Over the last several years there has been a growing interest in distributed ledger technologies (DLTs - which include blockchains such as Ethereum and EOS). One powerful aspect of DLTs that is fueling this interest is that of smart contracts, which are software programs that execute on distributed ledgers. Smart contracts are used to i) control the flow of digital rights (e.g. funds and assets) between several parties and, ii) encapsulate the business logic (i.e. the rules for how a business operates; e.g. a bank policy limiting how much can be transferred in one transaction) for modifying a record in a distributed ledger. The transactions that a smart contract controls are stored in an immutable fashion on the distributed ledger without requiring a central authority to validate them. Ensuring that smart contracts are free of business logic errors and vulnerabilities is extremely difficult as they have open and exposed APIs and are immutable once deployed. This results in an exponential number of scenarios to be tested, making it difficult to verify their correct operation.
The growth in DLTs and difficulties in testing them has brought about an attendant interest from bad actors in exploiting - for financial gain - applications deployed on DLT platforms. These bad actors actively seek out new vulnerabilities that are unknown to DLT application developers and use that knowledge to attack and exploit DLT applications. (Such newly discovered vulnerabilities are termed "zero-day" vulnerabilities, as the exploit of the vulnerability takes place before or on the first (or "zeroth") day of a developer's awareness of the exploit.)
Klevoya is developing a new cybersecurity solution that will enable developers of DLT applications to ensure that their applications are free from vulnerabilities prior to being deployed on a public distributed ledger application platform that uses the WebAssembly (WASM) virtual machine (e.g. EOS, or Ethereum version 2's Ethereum WASM - eWASM).
This project aims to conduct applied research into techniques to perform fuzzing of DLT applications to uncover zero-day vulnerabilities and bugs in their implementation.
Securing applications deployed on DLT platforms will be critical to the UK's success in positioning itself as a leader in the DLT sector. The UK is well known for its cybersecurity expertise. Through this project, we will be able to leverage those skills; applying cutting edge cybersecurity technology to DLTs and enabling the UK to become a world-leading global provider of secure DLT applications.