract on to the blockchain. After a smart contract becomes a part of the chain, it is not possible to update or fix any issues. This distinct nature of smart contracts makes it essential to detect the program issues early on by paying attention to security smells. Security smells are clues that point to a deeper problem in the programming space. In this study, we review the literature and identify vulnerabilities that programmers and beneficiaries of smart contracts must avoid. We explain these security smells and categorize them based on their nature. We also review the applications that detect these vulnerabilities and provide information about their approach and coverage. Our main contribution is the evaluation of smart contracts as a platform or aid for mission-critical applications such as access control platforms. We conducted this evaluation by identifying the issues related to smart contracts and informing the reader about the problem, challenges, and techniques. We conclude by defining future directions for our research.

Sergiu SECHEL

Ransomware represents a class of malicious applications that encrypts the files of infected system and demands from victims a payment in cryptocurrency in order to receive the decryption key. The mainstream adoption of cryptocurrencies increased the number of ransomware attack. The outbreaks had risen in complexity and received mass-media attention in 2017 when two destructive campaigns crippled companies and institutions around the world. These outbreaks continue at an accelerated pace even though efforts are made to improve the detection and mitigation of ransomware. The purpose of this research is to assess the efficiency of current malware analysis methods and technologies in the detection of ransomware. The experiments presented here were performed using antivirus engines and dynamic malware analysis against live obfuscated ransomware samples.

Cédric Hébert, Francesco Di Cerbo

No abstract is available for this record.

Lijin Quan, Lei Wu, Haoyu Wang

As one of the representative Delegated Proof-of-Stake (DPoS) blockchain platforms, EOSIO's ecosystem grows rapidly in recent years. A number of vulnerabilities and corresponding attacks of EOSIO's smart contracts have been discovered and observed in the wild, which caused a large amount of financial damages. However, the majority of EOSIO's smart contracts are not open-sourced. As a result, the WebAssembly code may become the only available object to be analyzed in most cases. Unfortunately, current tools are web-application oriented and cannot be applied to EOSIO WebAssembly code directly, which makes it more difficult to detect vulnerabilities from those smart contracts. In this paper, we propose \toolname, a static analysis tool that can be used to detect vulnerabilities from EOSIO WASM code automatically. We focus on one particular type of vulnerabilities named \textit{fake-transfer}, and the exploitation of such vulnerabilities has led to millions of dollars in damages. To the best of our knowledge, it is the first attempt to build an automatic tool to detect vulnerabilities of EOSIO's smart contracts. The experimental results demonstrate that our tool is able to detect fake transfer vulnerabilities quickly and precisely. EVulHunter is available on GitHub\footnote{Tool and benchmarks: https://github.com/EVulHunter/EVulHunter} and YouTube\footnote{Demo video: https://youtu.be/5SJ0ZJKVZvw}.

Xiaoyang Zhu

The premise of the Internet of Things (IoT) is to interconnect not only sensors, mobile devices, and computers but also individuals, homes, smart buildings, and cities, as well as electrical grids, automobiles, and airplanes, to mention a few. However, realizing the extensive connectivity of IoT while ensuring user security and privacy still remains a challenge. There are many unconventional characteristics in IoT systems such as scalability, heterogeneity, mobility, and limited resources, which render existing Internet security solutions inadequate to IoT-based systems. Besides, the IoT advocates for peer-to-peer networks where users as owners intend to set security policies to control their devices or services instead of relying on some centralized third parties. By focusing on scientific challenges related to the IoT unconventional characteristics and user-centric security, we propose an IoT secure infrastructure enabled by the blockchain technology and driven by trustless peer-to-peer networks. Our IoT secure infrastructure allows not only the identification of individuals and collectives but also the trusted identification of IoT things through their owners by referring to the blockchain in trustless peer-to-peer networks. The blockchain provides our IoT secure infrastructure with a trustless, immutable and public ledger that records individuals and collectives identities, which facilitates the design of the simplified authentication protocol for IoT without relying on third-party identity providers. Besides, our IoT secure infrastructure adopts socialized IoT paradigm which allows all IoT entities (namely, individuals, collectives, things) to establish relationships and makes the IoT extensible and ubiquitous networks where owners can take advantage of relationships to set access policies for their devices or services. Furthermore, in order to protect operations of our IoT secure infrastructure against security threats, we also introduce an autonomic threat detection mechanism as the complementary of our access control framework, which can continuously monitor anomaly behavior of device or service operations.

Jen-Wei Hu, Lo‐Yao Yeh, Shih-Wei Liao, Chu-Sing Yang

No abstract is available for this record.

Elvira Albert, Jesús Correas, Pablo Gordillo, Guillermo Román‐Díez · 5 authors

Ethereum smart contracts are public, immutable and distributed and, as such, they are prone to vulnerabilities sourcing from programming mistakes of developers. This paper presents SAFEVM, a verification tool for Ethereum smart contracts that makes use of state-of-the-art verification engines for C programs. SAFEVM takes as input an Ethereum smart contract (provided either in Solidity source code, or in compiled EVM bytecode), optionally with assert and require verification annotations, and produces in the output a report with the verification results. Besides general safety annotations, SAFEVM handles the verification of array accesses: it automatically generates SV-COMP verification assertions such that C verification engines can prove safety of array accesses. Our experimental evaluation has been undertaken on all contracts pulled from etherscan.io (more than 24,000) by using as back-end verifiers CPAchecker, SeaHorn and VeryMax.

Dmitrii Suvorov, Vladimir Ulyantsev

Modern blockchain systems support creation of smart contracts -- stateful programs hosted and executed on a blockchain. Smart contracts hold and transfer significant amounts of digital currency which makes them an attractive target for security attacks. It has been shown that many contracts deployed to public ledgers contain security vulnerabilities. Moreover, the design of blockchain systems does not allow the code of the smart contract to be changed after it has been deployed to the system. Therefore, it is important to guarantee the correctness of smart contracts prior to their deployment. Formal verification is widely used to check smart contracts for correctness with respect to given specification. In this work we consider program synthesis techniques in which the specification is used to generate correct-by-construction programs. We focus on one of the special cases of program synthesis where programs are modeled with finite state machines (FSMs). We show how FSM synthesis can be applied to the problem of automatic smart contract generation. Several case studies of smart contracts are outlined: crowdfunding platform, blinded auction and a license contract. For each case study we specify the corresponding smart contract with a set of formulas in linear temporal logic (LTL) and use this specification together with test scenarios to synthesize a FSM model for that contract. These models are later used to generate executable Solidity code which can be directly used in a blockchain system.

Jonathan White, Charles B. Daniels

Traditional management practices applied to the cybersecurity realm are causing significant delays to the product release cycle for major organizations and government agencies. These delays are often seen as a necessary part of the security landscape to ensure appropriate approvals, audits, and risks are addressed prior to fielding software. However, the exact opposite outcome has been observed; delayed releases decrease overall security and functionality. This paper presents an alternative approval and review process using blockchain technology that complements agile development and continuous delivery paradigms. An example implementation is provided to demonstrate the behavior of the proposed system under hypothetical auditing and threat assessment scenarios.

Daire Homan, Ian Shiel, Christina Thorpe

The aim of this research is to propose a new blockchain network model that facilitates the secure dissemination of Cyber Threat Intelligence (CTI) data. The primary motivations for this study are based around the recent changes to information security legislation in the European Union and the challenges that Computer Security and Incident Response Teams (CSIRT) face when trying to share actionable and highly sensitive data within systems where participants do not always share the same interests or motivations. We discuss the common problems within the domain of CTI sharing and we propose a new model, that leverages the security properties of blockchain. Our model provides a more effective and efficient framework for a CTI sharing network that has the potential to overcome the trust barriers and data privacy issues inherent in this domain. We implemented a testbed using Hyperledger Fabric and the STIX 2.0 protocol and validated the efficacy of the segmentation, implemented using smart contracts and Fabric channels.

Muhammad Saad, Ashar Ahmad, Aziz Mohaisen

Fake news has become a major problem in the cyberspace with far reaching consequences. The open access and unregulated social networks are popular attack vectors that are frequently used to propagate misinformation. To fight this problem, several naïve solutions have been proposed, including a blockchain implementation of news feed to distinguish facts from fiction. However, the size of social networks and the design constructs of blockchain add several new challenges that impede the real world deployment of such solutions. In this paper, we postulate a new blockchain system that overcomes the existing challenges and limits the spread of fake news across the network. Towards that, we analyze the information workflow in the social networks and construct an optimal detection system that can be effectively deployed with minimal overhead. Moreover, our proposed solution can be extended beyond social networks to other online platforms.

Tian Min, Wei Cai

Blockchain gaming is an emerging entertainment paradigm. However, blockchain games are still suffering from security issues, due to the immature blockchain technologies and its unsophisticated developers. In this work, we analyzed the blockchain game architecture and reveal the possible penetration methods of cracking. We scanned more than 600 commercial blockchain games to summarize a security overview from the perspective of the web server and smart contract, respectively. We also conducted three case studies for blockchain games to show detailed vulnerability detection.