## 2 Background and Related Work
### Blockchain Fundamentals  
A blockchain can be conceptualized as a state machine that maintains a record of historical states and user interactions. Specifically, miners, participants in the blockchain network who compete to compute a new block and are typically incentivized by rewards, gather _transactions_ to form a new block, denoted as \(B^{[n]}\). Miners then attempt to compute a _proof of work_ (explained shortly) to append this new block \(B^{[n]}\) to the existing blockchain \(\mathbb{BC}^{[n-1]}\), which contains all previous states and interactions up to the \((n-1)\)-th state. The addition of \(B^{[n]}\) enables a state transition from the \((n-1)\)-th state to the \(n\)-th state, formally expressed as  
\[\mathbb{BC}^{[n]}=\mathbb{BC}^{[n-1]}||B^{[n]}, \tag{1}\]  
where \(||\) denotes concatenation. The proof of work mechanism establishes a competitive process for appending new blocks (referred to as block mining) to the blockchain, thereby preventing monopolization by a small number of miners. Specifically, let  
\[t^{[n]}=(t_{1},t_{2},\cdots,t_{c_{n}}) \tag{2}\]  
denote the set of transactions collected by a miner for inclusion in block \(B^{[n]}\), where \(c_{n}\) denotes the total number of transactions in \(B^{[n]}\). Block \(B^{[n]}\) consists of the hash value \(h^{[n-1]}\) of the immediately preceding block \(B^{[n-1]}\), the transaction set \(t^{[n]}\), and a nonce \(r^{[n]}\) that ensures the block meets predefined conditions. When a miner is said to have obtained the proof of work to add their constructed block \(B^{[n]}\) to the existing blockchain \(\mathbb{BC}^{[n-1]}\), this implies that they have successfully calculated the nonce \(r^{[n]}\) to satisfy the required conditions based on the transaction set \(t^{[n]}\) they intend to register. This process can be expressed as  
\[h^{[n]}=H(h^{[n-1]}||t^{[n]}||r^{[n]})\in\mathcal{C}, \tag{3}\]  
where \(H\) is a cryptographic hash function, \(\mathcal{C}\) represents the set of conditions that the hash value \(h^{[n]}\) of \(B^{[n]}\) must meet, and \(r^{[n]}\) is the nonce number that satisfies (3). In Bitcoin, \(H\) is the SHA-256 hash function [38], and \(\mathcal{C}\) is defined as the set of 256-bit strings that are smaller than a predetermined target value. In (3), the blockchain includes the hash value of the last connected block in a new block, ensuring the integrity of the blockchain by preventing arbitrary modifications to previously linked blocks. A smart contract is a self-executing computer program deployed on a blockchain that automates the execution of contractual logic between parties. As demonstrated in Ethereum, a smart contract consists of program code that maintains internal variables and state, and can generate outputs deterministically based on input data. While a smart contract cannot initiate itself, it is triggered explicitly by a user through a transaction. For example, the transaction  
\[TX=u\to sc:d \tag{4}\]  
instructs all nodes in the blockchain network to execute the smart contract \(sc\) with input \(d\), based on a valid request from user \(u\). To verify the authenticity of the initiating user, the transaction must include a digital signature, though this aspect is omitted in this discussion for simplicity. Once invoked, a smart contract can maintain cryptocurrency balances, update internal state, and even trigger other smart contracts during its execution. In the standard format of a transaction, this is represented as follows:  
\[TX=\text{sender's address}\rightarrow\text{receiver's address}:\text{ transmitted content}. \tag{5}\]  
For the sake of simplicity, we will use the owners instead of their addresses in the sender and receiver fields. For example, in (4), \(u\) represents \(addr(u)\). Here, \(addr(X)\) refers to the address of \(X\), which acts as an identifier on the blockchain network. This simplification does not lead to any ambiguity in the sender and receiver fields, as only addresses are permitted in these fields.