ECE398SC Spring 2018

Smart Contract Security

Lecture 1: Welcome & Intro to Cryptocurrencies
Prof. Andrew Miller (ECE)
Goals of this course:
- Hands on experience in cryptocurrency, blockchains, cryptography

- Develop the skill of learning and applying a new programming

language, and especially smart contract programming

- Early exposure to concepts and techniques in computer security

Why computer security?
- Everything we already depend on is terrifyingly broken

Increasing harm of data breaches, advanced persistent attackers

Systems traditionally built with security as an afterthought

- The security mindset: You need to be able to think like an attacker

To analyze the security of a system

To build more secure systems

“How can I make this system break? What’s the worst I can do to it?”
 Data Breaches

http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
Information sharing poses a dilemma...
We want:
Digitization, automation of business processes
More information sharing between businesses

We also want:
Confidentiality & security against hacks/breaches
The Times 03/Jan/2009 Chancellor on
brink of second bailout for banks.
 Virtual currencies are implemented
on top of a shared database
Alice: $10
$20 -10
Bob: $30
$20 +10

Give $10 Bob, you’ve

to Bob received $10

Alice Bob

Desired security properties:

- Consistency
- Availability
- Application-defined access controls (for writes/updates)
- Privacy
~10,000 reachable nodes http://bitnodes.earn.com/
https://etherscan.io/
Bitcoin has a
$160 Billion market cap

Source: coinmarketcap 11
Cryptocurrency mining (we’ll talk about it later)

~$1M per day of newly minted bitcoins awarded to miners

Why study blockchains and computer security?
Optimistic: a chance to build security into new platforms from the start

Realistic: Security hazards in blockchains are so blatant and visible on the

surface, they make for good learning examples!

Cryptocurrencies are open systems, exciting platforms for experimenting

Cryptocurrencies encourage DIY security, “be your own bank”

Bitcoin Paper Wallet
Private Key

Public Key
Public key / private key in bitcoin

- If someone has your public key (i.e. “address”, they can

send you money.

- If you lose your private key (i.e., “wallet”), you can’t

spend your money.

- If a thief gets your private key, they can steal your

money.
Private Key
Public Key
 Alice and Bob are only identified
by public keys

Transfer 10 Bitcoins from me to Bob.

1BTC

Bitcoin Network 3BTC

1BTC

Alice
5BTC
Signed with Alice’s private key

(Public Key Digital Signature)

Bitcoin is the first and largest of hundreds of cryptocurrencies

https://coinmarketcap.com
 Cryptocurrency exchange markets

Beware the middleman: Empirical analysis of Bitcoin-exchange risk

Tyler Moore and Nicolas Christin, Financial Crypto 2013
 There’s a Bitcoin ATM in Champaign!
https://imgur.com/a/DRhWL
ATMs
More generally: “programmable money”
Digital currency is just one application on top of
a blockchain
Decentralized Consensus
Money “Blockchain”
Users
Account Balances
Alice: ฿10
Bob: ฿15
Carol: ฿120

27
Smart Contracts: user-defined programs running on
top of a blockchain
Decentralized Consensus
Money “Blockchain”
Users
Contracts
Storage
Code
Data

28
Smart Contract Example (very high level)
If GOOG rises to $1,000 by
30 June 2015, assign 10
shares from Alice to Bob and
pay Alice $10,000

Other examples abound:

Auctions, elections, lotteries, escrow, ...
 https://www.sec.gov/ICO

Please be #craeful!!!

Only interaction with

testnet is required

Source: Business insider

Ethereum’s timeline has been pocked by failures
caused by buggy and insecure smart contracts
Homework: Choose your starting character

get testnet Ether from the faucet

Send some tETH (any amount) to me:

0x1B326Ad348e19ecFd1406C43D3bF7a95547AC55c

Introduce yourself on Piazza and post your address

A blockchain is a Distributed Trusted Computer

Ordinary databases:
- distributed within one company
- distributed for performance
and availability

Blockchain databases:
- distributed across multiple
entities
- distributed for privacy and
security against attacks
Permissioned Blockchains Public Blockchains

Open for participation by

AKA “Consortium blockchain” anyone
Nodes are run by well-known,
mostly trusted entities
More Resources

https://www.coursera.org/course/bitcointech

http://soc1024.ece.illinois.edu/teaching/ece598am/fall2016/