Cryptocurrency trading is becoming a feature of the world's digital commerce in the present time. The software used to carry out financial operations in cryptocurrency trading must have speed and reliability. Successful cryptocurrency trading is unsustainable without secure financial software. The paper analyzes the interdependence of these two close areas as well as possible individual deviations in the functioning of financial software. The elements for controlling cryptocurrency trading software based on the specifics of a real case are discussed. The introduction of cryptocurrencies into financial, market and social movements in general required a complete change in the security system. In dealing with crypto-currencies, the protection of social institutions (banks, auditors, financial police) is insuficient, but priority must be given to software solutions, mathematical algorithms, and the laws of probability theory. In this sense, business in the domain of cryptocurrencies has significantly improved the methodology, means and technology of protection of all participants of financial transactions in general. The elements for quality control of cryptocurrency trading software are discussed based on the specifics of a real case.
definition also a "controller", and in itself the maximum cybersecurity risk since it controls trafic in the world in Financial transactions can be done through various digi- accordance with its protocols and especially its interests. tal forms: cards, mobile phone, etc. When paying with Google has a de facto monopoly on the search function. cards, a device called a POS terminal (Point Of Sale) plays Without an independent / alternative / parallel Internet, an important role. It is a simple electronic device, of there can hardly be a reliable digital trade, but at the relatively small dimensions, equipped with software for moment there is no choice. processing payment card transactions. Its basic functions The next level of "control" are ISPs (Internet Service are: reading data from the card, forwarding it to the ac- Providers). ISPs have the equipment and access to the cepting bank and accepting the response of the issuing telecommunications lines needed to connect to the Inbank, based on which the payment for the purchase of ternet in a given geographic area. ISP is a company that goods is made. It is used in service and commercial shops. provides individuals and organizations with access to It is the device through which the user accesses the "big the Internet and other related services (e-mail, domain black box" that performs financial transactions. registration and web hosting, etc.). Services are charged.
It is useful to return to the basic principles of dig- Does the ISP provide "trusted services"? And here, the
ital payment at the beginning of the analysis, that is, primary question is who forms and who chooses the ISP,
to observe the process from the general to the individ- that is, who is the "best" on the market, by analogy with
ual. Digital trade currently uses the internet as its basic Google, "which is always the best on the market".
technological infrastructure. Financial software applica- In addition to the technological participants in the
tions require a more detailed understanding of Internet management of data flows, there are also participants
management. The fact is that Google, as a significant from the domain of legislation (levels of states and
inparticipant in the Internet, occupies a huge part of the ternational or supranational organizations) that further
transaction ecosystem. Google is an intermediary, but by complicate the process of data transfer. The term "trust
service" is now in very wide use in the world and in our
BISEC’22: 13th International Conference on Business Information country, and is formalized in a series of laws and
regula*SeCcourrrietys,pDonecdeimngbearu0th3,o2r.022, Belgrade, Serbia tions. However, if we look at the broader picture, some
$ julijana.mir@gmail.com (J. Mirčevski); nikola.popovic@eunet.rs very serious processes in the field of finance and trade
(N. B. Popović); mirjana_andric@yahoo.com (M. Andrić); in the world raise doubts about the meaning of the term
stanojev.br@gmail.com (B. Stanojev) "trust" [1]. Paper or more precisely virtual gold recalls,
© 2023 Copyright for this paper by its authors. Use permitted under Creative Commons License whether we like it or not, the early conquest of America
CPWrEooUrckReshdoinpgs IhStpN:/c1e6u1r3-w-0s.o7r3g ACttEribUutRion W4.0oInrtekrnsahtioonpal (PCCroBYce4.0e).dings (CEUR-WS.org)
by Europeans who gave the natives shiny glass balls in ex- The problems caused by these omissions are mostly
change for physical gold [2]. In this paper, we do not deal solved individually, and often through court cases. There
with gold, but the question of "trusted services" remains is no professional agency, association, group of
compepartially open. For example, does Google as a company tent individuals who would make a general solution in
really provide trustworthy services? Let’s just mention disputed cases. Analyzes show that similar problems
the issue of collecting user personal data and creating a arising from the insuficient security of software
applicauser profile that is formally generated for the purpose of tions are also appearing in the world. They are solved in
more eficient searching. Regulations and mechanisms various ways, so it is necessary to make an overview of
for preventing money laundering allow all messages to the relevant world experiences.
be intercepted and read! There are too many intermedi- According to research published by us,
https://www.itaries that provide "trusted services" and this opens up klinika.rs/ [
or exited in another software service Everything that has been said is correct, but in the • "Server crash" results in the inactivity of the web- observed case, it is obvious that there is some element of site of a bank or other company that performs the "production chain" that does not work according to transfers through a web application, which causes the theory that appears in a huge number of articles on delays in payments, breaking loan repayment this topic. Blockchain ensures the integrity of a certain deadlines, incorrect interest calculations, and the chain of data packets, but to what extent and whether it like. ensures the integrity of the entire chain of transactions.
Is the blockchain technology implemented correctly, who
checks it and how? For example, the temporary event of
the interruption of the use of payment cards [
Most often, trade is enabled within 5 diferent cryp- ifnd a few hundred or thousands of terrorists. This is not tocurrencies (Bitcoin, Ethereum, Litecoin, Bitcoin Cash a logic we can accept without serious reservation. and Tether), and powerful foreign companies also have The criteria that must be met in order for electronic more digital currencies in circulation. It is necessary that transactions to be secure are the following: business technology is constantly improved.
The operations of cryptocurrency trading companies • Ensuring the privacy of communication, are regulated by the Law on Digital Assets (Oficial • Protection of secrecy and confidentiality of data, Gazette of RS No. 153/2020), according to which, in ac- • Protection of sensitive and personal information cordance with the definition of Article 5 of Article 2 and from intentional and unintentional disclosure, Article 3 of the Law, such a company is a provider of ser- • Ensuring data integrity, vices related to digital assets. Sites such as: https://ecd.rs, • Detection of unauthorized modification of data https://teslacryptocap.com/, are functional platforms for in transmission trading digital assets that, in accordance with the defini- In order to meet the above criteria, software application of Article 11 of Article 2 of the Law on Digital Assets, tions must provide the following processes: Authentiorganize cryptocurrency trading. On these software plat- cation means a programmatic procedure for verifying forms, it is possible to join people interested in buying the identity of a user (person, application or device) that and/or selling cryptocurrencies, as well as exchanging requires access to a system or network, Authorization one cryptocurrency for another. Transactions take place includes the process of checking whether a person or in accordance with the applicable rules and in a manner entity is legally authorized for the rights it requests Nonthat leads to the conclusion of the contract. repudiation of a transaction consists of procedures to
Well-known foreign companies for this type of trading eliminate the possibility that the initiator of the transacare: IQ Option, eToro, Binance, Coinbase tion denies sending the message.
It is necessary for the digital platform to introduce software support for authentication standards. The software systems of several companies that operationally support cryptocurrency trading own their digital plat- In the observed case, an incident occurred that clearly forms on the rs or io domain and provide the specified indicates a problem in the software through which digital required security functions. For this purpose, the ECD money trading was performed. In a formal sense, it can system application uses hash functions in order for the be expected that an entrepreneur who performs crypsystem to realize the authentication of requests sent by tocurrency trading services uses the correct software in a specific identified user. The hash function, according accordance with the valid regulations of the Republic to a certain algorithm, generates a series of characters of Serbia and the corresponding foreign and domestic that result in a unique transaction identification code. regulations used for the domain of banking services. The When talking about authentication standards, it is useful observed omission is of such a nature that there is reasonto mention that certain countries impose restrictions on able doubt as to whether the software has passed quality authentication capacity [1, 2]. In the chapter "Import control. In software quality control, it is necessary to and Export Control Laws" [8], the author explains in de- follow control procedures in accordance with internatail the problem of transfer of software technologies, i.e. tional and national standards. In the observed case, the algorithms, and the reasons for restrictions. These are supplied software subsequently demonstrated a defect (is long-known restrictions, but users are persistently told it the only one?). deliver, so the question arises as to how about the maximum protection of their digital money. In the results of the initial quality control, ie the behavior addition, system software ie. operating systems, develop- of the software in the time domain, are monitored. What ment software as well as software that is purchased from complicates the analysis is the assessment that it may not the original manufacturer or intermediary has limitations even be a programmer’s fault. Namely, the question is in the laws of more technologically developed countries whether the software over time remains in the same (ini[9]. Trade in digital money is done over the Internet, so tial) operational state in which the application started? the rules of operation and protection are provided by It is useful to note that, in addition to the common view those who are technologically strongest, that is, those of software and hardware as fixed structures, they are who manage the Internet. in fact dynamic structures. Operating systems are fre
The term "Cryptocurrency wallet" also introduces the quently updated (most often in the form of improved term "trust", for example [10]: "Embedding support for a protection etc.) and sporadically cause problems. It also cryptocurrency wallet is essential for a crypto exchange. updates the development software used to create crypAll the crypto tokens/coins will be stored in the user’s tocurrency trading software, among others. For example, wallet. Developing a wallet solution with enhanced secu- the Python programming language in version 10.3 cannot rity will help in the development of trust between users be installed under the Windows operating system if the and your cryptocurrency exchange. operating system version is below version 8. At the same
We repeat that it is a multifactorial problem that can- time, the same version of the programming language, not be accepted at the technological level. In technology, together with all its libraries, can be installed without reliability is ensured by a multiple safety factor (in con- problems on Linux. From a purely software point of view, struction, by incorporating several times the amount of cryptocurrency trading software projects work with exconcrete and iron, etc.). tensive function libraries (for example Microsoft Base
The "maximum security" of storing and generally Cryptographic Provider), or software libraries used in working with cryptocurrencies is limited by the local the development of applications and depending on the laws of the countries in which the headquarters of secu- applied programming language. For example, in the text rity firms are located. The applied protection algorithms [11], a table of frequently used software components in must be aligned with local normative acts that regulate the development of applications for working with crypthe export and import of technologies related to the pro- tocurrencies is given in Table 1. tection of communications and data. The fact that an It is especially important to emphasize that digital algorithm is patented for a user in cryptocurrency trad- currency trading applications are primarily oriented toing means nothing - it all depends on what is actually wards WEB technology (programming languages PHP, implemented in a software system. JavaScript, etc.), which is known for its security "holes". Browsers are also software components that are literally continuously updated (in the visible and invisible domains). To what extent all those components passed quality control is an important question, since the influence of the market is disproportionately present here.
Table 1 The user can only trust that it will not be stolen by someSoftware components for work with cryptocurrencies one with higher access powers. When the basic software Mobile App Development XRaemacatrNinative, Flutter, iunseasdodritcioomn mtount hiceatdeesfinweidthwsoevrkerpalroextotecronlsa,l sthofetrweairsenaond suficient control - checking the synchronization of their Web App Development ANnogdue.lJaSr,, RNeeasct.tj.sJ,SN,PeHxtP.js, wthoerrke iasnadktnhoewrnespurlotbsloemfdoaftalopsirnogcetismsiengsy.nFcohrroenxiazmatpiolen, Back-end Development AMWonSg,oFDireB-,bMasyeSQL, aosnapteercshonniaclacloamsppeuctteirssndoutectoonsthideearegdinign oqfudaleivtyicceos,ntthroisl since it is "understood" that all participants in the trade are equipped with correct devices.
There is no reason to believe that software components The issue of quality control of "software complex" is have serious flaws, but practice shows that there is no not covered by any international regulations or recomreason to believe that they do not. mendations. The term "International Information Security" is not new, but it has not yet been introduced 6. Quality control in a complex isntatondtahreddsormefearintoof"odbisgeitravlecdosmofmtweracree. oRfeagsuilnagtiloenms aannudsoftware/hardware environment facturer". Since the software complex is created by the nature of things by the inclusion of products from sevAnalysis of international standards for software quality eral "software manufacturers", the matter is significantly control [12] and other documents in the field of control more complicated. For example, the latest worldwide indicates that not all features of interest are covered. automotive "supply chain" crisis shows that replacing For example, on page 11 [12] it is written: "4.2.2.1 Time components is not a simple matter at all. The problem of behavior - Degree to which the response and processing "chips" for electronics in cars, although it initially seemed times and throughput rates of the product or system, simple, created a series of new problems, one of which is when performing its functions, meet requirements. checking the compatibility of chips from diferent man4.2.2.2 Resource utilization - Degree to which the ufacturers. The same or in reality much more compliamounts and types of resources used by a product system, cated thing is with the "complex software" that uses the when performing its functions, meet requirements." "services" of diferent software, but not only (individual)
In the first point called "Time behavior", the mainte- software, but also the system of services (one can also nance of the response time of the product or system is say a chain of services). For example, paying for the serobserved, but not the functional changes over time, i.e. vices of buying digital currency requires the service of the assumption is that the product is static in terms of at least one but essentially more banks. Banks’ response functional characteristics. The second point, Resource times difer both in terms of time and method of mesutilization, talks about "the degree and type of resources sage exchange. The bank as an intermediary has its own that meet (initial) requirements". Trading in digital cur- inertia, which is conditioned by technology, but also by rency or assets in general is done in direct contact with many other reasons of an economic nature, that is, reathe (external) environment, which is dynamic in nature. sons of the bank’s business policy. Do banks use reliable New system participants appear, some disappear, some software systems, do they use "proven libraries" in softchange software systems, etc. Despite the fact that the ware development? Which and what kind of software criteria for participation in trafic are suficiently clearly each individual bank uses cannot be known. Checking defined (message formats, messages, etc.), practice shows these queries is not possible in practice because it would the possible presence of anomalies. amount to a violation of regulations. It means that the
International standards are concentrated on one prod- user and financial operators only have at their disposal
uct (software or any other system) viewed as an indi- "trust in the bank", which is basically a religious attitude
vidual entity. However, how to control the quality of and not a technological one.
"compound software" actually a software system con- Blockchain technology in itself is not controversial,
sisting of "local software(s)" interacting with "external i.e. the theoretical basis is probably correct enough. The
software". As far as we have established so far, "quality key problem is in the application i.e. when blockchain
control" is not foreseen in this case. When trading in dig- technology starts to be applied in the "production chain",
ital assets or money, this procedure is not implied. Even but without knowing what is applied in the "accessible"
checking external software would be an act of attacking or "peripheral" part of the production chain. Namely, in
foreign software. Legal Restrictions clearly indicate that the text [
With API I, a note from the text [13] is useful, which In accordance with the Business Rules, a Contractual says: "You can also implement other APIs that comple- relationship is established between the User and the tradment your crypto currency API to help build a better ing company. The contractual relationship is always project. Consider security features like email verification established at the User’s initiative by creating an order or phone verification a priority for many crypto currency- for the purchase (or sale) of virtual currencies, which is based projects.". Also, for example for "Binance API" it considered as giving an Ofer to conclude a contract. If says: "The API is easy to implement, with relatively few the Order is created in accordance with the instructions issues or bugs, and thus the low likelihood of requiring given on the website, it is considered that the Ofer has additional troubleshooting." been accepted by the trader’s company. After that, the
The author of the mentioned quotes is Emma Jager - software application informs the user that the order has Google alumna, which warns us that people with more been successfully sent, that is, that the ofer has been ac(big) experience in this field know that there are problems cepted. Then, the trader approaches the fulfillment of his in APIs as well. In our environment, claims that we have obligation, i.e., sending money, in cases where the User a large number of IT experts are largely overshadowed sells virtual currencies, i.e., sending virtual currencies, in by the fact that even 25% of the total number of experts cases when the User buys virtual currencies. have a secondary education. It is also useful to note the Through the digital platform-site, the specific user cretrend expressed in text [11]: ated an order for the purchase of virtual currencies of the "The demand for cryptocurrency exchange apps will type "Ethereum" for the amount of 100,000.00 (one huncontinue to rise with the growing trading volumes world- dred thousand) dinars. The epilogue of the created order wide. In such a scenario, launching a high-end crypto is such that they were sent/transferred to the user’s digiexchange app is a far better choice than thinking of ways tal wallet by the Merchant. Virtual currency "Ethereum" to mine bitcoin tokens. By being an intermediary and in the amount of 0.27135122 units of the same (equivahandling transactions eficiently, an entrepreneur can lent to the value of 100,000.00 dinars at that moment). earn enormously." However, the dinar amount of RSD 100,000.00 was not
Developing software for crypto exchange can earn paid. The financial operator, in this particular case the more money than "mining" which requires significant money transfer service "iPay", did not forward the reinvestment, which means that software with potentially served money from the User’s account to the Merchant’s problematic features will be mass generated. bank account, but returned it to his bank account.
This case is a consequence of incorrect functioning of the financial software of organizations in the trade 7. Process flow on a concrete chain. The "iPay" service has an explanation that it is example an "electronic error". The Merchant is seeking a final epilogue and possible compensation in a court case.
A company engaged in the provision of services related to digital assets for a fee, in the territory of the Republic of Serbia, performs transactions, purchases and sales of virtual currencies. The processes are carried out "online" through the website, i.e., the digital platform.
On the site, the Rules of Business are highlighted, as well as all other instructions that users should follow, in order to buy virtual currencies for a number of dinars or to be paid a certain number of dinars for the sale of virtual currencies. Transactions are processed by a software application, so that everything is automatically transferred, namely money to a bank account when selling virtual currencies, or virtual currency to a specialized digital "wallet" - when buying virtual currencies.
Financial service providers depend on customer trust, privacy and risk management. It is imperative to protect sensitive data deposited by customers from cyber-attacks and data breaches. A solution that includes enterprise risk management (ERM) capabilities is required. Such a solution provides protection not only for the company from potential business impacts of the crisis, but also protection for shareholders, customers and the industry as a whole from any ill efects and ripples. In particular, risk should be reduced in complex environments. Complex environments, data and software can make software ifnance applications more prone to vulnerabilities and increase security risk. There are software tools that can provide security for even the most complex configurations of digital trading, including cryptocurrency trading. If the speed of development is maximized, agile processes give developers speed, but then it is usually dificult to insert enough security processes without slowing down development. Special tools are needed that can help maximize speed while minimizing risk with. Since the trade in cryptocurrencies is enormously increasing and accelerating, the number of financial software applications in modern system software environments that function on the web or in the cloud is increasing to that extent.