easy-accordion-free domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114zoho-flow domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114wordpress-seo domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114Blockchain technology has experienced remarkable adoption in recent years, driven by its use across a broad spectrum of institutions, governments, retail investors, and users. However, this surge in\u2026 Read more on Cisco Blogs<\/a><\/p>\n \u200b[[{“value”:”<\/p>\n Blockchain technology has experienced remarkable adoption in recent years, driven by its use across a broad spectrum of institutions, governments, retail investors, and users. However, this surge in blockchain use and cryptocurrency investment has raised concerns among governments and regulatory bodies. The decentralized nature and cross-border capabilities of blockchains, along with a rise in scams, hacking incidents, and other illicit activities have underscored the need for scrutiny. This concern is heightened by the absence of comprehensive regulatory measures.<\/p>\n This blog provides guidance for both individuals and organizations on the essentials of risk due diligence when considering the adoption or investment in blockchains, cryptocurrencies, and tokens. It is important to note this guidance is not intended as financial advice<\/strong>. Instead, its main goal is to help users identify and steer clear of scams and investments that may entail substantial risks. Nevertheless, for financial advice that is customized to individual situations, readers are encouraged to seek the counsel of a qualified professional.<\/p>\n The heightened risk associated with blockchain and cryptocurrencies for adopters and investors can be attributed to a general lack of understanding and transparency in relation to their cybersecurity aspects and dependability. Adding to this risk is the rise of unique attack types specific to the blockchain environment, which differ from traditional security issues. Blockchain security, by its very nature, often diverges from standard cybersecurity practices originating from its decentralized, immutable, and cryptographic nature.<\/p>\n This divergence has led to the emergence of new threats that are not commonly known among many users. Examples include 51% attacks<\/a>, smart contract vulnerabilities<\/a>, Finney attacks<\/a>, and Vector76 attacks<\/a>, which are not typically covered by conventional cybersecurity measures. Most attacks on blockchains revolve around smart contract and consensus mechanism exploitation which are not present in contemporary IT or OT centralized digital environments.<\/p>\n To better emphasize the need for in-depth understanding of the security and reliability features of blockchains and cryptocurrencies, we\u2019ll examine two real-world blockchain attacks. These attacks led to considerable financial repercussions, serving as cautionary tales about the potential risks involved. These incidents include the Poly Network Cross Chain Contract Exploitation<\/a> and Ethereum Classic 51% attack<\/a>.<\/p>\n The Poly Network hack occurred on the August 10, 2021, with $600 million stolen in more than 12 different cryptocurrencies. The hackers exploited a bug to mismanage access rights between two smart contracts handling token transfers between different bridged (linked) blockchains and divert the funds to three malicious wallet addresses.<\/p>\n The attacker exploited the functionality \u201cEthCrossChainData,\u201d which records a list of public keys that authenticate the data coming from the blockchain, allowing the attacker to modify the list to match its own private keys and redirect funds to the selected malicious wallets. This kind of hacking incident might have been prevented with the implementation of thorough vulnerability assessments of the source code. A notable issue is the insufficient information provided to investors and adopters regarding the inherent risks associated with cross-chain transactions. These risks stem from the complex coding necessary to execute such operations, often not fully understood by those involved.<\/p>\n The Ethereum Classic blockchain suffered four \u201c51% attacks,\u201d in which a single entity gained control over most of the network\u2019s computing power by introducing many network clients\/nodes with high computational capacity overshadowing the computational power of legitimate nodes. This opened the door for adversaries to manipulate network transactions and steal Ethereum Classic coins. Investors and adopters are often unaware of the risks entailed in proof-of-work consensus mechanisms that facilitate low hashrates.<\/p>\n The hashrate originates from the processing power of validator nodes that lend their computational power to validate and secure blockchain transactions. In the case of a low hashrate, attackers can exploit the network by overpowering it. This can have a significant impact for investors, as they can lose a significant amount of their money. Such incidences could be mitigated by monitoring the hashrate of the blockchain network to enforce proactive measures once the hashrate falls under a threshold, all while monitoring on-chain activity for double spend attempts.<\/p>\n Adopters, investors, and large organizations are primarily concerned with selecting digital assets that are reliable and secure to safeguard against the loss of value, whether through fraud or other unforeseen complications. Therefore, we\u2019ll focus on presenting an empirical methodology to mitigate associated risks. It aims to guide the selection of reliable, and secure blockchains, cryptocurrencies and tokens, providing a framework for safer investment and adoption decisions.<\/p>\n The proposed methodology centers around nine fundamental pillars: Blockchain Type, Consensus mechanism, Team, Whitepaper, Source code, Historical hacks and vulnerabilities, Wallet distribution, Governmental and Legal Scrutiny and Liquidity. Although the attributes currently used to assess blockchains and cryptocurrencies are deemed adequate, it is important to recognize that these criteria are likely to evolve alongside the progression of blockchain technology and cryptocurrencies. Future changes and enhancements in these technologies can be inferred from new features that developers introduce to blockchain systems and cryptocurrencies that are often described in their whitepapers or on GitHub pages.<\/p>\n Blockchain type refers to the access rights and degree of control that users have over a specific blockchain. There are four main types of blockchains:<\/p>\n Public<\/strong>: Anyone can read and write (transact) on a public blockchain such as Bitcoin<\/a>. This is the most accepted type of blockchain in terms of security and reliability as all stakeholders have visibility on all transactions and on-blockchain data. In most cases, public blockchains have also a high degree of decentralization, which minimizes attacks related to high-influence nodes in the network. In evaluating blockchain risk levels, public blockchains typically present the lowest risk. Their open-source nature fosters transparency in their operations, making their processes and transactions more visible and accountable. Hybrid blockchains carry a moderately higher risk due to their semi-transparent nature, where not all elements are publicly accessible or controlled by users.<\/p>\n Private and consortium blockchains represent the highest risk category. These blockchains require users to place complete trust in the controlling entities, as they lack the transparency and decentralization of public blockchains. This heightened risk is due to the potential for misuse or mismanagement by the controlling parties.<\/p>\n To accurately determine the type of blockchain and mitigate risks, particularly when it comes to token (creation of crypto tokens can be created with minimal effort making them ideal for scams), it is advisable to adopt three methodologies:<\/p>\n Analysis of the project\u2019s website and associated whitepaper describing the crypto project to verify its value and reliability, an example would be the Ethereum whitepaper<\/a>. Typically, all the mentioned sources should be accessible for public blockchain initiatives. If any of these sources is unavailable, the associated risks notably escalate.<\/p>\n A consensus mechanism is a fault-tolerant algorithm used in blockchains to achieve agreements on a single state of the network among distributed processes or multi-agent systems, such as cryptocurrencies. Consensus mechanisms in cryptocurrencies are used by validating nodes (e.g., miners) to validate and accept transactions originating from decentralized computing agents. Four types of consensus mechanisms exist:<\/p>\n Proof-Based (Pox): <\/strong>There are two main types of proof-based algorithms, proof-of-work (PoW)<\/strong> and proof-of-stake (PoS)<\/strong>. DAG: <\/strong>Directed Acyclic Graphs (DAG) is an alternative to traditional consensus blockchain mechanisms that aims to improve speed, scalability and reduce costs. The main difference from other blockchains is on the data structure. Instead of storing data\/transactions on a blockchain and passing this information to all the nodes in the network, DAG networks can perform point-to-point transactions without broadcasting it to the network for verification due to their tree-like structure and high-connectivity between nodes. Although DAGs are more effective than legacy blockchains, they are also vulnerable to several attacks that can damage the integrity of a network due to the low volume of authentications and transactions on the network, including manipulating nodes in the network, leaving them susceptible to various traditional networking, and blockchain-specific attacks. The selection of a consensus mechanism Is a complex task, as each has its advantages and disadvantages in terms of security and reliability. In principle, proof-of-work is secure when a blockchain network is populated with many miners maintaining a high hash rate for verifications, making it restrictive for adversaries to use their own hash rate against the legitimate users and take over blockchain transactions.<\/p>\n Websites such as Blockchain.com<\/a> can provide information on the hash rate of various blockchains. In terms of proof-of-stake blockchains, they can only maintain their secure operations when there is a healthy distribution of the cryptocurrencies or tokens to various wallets and users (the method to audit crypto distributions is visited later in the paper). DAG mechanisms are very susceptible to man-in-the-middle attacks aiming to manipulate the integrity and availability of transactions. PBFT mechanisms are generally safe, but susceptible to attacks when small number of nodes operate in a blockchain network, allowing potential adversaries to implement attacks that can influence most of the network stakeholders, such as Sybil attacks<\/a>, and make decisions for the entire network.<\/p>\n This factor evaluates the openness of the team behind a blockchain, cryptocurrency or token. While blockchain and cryptocurrencies fundamentally support decentralized and semi-anonymous transactions, the anonymity of the development team can markedly raise the risk of monetary loss due to a lack of accountability. This anonymity heightens the danger of fraudulent activities such as rug-pulls or price manipulation.<\/p>\n Reputable digital currency projects typically disclose their team\u2019s identities and credentials, providing assurance to users and investors about the legitimacy of their project. It should be straightforward to research a crypto project\u2019s team. Increased difficulty in finding information about the team substantially raises the risk associated with investing in or adopting the project. Basic research on a crypto team can be conducted using the following resources:<\/p>\n Social Networks (LinkedIn, X, Instagram, Facebook, Reddit, etc.). It is also important to consider how long the team has been operational. A shorter operational history suggests a higher risk. For instance, if all social media and YouTube content related to the team were created within the past five days, and there is little evidence of significant project development, this could indicate a potential rug-pull scenario.<\/p>\n Whitepapers and roadmaps are crucial, serving as the bedrock for comprehending, assessing, and partaking in various crypto projects. A whitepaper serves as the foundational document, offering an in-depth exposition of the project\u2019s technical underpinnings, its mission, the problem it intends to address. It covers the cryptocurrency\u2019s technical aspects, consensus mechanism, security features and tokenomics, thus equipping potential investors and developers with a deeper understanding of the project. These documents are instrumental in fostering transparency, which in turn cultivates trust and credibility \u2014 essentials in a sector brimming with innovation and investment prospects. For investors, whitepapers and roadmaps are critical tools for evaluating risks and making decisions.<\/p>\n As regulatory scrutiny escalates in the crypto world, whitepapers can signify a project\u2019s dedication to regulatory compliance, an increasingly vital factor for long-term viability. A well-crafted whitepaper and roadmap thus empower investors and users to make informed choices, distinguish genuine projects from fraudulent ones, and engage with the crypto community more responsibly and knowledgeably.<\/p>\n Whitepapers should be easily available in a project\u2019s website, such as the whitepaper for Avalanche<\/a>. A whitepaper that is not easily comprehensible or appears hastily assembled, a scenario now more plausible with generative AI, might indicate a dubious project.<\/p>\n Checking a cryptocurrency project\u2019s GitHub repository is vital for several reasons. It offers insight into the project\u2019s development activity and the competence of its development team. By examining the frequency and quality of code commits, pull requests and issue discussions on GitHub, potential investors and users can gauge the project\u2019s commitment to ongoing development and the team\u2019s ability to deliver on their promises. A regularly updated and active GitHub repository is a positive sign, indicating that the project is actively maintained and progressing towards its goals.<\/p>\n GitHub also provides a level of transparency and accountability that is essential in the cryptocurrency space. The open nature of GitHub allows anyone to scrutinize the codebase, which can reveal any vulnerabilities or security issues. It also enables the community to participate in code reviews, offer reports and bug fixes, and suggest improvements. This collaborative approach enhances the project\u2019s security and reliability. Conversely, projects with closed or inactive repositories raise red flags, as they may be less transparent, or worse, potentially abandoned, or fraudulent. Obtaining access to GitHub repositories should be a simple as a google search. The highest the number of users interreacting with the code and the longer the time of existence for a project the highest the confidence should be.<\/p>\n This attribute considers if a blockchain, cryptocurrency or token was compromised or is vulnerable to attacks. It is normal to find that a crypto project has been compromised at a point of time, however, the exploitation methodology used for these attacks and vulnerable code should be revised to ensure that the source code is patched and secured. In the case that a project is not concerned with vulnerability management and best security practices, it renders the project elevated risk due to a high likelihood of a future compromise.<\/p>\n To determine if a project has a history of vulnerabilities and threats, a straightforward approach is to consult news outlets that specialize in reporting on these issues within the cryptocurrency sector. A prime resource for this information is Rekt<\/a>, covering all reported exploitation across different blockchains and platforms. Additional sources that can also prove useful include Cointelegraph<\/a>, CryptoSlate<\/a> and Substack<\/a>.<\/p>\n The wallet holder distribution describes the number of coins or tokens held by each wallet for a specific project. This metric only applies for cryptocurrencies or tokens that are leveraging public or hybrid blockchains where the transactions are publicly accessible. If a wallet holds a large distribution of a cryptocurrency or token, there is a significant risk for network manipulation.<\/p>\n Such information can be found in the respective blockchains of interest (e.g., Etherscan<\/a> for Ethereum) or in cryptocurrency and token price tracking tools such as CoinMarketCap<\/a>. It\u2019s important to remember that, in some cases, adversaries may split their holdings of tokens across multiple wallets to give the appearance of lower token accumulation in a network. It should be noted that addresses holding significant amounts of cryptocurrencies are often associated with exchanges or smart contracts. This is a typical scenario, and these addresses usually shouldn\u2019t be factored into analytical assessments, unless there is reason to believe that an exchange or smart contract address is operating with malicious intent. Such nuances are crucial in accurately interpreting the distribution and concentration of tokens within a network.<\/p>\n The exponential adoption of blockchain has seen severe scrutiny by governments and regulators around the globe. Such case is the lawsuit from the U.S. Securities and Exchange Commission against Ripple<\/a>, accusing the defendant of conducting an $1.3 billion unregistered securities offering.<\/p>\n Legal and governmental scrutiny can significantly increase the risks of investing and adoption due to potential loss of value. Such losses can be partial or complete in the case where a government orders a company to cease operations (in the case of a centralized crypto project). To minimize such risks, adopters and investors alike must warrant that their crypto project of interest is not a target of governmental and legal scrutiny. When vetting a cryptocurrency project, it\u2019s crucial to consider the influence of certain governmental entities and organizations that play a significant role in shaping global legal frameworks and policies for cryptocurrencies. These key entities typically set the standards and regulations that impact the crypto industry, and consulting their guidelines and policies is an essential step in the evaluation process. These prominent bodies include:<\/p>\n International Monetary Fund<\/a> Another useful source to help the reader better understand the current efforts on cryptocurrency regulation in different jurisdictions is the cod3x,<\/a> crypto council for innovation<\/a> and Atlantic Council<\/a>.<\/p>\n Liquidity plays a critical role in assessing the reliability of cryptocurrency and token projects. Low liquidity can significantly impede an investor\u2019s ability to trade, particularly when trying to exit their position (sell). Additionally, it leaves the crypto project susceptible to price manipulation, as even a small amount of capital can drastically affect the price. This environment is ripe for schemes like pump-and-dump or rug-pulls. High liquidity, conversely, makes price manipulation more challenging, requiring substantial capital to impact the market meaningfully.<\/p>\n However, it\u2019s worth noting that low liquidity doesn\u2019t always signify a lack of potential. While it often points to a newly conceived project lacking substantial backing, some major crypto projects began with limited liquidity and organically grew over time. Therefore, liquidity should be considered alongside other project features for a more comprehensive evaluation.<\/p>\n To assess the liquidity of a crypto project, CoinMarketCap<\/a> is a useful tool. Key metrics to focus on include the fully diluted market cap, which reflects the total value of the cryptocurrency if all coins were in circulation, and the circulating supply, indicating the currently available coins in the market. Extremely low values in either metric could pose significant risks. Additionally, if the circulating supply is a small fraction of the fully diluted market cap, it may indicate potential risk, as large releases of coins into circulation could lead to substantial price fluctuations and manipulation. Such details are often outlined in a project\u2019s whitepaper and website and should be carefully reviewed.<\/p>\n To better demonstrate the use of the proposed auditing methodology and the need for due diligence in evaluating crypto projects, we will apply this framework to three hypothetical examples of cryptocurrencies and tokens. These cases will focus on public blockchains, as private or hybrid blockchains often function as \u201cblack boxes.\u201d In such blockchains, there is limited transparency regarding their internal workings, thus requiring a higher degree of trust.<\/p>\n Token \u201cX\u201d (Git hub)<\/p>\n Yes \u2013 Project created 10 days ago with only two accounts linked to the project The team is unknown. A high-risk investment that can be susceptible to price manipulation or a rug-pull.<\/p>\n Low liquidity combined with a consensus mechanism tied to stake ownership can allow threat actors to gain control over the network with a relatively small investment.<\/p>\n The project appears reliable and promising, yet its low liquidity poses a risk to the security of its consensus mechanism.<\/p>\n The network remains vulnerable to attacks due to its history of 51% hacks and ongoing low hash rate, with previous issues of adversaries overpowering the network not yet resolved.<\/p>\n The project looks reliable; however, 51% attacks are still possible that can lead to loss of cryptocurrency.<\/p>\n The rapid expansion of blockchain technology has garnered attention and concern from governments due to its decentralized nature and regulatory challenges. There is still a need for companies to be aware of the risks posed by these technologies, including the threat of scams and unique blockchain vulnerabilities. We hope this post serves as a guide for safe adoption and investment, stressing the importance of professional advice for financial decisions. The aim is to educate a wide audience on navigating the complex landscape of blockchain technology safely and responsibly. Always seek expert guidance, stay updated with the latest developments, and prioritize security in your blockchain endeavors.<\/p>\n We\u2019d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!<\/em><\/p>\n Cisco Security Social Channels<\/strong><\/p>\n Instagram<\/a><\/strong>Facebook<\/a><\/strong>Twitter<\/a><\/strong>LinkedIn<\/a><\/strong><\/p>\n “}]]\u00a0\u00a0Blockchain adoption and crypto investments are peaking, along with scams. Ensure safety in this bull run by being diligent.\u00a0\u00a0Read More<\/a>\u00a0Cisco Blogs\u00a0<\/p>","protected":false},"excerpt":{"rendered":" <\/p>\n Blockchain technology has experienced remarkable adoption in recent years, driven by its use across a broad spectrum of institutions, governments, retail investors, and users. However, this surge in\u2026 Read more on Cisco Blogs<\/a><\/p>\n \u200b[[{“value”:”<\/p>\n Blockchain technology has experienced remarkable adoption in recent years, driven by its use across a broad spectrum of institutions, governments, retail investors, and users. However, this surge in blockchain use and cryptocurrency investment has raised concerns among governments and regulatory bodies. The decentralized nature and cross-border capabilities of blockchains, along with a rise in scams, hacking incidents, and other illicit activities have underscored the need for scrutiny. This concern is heightened by the absence of comprehensive regulatory measures.<\/p>\n This blog provides guidance for both individuals and organizations on the essentials of risk due diligence when considering the adoption or investment in blockchains, cryptocurrencies, and tokens. It is important to note this guidance is not intended as financial advice<\/strong>. Instead, its main goal is to help users identify and steer clear of scams and investments that may entail substantial risks. Nevertheless, for financial advice that is customized to individual situations, readers are encouraged to seek the counsel of a qualified professional.<\/p>\n The heightened risk associated with blockchain and cryptocurrencies for adopters and investors can be attributed to a general lack of understanding and transparency in relation to their cybersecurity aspects and dependability. Adding to this risk is the rise of unique attack types specific to the blockchain environment, which differ from traditional security issues. Blockchain security, by its very nature, often diverges from standard cybersecurity practices originating from its decentralized, immutable, and cryptographic nature.<\/p>\n This divergence has led to the emergence of new threats that are not commonly known among many users. Examples include 51% attacks<\/a>, smart contract vulnerabilities<\/a>, Finney attacks<\/a>, and Vector76 attacks<\/a>, which are not typically covered by conventional cybersecurity measures. Most attacks on blockchains revolve around smart contract and consensus mechanism exploitation which are not present in contemporary IT or OT centralized digital environments.<\/p>\n To better emphasize the need for in-depth understanding of the security and reliability features of blockchains and cryptocurrencies, we\u2019ll examine two real-world blockchain attacks. These attacks led to considerable financial repercussions, serving as cautionary tales about the potential risks involved. These incidents include the Poly Network Cross Chain Contract Exploitation<\/a> and Ethereum Classic 51% attack<\/a>.<\/p>\n The Poly Network hack occurred on the August 10, 2021, with $600 million stolen in more than 12 different cryptocurrencies. The hackers exploited a bug to mismanage access rights between two smart contracts handling token transfers between different bridged (linked) blockchains and divert the funds to three malicious wallet addresses.<\/p>\n The attacker exploited the functionality \u201cEthCrossChainData,\u201d which records a list of public keys that authenticate the data coming from the blockchain, allowing the attacker to modify the list to match its own private keys and redirect funds to the selected malicious wallets. This kind of hacking incident might have been prevented with the implementation of thorough vulnerability assessments of the source code. A notable issue is the insufficient information provided to investors and adopters regarding the inherent risks associated with cross-chain transactions. These risks stem from the complex coding necessary to execute such operations, often not fully understood by those involved.<\/p>\n The Ethereum Classic blockchain suffered four \u201c51% attacks,\u201d in which a single entity gained control over most of the network\u2019s computing power by introducing many network clients\/nodes with high computational capacity overshadowing the computational power of legitimate nodes. This opened the door for adversaries to manipulate network transactions and steal Ethereum Classic coins. Investors and adopters are often unaware of the risks entailed in proof-of-work consensus mechanisms that facilitate low hashrates.<\/p>\n The hashrate originates from the processing power of validator nodes that lend their computational power to validate and secure blockchain transactions. In the case of a low hashrate, attackers can exploit the network by overpowering it. This can have a significant impact for investors, as they can lose a significant amount of their money. Such incidences could be mitigated by monitoring the hashrate of the blockchain network to enforce proactive measures once the hashrate falls under a threshold, all while monitoring on-chain activity for double spend attempts.<\/p>\n Adopters, investors, and large organizations are primarily concerned with selecting digital assets that are reliable and secure to safeguard against the loss of value, whether through fraud or other unforeseen complications. Therefore, we\u2019ll focus on presenting an empirical methodology to mitigate associated risks. It aims to guide the selection of reliable, and secure blockchains, cryptocurrencies and tokens, providing a framework for safer investment and adoption decisions.<\/p>\n The proposed methodology centers around nine fundamental pillars: Blockchain Type, Consensus mechanism, Team, Whitepaper, Source code, Historical hacks and vulnerabilities, Wallet distribution, Governmental and Legal Scrutiny and Liquidity. Although the attributes currently used to assess blockchains and cryptocurrencies are deemed adequate, it is important to recognize that these criteria are likely to evolve alongside the progression of blockchain technology and cryptocurrencies. Future changes and enhancements in these technologies can be inferred from new features that developers introduce to blockchain systems and cryptocurrencies that are often described in their whitepapers or on GitHub pages.<\/p>\n Blockchain type refers to the access rights and degree of control that users have over a specific blockchain. There are four main types of blockchains:<\/p>\n Public<\/strong>: Anyone can read and write (transact) on a public blockchain such as Bitcoin<\/a>. This is the most accepted type of blockchain in terms of security and reliability as all stakeholders have visibility on all transactions and on-blockchain data. In most cases, public blockchains have also a high degree of decentralization, which minimizes attacks related to high-influence nodes in the network. In evaluating blockchain risk levels, public blockchains typically present the lowest risk. Their open-source nature fosters transparency in their operations, making their processes and transactions more visible and accountable. Hybrid blockchains carry a moderately higher risk due to their semi-transparent nature, where not all elements are publicly accessible or controlled by users.<\/p>\n Private and consortium blockchains represent the highest risk category. These blockchains require users to place complete trust in the controlling entities, as they lack the transparency and decentralization of public blockchains. This heightened risk is due to the potential for misuse or mismanagement by the controlling parties.<\/p>\n To accurately determine the type of blockchain and mitigate risks, particularly when it comes to token (creation of crypto tokens can be created with minimal effort making them ideal for scams), it is advisable to adopt three methodologies:<\/p>\n Analysis of the project\u2019s website and associated whitepaper describing the crypto project to verify its value and reliability, an example would be the Ethereum whitepaper<\/a>. Typically, all the mentioned sources should be accessible for public blockchain initiatives. If any of these sources is unavailable, the associated risks notably escalate.<\/p>\n A consensus mechanism is a fault-tolerant algorithm used in blockchains to achieve agreements on a single state of the network among distributed processes or multi-agent systems, such as cryptocurrencies. Consensus mechanisms in cryptocurrencies are used by validating nodes (e.g., miners) to validate and accept transactions originating from decentralized computing agents. Four types of consensus mechanisms exist:<\/p>\n Proof-Based (Pox): <\/strong>There are two main types of proof-based algorithms, proof-of-work (PoW)<\/strong> and proof-of-stake (PoS)<\/strong>. DAG: <\/strong>Directed Acyclic Graphs (DAG) is an alternative to traditional consensus blockchain mechanisms that aims to improve speed, scalability and reduce costs. The main difference from other blockchains is on the data structure. Instead of storing data\/transactions on a blockchain and passing this information to all the nodes in the network, DAG networks can perform point-to-point transactions without broadcasting it to the network for verification due to their tree-like structure and high-connectivity between nodes. Although DAGs are more effective than legacy blockchains, they are also vulnerable to several attacks that can damage the integrity of a network due to the low volume of authentications and transactions on the network, including manipulating nodes in the network, leaving them susceptible to various traditional networking, and blockchain-specific attacks. The selection of a consensus mechanism Is a complex task, as each has its advantages and disadvantages in terms of security and reliability. In principle, proof-of-work is secure when a blockchain network is populated with many miners maintaining a high hash rate for verifications, making it restrictive for adversaries to use their own hash rate against the legitimate users and take over blockchain transactions.<\/p>\n Websites such as Blockchain.com<\/a> can provide information on the hash rate of various blockchains. In terms of proof-of-stake blockchains, they can only maintain their secure operations when there is a healthy distribution of the cryptocurrencies or tokens to various wallets and users (the method to audit crypto distributions is visited later in the paper). DAG mechanisms are very susceptible to man-in-the-middle attacks aiming to manipulate the integrity and availability of transactions. PBFT mechanisms are generally safe, but susceptible to attacks when small number of nodes operate in a blockchain network, allowing potential adversaries to implement attacks that can influence most of the network stakeholders, such as Sybil attacks<\/a>, and make decisions for the entire network.<\/p>\n This factor evaluates the openness of the team behind a blockchain, cryptocurrency or token. While blockchain and cryptocurrencies fundamentally support decentralized and semi-anonymous transactions, the anonymity of the development team can markedly raise the risk of monetary loss due to a lack of accountability. This anonymity heightens the danger of fraudulent activities such as rug-pulls or price manipulation.<\/p>\n Reputable digital currency projects typically disclose their team\u2019s identities and credentials, providing assurance to users and investors about the legitimacy of their project. It should be straightforward to research a crypto project\u2019s team. Increased difficulty in finding information about the team substantially raises the risk associated with investing in or adopting the project. Basic research on a crypto team can be conducted using the following resources:<\/p>\n Social Networks (LinkedIn, X, Instagram, Facebook, Reddit, etc.). It is also important to consider how long the team has been operational. A shorter operational history suggests a higher risk. For instance, if all social media and YouTube content related to the team were created within the past five days, and there is little evidence of significant project development, this could indicate a potential rug-pull scenario.<\/p>\n Whitepapers and roadmaps are crucial, serving as the bedrock for comprehending, assessing, and partaking in various crypto projects. A whitepaper serves as the foundational document, offering an in-depth exposition of the project\u2019s technical underpinnings, its mission, the problem it intends to address. It covers the cryptocurrency\u2019s technical aspects, consensus mechanism, security features and tokenomics, thus equipping potential investors and developers with a deeper understanding of the project. These documents are instrumental in fostering transparency, which in turn cultivates trust and credibility \u2014 essentials in a sector brimming with innovation and investment prospects. For investors, whitepapers and roadmaps are critical tools for evaluating risks and making decisions.<\/p>\n As regulatory scrutiny escalates in the crypto world, whitepapers can signify a project\u2019s dedication to regulatory compliance, an increasingly vital factor for long-term viability. A well-crafted whitepaper and roadmap thus empower investors and users to make informed choices, distinguish genuine projects from fraudulent ones, and engage with the crypto community more responsibly and knowledgeably.<\/p>\n Whitepapers should be easily available in a project\u2019s website, such as the whitepaper for Avalanche<\/a>. A whitepaper that is not easily comprehensible or appears hastily assembled, a scenario now more plausible with generative AI, might indicate a dubious project.<\/p>\n Checking a cryptocurrency project\u2019s GitHub repository is vital for several reasons. It offers insight into the project\u2019s development activity and the competence of its development team. By examining the frequency and quality of code commits, pull requests and issue discussions on GitHub, potential investors and users can gauge the project\u2019s commitment to ongoing development and the team\u2019s ability to deliver on their promises. A regularly updated and active GitHub repository is a positive sign, indicating that the project is actively maintained and progressing towards its goals.<\/p>\n GitHub also provides a level of transparency and accountability that is essential in the cryptocurrency space. The open nature of GitHub allows anyone to scrutinize the codebase, which can reveal any vulnerabilities or security issues. It also enables the community to participate in code reviews, offer reports and bug fixes, and suggest improvements. This collaborative approach enhances the project\u2019s security and reliability. Conversely, projects with closed or inactive repositories raise red flags, as they may be less transparent, or worse, potentially abandoned, or fraudulent. Obtaining access to GitHub repositories should be a simple as a google search. The highest the number of users interreacting with the code and the longer the time of existence for a project the highest the confidence should be.<\/p>\n This attribute considers if a blockchain, cryptocurrency or token was compromised or is vulnerable to attacks. It is normal to find that a crypto project has been compromised at a point of time, however, the exploitation methodology used for these attacks and vulnerable code should be revised to ensure that the source code is patched and secured. In the case that a project is not concerned with vulnerability management and best security practices, it renders the project elevated risk due to a high likelihood of a future compromise.<\/p>\n To determine if a project has a history of vulnerabilities and threats, a straightforward approach is to consult news outlets that specialize in reporting on these issues within the cryptocurrency sector. A prime resource for this information is Rekt<\/a>, covering all reported exploitation across different blockchains and platforms. Additional sources that can also prove useful include Cointelegraph<\/a>, CryptoSlate<\/a> and Substack<\/a>.<\/p>\n The wallet holder distribution describes the number of coins or tokens held by each wallet for a specific project. This metric only applies for cryptocurrencies or tokens that are leveraging public or hybrid blockchains where the transactions are publicly accessible. If a wallet holds a large distribution of a cryptocurrency or token, there is a significant risk for network manipulation.<\/p>\n Such information can be found in the respective blockchains of interest (e.g., Etherscan<\/a> for Ethereum) or in cryptocurrency and token price tracking tools such as CoinMarketCap<\/a>. It\u2019s important to remember that, in some cases, adversaries may split their holdings of tokens across multiple wallets to give the appearance of lower token accumulation in a network. It should be noted that addresses holding significant amounts of cryptocurrencies are often associated with exchanges or smart contracts. This is a typical scenario, and these addresses usually shouldn\u2019t be factored into analytical assessments, unless there is reason to believe that an exchange or smart contract address is operating with malicious intent. Such nuances are crucial in accurately interpreting the distribution and concentration of tokens within a network.<\/p>\n The exponential adoption of blockchain has seen severe scrutiny by governments and regulators around the globe. Such case is the lawsuit from the U.S. Securities and Exchange Commission against Ripple<\/a>, accusing the defendant of conducting an $1.3 billion unregistered securities offering.<\/p>\n Legal and governmental scrutiny can significantly increase the risks of investing and adoption due to potential loss of value. Such losses can be partial or complete in the case where a government orders a company to cease operations (in the case of a centralized crypto project). To minimize such risks, adopters and investors alike must warrant that their crypto project of interest is not a target of governmental and legal scrutiny. When vetting a cryptocurrency project, it\u2019s crucial to consider the influence of certain governmental entities and organizations that play a significant role in shaping global legal frameworks and policies for cryptocurrencies. These key entities typically set the standards and regulations that impact the crypto industry, and consulting their guidelines and policies is an essential step in the evaluation process. These prominent bodies include:<\/p>\n International Monetary Fund<\/a> Another useful source to help the reader better understand the current efforts on cryptocurrency regulation in different jurisdictions is the cod3x,<\/a> crypto council for innovation<\/a> and Atlantic Council<\/a>.<\/p>\n Liquidity plays a critical role in assessing the reliability of cryptocurrency and token projects. Low liquidity can significantly impede an investor\u2019s ability to trade, particularly when trying to exit their position (sell). Additionally, it leaves the crypto project susceptible to price manipulation, as even a small amount of capital can drastically affect the price. This environment is ripe for schemes like pump-and-dump or rug-pulls. High liquidity, conversely, makes price manipulation more challenging, requiring substantial capital to impact the market meaningfully.<\/p>\n However, it\u2019s worth noting that low liquidity doesn\u2019t always signify a lack of potential. While it often points to a newly conceived project lacking substantial backing, some major crypto projects began with limited liquidity and organically grew over time. Therefore, liquidity should be considered alongside other project features for a more comprehensive evaluation.<\/p>\n To assess the liquidity of a crypto project, CoinMarketCap<\/a> is a useful tool. Key metrics to focus on include the fully diluted market cap, which reflects the total value of the cryptocurrency if all coins were in circulation, and the circulating supply, indicating the currently available coins in the market. Extremely low values in either metric could pose significant risks. Additionally, if the circulating supply is a small fraction of the fully diluted market cap, it may indicate potential risk, as large releases of coins into circulation could lead to substantial price fluctuations and manipulation. Such details are often outlined in a project\u2019s whitepaper and website and should be carefully reviewed.<\/p>\n To better demonstrate the use of the proposed auditing methodology and the need for due diligence in evaluating crypto projects, we will apply this framework to three hypothetical examples of cryptocurrencies and tokens. These cases will focus on public blockchains, as private or hybrid blockchains often function as \u201cblack boxes.\u201d In such blockchains, there is limited transparency regarding their internal workings, thus requiring a higher degree of trust.<\/p>\n Token \u201cX\u201d (Git hub)<\/p>\n Yes \u2013 Project created 10 days ago with only two accounts linked to the project The team is unknown. A high-risk investment that can be susceptible to price manipulation or a rug-pull.<\/p>\n Low liquidity combined with a consensus mechanism tied to stake ownership can allow threat actors to gain control over the network with a relatively small investment.<\/p>\n The project appears reliable and promising, yet its low liquidity poses a risk to the security of its consensus mechanism.<\/p>\n The network remains vulnerable to attacks due to its history of 51% hacks and ongoing low hash rate, with previous issues of adversaries overpowering the network not yet resolved.<\/p>\n The project looks reliable; however, 51% attacks are still possible that can lead to loss of cryptocurrency.<\/p>\n The rapid expansion of blockchain technology has garnered attention and concern from governments due to its decentralized nature and regulatory challenges. There is still a need for companies to be aware of the risks posed by these technologies, including the threat of scams and unique blockchain vulnerabilities. We hope this post serves as a guide for safe adoption and investment, stressing the importance of professional advice for financial decisions. The aim is to educate a wide audience on navigating the complex landscape of blockchain technology safely and responsibly. Always seek expert guidance, stay updated with the latest developments, and prioritize security in your blockchain endeavors.<\/p>\n We\u2019d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!<\/em><\/p>\n Cisco Security Social Channels<\/strong><\/p>\n Instagram<\/a><\/strong>Facebook<\/a><\/strong>Twitter<\/a><\/strong>LinkedIn<\/a><\/strong><\/p>\nCase 1: Poly Network Cross Chain Contract Exploitation<\/strong><\/h2>\n
Case 2: Ethereum Classic 51% Attack<\/strong><\/h2>\n
Blockchain Assessment Methodology<\/strong><\/h2>\n
Blockchain Type<\/strong><\/h2>\n
\nPrivate<\/strong>: Only the owning organization(s) can read and write on the blockchain and, usually, only a handful of nodes can write on the ledger (e.g., Hyperledger<\/a>). Although such networks are usually faster than public blockchains, they are not transparent, and stakeholders can manipulate blocks at will to the extent that they can even impact the immutability of blockchain by altering previous transactions or delete blocks.
\nConsortium<\/strong>: Like private blockchains, consortium blockchains (e.g., Ripple<\/a>) also offer little to no transparency and are often highly centralized. The only difference is that consortium blockchains compromised of multiple organizations instead of a single entity.
\nHybrid<\/strong>: Hybrid blockchains inherit architectural designs from public and private blockchains (e.g., Komodo<\/a>). The degree to what characteristics a hybrid blockchain inherits depends on a specific solution and its purpose. Usually, a large part of the activities and transactions take place on the background as part of a private ledger (blockchain), where the results of those activities are broadcasted on a public blockchain. While hybrid blockchains improve performance, they compromise the trustless and fully transparent nature of user-blockchain interactions. In these systems, users are required to place complete trust in the organization(s) overseeing the private components of the transactions.<\/p>\n
\nVisit the GitHub page containing the source code of the cryptocurrency or token of interest to validate its opensource and transparent nature, such as Ethereum\u2019s GitHub<\/a>
\nUse blockchain explorers to make sure that transactions in the blockchain of interest are visible and transparent to users. Websites like Blockchain.com<\/a> can be used to explore transactions.<\/p>\nConsensus mechanism<\/strong><\/h2>\n
\nProof-of-Work<\/em>: A decentralized consensus mechanism that requires miners to use their computational power to validate transactions and mine new tokens in a blockchain network. This is achieved by solving an arbitrary mathematical puzzle that prevents fraud on the network. Proof-of-work is extensively used in cryptocurrency and is generally a secure method for validating blockchain transactions.<\/strong> However, the security and reliability of such networks are heavily reliant on the computational power (hash-rate) and decentralization degree of mining nodes. If the aggregated computation power of miners is low or highly centralized, it is possible that attackers overpower the security of the network and damage the integrity and reliability of a blockchain by manipulating transactions which can incur significant disruptions including loss of money.
\n\u00a0Proof<\/em>-of-Stake: Like proof-of-work, mining nodes in proof-of-stake blockchains validate block transactions in a decentralized manner. However, instead of verifying transactions in proportion to the processing power a miner holds in this case is relative to the percentage of the total coins that a miner holds. Although, this improves energy consumption and lowers mining costs, it poses significant security risks in the case where a small number of mining nodes own the largest percentage of coins in a network or where the largest holders collude to manipulate the blockchain for profit, such as price manipulation or apply policies in a blockchain that will ultimately benefit the major stakeholders.<\/p>\n
\nPBFT (Practical Byzantine Fault Tolerance): <\/strong>The main objective of PBFT algorithms is to decide whether to accept a piece of information that is submitted to a blockchain or not. Each node in the network maintains an internal state. When a node receives a transaction, they use the message in conjunction with their internal state to perform a computation. This computation will result into the decision about the message. The decision is then shared with other nodes in the network. The final decision is determined based on the total decisions from all nodes. Compared to proof-of-work, a high hash rate is not required for verification as PBFT relies on the number of nodes confirming a transaction. Once sufficient responses are reached, the transaction is verified as a valid transaction. Like proof-of-work, PBFT can be a secure medium for verification only when sufficient nodes exist in the network that are operated by different parties.<\/p>\nTeam<\/strong><\/h2>\n
\nYouTube
\nCryptocurrency-related forums and communities such as Bitcointalk and CryptoCompare.
\nPodcasts and interviews with the operators.<\/p>\nWhitepaper<\/h2>\n
Source Code (GitHub)<\/strong><\/h2>\n
Historical hacks and vulnerabilities<\/strong><\/h2>\n
Wallet Distribution<\/strong><\/h2>\n
Governmental and Legal Scrutiny<\/strong><\/h2>\n
\nEuropean Central Bank<\/a>
\nFATF<\/a>
\nBank for International Settlements<\/a>
\nUS Securities and Exchange Commission<\/a><\/p>\nLiquidity<\/strong><\/h2>\n
Auditing Use Cases<\/strong><\/h2>\n
\nCoin \u201cY\u201d
\nCoin \u201cZ\u201d
\nBlockchain Type
\nPublic
\nPublic
\nPublic
\nConsensus Mechanism
\nProof-of-Work (high hash rate)
\nProof-of-Stake (low distribution)
\nProof-of-Work (low hash rate)
\nTeam
\nUnknown
\nKnown
\nKnown
\nWhitepaper
\nYes \u2013 Low quality, rushed, limited value
\nYes \u2013 good quality
\nYes \u2013 good quality
\nSource Code<\/p>\n
\nYes \u2013 more than 1,000 active users and developers
\nYes \u2013 more than 500 users and developers
\nHistorical hacks & Bugs
\nNo
\nYes \u2013 but vulnerabilities fixed
\nYes \u2013 51% attacks
\nWallet Distribution
\n80% belongs to 2 private wallet addresses
\n40% belongs to a private wallet address
\nHealthy distribution, first 40 addresses hold 11% of crypto
\nGovernmental and Legal Scrutiny
\nN\/A
\nN\/A
\nN\/A
\nLiquidity
\n$90,000
\n$ 6,000,000
\n$ 100,000,000
\nRisks<\/p>\n
\nWhitepaper shows no innovation and no substance.
\n\u00a0Limited financial backing.
\nGitHub page exists for just two weeks with little following.
\nMajority of the tokens are distributed in just two addresses, owned by the creators.<\/p>\nConclusion<\/strong><\/h2>\n
Case 1: Poly Network Cross Chain Contract Exploitation<\/strong><\/h2>\n
Case 2: Ethereum Classic 51% Attack<\/strong><\/h2>\n
Blockchain Assessment Methodology<\/strong><\/h2>\n
Blockchain Type<\/strong><\/h2>\n
\nPrivate<\/strong>: Only the owning organization(s) can read and write on the blockchain and, usually, only a handful of nodes can write on the ledger (e.g., Hyperledger<\/a>). Although such networks are usually faster than public blockchains, they are not transparent, and stakeholders can manipulate blocks at will to the extent that they can even impact the immutability of blockchain by altering previous transactions or delete blocks.
\nConsortium<\/strong>: Like private blockchains, consortium blockchains (e.g., Ripple<\/a>) also offer little to no transparency and are often highly centralized. The only difference is that consortium blockchains compromised of multiple organizations instead of a single entity.
\nHybrid<\/strong>: Hybrid blockchains inherit architectural designs from public and private blockchains (e.g., Komodo<\/a>). The degree to what characteristics a hybrid blockchain inherits depends on a specific solution and its purpose. Usually, a large part of the activities and transactions take place on the background as part of a private ledger (blockchain), where the results of those activities are broadcasted on a public blockchain. While hybrid blockchains improve performance, they compromise the trustless and fully transparent nature of user-blockchain interactions. In these systems, users are required to place complete trust in the organization(s) overseeing the private components of the transactions.<\/p>\n
\nVisit the GitHub page containing the source code of the cryptocurrency or token of interest to validate its opensource and transparent nature, such as Ethereum\u2019s GitHub<\/a>
\nUse blockchain explorers to make sure that transactions in the blockchain of interest are visible and transparent to users. Websites like Blockchain.com<\/a> can be used to explore transactions.<\/p>\nConsensus mechanism<\/strong><\/h2>\n
\nProof-of-Work<\/em>: A decentralized consensus mechanism that requires miners to use their computational power to validate transactions and mine new tokens in a blockchain network. This is achieved by solving an arbitrary mathematical puzzle that prevents fraud on the network. Proof-of-work is extensively used in cryptocurrency and is generally a secure method for validating blockchain transactions.<\/strong> However, the security and reliability of such networks are heavily reliant on the computational power (hash-rate) and decentralization degree of mining nodes. If the aggregated computation power of miners is low or highly centralized, it is possible that attackers overpower the security of the network and damage the integrity and reliability of a blockchain by manipulating transactions which can incur significant disruptions including loss of money.
\n\u00a0Proof<\/em>-of-Stake: Like proof-of-work, mining nodes in proof-of-stake blockchains validate block transactions in a decentralized manner. However, instead of verifying transactions in proportion to the processing power a miner holds in this case is relative to the percentage of the total coins that a miner holds. Although, this improves energy consumption and lowers mining costs, it poses significant security risks in the case where a small number of mining nodes own the largest percentage of coins in a network or where the largest holders collude to manipulate the blockchain for profit, such as price manipulation or apply policies in a blockchain that will ultimately benefit the major stakeholders.<\/p>\n
\nPBFT (Practical Byzantine Fault Tolerance): <\/strong>The main objective of PBFT algorithms is to decide whether to accept a piece of information that is submitted to a blockchain or not. Each node in the network maintains an internal state. When a node receives a transaction, they use the message in conjunction with their internal state to perform a computation. This computation will result into the decision about the message. The decision is then shared with other nodes in the network. The final decision is determined based on the total decisions from all nodes. Compared to proof-of-work, a high hash rate is not required for verification as PBFT relies on the number of nodes confirming a transaction. Once sufficient responses are reached, the transaction is verified as a valid transaction. Like proof-of-work, PBFT can be a secure medium for verification only when sufficient nodes exist in the network that are operated by different parties.<\/p>\nTeam<\/strong><\/h2>\n
\nYouTube
\nCryptocurrency-related forums and communities such as Bitcointalk and CryptoCompare.
\nPodcasts and interviews with the operators.<\/p>\nWhitepaper<\/h2>\n
Source Code (GitHub)<\/strong><\/h2>\n
Historical hacks and vulnerabilities<\/strong><\/h2>\n
Wallet Distribution<\/strong><\/h2>\n
Governmental and Legal Scrutiny<\/strong><\/h2>\n
\nEuropean Central Bank<\/a>
\nFATF<\/a>
\nBank for International Settlements<\/a>
\nUS Securities and Exchange Commission<\/a><\/p>\nLiquidity<\/strong><\/h2>\n
Auditing Use Cases<\/strong><\/h2>\n
\nCoin \u201cY\u201d
\nCoin \u201cZ\u201d
\nBlockchain Type
\nPublic
\nPublic
\nPublic
\nConsensus Mechanism
\nProof-of-Work (high hash rate)
\nProof-of-Stake (low distribution)
\nProof-of-Work (low hash rate)
\nTeam
\nUnknown
\nKnown
\nKnown
\nWhitepaper
\nYes \u2013 Low quality, rushed, limited value
\nYes \u2013 good quality
\nYes \u2013 good quality
\nSource Code<\/p>\n
\nYes \u2013 more than 1,000 active users and developers
\nYes \u2013 more than 500 users and developers
\nHistorical hacks & Bugs
\nNo
\nYes \u2013 but vulnerabilities fixed
\nYes \u2013 51% attacks
\nWallet Distribution
\n80% belongs to 2 private wallet addresses
\n40% belongs to a private wallet address
\nHealthy distribution, first 40 addresses hold 11% of crypto
\nGovernmental and Legal Scrutiny
\nN\/A
\nN\/A
\nN\/A
\nLiquidity
\n$90,000
\n$ 6,000,000
\n$ 100,000,000
\nRisks<\/p>\n
\nWhitepaper shows no innovation and no substance.
\n\u00a0Limited financial backing.
\nGitHub page exists for just two weeks with little following.
\nMajority of the tokens are distributed in just two addresses, owned by the creators.<\/p>\nConclusion<\/strong><\/h2>\n