- No More Attacks on Proof-of-Stake Ethereum?
Authors: Francesco D’Amato, Joachim Neu, Ertem Nusret Tas
The latest message driven (LMD) greedy heaviest observed sub-tree (GHOST) consensus protocol is a critical component of future proof-of-stake (PoS) Ethereum. In its current form, the protocol is brittle and intricate to reason about, as evidenced by recent attacks, patching attempts, and G¨orli testnet reorgs. We present Goldfish, which can be seen as a considerably simplified variant of the current protocol, and prove that it is secure and reorg resilient in synchronous networks with dynamic participation, assuming a majority of the nodes (validators) follows the protocol honestly. Furthermore, we show that subsampling validators can improve the communication efficiency of Goldfish, and that Goldfish is composable with finality gadgets and accountability gadgets. The aforementioned properties make Goldfish a credible candidate for a future protocol upgrade of PoS Ethereum, as well as a versatile pedagogical example. Akin to traditional propose-and-vote-style consensus protocols, Goldfish is organized into slots, at the beginning of which a leader proposes a block containing new transactions, and subsequently members of a committee take a vote towards block confirmation. But instead of using quorums, Goldfish is powered by a new mechanism that carefully synchronizes the inclusion and exclusion of votes in honest validators’ views.
- LMD-GHOST is the current consensus protocol employed by Proof-of-Stake Ethereum. Although this protocol was designed to address a host of attacks, it is susceptible to so-called voting rebalancing attacks.
- These attacks can be highly disruptive to the Ethereum network as they break economic finality and lead to reorganizations on the blockchain that most applications are not equipped to handle.
- This paper proposes a new consensus protocol called Goldfish which is designed to address this attack vector. Crucially, Goldfish is highly compatible with the architecture of LMD-GHOST and does not entail big changes to Proof-of-Stake Ethereum.
- Exploring Vulnerabilities and Anomalies in NFT Marketplaces
Author: Xiangyu Ruan
Since the invention of the blockchain, an increasing number of people have been working on creating various decentralized financial (DeFi) products. NFTs, or non-fungible tokens, are among the most widely used DeFi products. The NFT market is developing and expanding quickly and drawing more players. However, the NFT market is experiencing several technological and financial security challenges. Our goal in this thesis is to present a systematic and thorough assessment of NFT security challenges, including technical flaws, fraud, market manipulation, and money laundering, as well as to suggest cutting-edge detection methods for the rug-and-pull and wash trade utilizing the machine learning model and graph-based model, respectively. The validation findings from random sampling indicate that our detection techniques successfully identify targeted dishonesty.
- NFT markets might have cooled down after the recent market downturn, but there is still an enormous amount of interest in how NFTs can be better implemented and secured.
- This paper provides a formalization of the security issues faced by popular NFT implementations and taxonomizes the different types of exploits via historical case studies.
- Beyond NFT implementation frameworks, the paper also discusses market structures and historical anomalies in popular NFT marketplaces.
- Fighting Sybils in Airdrops
Authors: Zheng Liu, Hongyang Zhu
Airdrop is a crucial concept in tokenomics. Startups of decentralized applications (DApps) reward early supporters by airdropping newly issued tokens up to a certain amount as a free giveaway. This naturally induces greedy hackers, called Sybils, to create multiple accounts for more shares. Most airdrops have prerequisites for qualification, in which utilizing these DApps is unsurprisingly the principal. One particular characteristic of DApps is to implement users’ interactions with them in the form of token transfer transactions or smart contract calling transactions on public blockchains. We argue that these individual transactions could reveal underlying signatures of their sending accounts. Specifically, accounts controlled by the same Sybil may exhibit some common behaviors. A careful analysis of Sybil’s behaviors shows that accounts controlled by the same Sybil may produce similar DApp activities and regular token transfer patterns. We model the transactions as graphs by representing accounts as vertices and transactions as edges. When multiple accounts receive tokens from the same Sybil to conduct interactions with DApps, we inspect the graphs for these activities and patterns to detect suspicious accounts. We demonstrate the effectiveness of the proposed method in a recent airdrop by presenting the suspicious accounts controlled by Sybils. All the detected accounts exhibit similar interaction activities and regular transfer patterns.
- The air-dropping of tokens is a popular distribution mechanism and its primary goal is to reward the early users of an application.
- However, airdrops are frequently manipulated by sophisticated attackers who try to pose as multiple users in order to get a disproportionate number of “free” tokens.
- This paper analyzes historical airdrops and frames this type of manipulation as a Sybil attack. The authors then present clustering techniques that can be used by projects to flag malicious accounts.
- Towards Interoperability of Open and Permissionless Blockchains: A Cross-Chain Query Language
Author: Felix Härer
The rise of open and permissionless blockchains has introduced novel platforms for applications based on distributed data storage. At the application and business levels, long-established query languages such as SQL provide interoperability that can be complemented by blockchain-based data storage today, enabling permissionless and verifiable data storage along with decentralized execution across tens of thousands of nodes. However, when accessing one or more blockchains, interoperability is not provided today, posing challenges such as inhomogeneous data access in addition to different features and trade-offs, e.g. in data and distribution, scalability, and security. Towards interoperability in data access among the increasing number of blockchain platforms, this paper introduces a crosschain query language for data access across blockchains. Similar to SQL, the language abstracts from implementation based on a data model compatible with the largest open and permissionless blockchains (OPB) today. The language, data model, and processing architecture are demonstrated and evaluated with an implemented prototype, aiming to contribute to the discussion on blockchain interoperability among OPB.
- Blockchain Interoperability is the ability of users and applications to interact with one another across different networks.
- A lot of the focus on this front has been on the development of cross-chain bridges which essentially recreate user balances in supported blockchains and relay their messages.
- While most interoperability discussions today tend to focus on bridge design, there are other challenges introduced by this cross-chain paradigm, especially as it relates to data normalization.
- This paper is interesting as it focuses on the data inconsistency problem and proposes a new query language that is agnostic of a blockchain’s data model. If adopted, this language can be used by cross-chain applications to normalize transactional data.
- Permissionless Clock Synchronization with Public Setup
Authors: Juan Garay, Aggelos Kiayias, Yu Shen
The permissionless clock synchronization problem asks how it is possible for a population of parties to maintain a system-wide synchronized clock, while their participation rate fluctuates —possibly very widely— over time. The underlying assumption is that parties experience the passage of time with roughly the same speed, but however they may disengage and engage with the protocol following arbitrary (and even chosen adversarially) participation patterns. This (classical) problem has received renewed attention due to the advent of blockchain protocols, and recently it has been solved in the setting of proof of stake, i.e., when parties are assumed to have access to a trusted PKI setup [Badertscher et al., Eurocrypt ’21]. In this work, we present the first proof-of-work (PoW)-based permissionless clock synchronization protocol. Our construction assumes a public setup (e.g., a CRS) and relies on an honest majority of computational power that, for the first time, is described in a fine-grain timing model that does not utilize a global clock that exports the current time to all parties. As a secondary result of independent interest, our protocol gives rise to the first PoW-based ledger consensus protocol that does not rely on an external clock for the time-stamping of transactions and adjustment of the PoW difficulty
- Blockchains are designed to track changes in a ledger, or an application, over the course of time. While blocks serve as a measure of time, they can at times be at odds with “human” time. This, in turn, impacts use-cases where the human time reported in a block serves as an input for an application, such as a weather oracle.
- This paper discusses how clock synchronization can be better implemented on blockchains in a permissionless setting. The authors apply this schema to Bitcoin and, as a first use case, evaluate how this clock can be used to adjust mining difficulty more appropriately.
- A Study of Inline Assembly in Solidity Smart Contracts
Authors: Stefanos Chaliasos, Arthur Gervais, Benjamin Livshits
The Solidity programming language is the most widely used language for smart contract development. Improving smart contracts’ correctness, security, and performance has been the driving force for research in vulnerability detection, program analysis, and compiler techniques for Solidity. Similar to system-level languages such as C, Solidity enables the embedding of low-level code in programs, in the form of inline assembly code. Developers use inline assembly for low-level optimizations, extending the Solidity language through libraries, and using blockchain-specific opcodes only available through inline assembly. Nevertheless, inline assembly fragments are not well understood by an average developer and can introduce security threats as well as affect the optimizations that can be applied to programs by the compiler; it also significantly limits the effectiveness of source code static analyzers that operate on the Solidity level. A better understanding of how inline assembly is used in practice could in turn increase the performance, security, and support for inline assembly in Solidity. This paper presents a large-scale quantitative study of the use of inline assembly in 6.8𝑀 smart contracts deployed on the Ethereum blockchain. We find that 23% of the analyzed smart contracts contain inline assembly code, and that the use of inline assembly has become more widespread over time. We further performed a manual qualitative analysis for identifying usage patterns of inline assembly in Solidity smart contracts. Our findings are intended to help practitioners understand when they should use inline assembly and guide developers of Solidity tools in prioritizing which parts of inline assembly to implement first. Finally, the insights of this study could be used to enhance the Solidity language, improve the Solidity compiler, and to open up new research directions by driving future researchers to build appropriate methods and techniques for replacing inline assembly in Solidity programs when there is no real necessity to use it.
- Inline Assembly is a relatively sophisticated technique used by smart contract developers to embed low-level code in their applications.
- While some opcodes are only available through Inline Assembly, the primary motivation for its use is gas optimization as the on-chain footprint of applications can be decreased by these low-level primitives.
- This paper is the first comprehensive study of the use of Inline Assembly and sheds light on the predominance of this technique. It also provides valuable insights to developers on the appropriateness of Inline Assembly and ways that Solidity can be enhanced for this practice.
