Security Evaluation of GoQuorum-based Smart Contracts

Security Evaluation of GoQuorum-based Smart Contracts: A Case Study of Malfunctioning Access Control and Double-Spending

Slager, Cheyenne (TU Delft Electrical Engineering, Mathematics and Computer Science; TU Delft Intelligent Systems)

Liang, K. (mentor)
Scharenborg, O.E. (graduation committee)

Delft University of Technology

Computer Science and Engineering

CSE3000 Research Project

2021-07-02

GoQuorum is an enterprise blockchain platform that supports smart contracts and allows for private transactions. Smart contracts enable automated payment while eliminating the need for third-party involvement. Previous attacks on smart contracts have already shown that existing vulnerabilities can lead to great financial losses. Yet, a study focusing specifically and exclusively on the security of GoQuorum-based smart contracts does not yet exist. This work evaluates two vulnerabilities: faulty use of tx.origin in authentication and private state divergence. Three attacks are demonstrated, leading to draining a contract's ether balance and double-spending. MythX is recommended to detect vulnerable code, while replacing tx.origin with msg.sender eliminates the vulnerability. It is concluded that Zero-Knowledge Proofs are a promising solution to validate transactions while maintaining privacy, although applying them to GoQuorum requires more research and development.

Blockchain
GoQuorum
Security
smart contracts
privacy

http://resolver.tudelft.nl/uuid:693159cd-8dee-453b-b7f6-f69dd1235b86

Student theses

bachelor thesis

© 2021 Cheyenne Slager