Blockchain security based on cryptography: a review

Dongyang Lyu; Wenwen Zhou; Xiaoqi Li

REVIEW 2 major objections 2 minor 6 cited by

Blockchain security based on cryptography: a review

T0 review · 2 major / 2 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A cryptography-centric review maps blockchain attacks across six layers and proposes defenses for six major threats.

desk verdict A straightforward survey with no new results; the only real question is whether the catalog is accurate and the taxonomy is useful, and that cannot be judged from the abstract. read the letter →

arxiv 2508.01280 v2 pith:N5NDZWIA submitted 2025-08-02 cs.CR

Wenwen Zhou , Dongyang Lyu , Xiaoqi Li This is my paper · ORCID

classification cs.CR

keywords blockchainsecuritycryptographysix-layerarchitecture51%attackdouble-spendingreentrancyreplaySybil

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This review argues that blockchain security is best understood through the cryptographic primitives embedded in the system and organized by a six-layer architecture: data, network, consensus, contract, incentive, and application. It analyzes how each layer is attacked and proposes mitigation or defense methods for major attack types. The paper then drills into six named attacks—51% attack, double-spending, reentrancy, replay, Sybil, and timestamp tampering—and designs countermeasures for each. A sympathetic reader would take away a structured catalog of threats and protections, useful for orienting security work in blockchain systems.

What carries the argument

The organizing device is the six-layer blockchain architecture, with cryptographic primitives—hash functions and digital signatures—as the binding technology that each layer relies on. The paper uses this architecture as a classification scheme: every attack is assigned to a layer, and the attack's principle leads to a corresponding mitigation or defense. This layer-to-attack-to-defense mapping is what carries the review's argument.

What would settle it

A documented blockchain attack that cannot be assigned to any of the six layers, or a known incident in which one of the paper's proposed defenses failed despite being correctly applied, would weaken the central catalog.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that blockchain attacks can be systematically analyzed from a cryptography perspective, with each attack located in one of six layers, and that for the six most prominent attacks there are mitigation or defense solutions worth designing. It introduces the role of hash functions, digital signatures, and related cryptographic techniques in the blockchain, then maps attacks onto the data, network, consensus, contract, incentive, and application layers. The intended contribution is a reference catalog: attack principles, layer placement, and countermeasures in one place.

Load-bearing premise

The review stands or falls on whether the six-layer architecture faithfully captures real blockchain systems and whether the summarized attack mechanisms and defenses accurately represent the literature.

Editorial extensions

If this is right

Practitioners can use the six-layer map to locate a given threat quickly and identify the layer where a defense should be implemented.
If the proposed countermeasures are sound, 51% and Sybil attacks would be countered primarily at the consensus and network layers, through mechanisms such as increased confirmation requirements and identity verification.
Reentrancy and replay attacks would be handled at the contract and application layers, using state-check patterns and transaction-uniqueness mechanisms.
The paper's summary of core unsolved problems points future research toward cryptographic strengthening, such as more resilient consensus and signature schemes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A layered taxonomy tends to understate cross-layer attacks, where an adversary combines weaknesses in, say, the network and consensus layers; testing the catalog against known real-world incidents would reveal how much coverage it actually provides.
The cryptography-first framing suggests the same attack names will shift meaning as the underlying primitives change: post-quantum hashing and signatures would alter several of the proposed defenses even if the layer assignment stays fixed.
One concrete extension would be to score each countermeasure by deployment cost and failure history, turning the catalog into a decision tool rather than a classification.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This is a review paper, so "novelty" is beside the point. The useful question is whether it gives readers a reliable map of blockchain attacks and defenses. Based on the abstract, I can't confirm that, but nothing here is disqualifying either.

What the paper does well is organization. The six-layer architecture (data, network, consensus, contract, incentive, application) is a clear way to structure a threat survey, and listing six major attacks with proposed mitigations gives practitioners something actionable. The abstract is well-written and internally consistent. If the full text lives up to that structure, this could be a solid teaching reference.

The soft spots are real but not fatal. First, the "perspective of cryptography" is stretched. Reentrancy is a smart-contract execution bug, and timestamp tampering is a protocol-level manipulation; neither is a failure of a cryptographic primitive. That's fine for a broad security survey, but the framing should be honest about that. Second, the claim of comprehensiveness is unverifiable from the abstract alone. The survey could be superficial, with cherry-picked references or misrepresented attacks. Third, the six-layer model is a convenient convention, not a universal standard; it can force awkward categorizations. None of these are enough to reject the paper, but they are exactly what a referee should check.

The stress-test note is right: no objection can be raised from the abstract alone, and the main risks are external accuracy and forced categorization.

My take: this paper deserves a serious referee, not a desk reject, provided the full text is in hand. A referee should spot-check the cited attacks, see whether the six-layer model is applied honestly, and flag the scope issue about cryptography. If those checks pass, it's a useful survey for students and practitioners who want a structured map of blockchain security. I would not cite it in my own research unless I needed a broad background reference, and I'd want to read the full text first. But I'd bring it to a reading group focused on blockchain security education.

Recommendation: send it to peer review, but make sure the referee knows the article is a survey and should be judged on accuracy and usefulness, not novelty.

Referee Report

2 major / 2 minor

Summary. This manuscript is a survey paper that aims to analyze blockchain security from a cryptography-oriented viewpoint. The abstract indicates that the paper first reviews cryptographic primitives used in blockchain (hash functions, digital signatures, and related techniques), then organizes blockchain attacks by a six-layer architecture (data, network, consensus, contract, incentive, and application layers), and finally details the attack principles and mitigation/defense strategies for six specific attacks: 51% attack, double-spending, reentrancy, replay, Sybil, and timestamp tampering. The paper closes with a discussion of open core problems and future directions for blockchain security.

Significance. If the promises in the abstract are fulfilled, the paper would provide a useful structured catalog of blockchain attacks and defenses for practitioners, especially as a cryptography-oriented entry point into the security literature. The six-layer taxonomy and the focused treatment of six named attacks could serve as a reference for readers seeking a broad but organized overview. However, because the review's value depends on accurate representation of prior literature and on the coherence of the proposed taxonomy, these aspects cannot be assessed from the abstract alone. The manuscript does not appear to introduce new algorithms or formal results; its contribution would be one of synthesis and organization rather than novel technical derivation.

major comments (2)

[Abstract] The central claim of providing a 'comprehensive' analysis of blockchain attacks from the perspective of cryptography is not verifiable from the abstract alone. As a survey, the manuscript's contribution rests on the accuracy of its source summaries and the completeness of its coverage; neither can be checked without access to the full text and reference list. I therefore cannot assess whether the promised comprehensiveness is actually achieved.
[Abstract] The abstract lists reentrancy attack as one of the six attacks to be analyzed 'from the perspective of cryptography.' Reentrancy is fundamentally an execution-order vulnerability in smart-contract code rather than a failure of a cryptographic primitive or protocol. The paper's framing needs to clarify whether 'cryptography perspective' is meant broadly to include protocol- and code-level security of blockchain systems, or whether reentrancy is included as a special case. Without this clarification, the stated scope could mislead readers about the survey's thematic coherence.

minor comments (2)

[Abstract] There are minor stylistic and typographical issues, such as inconsistent capitalization of 'Timestamp Tampering attack' versus 'Sybil attack' and the phrase 'non-tamperable' which could be more conventionally rendered as 'tamper-resistant' or 'tamper-evident.' These do not affect the substance.
[Abstract] The abstract does not indicate the publication window or coverage criteria of the literature surveyed. A sentence specifying the time span and sources (e.g., journals, conference proceedings, standard databases) would help readers calibrate the survey's comprehensiveness.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found in abstract-only review; no derivation chain to be circular.

full rationale

This paper is presented as a review, not as a derivation or prediction. The available evidence is only the abstract, which describes qualitative analysis of blockchain attacks organized by a six-layer architecture and summarizes mitigation strategies for six named attacks. There are no equations, no fitted parameters, no self-citations invoked as load-bearing premises, and no claimed result that reduces by construction to an input. A survey restating established material is not circular in the sense defined here. The abstract does not disclose any internal mathematical or statistical derivation that could be self-referential. Without the full text, one cannot assess the fidelity of the cited attack classifications or the validity of the six-layer model, but neither concern constitutes circularity. Therefore, no specific circular step can be identified, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

This is a review paper, so it introduces no free parameters or invented entities. It relies on standard domain assumptions such as the six-layer blockchain model and the security of cryptographic primitives.

assumptions (2)

domain assumption Blockchain systems can be decomposed into six layers: data, network, consensus, contract, incentive, and application.
The entire review is structured around this layer model, asserted in the abstract without further justification.
domain assumption Cryptographic primitives (hash functions, digital signatures) are secure under standard assumptions.
The review's proposed defenses rely on the security of these primitives, which is standard but unproved in the paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Blockchain security based on cryptography: a review." pith.science (2026). https://pith.science/paper/N5NDZWIA

@misc{pith2026250801280,
  author       = {Pith},
  title        = {Pith review of: Blockchain security based on cryptography: a review},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N5NDZWIA}},
  note         = {Machine review of arXiv:2508.01280}
}

read the original abstract

As an emerging service framework built by combining cryptography, P2P network, consensus mechanism and innovative contract technology, blockchain has been widely used in digital finance, data sharing, message traceability and electronic evidence preservation because of its decentralised, non-tamperable and transaction traceability. However, with the complex and changeable application scenarios of blockchain technology and the continuous enhancement of blockchain attack technology, the security of the blockchain system has been seriously threatened, dramatically affecting the development and application of blockchain technology. This paper aims to analyse the attacks on blockchain from the perspective of cryptography. Firstly, from the cryptography technology in the blockchain, the principle of hash functions, digital signatures, and other technologies, as well as their role in the blockchain, are introduced. Then, based on the six-layer architecture of the blockchain, the attacks on the data layer, the network layer, the consensus layer, the contract layer, the incentive layer and the application layer are analysed, and the methods to mitigate or resist the attacks are proposed. Secondly, the attack principles of 51% attack, Double-Spending attack, Reentrancy attack, Replay attack, Sybil attack and Timestamp Tampering attack were analysed, and the mitigation or defence solutions for these six attacks were designed. Finally, the core problems to be solved in blockchain technology are summarised, and the future development of blockchain security technology is projected.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 6 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

From Viral to Void: Multi-Dimensional Behavioral and Contractual Analysis for Rug Pull Identification
cs.CR 2026-08 reject novelty 4.0 of 10

An MLP with SMOTE and Focal Loss is claimed to detect rug pull tokens with 0.927 accuracy, but the ground truth labels are partly randomly generated.
Fingerprint-Driven Automation: Coupling Reconnaissance with POC Verification
cs.CR 2026-07 conditional novelty 4.0 of 10

Deepscan couples web reconnaissance output to vulnerability-verification PoC execution through a fingerprint-matching pipeline and is tested on CTF and Vulhub environments.
Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing
cs.CR 2026-07 conditional novelty 4.0 of 10

Code slicing plus a knowledge base raises the LLM's positive-label rate from 73.8% to 97.1% on 450 NFT contracts, an effect not validated against ground truth.
Immutable Digital Recognition via Blockchain
cs.CR 2025-08 reject novelty 3.0 of 10

A hybrid blockchain badge system with centralized certification and decentralized issuance is described, but remains a conceptual design with no implementation or validation.
A Comprehensive Evaluation and Practice of System Penetration Testing
cs.CR 2025-10 conditional novelty 2.0 of 10

A survey-style paper that proposes a weighted tool-scoring rubric, then demonstrates routine host and web penetration tests on vulnerable virtual machines.
Security Analysis of Ponzi Schemes in Ethereum Smart Contracts
cs.CR 2025-10 reject novelty 2.0 of 10

A known four-way classification of Ponzi smart contracts is restated and run through the Mythril scanner on a few examples, while the claimed 500-contract batch analysis is asserted without releasing data or results.

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.