Making Smart Contracts Smarter

Advancements in cryptography and computer science have given birth to blockchain technology. One of the most exciting evolutions of blockchain is the advancements in smart contract technology. Smart contracts can be used for a broad range of use cases, not just financial transactions. Smart contract technology on the public blockchain, represented by Ethereum, due to its public and opaque nature, is not a good choice for many scenarios that do not require full disclosure, such as many IoT applications. On the other hand, the existing blockchain smart contract system still has a strong connection with virtual currency, which also limits its application in non-financial scenarios. In order to solve the above problems and explore more of the potential of smart contracts for the IoT application domain, this paper mainly explores the construction of a smart contract system based on consortium blockchains associated with no virtual currency. Based on the smart contract system designed in this project, blockchain can be more easily applied in payment, product traceability, authority authentication, and other fields. Through a certain centralized way, the system is easier to manage, can reduce the management expenditure, and the power and other resource consumption is less, which is conducive to environmental protection. Results show that our smart contract system has the potential for IoT usage in the future.

Integer overflow is a common vulnerability in Ethereum Smart Contracts (ESCs) and often causes huge economic losses. Smart contracts cannot be changed once it is deployed on the blockchain and thus demand further testing. Mutation testing is a fault-based testing method that can effectively improve the sufficiency of a test for smart contracts. However, existing methods cannot efficiently perform mutation testing specifically for integer overflow in ESCs. Therefore, by analyzing integer overflow in ESCs, we propose five special mutation operators to address such vulnerability in terms of detecting sufficiency in ESC testing. An empirical study on 40 open-source ESCs is conducted to evaluate the effectiveness of the proposed mutation operators. Results show that: (1) our proposed mutation operators can reproduce all 179 integer overflow vulnerabilities in 40 smart contracts, and the generated mutants have high compilation pass rate and integer overflow vulnerability generation rate; moreover, (2) the generated mutants can find the shortcomings of existing testing methods for integer overflow vulnerability, thereby providing effective support to improve the sufficiency of the test.

Blockchain technology and its applications are gaining popularity day by day. It is a ground-breaking technology that allows users to communicate without the need of a trusted middleman. A smart contract (self-executable code) is deployed on the blockchain and auto executes due to a triggering condition. In a no-trust contracting environment, smart contracts can establish trust among parties. Terms and conditions embedded in smart contracts will be imposed immediately when specified criteria have been fulfilled. Due to this, the malicious assailants have a special interest in smart contracts. Blockchains are immutable means if some transaction is deployed or recorded on the blockchain, it becomes unalterable. Thus, smart contracts must be analyzed to ensure zero security vulnerabilities or flaws before deploying the same on the blockchain because a single vulnerability can lead to the loss of millions. For analyzing the security vulnerabilities of smart contracts, various analysis tools have been developed to create safe and secure smart contracts. This paper presents a systematic review on Ethereum smart contracts analysis tools. Initially, these tools are categorized into static and dynamic analysis tools. Thereafter, different sources code analysis techniques are studied such as taint analysis, symbolic execution, and fuzzing techniques. In total, 86 security analysis tools developed for Ethereum blockchain smart contract are analyzed regardless of tool type and analysis approach. Finally, the paper highlights some challenges and future recommendations in the field of Ethereum smart contracts.

Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting parties. Being the most prominent platform that supports smart contracts, Ethereum has been targeted by many attacks and plagued by security incidents. Consequently, many smart contract vulnerabilities have been discovered in the past decade. To detect and prevent such vulnerabilities, different security analysis tools, including static and dynamic analysis tools, have been created, but their performance decreases drastically when codes to be analyzed are constantly being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool that detects smart contract vulnerabilities. Eth2Vec maintains its robustness against code rewrites; i.e., it can detect vulnerabilities even in rewritten codes. Other machine-learning-based static analysis tools require features, which analysts create manually, as inputs. In contrast, Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable contracts. In doing so, Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned contracts. We performed experiments with existing open databases, such as Etherscan, and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics, i.e., precision, recall, and F1-score.

Smart contract (SC) is an extension of BlockChain technology. Ethereum BlockChain was the first to incorporate SC and thus started a new era of crypto-currencies and electronic transactions. Solidity helps to program the SCs. Still, soon after Solidity's emergence in 2014, Solidity-based SCs suffered many attacks that deprived the SC account holders of their precious funds. The main reason for these attacks was the presence of vulnerabilities in SC. This paper discusses SC vulnerabilities and classifies them according to the domain knowledge of the faulty operations. This classification is a source of reminding developers and software engineers that for SC's safety, each SC requires proper testing with effective tools to catch those classes' vulnerabilities.

As Ethereum's smart contracts have boomed, it has become an integral part of the blockchain ecosystem. Unfortunately, some malicious users also find the opportunity to use fraudulent means to profit. A new reported approach is to lure new users or other attackers into the contract in an attempt to make a profit by exposing seemingly obvious flaws in the contract. But in fact, the contract contains a hidden trap that ultimately benefits the creator of the contract. Such contracts are known as honeypot contracts in the blockchain ecosystem. Previous studies proposed two methods to identify such smart contracts by using symbolic execution and contract behaviors. However, these methods either make it difficult to discover new categories or fail to warn users before they lose money. To solve this problem, we propose a machine learning model to detect honeypot contracts based on N-gram features and LightGBM. Extensive experiments show that our proposed model performs well in different conditions.

Permissionless blockchain-enabled smart contracts that use the proof-of-stake (PoS) algorithm for validation of transactions have scalability and on-chain governance as a primary concern. We consider smart contracts that use lite mobile wallets with support of the unspent transaction output protocol (UTXO) and simple payment verification (SPV) to increase the number of transaction throughput. Furthermore, we investigate in this paper to which extent it is possible to change the parameters of the blockchain using smart contracts in hot parameter swaps at runtime for enabling continuous soft forks. The leading smart contract solution Ethereum does not have the functionality to change blockchain parameters and requires hard forks multiple times, and thus, Ethereum smart contracts are not scalable for large industrial applications. This whitepaper fills the gap by presenting the Qtum’s decentralized-governance protocol (DGP) that aims for managing essential blockchain parameters using smart contracts for enabling frequent soft forks. Compared with the Ethereum alternative, we explore the Qtum utility advantages and current Qtum smart contract future development plans integrating dedicated x86 hardware development for industry case applications.KeywordsSmart contractBlockchainMobileLite walletPoSAbstraction layerSVPUTXODecentralized governance

The inception of blockchain techniques has been revolutionizing various domains, e.g., Internet of Things, supply chain and healthcare. Ethereum smart contracts emerge as the promising blockchain application, which could enable distrustful parties to participate in the automatic and trustful transactions. Given the increasing importance of Ethereum smart contracts, understanding them becomes imperative. However, prior work only studied smart contracts with general high-level patterns, and one critical question has not been answered yet: how do smart contracts behave individually? In this paper, we present a behavior-aware profiling of individual smart contract from a multi-party perspective, which improves the visibility of the smart contract ecosystem. We conduct a detailed study of the behavior of individual smart contract on two real-world datasets, and our profiling reveals interesting and surprising observations. For example, a few contract completion chains have more than 50 contracts and all of them belong to the Finance category. We also discuss the implications that lead to recommendations to improve the security and performance of the smart contract ecosystem. Overall, our work effectively complements previous work towards generating a comprehensive understanding of smart contracts.

In recent years, Ethereum gained tremendously in popularity, growing from a daily transaction average of 10K in January 2016 to an average of 500K in January 2020. Similarly, smart contracts began to carry more value, making them appealing targets for attackers. As a result, they started to become victims of attacks, costing millions of dollars. In response to these attacks, both academia and industry proposed a plethora of tools to scan smart contracts for vulnerabilities before deploying them on the blockchain. However, most of these tools solely focus on detecting vulnerabilities and not attacks, let alone quantifying or tracing the number of stolen assets. In this paper, we present Horus, a framework that empowers the automated detection and investigation of smart contract attacks based on logic-driven and graph-driven analysis of transactions. Horus provides quick means to quantify and trace the flow of stolen assets across the Ethereum blockchain. We perform a large-scale analysis of all the smart contracts deployed on Ethereum until May 2020. We identified 1,888 attacked smart contracts and 8,095 adversarial transactions in the wild. Our investigation shows that the number of attacks did not necessarily decrease over the past few years, but for some vulnerabilities remained constant. Finally, we also demonstrate the practicality of our framework via an in-depth analysis on the recent Uniswap and Lendf.me attacks.KeywordsEthereumSmart contractsAttack detectionForensics

The paper aims at creating ERC-20 Token and crowd sale step-by-step with Ethereum smart contracts. In the process, it focuses on testing the smart contracts, deploying the smart contracts to the Ethereum blockchain, and building an ICO website deployed to the web for the buying and selling of the tokens. The Ethereum blockchain provides a platform for creating our cryptocurrency, or tokens that can be purchased via Ether which is the native cryptocurrency of the Ethereum blockchain. ERC-20 is a standard document that specifies the behavior of the tokens so that they are compatible with other platforms like cryptocurrency exchanges. We used Ethereum which is a blockchain like Bitcoin. We created a token called ;Token ; and there are 100,000,000 such tokens. Firstly, the token smart contract keeps track of some token attributes which are basic. It also keeps track of who owns ;My Token ; and how much. ERC-20 tokens can be used as a payment just, just like any other cryptocurrency, from one account to another. They can also be purchased in a crowd sale, like an ICO.

Ethereum smart contracts are programs that run on the Ethereum blockchain, and many smart contract vulnerabilities have been discovered in the past decade. Many security analysis tools have been created to detect such vulnerabilities, but their performance decreases drastically when codes to be analyzed are being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool for vulnerability detection, with robustness against code rewrites in smart contracts. Existing machine-learning-based static analysis tools for vulnerability detection need features, which analysts create manually, as inputs. In contrast, Eth2Vec automatically learns features of vulnerable Ethereum Virtual Machine (EVM) bytecodes with tacit knowledge through a neural network for language processing. Therefore, Eth2Vec can detect vulnerabilities in smart contracts by comparing the code similarity between target EVM bytecodes and the EVM bytecodes it already learned. We conducted experiments with existing open databases, such as Etherscan, and our results show that Eth2Vec outperforms the existing work in terms of well-known metrics, i.e., precision, recall, and F1-score. Moreover, Eth2Vec can detect vulnerabilities even in rewritten codes.

BackgroundWearable devices have limited ability to store and process such data. Currently, individual users or data aggregators are unable to monetize or contribute such data to wider analytics use cases. When combined with clinical health data, such data can improve the predictive power of data-driven analytics and can proffer many benefits to improve the quality of care. We propose and provide a marketplace mechanism to make these data available while benefiting data providers.ObjectiveWe aimed to propose the concept of a decentralized marketplace for patient-generated health data that can improve provenance, data accuracy, security, and privacy. Using a proof-of-concept prototype with an interplanetary file system (IPFS) and Ethereum smart contracts, we aimed to demonstrate decentralized marketplace functionality with the blockchain. We also aimed to illustrate and demonstrate the benefits of such a marketplace.MethodsWe used a design science research methodology to define and prototype our decentralized marketplace and used the Ethereum blockchain, solidity smart-contract programming language, the web3.js library, and node.js with the MetaMask application to prototype our system.ResultsWe designed and implemented a prototype of a decentralized health care marketplace catering to health data. We used an IPFS to store data, provide an encryption scheme for the data, and provide smart contracts to communicate with users on the Ethereum blockchain. We met the design goals we set out to accomplish in this study.ConclusionsA decentralized marketplace for trading patient-generated health data can be created using smart-contract technology and IPFS-based data storage. Such a marketplace can improve quality, availability, and provenance and satisfy data privacy, access, auditability, and security needs for such data when compared with centralized systems.

Innovation in smart contract systems helps to create decentralized payment systems. These developing concepts will be a new perspective to solve transparency issues. Smart contracts can prove all transactions and flow of funds and money between parties. Business deals and financial payment methods are expected to be a hybrid approach in both traditional and smart contracts in the future. Empirical analysis of smart agreements among their emerged platforms, different applications, and design views will enlighten future needs of trade payment methods. This chapter investigates the concept of smart contracts and critical issues for developing on financial payments environment. This research also aims to examine possible advantages of the application of smart contracts as innovation, legal, and technical aspects of the emerging business environment. The analysis will compare new mechanisms securing a block-chain applied to financial payments. This chapter also reviews the mechanisms of smart contracts and block-chain and focus on predicted future areas on the financial system.

There has been a massive growth of Internet of Things (IoT) applications recently for both personal and organization use cases. But an IoT network is vulnerable to many privacy and security concerns. While some researchers have tried to define different access control models for IoT and tried to use blockchain in some cases, the solutions presented to date lacks a flexible and robust access control model that can be used for complex organization and cross-organization resource access scenarios and lacks the scalability and performance needed for IoT. This paper introduces a novel entitlement-based access control model that provides an efficient and secure way to delegate resource access rights to any entity. The solution uses service-oriented approach and a combination of public blockchain (with smart contracts) and local off-chain data for entitlements management and control. To analyze the proposed architecture, a large-scale cross-organization IoT scenario is taken into consideration and some qualitative evaluations are presented while implementation with Ethereum blockchain and smart contracts are currently in progress.

Smart contracts in Ethereum are executed by the Ethereum Virtual Machine (EVM). We defined EVM in Lem, a language that can be compiled for a few interactive theorem provers. We tested our definition against a standard test suite for Ethereum implementations. Using our definition, we proved some safety properties of Ethereum smart contracts in an interactive theorem prover Isabelle/HOL. To our knowledge, ours is the first formal EVM definition for smart contract verification that implements all instructions. Our definition can serve as a basis for further analysis and generation of Ethereum smart contracts.