A Taxonomy of Blockchain Threats and Vulnerabilities

Alkhalifah, Ayman; Ng, A. W. M; Kayes, A. S. M.; Chowdhury, Jabed; Alazab, Mamoun; Watters, Paul A.

doi:10.20944/preprints201909.0117.v1

Cited by 14 publications

(6 citation statements)

References 1 publication

(1 reference statement)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In other words, consensus algorithms emerged as an exciting and prominent theme for researchers, with numerous studies exploring their intricacies and implications. 4,33,44,67,69,72,75 Additionally, there has been significant attention given to the smart contract vulnerabilities within the Ethereum ecosystem in studies. 37,43,65,66,70,73,75 Another prevalent theme among researchers was the exploration of vulnerabilities and attacks related to the blockchain concept.…”

Section: Limitationsmentioning

confidence: 99%

“…4,33,44,67,69,72,75 Additionally, there has been significant attention given to the smart contract vulnerabilities within the Ethereum ecosystem in studies. 37,43,65,66,70,73,75 Another prevalent theme among researchers was the exploration of vulnerabilities and attacks related to the blockchain concept. 37,43,65,75 While the blockchain layer received moderate attention in the reviewed taxonomic literature.…”

Section: Limitationsmentioning

confidence: 99%

“…37,43,65,66,70,73,75 Another prevalent theme among researchers was the exploration of vulnerabilities and attacks related to the blockchain concept. 37,43,65,75 While the blockchain layer received moderate attention in the reviewed taxonomic literature. 37,42,65,76,77 More specifically, since 2017, majorly 22 taxonomy studies were identified related to Blockchain and hardly any of them focused on the endpoint concept and components.…”

Section: Limitationsmentioning

confidence: 99%

See 2 more Smart Citations

A taxonomy of endpoint vulnerabilities and affected blockchain architecture layers

Noor,

Mustafa

2024

Concurrency and Computation

View full text Add to dashboard Cite

Blockchain technology has gained significant attention and adoption due to its decentralized nature, and promising secure and immutable transactions. The interpretation of Blockchain's components has been presented in an innovative manner, illustrating the features they enable or manage. However, its networks do not appear so immune to vulnerabilities like any other technological system. Among the typical weaknesses, endpoint vulnerabilities refer to weaknesses in the endpoints that interact with the blockchain network. They pose a significant risk to the security and integrity of the entire system. These vulnerabilities can affect blockchain networks including smart contract vulnerabilities, wallet vulnerabilities, and communication vulnerabilities. In view of the absence of any viable taxonomic description and associated value, we attempted a novel comprehensive classification of endpoint vulnerabilities. The proposed taxonomy is designed to logically categorize and classify the various endpoint vulnerabilities through a pictorial representation. It encompasses wallet vulnerabilities, malware, cryptojacking and human negligence. Additionally, this paper proposes a novel approach to mapping endpoint vulnerabilities to the blockchain abstract layer. It gives a unique way to study the vulnerabilities and layers' relation. Finally, the corresponding violated principles behind the vulnerabilities have been identified and indicated. By providing a structured taxonomy of endpoint vulnerabilities, this paper aims to enhance the understanding of the security challenges associated with blockchain applications. By understanding and addressing the taxonomy of endpoint vulnerabilities, blockchain practitioners and researchers can enhance blockchain networks' overall security and trustworthiness, paving the way for broader adoption and utilization of this transformative technology. It may have implications in terms of identifying, linking, developing control, and finally mitigating endpoint vulnerabilities in the rapidly changing environment.

show abstract

Section: Limitationsmentioning

confidence: 99%

Section: Limitationsmentioning

confidence: 99%

Section: Limitationsmentioning

confidence: 99%

See 1 more Smart Citation

A taxonomy of endpoint vulnerabilities and affected blockchain architecture layers

Noor,

Mustafa

2024

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…Another stackbased model was proposed by Zhang et al [293] and consists of six layers, where the layers stand for the application, contract, incentive, consensus, network, and a data layer. The works of Alkhalifah et al [294] and Zhu et al [295] feature groupings consisting of five (network, consensus, mining pool, smart contract, and client vulnerabilities) and four (data privacy, data availability, data integrity, and data controllability attacks) categories, respectively. Natoli et al [296] focus mainly on the consensus layer but include some network-layer attacks as well (e.g., eclipse attacks and BGP hijacking).…”

Section: B Research With Layered or Stacked Categorizationmentioning

confidence: 99%

The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses

Homoliak

Venugopalan

Reijsbergen

et al. 2021

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

Blockchains are distributed systems, in which security is a critical factor for their success. However, despite their increasing popularity and adoption, there is a lack of standardized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and extend the knowledge about the security and privacy aspects of blockchains and contribute to the standardization of this domain.We propose the security reference architecture (SRA) for blockchains, which adopts a stacked model (similar to the ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the network layer, (2) the consensus layer, (3) the replicated state machine layer, and (4) the application layer. At each of these layers, we identify known security threats, their origin, and countermeasures, while we also analyze several cross-layer dependencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific version of the threat-risk assessment standard ISO/IEC 15408 by embedding the stacked model into this standard. Finally, we provide designers of blockchain platforms and applications with a design methodology following the model of SRA and its hierarchy.

show abstract

“…Ethernaut [41] is a wargame focused on Ethereum smart contract vulnerabilities in Solidity. There are several good articles discussing blockchain security [2,17,46] as well.…”

Section: Education and Further Readingmentioning

confidence: 99%