review articles DOI:10.1145/3372115 system is designed to achieve common Software weaknesses in cryptocurrencies security goals: transaction integrity and availability in a highly distributed sys- create unique challenges in responsible tem whose participants are incentiv- revelations. ized to cooperate.38 Users interact with the cryptocurrency system via software BY RAINER BÖHME, LISA ECKEY, TYLER MOORE, “wallets” that manage the cryptograph- NEHA NARULA, TIM RUFFING, AND AVIV ZOHAR ic keys associated with the coins of the user. These wallets can reside on a local client machine or be managed by an online service provider. In these appli- cations, authenticating users and Responsible maintaining confidentiality of crypto- graphic key material are the central se- curity goals. Exchanges facilitate trade Vulnerability between cryptocurrencies and between cryptocurrencies and traditional forms of money. Wallets broadcast cryptocur- Disclosure in rency transactions to a network of nodes, which then relay transactions to miners, who in turn validate and group Cryptocurrencies them together into blocks that are ap- pended to the blockchain. Not all cryptocurrency applications revolve around payments. Some crypto- currencies, most notably Ethereum, support “smart contracts” in which general-purpose code can be executed with integrity assurances and recorded DESPITE THE FOCUS on operating in adversarial on the distributed ledger. An explosion of token systems has appeared, in environments, cryptocurrencies have suffered a litany which particular functionality is ex- of security and privacy problems. Sometimes, these pressed and run on top of a cryptocur- rency.12 Here, the promise is that busi- issues are resolved without much fanfare following ness logic can be specified in the smart a disclosure by the individual who found the hole. In contract and confidently executed in a other cases, they result in costly losses due to theft, distributed fashion. The emergence of a vibrant ecosys- exploits, unauthorized coin creation, and destruction. tem of decentralized cryptocurrencies These experiences provide regular fodder for has prompted proposals that leverage outrageous news headlines. In this article, we focus on the underlying technology to construct new central bank currency2 and corpo- the disclosure process itself, which presents unique challenges compared to other software projects.15 To key insights illustrate, we examine some recent disclosures and ˽ Cryptocurrency software is complex and vulnerabilities can be readily, and discuss difficulties that have arisen. anonymously, monetized. While Bitcoin is the best known, more than 2,000 ˽ Responsible vulnerability disclosure in cryptocurrencies is hard because cryptocurrencies are in circulation, collectively decentralized systems, by design, 6 give no single party authority to push valued at $350 billion as of August 2020. Figure 1 code updates. conceptualizes the landscape as a stack. While the ˽ This review of case studies informs recommendations for preventing details differ, at the lowest level, each cryptocurrency catastrophic cryptocurrency failures. FOUNDATION THE IMAGE BY ILLUSTRATION 62 COMMUNICATIONS OF THE ACM | OCTOBER 2020 | VOL. 63 | NO. 10 OCTOBER 2020 | VOL. 63 | NO. 10 | COMMUNICATIONS OF THE ACM 63 review articles rate electronic money, such as Face- is potentially viewable on shared led- ventions adopted for general software book’s asset-linked Libra. This article gers in the blockchain systems on products in several ways. Two funda- focuses on existing decentralized cryp- which they transact. Some cryptocur- mental differences arise from the very tocurrencies. Some lessons discussed rencies employ advanced cryptograph- nature of cryptocurrencies. here could also inform the design and ic techniques to protect user privacy, First, the decentralized nature of operation of these prospective forms of but their added complexity often intro- cryptocurrencies, which must continu- digital money issued by public or pri- duces new flaws that threaten such pro- ously reach system-wide consensus on a vate legal entities. tections. single history of valid transactions, de- Bugs in cryptocurrencies. The crypto- Disclosures. Disclosures in crypto- mands coordination among a large ma- currency realm itself is a virtual “wild currencies have occurred in varying cir- jority of the ecosystem. While an indi- west,” giving rise to myriad protocols cumstances, from accidental discover- vidual can unilaterally decide whether each facing a high risk of bugs. Projects ies, through analysis by expert and how to apply patches to her client rely on complex distributed systems developers and academics, to observ- software, the safe activation of a patch with deep cryptographic tools, often ing successful exploits in the wild. In that changes the rules for validating adopting protocols from the research the rest of this article, we highlight the transactions requires the participation frontier that have not been widely vet- difficulties and subtleties that arise in of a large majority of system clients. Ab- ted. They are developed by individuals each case. The root causes of most of sent coordination, users who apply with varying level of competence (from the difficulties lie in the special nature patches risk having their transactions enthusiastic amateurs to credentialed of cryptocurrencies: they are based on ignored by the unpatched majority. experts), some of whom have not devel- distributed systems that were designed Consequently, design decisions oped or managed production-quality to be difficult to change in order to pro- such as which protocol to implement or software before. Fierce competition be- vide strong guarantees on their future how to fix a vulnerability must get sup- tween projects and companies in this behavior. In order to change these port from most stakeholders to take ef- area spurs rapid development, which rules, the consent of many participants fect. Yet no developer or maintainer often pushes developers to skip impor- is needed—participants who are often naturally holds the role of coordinating tant steps necessary to secure their co- anonymous, and who are organized bug fixing, let alone commands the au- debase. Applications are complex as loosely in communities without gov- thority to roll out updates against the they require the interaction between erning bodies or regulatory oversight. will of other participants. Instead, multiple software components (for ex- Here, we briefly highlight the differ- loosely defined groups of maintainers ample, wallets, exchanges, mining ences between conventional software usually assume this role informally. pools). The high prevalence of bugs is development and cryptocurrencies This coordination challenge is ag- exacerbated by them being so readily with regard to vulnerability disclosure, gravated by the fact that unlike “cre- monetizable. With market capitaliza- we identify key issues in the disclosure ative” competition often observed in tions often measured in the billions of process for cryptocurrency systems, the open source community (for exam- dollars, exploits that steal coins are si- and we formulate recommendations ple, Emacs versus vi), competition be- multaneously lucrative to cybercrimi- and pose open questions. tween cryptocurrency projects is often nals and damaging to users and other hostile. Presumably, this can be ex- stakeholders. Another dimension of How Is Disclosure Different? plained by the direct and measurable importance in cryptocurrencies is the Responsible vulnerability disclosure in connection to the supporters’ financial privacy of users, whose transaction data cryptocurrencies differs from the con- wealth and the often minor technical differences between coins. The latter is Figure 1. Components of the cryptocurrency architecture covered in this article. a result of widespread code reuse,28 which puts disclosers into the delicate User position of deciding which among Main security goals: many competing projects to inform re- Key management sponsibly. Due to the lack of formally Client software Online wallets • Confidentiality defined roles and responsibilities, it is e.g., Wallets And exchanges • Authentication moreover often difficult to identify who to notify within each project. Further- Business logic more, even once a disclosure is made, Smart contracts • Integrity one cannot assume the receiving side e.g., Token systems • Authorization will act responsibly: information about vulnerabilities has reportedly been • Integrity (Safety) used to attack competing projects,18 in- Cryptocurrency systems • Availability (Liveness) fluence investors, and can even be used • Incentives (Fairness) by maintainers against their own users. Miner Miner Miner The second fundamental difference emerges from the widespread design Developer goal of “code is law,” that is, making code the final authority over the shared 64 COMMUNICATIONS OF THE ACM | OCTOBER 2020 | VOL. 63 | NO. 10 review articles system state in order to avoid (presum- tocurrencies is characterized by specif- ably fallible) human intervention. To ic features of the domain. The proponents, this approach should interpretation of system state as mon- eliminate ambiguity about intention, ey, with many exchanges linking it me- but it inherently assumes bug-free chanically to the conventional financial code. When bugs are inevitably found, The decentralized system, makes it easier and faster to fixing them (or not) almost guarantees nature of monetize