1. Introduction

The categorization of blockchain attacks remains pivotal in both understanding and mitigating threats that jeopardize the robustness and transparency of blockchain networks. While blockchain technology is lauded for its decentralization and heightened security, it isn't immune to sophisticated adversarial exploits. Ensuring the resilience of these networks demands a thorough understanding of the multifaceted attacks targeting its distinct layers and components, from meddling with transactional data and smart contracts to disrupting consensus mechanisms or infringing on user privacy. In this analysis, we venture into the variegated threat landscape, dissecting attack methodologies and the subsequent defensive strategies implemented to shield the blockchain's intricate ecosystem. Grasping these classifications is quintessential for blockchain's ongoing refinement and fortified security. To provide a holistic perspective, three prominent classification paradigms have been identified, each of which will be juxtaposed to discern their inherent features and the nuances that differentiate them.

2. Analysis of Existing Surveys

2.1. Classification by Layer of Attack Occurrence

Within the multifaceted architecture of blockchain technology, six distinct layers emerge: the data layer, network layer, consensus layer, incentive layer, contract layer, and application layer. A comprehensive study by Hameed et al. delves into classifying applications within the realm of 'blockchain 4.0'. This examination not only stratifies attacks by their pertinent blockchain layers but also introduces their countermeasures [1]. Key facets, such as the nature of the attack, objectives of the attacker, ensuing security breaches, exploited vulnerabilities, and targeted applications, are comprehensively detailed in the study. The data layer showcases seven prominent attacks: Malleability attack [2], Time Hijacking, Quantum, Replay attack [3], Modification, Fault injection, and the Upgraded attack. Delving into the network layer, ten distinct threats surface, including the 51% attack [4], DDoS [5], Eclipse attack [6], Sybil attack [7], BGP Hijacking [8], Phishing, Liveness [9], Routing [10], Man-in-the-middle (MITM), and Blockchain ingestion. The consensus layer, though more limited, cites three main threats: Double spending [11, 12], Stake bleeding, and Cryptojacking. The incentive layer brings forth threats such as Selfish mining [13], Bribery, Refund, Block withholding, and Balance attacks. Contract layer breaches span eight types, featuring Integer overflow, Re-Entrancy, Short address, Criminal smart contract, Transaction ordering dependency [14], Timestamp dependency, Gas cost, and Mishandling exceptions. Lastly, the application layer identifies ten attacks, including Location cheating, Ballot stuffing, Badmouthing, Guess, Chosen ciphertext [15], Impersonation, Linking [16], Collusion, Private key compromise [17], and Money laundering [18, 19].

While discerning the nature, objectives, and other facets of these attacks, it becomes evident that there's no singular connecting thread. Each attack emerges with its unique characteristics. However, various countermeasures can be employed across different threats. Notably, digital signatures, consensus algorithms, and cryptographic measures appear recurrently as solutions. A consistent observation is that both digital signatures and cryptographic techniques tend to be deployed against attacks capitalizing on breaches of integrity.

2.2. Classification Based on Attack Models Affecting Blockchain Security Modules

Table 1. Attack models and attacks [20].

The hash based attack only happened when attacker have over 51% hash value or mining power. The centralization attack would break the decentralization and make things look like centralization. The selfish mining attack is not obviously to conclude into the centralization attack, if keeping the block without sharing with others is a kind of behavior that break the decentralization, the stubborn would also be centralization attack in this taxonomy. Traffic attack would cause denial of service because of huge amount of information are filled into the network. Network level attack in this survey was not describing the network layer of blockchain, the illegal usage of accounts and authorities or the illegal occupation of hardware and software to threaten network. So some network layer attack is not include in this network level attack just like the 51% attack [21]. The injection attack described the vicious inputs into the program by unauthorized person. Integrity attack aimed to change the data, but due to the unique mechanism of blockchain, change of previous data cannot be realized. The Malware attack was classified to the integrity attack, this attack is a common attack that not only occurred in blockchain. As shown in Table 1.

Table 2. Classification method and attack characters [22].

The private key leakage attack was that the attacker can copy the keys when the same nonces or keys were used more than once [21]. This survey had given the solution to each attack and all of them were independent. The attacks based on the applications of blockchain were not mentioned widely in this taxonomy and the attacks based on smart contract were not discussed. As shown in Table 2.

2.3. Classification Considering Over-Layer Attacks

Expanding upon the concept of blockchain layers, Liu, H et al. introduced an enhanced taxonomy that presents a more functional classification. This survey offers a nuanced and comprehensive categorization, with particular emphasis on areas where over-layer attacks are most prevalent: the network, consensus, and incentive layers. Consequently, these three layers were amalgamated for a more holistic examination.

In the data layer, the taxonomy focuses on three distinct objectives of the attackers. Meanwhile, within the combined realm of the network, consensus, and incentive layers, the classification delves into four specific behaviors exhibited by attackers, two main objectives they aim to achieve, and two categories of victims they target. The contract layer's classification identifies two prevalent types of bugs responsible for the majority of attacks in this domain. For the application layer, two primary factors precipitating attacks are outlined. Table 3 presents a detailed overview of these classification methods, along with potential mitigation strategies for each type of attack. This refined taxonomy not only facilitates easier prediction and prevention of emerging threats but also ensures that the majority of attacks can be captured under this framework. The only exception noted is malware-based attacks, which stand outside this classification's purview.

Table 3. Countermeasures [23].

3. Comparison of Existing Classifications

Hameed et al classified blockchain attack by blockchain layers, and the taxonomy invented by Liu [21], H et alwas based on blockchain layers. The advantage by doing this is that the classification is comprehensive enough to contain all of the blockchain attacks. As the classification by layers was over-broadly and other properties like attack nature listed in table 2 were in low correlation, it was hard to found new attacks in a short term.

Classification based on attack models affecting blockchain security moduleshas given the detailed definition of each classified attack (hash based attack, centralization attack, etc.), which was not too broad and made sure each specific attack (selfish mining attack, eclipse attack, etc.) in one class have common point or strong correlation. This made it easier to find new attacks. For example, it is more likely to find new attacks with similar character that they are all hash-based attack than finding new attacks that they are in the same layer. However this taxonomy was not friendly to forecast the countermeasures, the survey gave each attack unique method to solve without consider the correlation of countermeasures. Moreover, this taxonomy was the least comprehensive compared with other two taxonomies, the most intuitive example was that the smart contract layer attack was not mentioned in this classification.

Classification considering over-layer attacks gave the same countermeasures to each objectives, behaviors, etc. This would make it more efficient when finding the countermeasure of new attacks.

4. Proposed Classification Method and Discussion

By comparing three taxonomies, the classification considering over-layer attacks would be the best to conclude all blockchain attacks, only malware attack was not in this range. Not only the over-layer attacks were considered, the categories were classified in a strong relevance. This taxonomy better described common characteristics of attacks that belongs to the same category of attack, the process to classify new attacks would be easier and more helpful on forecast the new attacks and the countermeasures of new attacks. The future challenge might be the over-layer attacks which contain data layer attack and application layer, this kind of over-layer attack did not discuss in this taxonomy because of the lack of examples. Also, the taxonomy with higher correlation between attacks would be a direction of future work.

5. Conclusion

Blockchain attacks vary widely, yet discernible patterns and correlations emerge upon closer inspection. Studying these attacks in isolation, without seeking their interrelatedness, may impede the understanding and mitigation of newer threats. This paper presents three distinct taxonomies to classify these threats. The initial taxonomy delineates attacks based on the blockchain layers they target, namely: data, network, consensus, incentive, contract, and application layers. A more intricate classification follows, which categorizes attacks by the specific security modules they compromise within the blockchain. This includes hash-based attacks, centralization threats, traffic disruptions, network level offenses, injection schemes, integrity compromises, and private key leakages. The third and final taxonomy shifts its focus to over-layer attacks, emphasizing the intrinsic relationships between different threats. Here, data layer attacks are categorized by attacker objectives. The network, consensus, and incentive layers are differentiated by attacker behaviors, their objectives, and victim types. The contract layer classifies attacks based on specific bug types, while the application layer's threats are sorted by the underlying factors prompting the attacks. By pinpointing the critical aspects of these classification methodologies, this paper offers fresh perspectives on devising newer, more encompassing taxonomies. Such comprehensive approaches can play an instrumental role in enhancing the broader understanding of blockchain threats and their mitigation.