- Analyzing and Preventing Sandwich Attacks in Ethereum
Author: Patrick Züst
Ethereum uses a permissionless blockchain to enable applications without central intermediaries. However, the advent of decentralized finance (DeFi) has led to various new attacks which are being launched on a global scale. Bots continuously scan pending transactions and employ different tactics to profitably frontrun them. A common type of frontrunning is the so-called sandwich attack. In this work, we present a large-scale analysis of sandwich attacks for a time period of twelve months. We found that during this time there were at least 525,004 attacks leading to an accumulated profit of 57,493 ETH (189,311,716 USD). We also show that miners have recently begun to play a more active role in these value extractions which drastically changes the patterns we observe for sandwich attacks. Splitting up frontrunnable trades can be a valid mitigation strategy. We show how traders could have saved 30’525 ETH (89,987,700 USD) by releasing multiple smaller swaps instead of one large trade. A public tool to check whether a transaction is susceptible to sandwich attacks and to find a suitable order split was released on www.DeFi-Sandwi.ch.
Link: https://pub.tik.ee.ethz.ch/students/2021-FS/BA-2021-07.pdf
- Securing Wireless Payment Channel Networks With Minimum Lock Time Windows
Authors: Gabriel Antonio Fontes Rebello, Maria Potop-Butucaru, Marcelo Dias de Amorim, and Otto Carlos Muniz Bandeira Duarte
Payment channel networks (PCN) enhance the impact of cryptocurrencies by providing a fast and consensus-free solution to the scalability problems of traditional blockchain protocols. However, PCNs often rely on powerful nodes with high availability and computational capacity, hindering their adoption in mobile environments. In this paper, we consider a hybrid PCN architecture that extends the functionalities of traditional PCNs to wireless resource-constrained devices. We analyze the token theft vulnerability and propose a countermeasure based on lock time windows. We evaluate our proposal with real data from the Lightning Network and from mobile broadband networks. The results show that the minimum lock time window depends on the downtime of devices and that selecting a default window is most effective when devices present high availability.
Link: https://hal.archives-ouvertes.fr/hal-03287777/document
- Compositional Verification of Smart Contracts Through Communication Abstraction
Authors: Scott Wesley, Maria Christakis, Jorge A. Navas, Richard Trefler, Valentin Wustholz, and Arie Gurfinkel
Solidity smart contracts are programs that manage up to 2 160 users on a blockchain. Verifying a smart contract relative to all users is intractable due to state explosion. Existing solutions either restrict the number of users to under-approximate behaviour, or rely on manual proofs. In this paper, we present local bundles that reduce contracts with arbitrarily many users to sequential programs with a few representative users. Each representative user abstracts concrete users that are locally symmetric to each other relative to the contract and the property. Our abstraction is semi-automated. The representatives depend on communication patterns, and are computed via static analysis. A summary for the behaviour of each representative is provided manually, but a default summary is often sufficient. Once obtained, a local bundle is amenable to sequential static analysis. We show that local bundles are relatively complete for parameterized safety verification, under moderate assumptions. We implement local bundle abstraction in SmartACE, and show order-of-magnitude speedups compared to a state-of-the-art verifier.
Link: https://arxiv.org/pdf/2107.08583.pdf
- Governing Decentralized Complex Queries Through a DAO
Authors: Mirko Zichichi, Luca Serena, Stefano Ferretti, and Gabriele D’Angelo
Recently, a new generation of P2P systems capable of addressing data integrity and authenticity has emerged for the development of new applications for a “more” decentralized Internet, i.e., Distributed Ledger Technologies (DLT) and Decentralized File Systems (DFS). However, these technologies still have some unanswered issues, mostly related to data lookup and discovery. In this paper, first, we propose a Distributed Hash Table (DHT) system that efficiently manages decentralized keyword-based queries executed on data stored in DFS. Through a hypercube logical layout, queries are efficiently routed among the network, where each node is responsible for a specific keywords set and the related contents. Second, we provide a framework for the governance of the above network, based on a Decentralized Autonomous Organization (DAO) implementation. We show how the use of smart contracts enables organizational decision making and rewards for nodes that have actively contributed to the DHT. Finally, we provide experimental validation of an implementation of our proposal, where the execution of the same protocol for different logical nodes of the hypercube allows us to evaluate the efficiency of communication within the network.
Link: https://arxiv.org/pdf/2107.06790.pdf
- A Cooperative Optimal Mining Model for Bitcoin
Authors: David Lajeunesse and Hugo D. Scolnik
We analyze Bitcoin mining from the perspective of a game and propose an optimal mining model that maximizes profits of pools and miners. The model is a two-stage Stackelberg game in which each stage forms a sub-game. In stage I, pools are the leaders who assign a computing power to be consumed by miners. In stage II, miners decide of their power consumption and distribution. They find themselves in a social dilemma in which they must choose between mining in solo, therefore prioritizing their individual preferences, and participating in a pool for the collective interest. The model relies on a pool protocol based on a simulated game in which the miners compete for the reward won by the pool. The solutions for the stage I sub-game and the simulated protocol game are unique and stable Nash equilibriums while the stage II sub-game leads to a stable cooperative equilibrium only when miners choose their strategies according to certain criteria. We conclude that the cooperative optimal mining model has the potential to favor Bitcoin decentralization and stability. Mainly, the social dilemma faced by miners together with the balance of incentives ensure a certain distribution of the network computing power between pools and solo miners, while equilibriums in the game solutions provide stability to the system.
Link: https://arxiv.org/pdf/2107.09707.pdf
- Assessment of Quantum Threat To Bitcoin and Derived Cryptocurrencies
Authors: Stephen Holmes and Liqun Chen
All cryptocurrencies are not the same. Today, they share a common quantum vulnerability through use of non-quantum safe Elliptic Curve Digital Signature Algorithm (ECDSA) digital signatures yet they have very different risks of quantum attack. The risk of attack for a cryptocurrency depends on a number of identified factors such as the block interval time, the vulnerability to an attack that delays the time for an unprocessed transaction to be completed and the behaviour of a cryptocurrency user to increase the cost of a quantum computer attack. Shor’s algorithm can be used to break ECDSA signatures with a quantum computer. This research addresses the two questions: When will a quantum computer be powerful enough to execute Shor’s algorithm? How fast would a quantum computer need to be to break a specific cryptocurrency? In this paper we observe that by benchmarking the speed of circuits and the time for quantum addition on quantum computers we can determine when there is a potential threat to a specific cryptocurrency.
Link: https://eprint.iacr.org/2021/967.pdf
- A DeFi Bank Run: Iron Finance, IRON Stablecoin, and the Fall of TITAN *
Author: Kanis Saengchote
Bank runs are a natural phenomenon for financial institutions that issue fixed value liabilities (e.g. money) that are backed by assets with uncertain value. I analyze Iron Finance, a decentralized finance (DeFi) protocol that issues stablecoin (a token with fixed nominal exchange rate: IRON) liabilities in exchange for a basket of other tokens (including a token issued by the protocol itself: TITAN). A combination of mathematical algorithms and incentive to arbitrage is used to maintain the exchange rate peg, but a shock to the protocol sent it into a downward spiral – much like a bank run. The incentives built into the protocol to defend the peg exacerbated its unravelling, raising the challenge of how DeFi protocols can address this vulnerability while remaining decentralized.
Link: https://www.pier.or.th/wp-content/uploads/2021/07/pier_dp_155.pdf