Blockchain Weakness Classification (BWC)
This document provides a hierarchical classification of weaknesses and vulnerabilities found in blockchain and decentralized application (DApp) ecosystems. The BWC framework covers risks from off-chain infrastructure to low-level smart contract code.
Table of Contents
- Blockchain Weakness Classification (BWC)
- Table of Contents
- BWC 1.0: Ecosystem & Off-Chain Risks
- BWC 2.0: Access Control Vulnerabilities
- BWC 3.0: Smart Contract Logic & State Manipulation
- BWC 4.0: Input & Data Validation Vulnerabilities
- BWC 5.0: Economic & Game-Theoretic Vulnerabilities
- BWC 6.0: Arithmetic & Numeric Vulnerabilities
- BWC 7.0: Low-Level & EVM-Specific Vulnerabilities
- BWC 7.1: Unchecked Return Values
- BWC 7.2: Unsafe Storage & Memory Handling
- BWC 7.2.1: Unsafe Storage Use
- BWC 7.2.2: Deleting Dynamic Data in Structs
- BWC 7.2.3: Broken EIP-1153 Transient Storage Use
- BWC 7.3: Weak Cryptographic Primitives
- BWC 7.3.1: Weak Random Number Generation
- BWC 7.3.2: Malleable ecrecover
- BWC 7.3.3: Second Pre-image Attacks
- BWC 7.3.4: Forgetting to Blind Polynomials in ZK Protocols
- BWC 7.4: EVM Interpretation Issues
- BWC 7.4.1: Incorrect VM Gas Charges
- BWC 7.4.2: Two-Parser Bugs
- BWC 7.1: Unchecked Return Values
- BWC 8.0: Denial of Service (DoS) Vulnerabilities
- BWC 9.0: Emerging Technology Vulnerabilities
- BWC 10.0: Network & Consensus Evolution Attacks
- BWC 11.0: Privacy & Regulatory Attack Vectors
BWC 1.0: Ecosystem & Off-Chain Risks
Vulnerabilities that exist outside the core blockchain logic but are critical to the security of the overall system. Every off chain component you incorporate add to you attack surface.
BWC 1.1: Identity & Key Management Failures
BWC 1.1.1: Compromised Device/OS
Vulnerabilities in user devices or operating systems leading to private key theft, session hijacking, or malicious transaction approvals
Device Exploit Methods
-
Malware laced PDF files and ZIP files
-
Fake Telegram Manual Verification leading to user running malware
-
Running untrusted code.
-
Mitigation:
- Separate Signing devices.
- Wipe Device after 3 months. Assume Device is compromised after every 3 months.
- Enable two-factor authentication.
- Keep software up-to-date.
- Avoid all attachments and links.
BWC 1.1.2: Private Key Leakage
Exposure of private keys through insecure storage, transmission, or handling.
- Mitigation:
- Always use Multi signature. With multiple Signers. Don't Use fancy UI(safe). Verify Calldata manually.
BWC 1.1.3: Insider Threat
Malicious actions by team members or contractors with privileged access.
- Mitigation:
- Privilege Separation.
- Enhanced KYC.
- Need to Know Access Control.
- On site Verification for remote workers.
BWC 1.1.4: Wrench Attacks
Refers to a situation where attackers bypass technical security entirely and instead use coercion, threats or physical violence such as kidnapping to force victims to surrender their passwords or assets.
- Mitigation:
- Decoy Wallets.
- Family Security Protocols.
- Avoiding Identity Exposure.
- Keep you circles tight and cautious.
- Nuke passwords.
BWC 1.1.5: Vulnerable Vanity/Address Generators
Flaws in tools used to generate custom addresses, potentially leading to predictable private keys.
- Mitigation:
- Avoid vanity address generators. It's vanity.
BWC 1.2: Social Engineering & Deception
BWC 1.2.1: Social Engineering Exploits
Tricking users into revealing sensitive information or transferring funds.
- Recruitment Scam
- Investment Scam/Pig Butchering Scam
- Crypto Recovery Scam
- Fake AirDrop Scam
- Address Poisoning Scam
- DeepFakes -Fake celebrity endorsements to promote investments -Deepfake-Impersonated Zoom Meetings
- Google Search Ad Phishing Attack
- Email Phishing Attacks: New Login of Google Account, New login of X account.
BWC 1.2.2: SIM Swap Attack
Taking control of a user's phone number to bypass two-factor authentication.
BWC 1.2.3: Front-End Hijack/Spoofing
Modification of DApp interfaces to trick users into approving malicious transactions.
- Mitigation:
- Bookmark trusted URLs.
- Verify URL from multiple Sources.
- Perform a trial run first.
BWC 1.2.4: Fake Wallet Applications
Malicious applications impersonating legitimate ones to steal credentials and funds.
BWC 1.2.5: Malicious Browser Extensions
BWC 1.2.6: Malicious RPC Provider
BWC 1.3: Infrastructure & Supply Chain Integrity
BWC 1.3.1: Compromised Validator/Node
Validators who control block production are compromised, leading to transaction censorship, reordering, or other malicious activities.
BWC 1.3.2: DNS Hijacking Attacks
Redirecting traffic from legitimate websites to fraudulent phishing sites by compromising DNS servers.
BWC 1.3.3: Compromised Communication Platforms
Hijacking of official Discord, X (Twitter), or email accounts to spread misinformation or phishing links.
BWC 1.3.4: Supply Chain Attacks
Compromises in the development pipeline, dependencies, or deployment processes.
- Mitigation:
- Create a Software Bill Of Materials Check. Ensuring that dependencies and packages undergo rigorous security screening.
- Source Code Analysis Check.
BWC 1.3.5: Ruggable Contract Design
Architectural design that intentionally allows malicious developers to steal user funds.
- Mitigation:
- Verify the source code.
BWC 1.4: Nation-State & Advanced Persistent Threats (APTs)
BWC 1.4.1: Coordinated Multi-Vector Attacks
BWC 1.4.2: State-Sponsored Infrastructure Compromise
BWC 1.4.3: Geopolitical Economic Warfare
BWC 1.4.4: Cross-Jurisdictional Regulatory Exploitation
BWC 2.0: Access Control Vulnerabilities
Failures in how permissions and privileges are managed and enforced within a smart contract.
BWC 2.1: Missing or Improper Authorization
BWC 2.1.1: Missing Access Control
Failure to implement proper authorization checks on sensitive functions.
BWC 2.1.2: tx.origin Authorization
Using the volatile tx.origin address instead of the stable msg.sender for authorization checks.
BWC 2.2: Flawed Permission Management
BWC 2.2.1: Lingering Approvals
Token approvals that remain active beyond their intended lifespan, creating security exposures.
BWC 2.2.2: Misconfigured Proxy
Errors in proxy contract setup leading to upgrade vulnerabilities, function collisions, or unauthorized access.
BWC 2.2.3: Untrusted Arbitrary Calls
Functions that allow calling arbitrary external contracts without proper security measures or validation (e.g., unsafe delegatecall).
BWC 2.2.4: Cross Contract Untrusted Arbitrary Calls
This vulnerability occurs when a contract executes a call to an external contract using untrusted or user-supplied calldata, but the vulnerability is only exposed through a series of interactions between multiple contracts. An attacker can exploit this by crafting malicious calldata that causes a trusted contract to perform an unauthorized action on their behalf against another contract in the system. This is particularly dangerous when the exploited contract has special privileges on the target contract.
BWC 2.3: Callback & Hook Vulnerabilities
BWC 2.3.1: Missing Validation in Flashloan Callbacks
Inadequate verification in callback functions that can be exploited during flash loan execution.
BWC 3.0: Smart Contract Logic & State Manipulation
Flaws in the business logic, state machine, and core functionality of a contract.
BWC 3.1: Reentrancy Attacks
BWC 3.1.1: Standard Reentrancy
Calling back into a vulnerable contract before its state updates are completed, allowing for multiple withdrawals or other exploits.
BWC 3.1.2: ERC-777 Reentrancy
Exploiting token hooks in the ERC-777 standard to reenter contracts during a tokensToSend or tokensReceived call.
BWC 3.1.3: Read-only Reentrancy
Reentering a contract to read state that is inconsistent or in the process of being changed, leading to logic errors.
BWC 3.1.4: Cross-Contract Reentrancy
A Cross-Contract Reentrancy differs from standard reentrancy in that it arises when a reentrancy occurs in a complex and often unforeseen call chain. This can happen when Contract A calls Contract B, which calls Contract C, which in turn calls back into Contract A or another related contract in an unexpected way, exploiting the system's state before the initial function call has completed.
BWC 3.2: Flawed State Management
BWC 3.2.1: Improper Initialization
Contracts deployed with incorrect initial state, missing initialization, or unset flags.
BWC 3.2.1.1: Proxy/Contract Initialization Front-Running
A specific type of front-running where an attacker observes a transaction that deploys a contract and immediately sends a transaction to initialize the contract with their own address as the owner. This is possible when the contract's initialization function is public and does not have proper access control.
BWC 3.2.2: Faulty Contract Checks
Logic errors in mechanisms that check the status or code of other contracts.
BWC 3.2.3: Forced Ether Balance
Manipulating a contract's Ether balance to disrupt logic that depends on address(this).balance.
BWC 3.2.4: Self Transfers and Transaction Timing Attacks
Exploiting state changes caused by transfers to the same address or by the ordering of transactions.
BWC 3.2.5: Broken State Adjustment
Errors in logic that is supposed to modify or correct contract state.
BWC 3.3: Token Standard & Logic Issues
BWC 3.3.1: Double EntryPoint Tokens
Contracts where a native token also has an ERC-20 representation, potentially leading to inconsistent state or accounting.
- *Example: Celo, Polygon (MATIC), zkSync ERA (ETH)*
BWC 3.3.2: Fee-on-Transfer & Rebase Accounting Issues
Incorrect handling of tokens that deduct fees during transfers or have an elastic supply (rebase tokens).
BWC 3.3.3: Improper Handling of Native Tokens
Errors in managing the blockchain's native currency (e.g., ETH, BNB) alongside other tokens.
BWC 3.3.4: Weird ERC20 Behaviors
Failure to handle non-standard implementations of the ERC20 interface, such as tokens without return values.
BWC 3.4: Governance & System Logic
BWC 3.4.1: DAO Governance Attacks
Exploiting voting mechanisms, proposal processes, or timelocks to pass malicious proposals.
BWC 3.4.2: Flawed Reward Systems
Exploitable incentive structures or reward calculation errors.
BWC 3.4.3: Bridge Status Mismatch
Inconsistencies between cross-chain bridge endpoints leading to fund loss or transaction failure.
BWC 4.0: Input & Data Validation Vulnerabilities
Weaknesses related to processing untrusted external data and inputs.
BWC 4.1: Insufficient Input Validation
Failure to properly sanitize or validate transaction inputs, enabling malicious or unexpected data to be processed. This includes missing zero-address checks.
BWC 4.2: Oracle Manipulation & Data Integrity
BWC 4.2.1: Insufficient Oracle Validation
Inadequate verification of external data feeds (e.g., price feeds), allowing manipulation of critical on-chain information.
BWC 4.2.2: Oracle Manipulation
Actively compromising or gaming the data feeds that DApps rely on for external information.
BWC 4.3: Cryptographic Signature Flaws
BWC 4.3.1: Missing Signature Validation
Improper or missing verification of cryptographic signatures, enabling transaction forgery.
BWC 4.3.2: Incomplete Signature Schemes
Flaws in the implementation of transaction signing cryptography.
BWC 4.4: Address Spoofing in Meta-Transactions
Exploitation of meta-transaction frameworks like ERC-2771 by impersonating authorized forwarder addresses.
BWC 5.0: Economic & Game-Theoretic Vulnerabilities
Flaws that can be exploited by rational economic actors to manipulate markets or extract value unfairly.
BWC 5.1: Miner Extractable Value (MEV) Attacks
BWC 5.1.1: Front-Running
Placing a transaction in the queue before a known future transaction to exploit the order of execution.
BWC 5.1.2: Back-Running
Placing transactions immediately after targeted transactions to exploit their effects.
BWC 5.1.3: Sandwich Attacks
Combining front-running and back-running to trap a victim's transaction and extract value.
BWC 5.2: Price & Liquidity Manipulation
BWC 5.2.1: Price Manipulation
Artificially influencing asset prices through market actions to exploit DApp mechanisms.
BWC 5.2.2: First Deposit / Inflation Attack
Exploiting initialization conditions in liquidity pools or staking systems to claim a disproportionate share of rewards.
BWC 5.2.3: Hardcoded Price
Using a fixed, hardcoded price for an asset instead of a dynamic feed, creating an easily exploitable arbitrage opportunity.
BWC 5.3: Transaction Execution Risks
BWC 5.3.1: Lack of Slippage Control
Missing or insufficient protection against price movement between the time a transaction is submitted and when it is executed.
BWC 6.0: Arithmetic & Numeric Vulnerabilities
Errors in mathematical calculations and data type handling.
BWC 6.1: Integer Overflow & Underflow
Exceeding the maximum or minimum value for an integer type, causing it to wrap around.
BWC 6.2: Precision Loss & Rounding Errors
Issues arising from integer division, order of operations (division before multiplication), or inconsistent decimal scaling.
BWC 6.3: Unsafe Type Casting
Improper or unchecked conversion between numeric types, potentially leading to overflow or precision loss.
BWC 6.4: Calculation Errors
General mathematical mistakes in contract logic, such as in liquidity or reward formulas.
BWC 6.5: Inconsistent Scaling Bugs
Errors in managing precision during unit conversion between different tokens or values.
BWC 7.0: Low-Level & EVM-Specific Vulnerabilities
Vulnerabilities related to the specifics of the Ethereum Virtual Machine (EVM), cryptographic primitives, and data handling.
BWC 7.1: Unchecked Return Values
Failing to verify the success status of external calls, leading the contract to incorrectly assume success.
BWC 7.2: Unsafe Storage & Memory Handling
BWC 7.2.1: Unsafe Storage Use
Improper handling of contract storage slots, leading to collisions or data corruption.
BWC 7.2.2: Deleting Dynamic Data in Structs
Memory corruption from improper deletion of complex data structures.
BWC 7.2.3: Broken EIP-1153 Transient Storage Use
Misuse of transient storage, which can enable reentrancy or state corruption due to improper clearing.
BWC 7.3: Weak Cryptographic Primitives
BWC 7.3.1: Weak Random Number Generation
Using predictable or manipulable sources of on-chain entropy (e.g., block.timestamp).
BWC 7.3.2: Malleable ecrecover
Vulnerabilities in signature recovery allowing for signature reuse or forgery.
BWC 7.3.3: Second Pre-image Attacks
Cryptographic vulnerabilities allowing for collisions in hash functions used by the contract.
BWC 7.3.4: Forgetting to Blind Polynomials in ZK Protocols
Weaknesses in zero-knowledge proof implementations that expose underlying data.
BWC 7.4: EVM Interpretation Issues
BWC 7.4.1: Incorrect VM Gas Charges
Logic that becomes vulnerable due to miscalculations of transaction execution costs.
BWC 7.4.2: Two-Parser Bugs
Inconsistencies between different parsers in the software stack, leading to unexpected execution.
BWC 8.0: Denial of Service (DoS) Vulnerabilities
Attacks designed to render a contract or system unusable, often by causing transactions to revert or consume excessive gas.
BWC 8.1: DoS via External Calls
Blocking contract functionality through external calls to malicious or non-functional contracts.
BWC 8.2: DoS via Malicious Receivers
A recipient contract designed to revert or consume excessive gas when receiving tokens or Ether.
BWC 8.3: DoS via Non-Reentrant Locks
Exploiting reentrancy guards to permanently or temporarily lock functions.
BWC 8.4: DoS via Numeric Calculation
Causing numeric underflows, overflows, or division-by-zero errors that block contract execution.
BWC 8.5: DoS via Block Gas Limit
Crafting operations that exceed the block gas limit, making certain state transitions impossible.
BWC 8.6: DoS via Hook Griefing
Exploitation of token standard callbacks (e.g., ERC777/721/1155) to cause denial of service.
BWC 8.7: DoS via Return Data Bomb
Exploitation of unbounded return data from an external call to cause an out-of-gas error.
BWC 8.8: DoS in Cross-Chain Messaging Protocols
Specific vulnerabilities in protocols like LayerZero or their integrations that can halt message passing.
BWC 9.0: Emerging Technology Vulnerabilities
BWC 9.1: Quantum Computing Threats
BWC 9.2: AI/ML Integration Attacks
BWC 9.2.1 Unrestricted Large Language Models (LLMs)
BWC 9.3: Hardware-Level Exploits
BWC 10.0: Network & Consensus Evolution Attacks
BWC 10.1: Advanced P2P Network Attacks
BWC 10.2: Novel Consensus Mechanism Exploits
BWC 10.3: Cross-Protocol Interoperability Attacks
BWC 10.4: Protocol Upgrade-Induced Vulnerabilities
Vulnerabilities that emerge in previously secure contracts when a network or protocol upgrade (like an EIP implementation) changes the behavior or security assumptions of the underlying platform. The contract code itself doesn't change, but its execution context does, rendering existing security patterns ineffective.