## 4 Case Study: BlockScribe Subscription Management System  
The previous sections on blockchain, Ethereum, smart contracts, wallets, and attack vectors show that a lack of awareness among users and developers is a major cause of vulnerabilities in Ethereum-based applications. Given the potential security risks involved in developing such applications, we decided to design and assess a web-based application built on the Ethereum platform, using the MetaMask wallet. The primary objective was to evaluate its security and identify critical aspects that must be considered when developing this kind of dApps. The implemented application, named BlockScribe (BS), functions as a blockchain-based subscription management system. It is written in Solidity version 0.8.21, taking advantage of built-in protections against integer overflow and underflow, support for structured exception handling, and improved gas optimization. The system was deployed on the Sepolia Ethereum test network and consists of two main layers: (i) a smart contract layer managing subscriptions and (ii) a front-end built in React and Ethers.js that connects to MetaMask. The system architecture is illustrated in Figure 4, and its key components, along with their interactions, are detailed below:  
* User--an individual who uses the web application. Users communicate with the MetaMask wallet for authentication and transaction signing. * Frontend app--a React-based [42] frontend application responsible for interacting with MetaMask (sending transactions, user authentication) and communicating with the Ethereum network. Integration with Ethereum is achieved using the Ethers.js library. * MetaMask--the cryptocurrency wallet used for testing BlockScribe. Although users can utilize any compatible cryptocurrency wallet, MetaMask was chosen due to its user-friendly interface and advanced security features. * Ethereum (Sepolia)--the Sepolia Ethereum test network [43] was used for conducting experiments. Sepolia, like other Ethereum testnets, allows developers to test and debug smart contracts and applications without incurring real transaction costs. It operates with test Ether, which has no real-world value, but provides an accurate simulation of how the application would perform on the Ethereum mainnet. * SubscriptionService smart contract--a smart contract implemented in Solidity, one of the most widely used contract-programming languages for developing Ethereum-based dApps. The SubscriptionService smart contract includes functionalities for subscription management, payment processing, and administrative actions. A fragment of this contract is presented in Algorithm 1. The design of the contract is intentionally minimalistic and serves an educational purpose. Instead of replicating a full-scale application, it focuses on illustrating the most common and impactful security mistakes made during smart contract development. This approach supports reproducibility, clarity of analysis, and alignment with the experimental goals of the study. The key variables were marked as _constant_ or _immutable_, and the public functions take advantage of _calldata_ for the input parameters to minimize the use of gas. Critical functions such as \(withdrawFunds()\) and \(selfDestructContract()\) are protected using \(require(msg.sender==owner)\) to ensure that only the contract owner can invoke them. The main public variables in the contract are as follows:  
Figure 4: BlockScribe system architecture. _address public owner_--stores the Ethereum address of the contract owner. This variable is initialized at the time of contract deployment. * _uint256 public subscriptionFee_--defines the subscription fee amount, expressed in Wei, where 1 Wei is the smallest unit of \(ETH\) (equivalent to \(10^{-18}\)\(ETH\)). * _uint public subscriptionPeriod_--specifies the duration of a subscription after payment. This value is hardcoded as 30 days and cannot be modified by any contract methods.