Blockchain technology

 

Blockchain technology is a decentralized, distributed digital ledger that securely records transactions across many computers, creating an immutable (unchangeable) and transparent record of data, like ownership or transactions, without needing a central authority like a bank. Data is grouped into "blocks," cryptographically linked in a chronological "chain," and validated by network consensus, making it highly secure and resistant to tampering. 

How it works:

• Blocks & Chains: Transactions are bundled into blocks. When a block fills, it's sealed with a unique digital fingerprint (cryptographic hash) and linked to the previous block, forming a chain.
• Decentralization: Instead of one central server, copies of the ledger are held by many computers (nodes) on the network, removing single points of failure.
• Consensus: Before a new block is added, most nodes must agree on its validity through a consensus mechanism, ensuring trust.
• Immutability: Once a block is added, altering its data would require changing all subsequent blocks across the majority of the network, which is computationally infeasible. 
• Key Features:

• Transparency: All participants can view transactions.
• Security: Cryptography and decentralization make it tamper-proof.
• No Intermediaries: Reduces reliance on third parties, lowering costs and increasing efficiency. 

Uses:

• Cryptocurrencies: Like Bitcoin, to track digital money.
• Supply Chain: To track goods transparently.
• Smart Contracts: Self-executing contracts with terms directly written into code.
• Digital Identity & Voting: Securing personal data and votes. 

Security in blockchain technology involves addressing vulnerabilities at multiple layers, from the underlying network infrastructure to the application-specific smart contract code. Key issues include consensus manipulation, smart contract logic flaws, and external operational risks. 

Blockchain-Related Issues

These vulnerabilities target the foundational infrastructure and protocols of the blockchain network. 

51% Attacks: An attacker or group gains control of more than 50% of the network's total computing power (hash power in Proof of Work) or staked tokens (in Proof of Stake), allowing them to manipulate transaction ordering, prevent new transactions from being confirmed, and perform "double-spending" of coins.

• Consensus Mechanism Attacks: Issues in consensus algorithms (e.g., selfish mining, block withholding) can be exploited to gain a disproportionate amount of block rewards or disrupt network operations.
• Network Attacks: The network layer is vulnerable to standard network threats like Distributed Denial of Service (DDoS) attacks, Sybil attacks (creating multiple fake identities), and routing attacks that can intercept or modify data transmission between nodes.
• Private Key Security: A primary operational risk is the compromise or mismanagement of users' private keys, which control access to digital assets. This often occurs through phishing or insecure storage, as transactions are irreversible once signed with a private key. 

Higher-Level Language (Solidity) Related Issues 

These issues stem from vulnerabilities and anti-patterns in the smart contract programming language itself, such as Solidity. 

• Reentrancy: A malicious contract repeatedly calls a vulnerable contract's function before the first execution is complete, often to drain funds. The "Checks-Effects-Interactions" pattern is the standard mitigation.
• Arithmetic Overflows/Underflows: Fixed-size integer types in Solidity (before version 0.8.0, which added automatic checks) can lead to values wrapping around their maximum or minimum limits, resulting in incorrect calculations and potential fund manipulation.
• Unauthorized Access: Missing or improperly implemented access control modifiers (like onlyOwner) can allow unauthorized users to execute critical functions.
• Insecure Randomness: Smart contracts rely on deterministic processes, making true randomness difficult to achieve on-chain. Using predictable variables like block.timestamp or blockhash for random numbers can be exploited by miners or attackers.
• Front-Running: Attackers monitor the mempool (where unconfirmed transactions wait) for profitable transactions and submit their own transaction with a higher gas fee to have it processed first, gaining an unfair advantage. 

EVM Bytecode Related Issues

Vulnerabilities at the Ethereum Virtual Machine (EVM) bytecode level are related to how the compiled code executes. 

• Stack Overflows/Underflows: The EVM uses a stack for computation; if the stack limits are exceeded due to recursive calls or complex logic, the contract can crash or behave unexpectedly.
• Call Stack Depth Limit: The EVM has a call stack depth limit. Maliciously crafted contracts can exploit this to cause a denial-of-service condition for other contracts.
• Short Address Attack: An attacker can manipulate transaction input data to exploit insufficient address length checks, potentially redirecting funds to their own address or causing other errors.
• Unchecked External Calls: If a smart contract calls another contract without verifying the return value, a failed external call may not revert the entire transaction, leading to inconsistent state in the calling contract. 

Real-Life Attacks on Blockchain Applications/Smart Contracts 

• The DAO Hack (2016): An attacker exploited a reentrancy vulnerability in the smart contract to drain approximately $60 million worth of Ether. This event led to a contentious hard fork, splitting Ethereum into Ethereum (ETH) and Ethereum Classic (ETC).
• Parity Wallet Hack (2017): A bug in a multi-signature wallet library left two critical functions public, allowing an attacker to claim ownership of the contract and freeze about $150 million worth of Ether indefinitely.
• Ronin Bridge Hack (2022): Attackers compromised the private keys of five out of nine validator nodes for the Ronin Network's cross-chain bridge, enabling them to forge withdrawal transactions and steal over $600 million in one of the largest DeFi hacks to date.
• Mt. Gox Exchange Collapse (2014): This was an attack on a centralized exchange, but it highlighted the vulnerability of centralized entities within the broader crypto ecosystem. Attackers exploited a Bitcoin transaction malleability vulnerability, leading to the loss of millions in user funds and the exchange's bankruptcy. 

Trusted Execution Environments (TEEs) 

Trusted Execution Environments (TEEs), such as Intel SGX, are a potential solution for enhancing blockchain security and privacy. 

• Function: TEEs create a secure, isolated environment (enclave) within a processor where data and code can be executed with integrity and confidentiality, even if the host operating system or network is compromised.
• Benefits for Blockchain:
  • Privacy: TEEs can process private or sensitive data off-chain within the enclave without revealing the raw data to the public ledger or even the node operator, thus enhancing data privacy.
  • Security: By isolating smart contract execution, TEEs can protect against certain host-level attacks and ensure the integrity of the computation, even if a node is malicious.
  • Scalability: Offloading complex computations to TEEs can potentially reduce the load on the main blockchain, improving scalability and transaction speeds.
• Limitations and Issues: TEEs themselves can have vulnerabilities (e.g., side-channel attacks). Furthermore, their use introduces a degree of reliance on hardware manufacturers (centralization risk) and increases the overall complexity of the system design. 

Blockchain security encompasses vulnerabilities at protocol, language (Solidity), and runtime (EVM) levels, alongside real-world exploits and hardware mitigations like Trusted Execution Environments (TEEs). These issues arise due to blockchain's immutability, public nature, and economic incentives for attacks. Detailed notes follow with examples from common lectures on smart contract security.

Blockchain Issues

Blockchain platforms face consensus, scalability, and economic attacks.

• 51% Attacks: Miner majority rewrites history; example—Ethereum Classic (ETC) lost $1.1M in 2019 as attackers double-spent via majority hash power.

• Sybil Attacks: Flooding network with fake nodes; countered by Proof-of-Stake (PoS) in Ethereum 2.0.

• Eclipse Attacks: Isolating nodes to manipulate views; risks private chain forks.​

Solidity Issues

Solidity, Ethereum's primary language, introduces high-level pitfalls exploitable due to its Turing-completeness and lack of safe defaults.

• Reentrancy: External calls before state updates allow recursive calls; DAO hack (2016) drained $60M by reentering withdrawal function.​

• Integer Overflow/Underflow: Pre-0.8.0, unchecked math wraps values; example—attackers mint extra tokens via uint overflow in bad ERC-20.

• Access Control Flaws: Missing modifiers like onlyOwner; unprotected functions let anyone self-destruct contracts.

• Timestamp Dependence: block.timestamp miner-manipulable; used in gambling contracts for predictable "randomness."

• Front-Running: Mempool scanning to bid higher gas; DEX arbitrage bots frontrun trades for profit.​

EVM Bytecode Issues

EVM executes low-level bytecode, exposing gas mechanics and opcodes to abuse.

• Gas Limit DoS: Loops over unbounded arrays exhaust block gas (30M on Ethereum); attackers submit transactions failing late.

• Unchecked Calls: call() returns false on failure but doesn't revert; leads to silent fund sends.

• Delegatecall Risks: Context swaps enable storage overwrites; Parity Wallet (2017) lost $30M via delegatecall bug initializing wrong library.

• Opcode Limits: STATICCALL post-Constantinople prevents state changes in view functions.​

Real-Life Attacks

Historical exploits highlight patterns.

• The DAO (2016): Reentrancy; led to Ethereum hard fork.

• Parity Multi-Sig (2017): Self-destruct vulnerability; $280K lost.

• BeautyChain (BEC, 2018): Infinite mint via balances[msg.sender] += totalSupply overflow.

• bZx Flash Loans (2020): Price oracle manipulation via repeated trades in one tx.

• Cream Finance (2021): Flash loan + oracle exploit drained $130M.​

Attack	Cause	Loss	Fix
DAO	Reentrancy	$60M	Checks-Effects-Interactions
Parity	Delegatecall	$280K	Initialization guards
BEC	Overflow	Millions	SafeMath/OpenZeppelin

Trusted Execution Environments

TEEs provide hardware-based isolation for off-chain computation, enhancing blockchain privacy/scalability.

• SGX (Intel): Enclaves shield code/data from host OS; Secret Network uses for private smart contracts.

• Issues: Side-channels (Spectre/Meltdown), attestation trust; example—Malware in SGX enclave compromised keys.

• Use Cases: Oracle feeds (e.g., Phala Network), ZK proofs generation without revealing inputs.

• Alternatives: AWS Nitro Enclaves, ARM TrustZone for mobile blockchain apps.​