Follow blockchain research across journals, conferences, and preprint repositories.
2,015 results · page 76 of 84
Sanket Kanjalkar, Joseph Kuo, Yunqi Li, Andrew Miller
No abstract is available for this record.
Menglin Fu, Lifa Wu, Zheng Hong, Feng Zhu · 6 authors
The second generation of blockchain represented by smart contracts has been developing vigorously in recent years. However, frequent smart contract vulnerability incidents pose a serious risk to blockchain ecosystem security. Since current symbol execution tools often fall into path explosion and thus lead to inefficient detection, this paper expands Mythril's framework to optimize its performance. Firstly, it finds out potential vulnerable code regions using static analysis and identifies critical paths that may have security defects. Then, aiming at the problem that traditional search algorithms cannot actively locate and explore critical paths, this paper presents a multi-objective oriented path search (MOPS) strategy based on path priority. This strategy guides dynamic symbolic execution to cover critical paths quickly, avoiding blind traversal of program execution paths. Finally, it describes security rules and proposes corresponding detection logics for different vulnerability categories. This paper analyzes over 1000 smart contracts extracted from Etherscan. Compared with existing tools based on symbolic execution, the proposed method can reduce time consumption by around 35% while ensuring the accuracy of vulnerability detection. Moreover, existing tools often issue warnings that do not actually cause financial losses. But the proposed method only concentrates on code regions related to transfer of funds, so it can reduce the false alarm rate to some extent.
Sarah Azouvi, Mary Maller, Sarah Meiklejohn
No abstract is available for this record.
Ayushi Sharma, Shashwat Tiwari, Nitin Arora, S. C. Sharma
Blockchain is an emerging technology that can radically improve transactions security at banking, supply chain, and other transaction networks. It's estimated that Blockchain will generate $3.1 trillion in new business value by 2030. Essentially, it provides the basis for a dynamic distributed ledger that can be applied to save time when recording transactions between parties, remove costs associated with intermediaries, and reduce risks of fraud and tampering. This book explores the fundamentals and applications of Blockchain technology. Readers will learn about the decentralized peer-to-peer network, distributed ledger, and the trust model that defines Blockchain technology. They will also be introduced to the basic components of Blockchain (transaction, block, block header, and the chain), its operations (hashing, verification, validation, and consensus model), underlying algorithms, and essentials of trust (hard fork and soft fork). Private and public Blockchain networks similar to Bitcoin and Ethereum will be introduced, as will concepts of Smart Contracts, Proof of Work and Proof of Stack, and cryptocurrency including Facebook's Libra will be elucidated. Also, the book will address the relationship between Blockchain technology, Internet of Things (IoT), Artificial Intelligence (AI), Cybersecurity, Digital Transformation and Quantum Computing. Readers will understand the inner workings and applications of this disruptive technology and its potential impact on all aspects of the business world and society. A look at the future trends of Blockchain Technology will be presented in the book.
Md. Shohel Rana, Charan Gudla, Andrew H. Sung
No abstract is available for this record.
Joran J. Honig, Maarten H. Everts, Marieke Huisman
No abstract is available for this record.
Yongfeng Huang, Yiyang Bian, Renpu Li, Jianjun Zhao · 5 authors
Smart contract security is an emerging research area that deals with security issues arising from the execution of smart contracts in a blockchain system. Generally, a smart contract is a piece of executable code that automatically runs on the blockchain to enforce an agreement preset between parties involved in the transaction. As an innovative technology, smart contracts have been applied in various business areas, such as digital asset exchange, supply chains, crowdfunding, and intellectual property. Unfortunately, many security issues in smart contracts have been reported in the media, often leading to substantial financial losses. These security issues pose new challenges to security research because the execution environment of smart contracts is based on blockchain computing and its decentralized nature of execution. Thus far, many partial solutions have been proposed to address specific aspects of these security issues, and the trend is to develop new methods and tools to automatically detect common security vulnerabilities. However, smart contract security is systematic engineering that should be explored from a global perspective, and a comprehensive study of issues in smart contract security is urgently needed. To this end, we conduct a literature review of smart contract security from a software lifecycle perspective. We first analyze the key features of blockchain that can cause security issues in smart contracts and then summarize the common security vulnerabilities of smart contracts. To address these vulnerabilities, we examine recent advances in smart contract security spanning four development phases: 1) security design; 2) security implementation; 3) testing before deployment; and 4) monitoring and analysis. Finally, we outline emerging challenges and opportunities in smart contract security for blockchain engineers and researchers.
J. J. Song, Hong S. He, Zhuo Lv, Chunhua Su · 6 authors
No abstract is available for this record.
Michael Rodler, Wenting Li, Ghassan Karame, Lucas Davi
Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this paper, we address this problem in the context of re-entrancy exploits and propose a novel smart contract security technology, dubbed Sereum (Secure Ethereum), which protects existing, deployed contracts against re-entrancy attacks in a backwards compatible way based on run-time monitoring and validation. Sereum does neither require any modification nor any semantic knowledge of existing contracts. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent attacks with a false positive rate as small as 0.06% and with negligible run-time overhead. As a by-product, we develop three advanced re-entrancy attacks to demonstrate the limitations of existing offline vulnerability analysis tools.
Christof Ferreira Torres, Julian Schütte, Radu State
The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language.
Rui Qiao, Sifeng Zhu, Qingxian Wang, Jie Qin
Internet of Things is widely used in many fields such as industry, medical care, education, and supply chain. With the participation of multi-authorized entities, a large number of dynamic data will be generated in the basic dimension of time. The operations on these data have to be safe and traceable for use in various forensics and decisions. Therefore, the key point of dynamic data security protection is to reject tampering of unauthorized users and to realize the process in evidence and tracing of the dynamic data operation. In order to find a solution to the problem above, an optimization of dynamic data traceability mechanism based on consortium blockchain is proposed in this article. First, a mathematical model for the security of dynamic data storage has been established, followed by analysis on honest behavior motive of individual node decision-making in group game and distributed node cooperation essence in specific industry background. After that, ownership transition function and the architecture of the dynamic data storage system are optimized; quality and growth characteristics of the system under stochastic state model are analyzed. Result shows that the solution can effectively avoid potential attacks such as tampering and faking under approved accession mode. The mechanism has good application value while ensuring the dynamic data storage security.
Shanto Roy, M. Ashaduzzaman, Mehedi Hassan, Arnab Rahman Chowdhury
The paper presents an in detailed case study of integrating BlockChain (BC) in IoT ecosystems in order to achieve security and privacy. Since the use in cryptocurrency, BlockChain has gained tremendous attraction due to the versatile application prospects it raises. As internet of things (IoT) is emerging towards the smart city requirements, device or data security seems to be a major concern. Therefore, BlockChain based decentralized and distributed system can meet the privacy preserving management in IoT ecosystems. In this paper, we discuss the necessity of utilizing BlockChain for IoT security, privacy, management. We present a literature overview of current progresses and security enhancement in sensor networks using BlockChain; their scope, prospects and limitations as well. Finally, we suggest some future directions to indicate further areas of improvement.
Chi Ho Lau, Kai-Hau Yeung Alan, Fan Yan
IoT networks are designed to connect as many devices as possible. Since any device can be connected to an IoT network, it faces an authentication issue, which may be exploited by attackers to break into the IoT network. A solution discussed in this paper is to make use of blockchain technology to authenticate IoT devices before it joins an IoT network. Based on the characteristics of blockchain, it can be used to create the digital identification of IoT devices and authenticate them. Authenticated Devices Configuration Protocol (ADCP) is proposed to achieve this authentication process. All results of the solution have been demonstrated by a fully working implementation, and do not solely rely on theoretical considerations or simulations.
Gerard de Roode, Ikram Ullah, Paul Havinga
IOTA is a novel cryptocurrency that uses distributed ledger technology based on directed acyclic graph data structure. Security of cryptocurrencies ought to be scrutinized in order to acquire esteemed security, attain trust, and accomplish indelible adoption. Although IOTA proffer resilient security controls, IOTA security is not yet well explored. Among all the propounded IOTA vulnerabilities that have been identified, we pragmatically exploit replay attack against IOTA. We further analyze the attack to perceive its impact. Attack methodology and proof of concept for the replay attack is presented. Our proposed exploitation methodology is based upon address reuse, while IOTA in default mode does not reuse addresses. Distrust, and privation of balance can be some of the severe impacts of this vulnerability.
Igor Kotsiuba, Artem Velykzhanin, Oleg Biloborodov, Inna Skarga-Bandurova · 7 authors
Smart Grids is an emerging technology promising significant changes in the economy and the social sphere. One among many challenges in their development and distribution is security. Considering recent hackers attacks on energy grids and taking into account the distributed structure of these systems the use of traditional means of computer protection and the search for a crime figure becomes more difficult or impossible. In this article, we introduce some application areas of smart grid forensic science, discuss the opportunities, and outline the open issues in the topic. We summarized challenges for forensic in Smart Grids in connection with a Blockchain and proposed a decentralized transaction platform based on Blockchain tailored to the energy sector with all the latest technology such as advanced metering infrastructure, distributed generation, etc.
W. K. Chan, Bo Jiang
In this paper, we report our project Fuse, which is a fuzz testing service. It presents the Fuse architecture, and discusses the progress and technical issues to be addressed to fuzz-test smart contracts and support fuzz-testing of Dapps.
Xu Wang, Xuan F. Zha, Guangsheng Yu, Wei Ni · 8 authors
Ethereum, as the first Turing-complete blockchain platform, provides various application program interfaces for developers. Although blockchain has highly improved security, faulty configuration and usage can result in serious vulnerabilities. In this paper, we focus on the security vulnerabilities of the official Go-version Ethereum client (geth). The vulnerabilities are because of the insecure API design and the specific Ethereum wallet mechanism. We demonstrate attacks exploiting these vulnerabilities in an Ethereum testbed. The vulnerabilities are confirmed by the scanning results on the public Internet. Finally, corresponding countermeasures against attacks are provided to enhance the security of the Ethereum platform.
Sukrit Kalra, Rishabh Sanghi, Mohan Dhawan
The gaming industry is affected by two key issues---cheating and DDoS attacks against game servers. In this paper, we aim to present a novel yet concrete application of the blockchain technology to address the seemingly disparate problems. Our approach uses blockchain to manage definitive game state and exploits peer consensus on every player action to track modifications to tangible player assets. While a key impediment to adopting blockchain for real-time systems is its high per-operation latency, our approach leverages several optimizations to enable real-time prevention of a large class of cheats where the reported client state is inconsistent with the observed state at the server. Further, blockchain-based games leverage the robust peer-to-peer architecture to successfully defend against DDoS attacks.
Michael Fröwis, Andreas Fuchs, Rainer Böhme
We propose and compare two approaches to identify smart contracts as token systems by analyzing their public bytecode. The first approach symbolically executes the code in order to detect token systems by their characteristic behavior of updating internal accounts. The second approach serves as a comparison base and exploits the common interface of ERC-20, the most popular token standard. We present quantitative results for the Ethereum blockchain, and validate the effectiveness of both approaches using a set of curated token systems as ground truth. We observe 100% recall for the second approach. Recall rates of 89% (with well explainable missed detections) indicate that the first approach may also be able to identify "hidden" or undocumented token systems that intentionally do not implement the standard. One possible application of the proposed methods is to facilitate regulator' tasks of monitoring and policing the use of token systems and their underlying platforms.
Fabiola Hazel Pohrmen, Rohit Das, Wanbanker Khongbuh, Goutam Saha
No abstract is available for this record.
George Markowsky, Олег Савенко, Anatoliy Sachenko
No abstract is available for this record.
Alexander Mense, Markus Flatscher
Smart contracts (SC) are one of the most appealing features of blockchain technologies facilitating, executing, and enforcing predefined terms of coded contracts without intermediaries. The steady adoption of smart contracts on the Ethereum blockchain has led to tens of thousands of contracts holding millions of dollars in digital currencies and small mistakes during the development of SC on immutable blockchains have already caused substantial losses and involve the danger for future incidents. Hence, today the secure development of smart contracts is an important topic and several attacks and incidents related to vulnerable smart contracts could have been avoided. To foster a secure development process of SC this paper summarizes known vulnerabilities in smart contracts found by literature research and analysis. It compares currently available code analysis tools for their capabilities to identify and detect vulnerabilities in smart contracts based on a taxonomy for vulnerabilities. Finally, based on the TheDOA attack the paper shows an example for the adoption of best practices to avoid severe vulnerabilities in smart contracts.
Wesley Joon-Wie Tann, Xing Han, Sourav Sen Gupta, Yew-Soon Ong
Symbolic analysis of security exploits in smart contracts has demonstrated to be valuable for analyzing predefined vulnerability properties. While some symbolic tools perform complex analysis steps, they require a predetermined invocation depth to search vulnerable execution paths, and the search time increases with depth. The number of contracts on blockchains like Ethereum has increased 176 fold since December 2015. If these symbolic tools fail to analyze the increasingly large number of contracts in time, entire classes of exploits could cause irrevocable damage. In this paper, we aim to have safer smart contracts against emerging threats. We propose the approach of sequential learning of smart contract weaknesses using machine learning---long-short term memory (LSTM)---that allows us to be able to detect new attack trends relatively quickly, leading to safer smart contracts. Our experimental studies on 620,000 smart contracts prove that our model can easily scale to analyze a massive amount of contracts; that is, the LSTM maintains near constant analysis time as contracts increase in complexity. In addition, our approach achieves $99\%$ test accuracy and correctly analyzes contracts that were false positive (FP) errors made by a symbolic tool.
Jianbo Gao, Han Liu, Chao Liu, Qingshan Li · 6 authors
While Ethereum smart contracts enabled a wide range of blockchain applications, they are extremely vulnerable to different forms of security attacks. Due to the fact that transactions to smart contracts commonly involve cryptocurrency transfer, any successful attacks can lead to money loss or even financial disorder. In this paper, we focus on the overflow attacks in Ethereum, mainly because they widely rooted in many smart contracts and comparatively easy to exploit. We have developed EASYFLOW, an overflow detector at Ethereum Virtual Machine level. The key insight behind EASYFLOW is a taint analysis based tracking technique to analyze the propagation of involved taints. Specifically, EASYFLOW can not only divide smart contracts into safe contracts, manifested overflows, well-protected overflows and potential overflows, but also automatically generate transactions to trigger potential overflows. In our preliminary evaluation, EASYFLOW managed to find potentially vulnerable Ethereum contracts with little runtime overhead. A demo video of EASYFLOW is at https://youtu.be/QbUJkQI0L6o.