Technical Summary: Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey

Problem Statement

Blockchain security has evolved from protecting isolated infrastructure to defending programmable economic systems where small implementation bugs or misconfigurations can lead to massive financial losses. The threat landscape has shifted from simple network disruptions and consensus bounds to complex, programmable economic abuse and cross-domain exploits. Existing surveys often suffer from three limitations:

1. Outdated Scope: Many foundational works focus on Bitcoin-era mechanisms, leaving DeFi, oracles, Layer-2 (L2) rollups, and cross-chain bridges under-analyzed.
2. Siloed Analysis: Empirical studies frequently isolate specific vulnerabilities (e.g., Solidity bugs) without accounting for how network assumptions, consensus incentives, Maximal Extractable Value (MEV), and application logic interact.
3. Uneven Evidence: Some surveys mix mature research with lightly validated preprints, obscuring the true research frontier.

The core problem addressed is the lack of a unified framework that explains how security assumptions fail when protocols are composed across different layers and trust domains, particularly in the context of Decentralized Finance (DeFi) and Web3 interoperability.

Methodology

The authors conducted a systematic review following PRISMA guidelines to construct a corpus of 246 high-quality academic studies.

• Selection Criteria: Papers were retained only if they changed how a blockchain system is modeled, exploited, or defended. Purely descriptive incident reports without reusable attack patterns were excluded, though major incidents were used as empirical anchors for case tables.
• Data Sources: The corpus was built from major digital libraries, official proceedings (e.g., IEEE S&P, ACM CCS, USENIX Security), arXiv, and IACR ePrint, updated through June 2026.
• Taxonomy Construction: The survey organizes the threat landscape using two primary axes:
  1. Four-Tier Layered Architecture: Network, Data & Cryptographic, Consensus & Incentive, and Application layers.
  2. Cross-Domain Trust Boundaries: Analyzing how assumptions are imported and exported between domains (e.g., bridges, oracles, rollups).
• Analytical Framework: The authors evaluate defenses not just by the property they check, but by the "residual assumptions" that remain exposed. They also employ a "timing-based evaluation" to distinguish between preventive monitors and forensic tools based on whether detection occurs before a loss becomes irreversible.

Key Contributions

The paper provides a structured coding and comparison exercise rather than a simple catalog of incidents. Its main contributions include:

1. Layered Attack Coding: Attacks are encoded by origin layer, entry condition, violated invariant, affected asset, and representative defense. This allows for a systematic comparison of threats ranging from network topology attacks to application-level logic bugs.
2. Defense Residual Assumptions: For every defense mechanism (scanners, privacy tools, consensus changes, MEV mitigations, bridge verifiers), the survey explicitly separates the property checked from the deployment assumption that remains unverified.
3. Cross-Domain Claim Schema: A unified schema is applied to bridges, rollups, oracles, and intents to compare failure modes such as validation asymmetry, finality mismatch, timing mismatches, and data-availability gaps.
4. Timing-Based Evaluation: The survey introduces a criterion to evaluate whether detection and response mechanisms operate before settlement becomes irreversible, distinguishing between tools that prevent loss and those that only aid forensics.

Results and Findings

1. Network Layer

• Topology Attacks: Eclipse attacks and BGP hijacking remain viable threats. Adversaries can isolate nodes to manipulate network views, enabling double-spending or consensus forking.
• Resource Exhaustion: Denial-of-Service (DoS) has evolved into protocol-level asymmetric resource exhaustion (e.g., BDoS, NURGLE), where attackers exploit mismatches between abstract gas pricing and concrete validator costs to overload the network.
• Insight: Higher-layer protocols often import network liveness assumptions without measuring tail-latency or partition resilience.

2. Data and Cryptographic Layer

• Implementation Gaps: While primitives are theoretically secure, failures often occur in deployment (e.g., nonce reuse, under-constrained zero-knowledge circuits, and signature malleability).
• Privacy Leakage: Pseudonymity is fragile. Heuristic graph clustering and traffic-timing analysis can deanonymize users. Even privacy-preserving protocols (like mixers) fail when user behavior (e.g., repeated transfers) shrinks anonymity sets.
• Insight: There is a gap between cryptographic anonymity (ideal ledger) and operational anonymity (real-world timing, network location, and bridge flows).

3. Consensus and Incentive Layer

• Strategic Mining: Attacks like selfish mining and block withholding exploit rational incentives rather than just resource dominance.
• MEV (Maximal Extractable Value): MEV has evolved into a multi-billion dollar shadow economy. It connects consensus rights (ordering) to application-layer value, enabling sandwich attacks and time-bandit attacks (reorganizing history to steal past MEV).
• Finality as an Economic Interface: Applications often treat probabilistic finality as deterministic, creating insolvency risks when reorganizations occur.
• Insight: Consensus security now requires analyzing economic payloads that make deviation profitable, not just safety/liveness predicates.

4. Application Layer

• Code vs. Logic: Vulnerabilities are split between code-level bugs (reentrancy, arithmetic errors) and financial-logic flaws (flash loan manipulation, oracle dependency).
• Flash Loans: These eliminate capital barriers, allowing attackers to manipulate AMM prices and trigger malicious liquidations in a single transaction.
• Frontend Threats: As protocols harden, attacks migrate to DApp frontends, exploiting signature phishing, address poisoning, and semantic compression in wallet interfaces.
• Insight: Security is a property of code under a specific market and mempool state, not just static bytecode.

5. Cross-Layer and Cross-Domain Security

• Failure Modes: Cross-domain systems (bridges, rollups, oracles) suffer from specific failure modes: validation asymmetry, finality mismatch, timing mismatches, and shared-security overload (e.g., restaking risks).
• Bridge Vulnerabilities: Bridges often concentrate trust in off-chain relayers or small validator sets. A compromise here can bypass source-chain logic entirely.
• Oracle Risks: Oracles are vulnerable to data-source pollution and cross-domain arbitrage, where off-chain market manipulation triggers on-chain deterministic exploits.
• Insight: Cross-domain risk is rarely reducible to a single vulnerable contract; it stems from the composition of mismatched assumptions across trust boundaries.

Significance and Claims

The paper claims to be the first survey to systematically map the "assumption propagation" across the entire Web3 stack. Its significance lies in:

• Unified Model: Providing a unified cross-layer model that explains how local failures cascade into systemic crises (e.g., a bridge exploit starting as weak validation and ending as a liquidity crisis).
• Shift in Focus: Moving the security discourse from isolated component analysis to compositional security, highlighting how the interaction of MEV, consensus, and application logic creates new attack surfaces.
• Future Agenda: Identifying open challenges for the next generation of Web3, including:
  • The "double-edged sword" of LLMs in security (need for better evaluation of AI-generated exploits).
  • Post-quantum migration of cryptography.
  • Compositional security in complex DeFi ecosystems.
  • Restaking risk containment and intent-centric security.
  • The need for reproducibility, standardized datasets, and "time-to-action" metrics in evaluation.

The authors conclude that future defenses must align detection, response, and settlement, and that the research frontier lies in understanding how assumptions fail when imported across different trust domains.