Enhancing E-Government Transparency Using Blockchain

An experimental comparison of a centralized government data system and a blockchain-based one, demonstrating how blockchain eliminates the undetectable data tampering that enables corruption.

BINUS University · Kelompok 14 — Jonathan Theja, Dexsen, Benaya Given · Advisor: Gintoro

This repository accompanies the thesis paper "Enhancing E-Government Transparency Using Blockchain: An Experimental Study." It builds two systems that manage the same government aid fund (Dana Bantuan) through an identical lifecycle (register → verify → disburse → audit) and attacks both with five distinct manipulation scenarios:

• System A — Centralized (the control): a Python Flask REST API over a real SQLite database, with no access control and no audit trail. A privileged insider can silently alter, delete, or forge any record.
• System B — Blockchain (the proposed solution): the DanaBantuan Solidity smart contract (Hardhat + OpenZeppelin). Writes are role-gated (admin + a separate verifier), records are immutable and fully logged on-chain, an on-chain budget is enforced, and aid is issued as a real ERC-20 token — the Dana Bantuan Token (DBT) — minted at disbursement and viewable in MetaMask.

Headline result (11 runs · ~5,500 manipulation attempts per system · 12,320 observations): System A allows 100% of tampering, 0% of it traceable; System B allows 0%, with 100% traceability (two-proportion test, p < 0.0001).

---

What's in here

Originally a proof of concept (a single Flask file + a contract to paste into Remix); now a full, runnable, statistically-evaluated project:

Folder	What it is
system-a/	System A — the centralized Flask + SQLite REST API (lifecycle + 5 attack endpoints)
system-b/	System B — the Hardhat project: DanaBantuan.sol, 12-test suite, deploy scripts
web/	Dashboard — Next.js + ethers.js: Live Demo, How-it-works (live audit log + mechanism), Results, Architecture
experiment/	Experiment harness — runs the 5 attack scenarios over repeated runs and computes statistics + charts
scripts/	One-command launchers (start-all.ps1 / start-all.sh)
shared/	Auto-generated contract address + ABI shared across apps
docs/	Architecture diagram, screenshots, and the consolidated Project Overview (technical companion, changes vs paper, runbook, Sepolia guide)

For the full design, methodology, statistics, and results, see docs/PROJECT_OVERVIEW.md.

---

Quick start (one command)

Prerequisites: Node.js 18+ and Python 3.10+.

python run_mvp.py

That's it. On first run it installs anything missing, then starts the local blockchain, deploys the contract, starts System A and the dashboard, and opens http://localhost:3000. (On Windows you can also double-click run_mvp.py; each service opens in its own window — close them to stop.) See the Demo Runbook for the presentation script.

Alternative launchers (shell scripts)

# install once
npm run install:all
cd system-a && python -m venv venv && venv/Scripts/pip install -r requirements.txt && cd ..

# then launch
powershell -ExecutionPolicy Bypass -File scripts/start-all.ps1   # Windows
bash scripts/start-all.sh                                         # macOS / Linux / Git-Bash

No MetaMask? No problem. On the local chain the dashboard has a built-in Dev-Wallet mode, so the demo works with zero browser extensions and even offline.

---

The aid lifecycle & the five attacks

Both systems implement register → verify → disburse → audit. Each is attacked with:

#	Scenario	Real-world corruption	System A	System B
S1	Alter amount	Embezzlement	succeeds, untraceable	reverts, traced
S2	Redirect wallet	Fund diversion	succeeds, untraceable	reverts, traced
S3	Delete/hide record	Ghost-beneficiary removal	succeeds, untraceable	impossible (no delete)
S4	Insert fake beneficiary	Ghost recipient	succeeds, untraceable	reverts (onlyAdmin)
S5	Post-disbursement edit	Cover-up after payout	succeeds, untraceable	reverts (immutable)

---

Running the pieces individually

System B — smart contract (Hardhat)

cd system-b
npm install
npx hardhat test                 # run the 12-test security suite
npm run node                     # start a local chain (keep running)
npm run deploy:local             # deploy + publish address/ABI to shared/ and web/

System A — REST API (Flask + SQLite)

cd system-a
python -m venv venv
venv/Scripts/activate            # Windows  (source venv/bin/activate on macOS/Linux)
pip install -r requirements.txt
python app.py                    # serves http://127.0.0.1:5000

A ready-made Postman collection (full lifecycle + all five attacks) is in postman/.

Dashboard — Next.js

cd web
npm install
npm run dev                      # http://localhost:3000

Experiment harness

cd experiment
npm install
npm test                         # unit tests for the statistical functions (CI, z-test, t-test)
node run.js --runs 10 --n 100    # 5 scenarios × 100 attempts × 10 runs, with statistics
node run.js --runs 10 --n 100 --seed 42   # add --seed for a bit-reproducible run (fresh chain)

Outputs go to experiment/results/ (metrics JSON, SVG charts, an HTML report, and a Markdown summary). The dashboard's Results tab reads the same metrics. Add --scalability for the dataset-size sweep.

---

Deploying to Sepolia (real testnet + live Etherscan)

To run the demo on the public Sepolia testnet — real Etherscan links, importable DBT token in MetaMask, and paper-matching gas figures — follow the Sepolia Guide. In short:

1. Switch MetaMask to Sepolia and get free test ETH from a faucet.
2. cp system-b/.env.example system-b/.env and paste your test wallet's private key (a public RPC is the default, so no Alchemy key is required).
3. Deploy: cd system-b && npx hardhat run scripts/deploy.js --network sepolia
4. (Optional) Measure: cd experiment && node run.js --network sepolia --runs 3 --n 20

Every write then appears on sepolia.etherscan.io — the public, tamper-proof audit trail. Even a blocked tamper is recorded there as a permanent failed transaction.

---

How each guarantee is enforced (System B)

Property	Mechanism	Verified by
Access control	onlyAdmin + separate verifier role	test: non-admin write reverts
Immutability	No update/delete; re-registration reverts; forward-only status	tests: overwrite reverts, no delete fn
Auditability	An event on every action (RecipientRegistered / RecipientVerified / FundDisbursed) + ERC-20 Transfer; blocked attempts remain as failed transactions	live audit-log view
Fiscal control	On-chain budget: totalAllocated + amount ≤ totalBudget	test: over-budget reverts
Transparency	Public view functions + on-chain events	Etherscan / dashboard

All proven by the suite: cd system-b && npx hardhat test (12 passing).

---

System A vs System B

Criterion	System A (Centralized)	System B (Blockchain)
Manipulation success (5 scenarios)	100%	0%
Traceability	0%	100%
Audit trail	None	Permanent, on-chain
Access control	None	Admin + verifier roles
Fiscal control	None	On-chain budget
Transparency	Internal only	Public (Etherscan)
Speed / cost	Fast, free	Slower, small gas cost

---

Screenshots

Results — 12,320 observations, System A 100% vs System B 0% manipulation (p < 0.0001):

How it works — the live on-chain audit log, read straight from the contract's events:

Architecture:

---

Academic materials

This repository holds the implementation. The consolidated technical companion is docs/PROJECT_OVERVIEW.md, and the advisor briefing on the paper revision is docs/PAPER_CHANGES_AND_DIRECTION.md. The paper itself, Turnitin report, and submission proofs are kept separately and are not published here. The original proof-of-concept contract is preserved at system-b/reference/DanaBantuan.poc.sol.