Bug bounties are a helpful system for identifying vulnerabilities in smart contracts. Many web3 applications use bug bounties today. However, hackers might worry about not getting paid or receiving a reduced bounty if the bounty is not exchanged atomically with a bug report. This concern could lead hackers to exploit the identified bug instead of reporting it. Furthermore, other efforts related to bug bounties require modification of existing smart contracts. To solve this, we propose a practical bug bounty platform for smart contracts, ContractSafeguard, that utilizes Intel SGX to ensure the existence of bugs and atomic exchange of bounty and bug reports. Bug hunters send transactions to smart contracts hosted within the Enclave and glitch them. Test code within the Enclave generates a bug report that includes proof of the bug’s existence and a method that triggers the bug. In other words, within the Enclave, our mechanism detects and proves that the smart contract under test has entered an abnormal state. Our on-chain bug bounty contract then verifies the proof within the bug report and pays the bounty to the bug hunter atomically. Since the proof is produced within the Enclave, generating false proofs is impossible, and the on-chain contract can trust the report. Additionally, the developer can use existing smart contracts without modification since we have a runtime of smart contracts in the Enclave. We design ContractSafeguard for Ethereum smart contracts.

As transactions of monetary value on the public blockchain become more widespread, there is a growing demand that the transactions be verified as legitimate. As a result, it has become mandatory for crypto asset exchanges to perform identity verification. On the other hand, Bitcoin and other public blockchains are easy to start transactions with, and the anonymity of the transactions is a significant value for users. To achieve these conflicting requirements at a certain level, we developed a method to manage information generated from a user’s biometric information with smart contract and link transactions on the blockchain to real people. This mechanism makes it relatively easy for the user to claim their identity while the operator can control the degree of identity verification.

A Mnemonic phrase is a set of secret words that correspond one-to-one with the secret key of a user's crypto wallet. If this phrase is lost, the user cannot access the cryptocurrencies. Thus, the user wants to back up the phrase with multiple storage, but the risk of leakage increases. To solve this dilemma, this paper proposes a leakable mnemonic phrase system in which the phrase is encrypted with a secret key generated from the user's biometric information. Since the leakable mnemonic phrase can be decrypted only with the user's biometric information, it can be backed up to various external storage and devices to solve the contradictory problem of keeping the contents of the phrase secret while preventing its loss. In this paper, we also show the results of evaluating the performance of this system by implementing it on an actual biometric authentication device. The encryption/decryption processing time is fast (200 ms), and the system successfully decrypted the mnemonic phrase six months after enrollment.

Non-Fungible Token(NFT) issued on the blockchain made adding scarcity to digital data possible. However, as NFT transactions soared, illegal use of other people's content increased. To solve this situation, this paper proposes the Proof of Origin concept, which adds authenticity to NFTs by utilizing a technology that generates the cryptographic keys required for digital signatures directly from biometric information and describes the system architecture, data structure, and implementation of this concept. Using biometric information to link NFTs to actual persons makes it possible to provide trustworthiness and high-added value to data. At the same time, the creator does not need to manage secret keys and can safely and efficiently claim the originality of the data.

This paper reports introducing software product lines (SPLs) into multiple divisions at Hitachi. For any divisions developing software for product families that have many variations, an SPL is the key to improving quality, cost, and development efficiency. To introduce SPLs into multiple business divisions from small embedded systems to large power control systems, we organized an SPL project across organizations. Throughout the project, we have successfully introduced SPLs into multiple divisions and identified common and useful activities such as evaluating legacy systems, training domain experts, and sharing experiences with SPL experts. We also report the lessons learned from our experiences about SPL adoptions.