[Paper Review] An Empirical Study of Blockchain System Vulnerabilities: Modules, Types, and Patterns

Xiao Yi, Daoyuan Wu+4 more|arXiv (Cornell University)|Oct 23, 2021

Blockchain Technology Applications and Security71 references4 citations

TL;DR

This paper presents the first empirical study of blockchain system vulnerabilities using a dataset of 1,037 vulnerabilities and 2,317 patches from four major blockchains (Bitcoin, Ethereum, Monero, Stellar). By applying clustering, correlation, and code signature analysis across file, text, and code levels, the authors identify high-risk modules, discover four new blockchain-specific vulnerability types, and extract 21 reusable patterns that detect similar flaws in other blockchains like Dogecoin and Zcash.

ABSTRACT

Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain's system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively identify 1,037 vulnerabilities and their 2,317 patches from 34,245 issues/PRs (pull requests) and 85,164 commits on GitHub. We thus build the first blockchain vulnerability dataset. We then perform unique analyses of this dataset at three levels, including (i) file-level vulnerable module categorization by identifying and correlating module paths across projects, (ii) text-level vulnerability type clustering by natural language processing and similarity-based sentence clustering, and (iii) code-level vulnerability pattern analysis by generating and clustering code change signatures that capture both syntactic and semantic information of patch code fragments. Our analyses reveal three key findings: (i) some blockchain modules are more susceptible than the others; notably, each of the modules related to consensus, wallet, and networking has over 200 issues; (ii) about 70% of blockchain vulnerabilities are of traditional types, but we also identify four new types specific to blockchains; and (iii) we obtain 21 blockchain-specific vulnerability patterns that capture unique blockchain attributes and statuses, and demonstrate that they can be used to detect similar vulnerabilities in other popular blockchains, such as Dogecoin, Bitcoin SV, and Zcash.

Motivation & Objective

• To systematically understand security vulnerabilities in low-level blockchain software systems, which remain underexplored compared to smart contract vulnerabilities.
• To build the first comprehensive blockchain vulnerability dataset by filtering and extracting 1,037 vulnerabilities and 2,317 patches from GitHub issues and pull requests.
• To analyze vulnerabilities at three levels: file-level module categorization, text-level type clustering, and code-level pattern mining using NLP and code signature techniques.
• To discover blockchain-specific vulnerability patterns that can be reused to detect similar flaws in other prominent blockchains.
• To validate the practical impact of findings by responsibly disclosing 20 vulnerabilities to major blockchain projects with confirmed responses.

Proposed method

• Designed a systematic filtering framework to extract vulnerabilities and patches from 34,245 GitHub issues/PRs and 85,164 commits across four blockchains.
• Performed file-level analysis by correlating module paths across projects to identify vulnerable components, especially in consensus, wallet, and networking modules.
• Applied natural language processing and similarity-based sentence clustering to categorize vulnerability descriptions into 11 types, including 4 novel blockchain-specific types.
• Generated code change signatures using syntactic and semantic analysis to cluster patches and extract 21 reusable blockchain-specific vulnerability patterns.
• Validated the patterns by detecting similar vulnerabilities in other blockchains such as Dogecoin, Bitcoin SV, and Zcash.
• Reported all 20 discovered vulnerabilities to vendors via email, GitHub, Discord, and bounty programs, with responses from Dogecoin, Zcash, Horizen, Ravencoin, and Dash.

Experimental results

Research questions

• RQ1 Which blockchain system modules are most prone to vulnerabilities, and what are the underlying reasons for their susceptibility?
• RQ2 What are the dominant types of vulnerabilities in blockchain systems, and are there any novel types unique to blockchain-specific properties?
• RQ3 Can we automatically extract reusable, blockchain-specific vulnerability patterns from patch code fragments that capture both syntactic and semantic characteristics?
• RQ4 To what extent can the identified patterns detect similar vulnerabilities in other major blockchains beyond the studied ones?
• RQ5 How effective are the discovered patterns in identifying real-world vulnerabilities, and what is the response rate from blockchain maintainers to responsible disclosure?

Key findings

• The consensus, wallet, and networking modules are the most vulnerable, each containing over 200 reported issues, indicating they are high-risk components in blockchain systems.
• Approximately 70% of the identified vulnerabilities are of traditional types (e.g., buffer overflow, race condition), while 4 new types—such as 'consensus manipulation' and 'state inconsistency'—are specific to blockchain semantics and architecture.
• The study extracted 21 blockchain-specific vulnerability patterns that model unique blockchain attributes like block validation order, transaction malleability, and state transition logic.
• These patterns successfully detected similar vulnerabilities in other blockchains, including Dogecoin, Bitcoin SV, and Zcash, demonstrating their generalizability and practical utility.
• Vulnerability disclosure to major projects resulted in confirmed responses from 5 out of 6 projects, with Dogecoin committing to fix all five reported issues in a future release.
• The study produced the first publicly available blockchain vulnerability dataset (https://github.com/VPRLab/BlkVulnDataset), enabling future research in blockchain security.