Keywords

1 Introduction

The first mention of blockchain like structures can be seen in work of David Chaum in 1982, but the first decentralized blockchain would not be implemented until 2008 when an individual, or a group, named Satoshi Nakamoto made Bitcoin [1]. As the development of blockchain technology started taking pace so the advantages of its usage became more apparent. Currently there are many implementations of the technology like Ethereum, Hyperledger Fabric, IBM blockchain platform and many others as well as already mentioned Bitcoin.

One of the main implementations of blockchain are cryptocurrencies, which are the foundation for smart contract based development. Cryptocurrencies, as a solution to decentralize payment systems and allow direct transfer of funds between two individuals without any financial institutions as intermediaries, are one of the main reasons and driving forces of blockchain invention and further development [2].

Blockchain platforms allowed for usage of smart contracts, the automatically executed pieces of code. With their usage smart contracts bring many benefits, such as reduction of transaction costs, accuracy, clear communication and transparency, allowing anonymous parties to carry out transactions and agreements without the need for an intermediary, legal system, or external enforcement mechanism but they also bring certain security threats [3, 4]. The well known DAO organization smart contract bug resulted in loss of about 50 million US dollars, and the bug inside one of MonoX startup smart contracts lead to losses of more than 31 million US dollars [5, 6].

There are many programming languages for smart contract development but one of the most well known ones is Solidity. Solidity is used for developing smart contracts on the Ethereum Blockchain platform and will be used in this paper to showcase an example of smart contract which aims to show one of possible usages of smart contracts for payment transactions. Best practices for smart contract secure coding is applied.

2 Blockchain and Ethereum

Blockchain is distributed, decentralized, ledger like structure that consists of blocks mutually interconnected using cryptographic techniques. The blockchain is constantly getting larger which is the result of adding new blocks [7]. Each block contains a pointer to the prevoius block which is represented as a hash value of that block. The current block is called child block of the block that precedes it which is called parent block. The first block in the blockchain is the Genesis block and this is the only block that has no parent. Each block consists of header and body. The contents and structure of those parts are not same in different blockchain platforms. The header of the block mainly consists of block version, parent block hash value, Merkle tree root hash value, timestamp, nBits, one-time string (nonce).

For any blockchain it is mandatory to define consensus algorithm. Consensus mechanism or algorithm is one of the defining points of blockchain and provides its usability. Consensus algorithm is actually a way to achieve distributed consensus about transaction order inside of a blockchain. The most known consensus mechanisms are POW (Proof of Work), POS (Proof of Stake), DPOS (Delegated Proof of Stake), PBFT (Practical Byzantine), PoET (Proof of Elapsed Time) of which the most commonly used are Proof of Work and Proof of Stake [8]. In the POW mechanism, all computers in a blockchain network perform complex mathematical calculations to decrypt specific transaction [9]. These mathematical calculations require great computational power. The miners are rewarded cryptocurrency proportional to amount of computational power invested. It is also important to mention that it is possible for two miners, nodes that is, to reach the appropriate one-time sequence (nonce) at the same time. In that case, two valid blocks are created and the blockchain branches into two. The miners continue to work on both chains, but the moment a new block is generated on one of the chains it becomes longer than the other which prompts all of the miners to now contribute only to mentioned chain. When one of the chains become longer enough than the other it is declared the main one, and the other chain is left unused. As the high use of computer resources inevitably leads to extremly high electricity consumption, a POS consensus mechanism has emerged as an alternative to POW [10]. Unlike the POW mechanism, POS does not require great investments of computer resources, but instead, a certain amount of cryptocurrency [11]. There is no concept of miners in POS mechanism based blockchain systems. The equivalent role of creating new blocks and transactions management is performed by validators. The aforementioned stake of cryptocurrency serves as a guarantee of the appropriate behavior and accuracy of the transactions validator processed.

Although the subject is fairly new with real development coming in last ten years or so the literature for research is vastly available. In this paper the emphasis is put on research papers that were published in credible sources mostly in the last five years. As addition the official websites of the used technologies are used to provide specific details about them. Whitepapers, such as the Bitcoin and Ethereum whitepapers, are also used to obtain the most acurate information. All together the literature used provided plenty of reliable information that allowed for thorough research [12].

2.1 Blockchain Security

Blockchain introduces extensive use of cryptography as means of providing security and trust between untrusted parties [13]. All of the information that is stored on the blockchain is using cryptography.

Cryptography building blocks that are used by blockchain are:

  • Public Key Cryptography

  • Hash Functions

  • Zero-Knowledge Proof

Public Key Cryptography.

This type of cryptography is used for proving that a transaction was made by the specific person. There are two ways to store private key in an e-wallet in blockchain, either in a hardware wallet or inside software wallet. Private key is used by the user to sign a message or a transactions and his public key is needed for verification that it was indeed him who signed the transaction [14]. Every transaction must be digitally signed with the private key. So the pair of public and private key makes a fundamental concept that allows the transactions to be signed and verified.

Ethereum, for example, uses digital signatures on transactions and blocks to identify the creator and to confirm that the signed data has not been tampered with since the signing. The most popular algorithm that is used for creation of the public and private key pairs is the Elliptic Curve Digital Signature Algorithm (ECDSA) [15].

Since every public key is a unique value assigned to only one user it can be used as their identifier. This way identity of users is managed without the need of revealing their real, exact identities.

Hash Functions.

Hash functions are mathematical equations that are one of the most important technologies used in the blockchain [16]. Every hash function must have five features [17]:

  • Fixed size. The output always consists of a fixed amount of characters, no matter the size of the input.

  • Preimage resistance. If the input is known it is not hard to get the output of the hash functions, but it is impossible to find the input if output is known.

  • 2nd preimage resistance. It is impossible for the same input to have the same hash value twice.

  • Collision resistance. It is impossible for two inputs to have the same hash value.

  • Big change. After changing a single bit of input, the output is drastically changed.

Zero-Knowledge Proofs.

This principle is used when blockchain is checking if the user has enough funds in the wallet [18]. There is no need for blockchain to know who exactly is the user nor the total amount of cryptocurrency that he has, only if he has enough funds to make the transaction. This way the privacy of users is increased.

2.2 Ethereum

One of the most commonly used blockchain platforms is the Ethereum platform which also provides the option of using smart contracts [19]. In addition to the previously described blocks, parent and child ones, there is a third type of blocks in Ethereum blockchains, and those are Ommer blocks. When two blocks are created simultaneously, one of the blocks is left out. The left out block is called Ommer block, or rarely uncle block. Hash values of these blocks are also included in header of blocks. Ethereum also uses so called ghost protocol [20]. These two new concepts allow for the miners of the blockchain to be rewarded even if the block they contributed to was a part of eventually left out chain. New block is generated approximately every 15 s. Ethereum block structure consist of previous block hash, transaction hash root, state root hash, receipt root hash, timestamp, difficulty, nonce, set gas limit, sum of gas used, extra data, number of a block.

Consensus mechanism of Ethereum blockchain is Proof of Work at the moment of writing this paper, with the plans to change to Proof of Stake in the third or fourth quarter of 2022. In 2020 Beacon Chain, which works on POS mechanism, was introduced as to make this move from POW to POS as seamless as possible [21]. POS will introduce many improvements to the Ethereum platform [22].

  • Lower electricity consumption

  • Reduced hardware requirements

  • Less centralization

  • Economic penalties for misbehaviour

  • Better security

  • Potential social recovery of an honest chain

When this migration plays, stake of 32 ETH will be mandatory in order to become a validator. Validator can lose this stake in its entirety if it is determined that he validated a bad block or a piece of it if he, for some reason, fails to validate assigned block.

3 Smart Contracts

The first description of smart contracts was made in 1990s by a legal scholar and an expert in computer science, Nick Szabo [23]. A smart contract, as well as a contract of any kind, defines the conditions under which a certain agreement is valid [24]. In relation to the contract in the traditional sense, the terms of the agreement in smart contracts are defined in the form of code that is executed on a blockchain platform. Some of the most well known blockchain platforms that are used for deployment of smart contracts include Ethereum, Solana, Hyperledger Fabric, Polkadot, Tezos and Algorand. Smart contract use makes it possible for applications to take advantage of blockchain benefits such as security and reliability [25]. On the Ethereum platform, all smart contracts are public and can be thought of as APIs. Applications based on smart contracts are often called decentralized applications or shorter Dapps [26]. These applications also include applications that allow users of cryptocurrencies to conduct complex financial transactions without the mediation of any financial instituion, known as DeFi applications (decentralized finance applications) [27].

The way of functioning of smart contracts will be explained through an example on the Ethereum platform. Within the Ethereum platform, smart contracts can be developed using several programming languages, the most commonly used of which are Vyper, Fe, Yul, Yul + and Solidity, which will be used in this paper as well. Solidity is a high-level object-oriented, statically typed language that supports inheritance, library use, and complex user-defined types. It is interesting to note that the benefits of Turing complete languages ​​are not used to develop smart contracts. It is even thought that these additional functionalities can lead to unnecessary security vulnerabilities, so the development of programming languages ​​that are not Turing complete like Vyper is advocated. The attack on the DAO organization that has already been mentioned was carried out using the capabilities that Solidity, as a Turing complete programming language has [28].

Smart contracts are executed within the Ethereum virtual machine (EVM) [29]. When executing transactions using smart contracts, it is necessary to pay a certain fee (“gas”). This fee is paid because each transaction on Ethereum requires a certain amount of computing resources. Thus, “gas” is a fee that is paid in order for the transaction to be successful [30]. The compensation value is expressed in gwei, where 1 gwei is equal to 10–9 ether (ETH). The amount of gwei to be paid to execute a transaction is calculated using the following formula:

$$ Gas\;units\left( {limit} \right)*\left( {Base\;fee + Tip} \right) = Total\;transaction\;fee $$
(1)

In the formula shown above, the Gas value is the value defined in the Ethereum yellow book. The base fee refers to the algorithmically determined value that needs to be paid for a particular transaction on the Ethereum blockchain and is calculated based on the demand for the blocks. The type or priority compensation serves as a reward for the miners working on the transaction processing. This value is often automatically determined for most electronic wallets.

The life cycle of an Ethereum smart contract consists of four phases that take place one after the other [31]:

  1. 1.

    The first phase is the phase of creating a smart contract. At this stage, the conditions, obligations and prohibitions related to the smart contract are decided. After that, you can start creating, coding, a smart contract. Once the smart contract has been created the second phase can be approached.

  2. 2.

    In the second phase, the smart contract is published, ie placed, on the blockchain. When a contract is published, it is first compiled and translated into a bytecode. This bytecode is stored in a blockchain and is assigned an address that is determined based on the address of the person who created the contract and a one-time string (nonce) encoded by the RLP function and hashed by the keccak-256 algorithm [32]. Once placed on the blockchain smart contracts can no longer be modified resulting from the immutability of the blockchain. If a change is needed, it is necessary to make a completely new smart contract. As already indicated, all contracts placed on the blockchain are public and can be accessed by any party.

  3. 3.

    Execution of a smart contract represents the next, third phase of the life cycle. This phase begins with the moment when the conditions of the contract are fulfilled. When the condition is met, the corresponding actions are automatically executed, which is also a transaction that is further approved by the blockchain miners. As a result of this phase, the executed transactions, as well as changes in the state of the participating entities will be permanently saved on the blockchain.

  4. 4.

    The completion of a smart contract is defined as the last phase. During this phase, the states are subjected to a final update, and then saved to the blockchain again. In the end, the payment is made and the funds are transferred from the electronic wallet of one participant to the electronic wallet of the other. This completes the life cycle of a smart contract.

Like all technologies, blockchain and smart contracts bring certain advantages and disadvantages. Among the main advantages are the reliability and undeniability provided by blockchain technology, transparency of actions that take place within a smart contract, secrecy of users affected by a particular contract during execution, job automation, cost reduction by eliminating intermediaries and high execution speed thanks to mathematical algorithms that are the base of blockchain. The decentralization, non-tampering, traceability and other characteristics of the blockchain also allow for the better digital rights management (DRM) [33]. On the other hand, the main shortcomings are insufficient legal regulation, problems with scalability and maintaining the speed of transaction processing, the inability to change smart ones after their publication on the platform, as well as high dependence on developers and exposure to errors and bugs [34]. In Fig. 1 solidity source code vulnerabilities are shown, and are shortly explained thereafter.

Fig. 1.
figure 1

Solidity source code vulnerabilities

Full size image

One of the attacks that a badly written code can lead to is the so-called Re-entrancy attack. The Re-entrancy attack is one of the most dangerous attacks that can be brought upon the Solidity smart contract. A re-entrancy attack happens when a function makes an external call to another contract that is untrusted [35]. After that the untrusted contract makes a recursive call back to the original function in an attempt to withdraw funds again. When the contract fails to update its state before sending funds, the attacker can continuously call the withdraw function until all of the contract’s funds are completely drained [36].

Integer overflow and underflow occurs when a number is added or subtracted from 8-bit unsigned integer that has the range of possible values between 0 and 255. If these operations produce the logical values out of range then the 8-bit integer gets truncated and the wrong value is stored [37].

Timestamp dependancy is a vulnerability is a product of the fact that useful information are usually stored in timestamp field of the block [37]. This field is arbitrary which allows for any miner to implant malicious information.

Each operation in a smart contract is a transaction and even though multiple transactions are not operated in a parallel fashion, the order of the operations in question might result in different outcomes [38].

Poorly written smart contract could result in great transaction costs which can lead to non sufficient funds for its execution.

Denial of service with throw can happen when a smart contract is reliant on the result of some external smart contract. That external contract can issue the throw command to stop the flow of execution [38].

Executing a code in an external smart contract could be performed by send, call and delegatecall functions. However, such functions do not stop the execution or throw any error if the callee contract has a runtime error. Instead, the functions would return false and continue running on the origin contract. Thus, this could lead to an erroneous execution flow [38].

Despite the all aforementioned vulnerabilities Solidity is still the most mature programming language for smart contracts development [39]. It is feature rich and provides good community support allowing for steep learning curve and easy problem and bug solving. Other programming languages are still a bit primitive compared to Solidity and lack some of the features that make programming in Solidity easier.

4 Smart Contract Use Case and Examination

As it was mentioned in the previous chapter already smart contracts on the Ehereum platform can be coded using multiple programming languages. In this chapter parts of an example of smart contract coded in Solidity programming language is shown. Solidity compiler that should be used is 0.8.0. Also, as a development environment, Remix IDE in version 0.22.2 was used, which can be used for the development of smart contracts on Ethereum, their placement on the blockchain, as well as management [40]. Remix IDE is open source software available as a web and desktop application. As an illustrative example, a smart contract will be presented, which is initiated in the process of buying books.

The purchase process is as follows. First, the buyer orders the title of the book, as well as the quantity he will buy. Then the order data reaches the seller. The buyer pays for the product and delivery costs. These funds are kept on the account of the smart contract and remain there until the condition is fulfilled, ie until the book is delivered to the buyer. The seller then sends an invoice with the delivery date via the sendInvoice function, which is also forwarded to the buyer of the book. When the book, in the form of a shipment, reaches the buyer, the deliverer records in a smart contract that the delivery has been made. At the very end, the smart contract releases the funds and transfers a part in the value of the book to the seller, and the rest in the value of the delivery costs to the delivery service. In the following figures, Figs. 2, 3 and 4, it is shown in the smart contract.

Fig. 2.
figure 2

First part of the smart contract code

Full size image
Fig. 3.
figure 3

Second part of the smart contract code

Full size image
Fig. 4.
figure 4

Third part of the smart contract code

Full size image

4.1 Smart Contract Examination

The shown example of a smart contract consists of entities, events, and functions. At the beginning of the contract, it is necessary to define the version of the compiler for which the code is written, and further, the specified version or any version that came out after that can be used for compiling, without compromising functionality. This definition is done with the help of the pragma directive and in the given example it is defined that the smart contract is compiled in version 0.8.0 and above, but not the compiler version from 0.9.0 and up. The pragma of the directive is followed by the definition of the contract itself. At the very beginning, two variable types of address are defined in which the addresses of the buyer's and seller's wallets are stored. In the continuation of the contract, the definitions of the structures necessary for functioning, the buyer (Buyer), the ordered book (OrderedBook), the shipment (Shipment), the invoice (Invoice) are given. All sent orders and invoices are stored in two hash tables of the corresponding names orders and invoices under the appropriate ordinal numbers which are stored in the variables orderNum and invoiceNum. The contract defines 4 events, OrderSent, InvoiceSent, OrderDelivered and PaySent. 5 functions are also defined, sendOrder, sendInvoice, getInvoice, sendPay, deliver. With the sendOrder function, order data is sent from the customer to the smart contract. With the OrderSent event, order data is passed from the smart contract to the seller. Next, funds are sent to the smart contract via the sendPay function, of which the seller is notified via the PaySent event. The seller then sends the invoice to the buyer via the sendInvoice function. Any account can be accessed via the getInvoice function. With the deliver function, shipment data is sent from the seller to the delivery company. The OrderDelivered event indicates that delivery has been delivered to the buyer and is the trigger for payment to the seller and the delivery company.

The meaning of several key words that appear in the previously explained example of a smart contract should also be emphasized:

  1. 1.

    payable - this keyword indicates that the address that follows can accept Ether.

  2. 2.

    emit - a keyword that serves as a trigger for the event

  3. 3.

    view - indicates that the function to which it is associated will not change the variables it accesses

Finally, it should be emphasized that the part of the code related to the creation of the constructor begins with the keyword constructor [39]. This part of the code is not mandatory, and if it is written, it will be run only once, when placing the smart contract on the blockchain, what's more, this part of the code will not even be displayed within the byte code. Only one constructor is allowed to be written, and in case it is omitted, the compiler will assume that it is empty.

5 Conclusion and Future Development

The presented example of a smart contract is a simplified version of a contract that would be applied in the real business world and as such would have to be improved, primarily its security aspect. Due to the current aim of the research being PoC (Proof of Concept), testing in the real world environment is planned to be conducted in the next phase of the research, and therefore this smart contract is currently not suitable for publishing on the Ethereum blockchain. It is also planned to, after the before mentioned testing is finished, publish the smart contract in question.

The implemented smart contract worked as intended, which means that the cryptocurrency was transfered from wallet to another. It can be concluded that the use of blockchain and smart contracts in this specific case brings improvements as it utilizes blockchain’s trustless system and thus solves one of the main concerns in traditional systems. Furthermore, comparison of blockchain based payment systems and traditional electronic payment systems is shown in Table 1.

Table 1. Comparison of traditional electronic payment systems and payment systems based on blockchain
Full size table

Ethereum and Solidity proved to be reliable choice of development tools, but throughout the research many drawbacks and flaws of using Solidity are exposed, therefore it might be good idea to consider using some other programming language, such as already mentioned Vyper. When implemented in the case of books trading they bring advantages such as decentralization, fewer transaction costs, automation. Smart contracts allow for automated payments when the specifically defined condition is fulfilled. This in return brings a sense of security as there is no way for any of the sides not to act according to what is expected of them. They eliminate the need for third party mediators which in turn reduces costs of transaction.