Double-spending Attacks Research Articles

DiFastBit: Transaction Differentiation Scheme to Avoid Double-Spending for Fast Bitcoin Payments

Bitcoin is a payment system that generates a decentralized digital currency without ensuring temporal constraints in its transactions; therefore, it is vulnerable to double-spending attacks. Karame has proposed a formalization for a successful double-spending attack based on meeting three requirements. This focuses on fast payment scenarios where the product is delivered immediately after the payment is announced in the mempool, without waiting for transaction confirmation. This scenario is key in Bitcoin to increase the probability of a successful double-spending attack. Different approaches have been proposed to mitigate these attacks by addressing one or more of Karame’s three requirements. These include the following: flooding every transaction without restrictions, introducing listeners/observers, avoiding isolation by blocking incoming connections, penalizing malicious users by revealing their identity, and using machine learning and bio-inspired techniques. However, to our knowledge, no proposal deterministically avoids double-spending attacks in fast payment scenarios. In this paper, we introduce DiFastBit: a distributed transaction differentiation scheme that shields Bitcoin from double-spending attacks in fast payment scenarios. To achieve this, we modeled Bitcoin from a distributed perspective of events and processes, reformulated Karame’s requirements based on Lamport’s happened-before relation (HBR), and introduced a new theorem that consolidates the reformulated requirements and establishes the necessary conditions for a successful attack on fast Bitcoin payments. Finally, we introduce the specifications for DiFastBit, formally prove its correctness, and analyze DiFastBit’s confirmation time.

A survey on scalable consensus algorithms for blockchain technology

The process of reaching an agreement on a value within a distributed network, known as a consensus problem, is a defining feature of blockchain. This consensus problem can be seen in various applications like load balancing, transaction validation in blockchain, and distributed computing. In recent years, many researchers have provided solutions to this problem. Hence we have presented a survey in which we delved into blockchain consensus algorithms and conducted a comparative analysis of all the consensus algorithms to provide information about each protocol’s advantages and drawbacks. This survey starts with the standard proof-of-work consensus protocol applied in bitcoin cryptocurrency and its limitations on the ground of the following parameters: throughput (transactions per second), latency, forks, fault tolerance, double spending attacks, and power consumption. The rest of the consensus algorithms in this paper have been systematically covered to address the limitations of proof-of-work. This paper also covered Raft and PBFT consensus algorithms suitable for permissioned networks. Although the PBFT consensus protocol has a high throughput and a low latency, it has limited node scalability. The PBFT has a low byzantine fault tolerant rate. This paper also covers PoEWAL for blockchain-based IoT applications and WBFT, which prevents corrupt nodes from taking part in consensus. A comparative analysis of the consensus algorithms provides an explicit knowledge of the present research, which also offers guidance for future study.

Determining the Number of Confirmation Blocks in a Two-Level Blockchain with Proof-of-Proof Consensus Protocol for Different Consensus Types in Mainchain/Sidechain to Prevent Double Spend Attack. I. PoS in Mainchain and PoW in Sidechain

Determining the Number of Confirmation Blocks in a Two-Level Blockchain with Proof-of-Proof Consensus Protocol for Different Consensus Types in Mainchain/Sidechain to Prevent Double Spend Attack. I. PoS in Mainchain and PoW in Sidechain

CPPA-RORS: A conditional privacy-preserving authentication scheme based on revocable one-time ring signature for VANETs

Vehicular ad-hoc networks (VANETs) are a wireless communication system designed to improve driving safety and traffic management, with a focus on enhancing road traffic efficiency and safety. Privacy protection is one of the crucial security challenges for VANETs. However, considering the high mobility of vehicles that frequently transmit delay-intolerant safety and informative messages, two problems exist in some ring signature-based conditional privacy-preserving authentication (CPPA) schemes for VANETs: first, vehicles cannot detect the malicious vehicles when a malicious vehicle signs a message multiple times; and second, the TAs cannot reveal vehicles’ identities when some vehicles engage in illegal activities. To address these concerns, we propose a CPPA scheme based on revocable one-time ring signature (CPPA-RORS) scheme, leveraging the properties of ring signatures. The scheme ensures anonymity of the honest vehicles while providing TAs with the ability to reveal malicious vehicles at any time. We allow one vehicle only can sign one signature on one message, called one-time, to safeguard vehicle privacy with high security. CPPA-RORS scheme provides the formal security model for VANETs, and in particular simultaneously offers message-linkability and mandatory revocability, effectively preventing the double-spending attack (Shrestha et al. 2020) and enabling TAs to revoke the anonymity of any vehicle at any time for further enhancing the security and trustworthiness of the networks. Theoretical analysis and experimental results show that CPPA-RORS provides robust security measures and privacy for vehicles in VANETs.

Security of the Secp256k1 Elliptic Curve used in the Bitcoin Blockchain

The article delves into the intricate characteristics and security properties of the secp256k1 elliptic curve used for the generation of addresses in the Bitcoin blockchain. The Bitcoin blockchain is a decentralized digital ledger that records all transactions made with Bitcoin cryptocurrency. In this work, the secp256k1 elliptic curve and its parameters and the method of generating private and public keys using random numbers are described. While the private key allows for the signing of transactions to spend Bitcoin, the corresponding public key and address enable others to verify transactions and send funds to that specific address on the blockchain, ensuring security, authenticity, and privacy in the decentralized network. The attacks on the use of secp256k1 for generating the bitcoin addresses like the Brute force attack, twist attack, fault attacks, and side channel attacks in the implementation of the elliptic curve are discussed. By maintaining the security and integrity of secp256k1, we can ensure that cryptographic operations, such as digital signatures and key exchanges, remain uncompromised. If the curve's security were compromised, malicious users could potentially derive private keys from public keys, leading to unauthorized transactions, double-spending, or other malicious activities. The security of implementation can be enhanced by ensuring cryptographic libraries and software implementations that utilize secp256k1 undergo thorough testing and validation to ensure correct and secure operations. The important attacks on blockchain technology like the 51% attack, Sybil attack, Double Spending attack, and Smart Contract vulnerabilities are discussed. Through a comprehensive exploration, readers will gain insights into why this particular elliptic curve was chosen for use in Bitcoin's cryptographic protocols, highlighting its role in ensuring the robustness and integrity of the blockchain ecosystem.

Adaptive Double-Spending Attacks on PoW-Based Blockchains

Previous state-of-the-art studies have proposed various analytical models to understand the double-spending attacks (DSA) occurred in Proof-of-Work (PoW) based Blockchains. Although many insights behind the double-spending attacks have been disclosed, we still believe that advanced versions of DSA can be developed to create new threats for the PoW-based blockchains such as the Bitcoin blockchain. In this paper, we present two new types of double-spending attacks in the context of the PoW-based blockchain and discuss the insights behind them. By considering more practical network parameters, such as the number of confirmation blocks, the hashpower of the double-spending attacker, the amount of coins in the target transaction, and the network-status parameter, we first analyze the success probability of the conventional double-spending attack, named Naive DSA. Based on Naive DSA, we create two new adaptive DSA, i.e., the Adaptive DSA and the Reinforcement Adaptive DSA (RA-DSA). In our analytical models, a double-spending attack is converted into a Markov Decision Process. We then exploit the Stochastic Dynamic Programming (SDP) approach to obtain the optimal attack strategies under Adaptive DSA and RA-DSA. Numerical simulation results demonstrate the correlations between each critical network parameter and the expected attacker's reward. Through the proposed analytical models, we aim to alert the PoW-based blockchain ecosystem that the threat of double-spending attacks is still at a dangerous level. For example, our findings show that the attacker can launch a successful attack with a small hashpower proportion much lower than 51% under RA-DSA.

IoT-based external attacks aware secure healthcare framework using blockchain and SB-RNN-NVS-FU techniques.

In recent times, there has been widespread deployment of Internet of Things (IoT) applications, particularly in the healthcare sector, where computations involving user-specific data are carried out on cloud servers. However, the network nodes in IoT healthcare are vulnerable to an increased level of security threats. This paper introduces a secure Electronic Health Record (EHR) framework with a focus on IoT. Initially, the IoT sensor nodes are designated as registered patients and undergo initialization. Subsequently, a trust evaluation is conducted, and the clustering of trusted nodes is achieved through the application of Tasmanian Devil Optimization (STD-TDO) utilizing the Student's T-Distribution. Utilizing the Transposition Cipher-Squared random number generator-based-Elliptic Curve Cryptography (TCS-ECC), the clustered nodes encrypt four types of sensed patient data. The resulting encrypted data undergoes hashing and is subsequently added to the blockchain. This configuration functions as a network, actively monitored to detect any external attacks. To accomplish this, a feature reputation score is calculated for the network's features. This score is then input into the Swish Beta activated-Recurrent Neural Network (SB-RNN) model to classify potential attacks. The latest transactions on the blockchain are scrutinized using the Neutrosophic Vague Set Fuzzy (NVS-Fu) algorithm to identify any double-spending attacks on non-compromised nodes. Finally, genuine nodes are granted permission to decrypt medical records. In the experimental analysis, the performance of the proposed methods was compared to existing models. The results demonstrated that the suggested approach significantly increased the security level to 98%, reduced attack detection time to 1300 ms, and maximized accuracy to 98%. Furthermore, a comprehensive comparative analysis affirmed the reliability of the proposed model across all metrics. The proposed healthcare framework's efficiency is proved by the experimental evaluation.

Preventing Double Spending Attacks through Crow Search Algorithm to Enhance E-Voting System Security

Electronic voting system is the process of polling votes and counting votes. In most of the countries voting may now be done electronically, there are still several difficulties involved, including the expense of paper, how ballots are organized, the possibility of varying results when tallying the votes, and others. Duplicate votes pose a significant concern as they can be fraudulently cast by individuals. To focus on this issue, Distributed Ledger Technology (DLT) is employed to enhance the voting procedure in a secured manner. A directed acyclic graph is used by the Internet of Things Application (IOTA), a promising distributed ledger system. Faster transaction confirmation, high scalability and zero transaction fees are achieved via the Directed Acyclic Graph structure. In both IOTA tangle and blockchain technology, the public cast duplicate votes. The unauthorized user can create duplicate votes in the blockchain as well as IOTA tangle. This can be focused in this proposed method. The double spending problem can be solved by using Crow Search Algorithm (CSA). This Optimization problem produces an improved result for resolving double spending in e-voting systems.

Profitability Analysis of Time-Restricted Double-Spending Attack on PoW-based Large Scale Blockchains with the Aid of Multiple Attacks

Profitability Analysis of Time-Restricted Double-Spending Attack on PoW-based Large Scale Blockchains with the Aid of Multiple Attacks

Bitcoin double-spending risk and countermeasures at physical retail locations

This research examines vulnerabilities and potential attacks using Bitcoin payment systems at physical retail locations. It also lays a theoretical and practical foundation for effective countermeasures that ensure the integrity of decentralized transactions and bolster the confidence of both merchants and customers. The study focuses on potential double-spend attacks, particularly in the context of instant payments made via non-custodial crypto wallets. It also evaluates alternatives for instant crypto payments that use alternative coins and second-layer blockchain solutions. Research has indicated that Eclipse, Sybil, Majority, Race, and Finney attacks carry a relatively low risk, especially when payment amounts are limited. The paper identifies Replace-By-Fee attacks as the most significant threat and presents a set of countermeasures. These findings are of great importance to cryptocurrency experts, payment tech researchers, retail enterprises, and stakeholders using non-custodial wallets while exploring decentralized blockchain aspects.

A dynamic state sharding blockchain architecture for scalable and secure crowdsourcing systems

Currently, the crowdsourcing system has serious problems such as single point of failure of the server, leakage of user privacy, unfair arbitration, etc. By storing the interactions between workers, requesters, and crowdsourcing platforms in the form of transactions on the blockchain, these problems can be effectively addressed. However, the improvement in total computing power on the blockchain is difficult to provide positive feedback to the efficiency of transaction confirmation, thereby limiting the performance of crowdsourcing systems. On the other hand, the increasing amount of data in blockchain further increases the difficulty of nodes participating in consensus, affecting the security of crowdsourcing systems. To address the above problems, in this paper we design a blockchain architecture based on dynamic state sharding, called DSSBD. Firstly, we solve the problems caused by cross sharding transactions and reconfiguration in blockchain state sharding through graph segmentation and relay transactions. Then, we model the optimal block generation problem as a Markov decision process. By utilizing deep reinforcement learning, we can dynamically adjust the number of shards, block spacing, and block size. This approach helps improve both the throughput of the blockchain and the proportion of non-malicious nodes. Security analysis has proven that the proposed DSSBD can effectively resist attacks such as transaction atomic attacks, double spending attacks, sybil attacks, replay attacks, etc. The experimental results show that the crowdsourcing system with the proposed DSSBD has better performance in throughput, latency, balancing, cross-shard transaction proportion, and node reconfiguration proportion, etc., while ensuring security.

Double Spending Attacks in Decentralized Digital Currencies: Challenges and Countermeasures

Double Spending Attacks in Decentralized Digital Currencies: Challenges and Countermeasures

Why Fixed Costs Matter for Proof-of-Work–Based Cryptocurrencies

We assess how the cost structure of cryptocurrency mining affects the response of miners to exchange rate fluctuations and the immutability of cryptocurrency ledgers that rely on proof-of-work. We show that the amount of mining power supplied to currencies that rely on specialized hardware, such as Bitcoin, responds less to adverse exchange rate shocks than other currencies respond to such shocks, a fact that is instrumental to avoiding double-spending attacks. The results may change if mining equipment used for one cryptocurrency can be transferred to another. For smaller currencies with low exchange rate correlation, transferability eliminates the protection that fixed costs provide. Our results weaken doomsday predictions for Bitcoin and other cryptocurrencies with declining block rewards. This paper was accepted by Bruno Biais, Special Section of Management Science: Blockchains and Crypto Economics. Supplemental Material: The data files are available at https://doi.org/10.1287/mnsc.2023.4901 .

Crystal: Enhancing Blockchain Mining Transparency With Quorum Certificate

Researchers have discovered a series of theoretical attacks against Bitcoin's Nakamoto consensus; the most damaging ones are selfish mining, double-spending, and consistency delay attacks. These attacks have one common cause: block withholding. This paper proposes Crystal, which leverages quorum certificates to resist block withholding misbehavior. Crystal continuously elects committees from miners and requires each block to have a quorum certificate, i.e., a set of signatures issued by members of its committee. Consequently, an attacker has to publish its blocks to obtain quorum certificates, rendering block withholding impossible. To build Crystal, we design a novel two-round committee election in a Sybil-resistant, unpredictable and non-interactive way, and a reward mechanism to incentivize miners to follow the protocol. Our analysis and evaluations show that Crystal can significantly mitigate selfish mining and double-spending attacks. For example, in Bitcoin, an attacker with 30% of the total computation power will succeed in double-spending attacks with a probability of 15.6% to break the 6-confirmation rule; however, in Crystal, the success probability for the same attacker falls to 0.62%. We provide formal end-to-end safety proofs for Crystal, ensuring no unknown attacks will be introduced. To the best of our knowledge, Crystal is the first protocol that prevents selfish mining and double-spending attacks while providing safety proof.

Blockchain-Based Computing Resource Trading in Autonomous Multi-Access Edge Network Slicing: A Dueling Double Deep Q-Learning Approach

We investigate the computing resource allocation in multi-access edge network slicing (NS) in the context of revenue and multi-access edge computing (MEC) resource management. The significant variety of slice resource utilization levels across slice tenants (i. e., Mobile Virtual Network Operators (MVNOs)) challenges MEC resource management in NS with MEC, leading to virtual machine resource (VMR) (i. e., computing resource) wastage or scarcity. As a result, for efficient MEC resource management, the infrastructure provider (InP) encourages dynamic resource sharing and trading (DRST) of unutilized slice VMR quotas. Nevertheless, cellular network security and privacy issues deter MVNOs from collaborating on effective DRST. The security characteristics inherent in blockchain have recently gained much interest for secure resource trading. Thus, this paper proposes a unique hierarchical blockchain-based inter-slice computing resource trading (ISCRT) scheme for peer-to-peer (P2P) MVNOs in an autonomous multi-sliced MEC-based 5G network. For secure ISCRT transactions, a consortium blockchain network with hyperledger smart contracts (SC) is designed. We model the demand and pricing problems of buyer and seller MVNOs for the unutilized VMRs using a two-stage Stackelberg game. Then, to obtain the Stackelberg equilibrium (SE), an enhanced dueling double deep Q-network (D3QN) algorithm is proposed, which intelligently determines the optimal demand and pricing policies of MVNOs for the unutilized VMRs during ISCRT transactions at negotiation intervals. Simulation analysis shows that the proposed enhanced D3QN algorithm outperforms benchmark schemes in terms of the MVNO slice-level satisfaction and VMR utilization while reducing double-spending attacks in ISCRT settings by 16% and increasing both players’ utility.

Securing Financial Transactions with a Robust Algorithm: Preventing Double-Spending Attacks

A zero-confirmation transaction is a transaction that has not yet been confirmed on the blockchain and is not yet part of the blockchain. The network propagates zero-confirmation transactions quickly, but they are not secured against double-spending attacks. In this study, the proposed method is used to secure zero-confirmation transactions by using the security hashing algorithm 512 in elliptic curve cryptography (ECDSA) instead of the security hashing algorithm 256. This is to generate a cryptographic identity to secure the transactions in zero-confirmation transactions instead of security hashing algorithm 256. The results show that SHA-512 is greater than SHA-256 in throughput. Additionally, SHA-512 offers better throughput performance than SHA-256 while also having a larger hash size. Results also show that SHA-512 is more secure than SHA-256.

Ethereum Security Based on Blockchain Framework and its Algorithms and Components

With the increasing amount and trading volume, account security has become an issue that people have to consider. The security of Ethereum is discussed in four different aspects. This paper reviews the application of cryptography in Ethereum, including the importance of relevant hash algorithms and digital signature techniques for securing data. The basic structure of the Merkle Tree and the role of its modified data structure, performed in the security mechanism of Ethereum are also analyzed. This paper also analyzes the related Merkle Proof algorithm. Additionally, the definition and working mechanism of Gas in Ethereum are also provided, through which the operating mechanism and creation method of Gas can guarantee the security of Ethereum's processing power. Finally, this paper indicates the underlying vulnerabilities and possible attacks on Bitcoin and Ethereum, including double spending attacks under proof of work and further introduces the related solutions. This paper can provide researchers good references on Ethereum security problem.

Comparison of efficiency of Double Spend Attack for blockchains with checkpoints and without them

Comparison of efficiency of Double Spend Attack for blockchains with checkpoints and without them

TEEDAG: A High-Throughput Distributed Ledger Based on TEE and Directed Acyclic Graph

With the arrival of the 5G era, the Internet of Things (IoT) has entered a new stage, and the amount of IoT data is growing rapidly. The traditional blockchain cannot handle massive amounts of data, which presents scalability challenges for blockchain technology. Existing blockchain improvement technologies such as off-chain payments, protocol improvements, and sharding techniques have performance bottlenecks and limitations in the data, which is rapidly growing. The blockchain is fundamentally a decentralized distributed ledger, and the traditional chain structure is inadequate for addressing concerns such as forks, double-spending attacks, and other factors in the current IoT landscape. In this paper, we propose a high-throughput distributed ledger based on Directed Acyclic Graph (DAG) named TEEDAG. We design a consensus algorithm based on self-referencing parallel chains combined with Trusted Execution Environment (TEE) to ensure the security of the consensus process. The experiment proves that TEEDAG demonstrates a significantly higher throughput compared to traditional blockchain solutions and offers improved security and efficiency compared to existing DAG-based distributed ledger solutions.

Formal verification of fraud-resilience in a crowdsourcing consensus protocol

Crowdsourcing has emerged as a promising computing paradigm that utilizes human intelligence to achieve complex tasks, but it encounters several security and trust issues. Blockchain is a potential technology that can resolve most of these issues, however, it is difficult to find an appropriate consensus protocol applicable to crowdsourcing systems. Therefore, this work presents a Trust and Transactions Chain (TTC) consensus protocol built upon blockchain technology. It selects a trusted leader and validators considering a trust model which depends on deposit ratio, block generation and validation rate, and waiting rate. The TTC protocol addresses the main challenge of ensuring correctness related to critical systems of crowdsourcing which has extreme significance as their failure can result in disastrous consequences. This work is primarily focused on fraud-resilience avoiding double-spending attack. It also deals with sybil and eclipse attacks. Model checking is exploited because it is effective and automatic to conduct formal verification. The TTC protocol is formally modeled utilizing Communicating Sequential Programs, and the fraud-resilience property is specified using Linear Temporal Logic. The verification of the model is done using Process Analysis Toolkit that takes the formal model and specified properties as input to inspect the properties’ satisfaction or violation. The results of the formal verification are analyzed with respect to the verification time and the number of visited states.