Blockchain Weakness Classification (BWC)

This document provides a hierarchical classification of weaknesses and vulnerabilities found in blockchain and decentralized application (DApp) ecosystems. The BWC framework covers risks from off-chain infrastructure to low-level smart contract code.

Table of Contents

BWC 1.0: Ecosystem & Off-Chain Risks

Vulnerabilities that exist outside the core blockchain logic but are critical to the security of the overall system. Every off chain component you incorporate add to you attack surface.

BWC 1.1: Identity & Key Management Failures

BWC 1.1.1: Compromised Device/OS

Vulnerabilities in user devices or operating systems leading to private key theft, session hijacking, or malicious transaction approvals

Device Exploit Methods

  • Malware laced PDF files and ZIP files

  • Fake Telegram Manual Verification leading to user running malware

  • Running untrusted code.

  • Mitigation:

    • Separate Signing devices.
    • Wipe Device after 3 months. Assume Device is compromised after every 3 months.
    • Enable two-factor authentication.
    • Keep software up-to-date.
    • Avoid all attachments and links.

BWC 1.1.2: Private Key Leakage

Exposure of private keys through insecure storage, transmission, or handling.

  • Mitigation:
    • Always use Multi signature. With multiple Signers. Don't Use fancy UI(safe). Verify Calldata manually.

BWC 1.1.3: Insider Threat

Malicious actions by team members or contractors with privileged access.

  • Mitigation:
    • Privilege Separation.
    • Enhanced KYC.
    • Need to Know Access Control.
    • On site Verification for remote workers.

BWC 1.1.4: Wrench Attacks

Refers to a situation where attackers bypass technical security entirely and instead use coercion, threats or physical violence such as kidnapping to force victims to surrender their passwords or assets.

  • Mitigation:
    • Decoy Wallets.
    • Family Security Protocols.
    • Avoiding Identity Exposure.
    • Keep you circles tight and cautious.
    • Nuke passwords.

BWC 1.1.5: Vulnerable Vanity/Address Generators

Flaws in tools used to generate custom addresses, potentially leading to predictable private keys.

  • Mitigation:
    • Avoid vanity address generators. It's vanity.

BWC 1.2: Social Engineering & Deception

BWC 1.2.1: Social Engineering Exploits

Tricking users into revealing sensitive information or transferring funds.

  • Recruitment Scam
  • Investment Scam/Pig Butchering Scam
  • Crypto Recovery Scam
  • Fake AirDrop Scam
  • Address Poisoning Scam
  • DeepFakes -Fake celebrity endorsements to promote investments -Deepfake-Impersonated Zoom Meetings
  • Google Search Ad Phishing Attack
  • Email Phishing Attacks: New Login of Google Account, New login of X account.

BWC 1.2.2: SIM Swap Attack

Taking control of a user's phone number to bypass two-factor authentication.

BWC 1.2.3: Front-End Hijack/Spoofing

Modification of DApp interfaces to trick users into approving malicious transactions.

  • Mitigation:
    • Bookmark trusted URLs.
    • Verify URL from multiple Sources.
    • Perform a trial run first.

BWC 1.2.4: Fake Wallet Applications

Malicious applications impersonating legitimate ones to steal credentials and funds.

BWC 1.2.5: Malicious Browser Extensions

BWC 1.2.6: Malicious RPC Provider

BWC 1.3: Infrastructure & Supply Chain Integrity

BWC 1.3.1: Compromised Validator/Node

Validators who control block production are compromised, leading to transaction censorship, reordering, or other malicious activities.

BWC 1.3.2: DNS Hijacking Attacks

Redirecting traffic from legitimate websites to fraudulent phishing sites by compromising DNS servers.

BWC 1.3.3: Compromised Communication Platforms

Hijacking of official Discord, X (Twitter), or email accounts to spread misinformation or phishing links.

BWC 1.3.4: Supply Chain Attacks

Compromises in the development pipeline, dependencies, or deployment processes.

  • Mitigation:
    • Create a Software Bill Of Materials Check. Ensuring that dependencies and packages undergo rigorous security screening.
    • Source Code Analysis Check.

BWC 1.3.5: Ruggable Contract Design

Architectural design that intentionally allows malicious developers to steal user funds.

  • Mitigation:
    • Verify the source code.

BWC 1.4: Nation-State & Advanced Persistent Threats (APTs)

BWC 1.4.1: Coordinated Multi-Vector Attacks

BWC 1.4.2: State-Sponsored Infrastructure Compromise

BWC 1.4.3: Geopolitical Economic Warfare

BWC 1.4.4: Cross-Jurisdictional Regulatory Exploitation

BWC 2.0: Access Control Vulnerabilities

Failures in how permissions and privileges are managed and enforced within a smart contract.

BWC 2.1: Missing or Improper Authorization

BWC 2.1.1: Missing Access Control

Failure to implement proper authorization checks on sensitive functions.

BWC 2.1.2: tx.origin Authorization

Using the volatile tx.origin address instead of the stable msg.sender for authorization checks.

BWC 2.2: Flawed Permission Management

BWC 2.2.1: Lingering Approvals

Token approvals that remain active beyond their intended lifespan, creating security exposures.

BWC 2.2.2: Misconfigured Proxy

Errors in proxy contract setup leading to upgrade vulnerabilities, function collisions, or unauthorized access.

BWC 2.2.3: Untrusted Arbitrary Calls

Functions that allow calling arbitrary external contracts without proper security measures or validation (e.g., unsafe delegatecall).

BWC 2.2.4: Cross Contract Untrusted Arbitrary Calls

This vulnerability occurs when a contract executes a call to an external contract using untrusted or user-supplied calldata, but the vulnerability is only exposed through a series of interactions between multiple contracts. An attacker can exploit this by crafting malicious calldata that causes a trusted contract to perform an unauthorized action on their behalf against another contract in the system. This is particularly dangerous when the exploited contract has special privileges on the target contract.

BWC 2.3: Callback & Hook Vulnerabilities

BWC 2.3.1: Missing Validation in Flashloan Callbacks

Inadequate verification in callback functions that can be exploited during flash loan execution.

BWC 3.0: Smart Contract Logic & State Manipulation

Flaws in the business logic, state machine, and core functionality of a contract.

BWC 3.1: Reentrancy Attacks

BWC 3.1.1: Standard Reentrancy

Calling back into a vulnerable contract before its state updates are completed, allowing for multiple withdrawals or other exploits.

BWC 3.1.2: ERC-777 Reentrancy

Exploiting token hooks in the ERC-777 standard to reenter contracts during a tokensToSend or tokensReceived call.

BWC 3.1.3: Read-only Reentrancy

Reentering a contract to read state that is inconsistent or in the process of being changed, leading to logic errors.

BWC 3.1.4: Cross-Contract Reentrancy

A Cross-Contract Reentrancy differs from standard reentrancy in that it arises when a reentrancy occurs in a complex and often unforeseen call chain. This can happen when Contract A calls Contract B, which calls Contract C, which in turn calls back into Contract A or another related contract in an unexpected way, exploiting the system's state before the initial function call has completed.

BWC 3.2: Flawed State Management

BWC 3.2.1: Improper Initialization

Contracts deployed with incorrect initial state, missing initialization, or unset flags.

BWC 3.2.1.1: Proxy/Contract Initialization Front-Running

A specific type of front-running where an attacker observes a transaction that deploys a contract and immediately sends a transaction to initialize the contract with their own address as the owner. This is possible when the contract's initialization function is public and does not have proper access control.

BWC 3.2.2: Faulty Contract Checks

Logic errors in mechanisms that check the status or code of other contracts.

BWC 3.2.3: Forced Ether Balance

Manipulating a contract's Ether balance to disrupt logic that depends on address(this).balance.

BWC 3.2.4: Self Transfers and Transaction Timing Attacks

Exploiting state changes caused by transfers to the same address or by the ordering of transactions.

BWC 3.2.5: Broken State Adjustment

Errors in logic that is supposed to modify or correct contract state.

BWC 3.3: Token Standard & Logic Issues

BWC 3.3.1: Double EntryPoint Tokens

Contracts where a native token also has an ERC-20 representation, potentially leading to inconsistent state or accounting.

- *Example: Celo, Polygon (MATIC), zkSync ERA (ETH)*

BWC 3.3.2: Fee-on-Transfer & Rebase Accounting Issues

Incorrect handling of tokens that deduct fees during transfers or have an elastic supply (rebase tokens).

BWC 3.3.3: Improper Handling of Native Tokens

Errors in managing the blockchain's native currency (e.g., ETH, BNB) alongside other tokens.

BWC 3.3.4: Weird ERC20 Behaviors

Failure to handle non-standard implementations of the ERC20 interface, such as tokens without return values.

BWC 3.4: Governance & System Logic

BWC 3.4.1: DAO Governance Attacks

Exploiting voting mechanisms, proposal processes, or timelocks to pass malicious proposals.

BWC 3.4.2: Flawed Reward Systems

Exploitable incentive structures or reward calculation errors.

BWC 3.4.3: Bridge Status Mismatch

Inconsistencies between cross-chain bridge endpoints leading to fund loss or transaction failure.

BWC 4.0: Input & Data Validation Vulnerabilities

Weaknesses related to processing untrusted external data and inputs.

BWC 4.1: Insufficient Input Validation

Failure to properly sanitize or validate transaction inputs, enabling malicious or unexpected data to be processed. This includes missing zero-address checks.

BWC 4.2: Oracle Manipulation & Data Integrity

BWC 4.2.1: Insufficient Oracle Validation

Inadequate verification of external data feeds (e.g., price feeds), allowing manipulation of critical on-chain information.

BWC 4.2.2: Oracle Manipulation

Actively compromising or gaming the data feeds that DApps rely on for external information.

BWC 4.3: Cryptographic Signature Flaws

BWC 4.3.1: Missing Signature Validation

Improper or missing verification of cryptographic signatures, enabling transaction forgery.

BWC 4.3.2: Incomplete Signature Schemes

Flaws in the implementation of transaction signing cryptography.

BWC 4.4: Address Spoofing in Meta-Transactions

Exploitation of meta-transaction frameworks like ERC-2771 by impersonating authorized forwarder addresses.

BWC 5.0: Economic & Game-Theoretic Vulnerabilities

Flaws that can be exploited by rational economic actors to manipulate markets or extract value unfairly.

BWC 5.1: Miner Extractable Value (MEV) Attacks

BWC 5.1.1: Front-Running

Placing a transaction in the queue before a known future transaction to exploit the order of execution.

BWC 5.1.2: Back-Running

Placing transactions immediately after targeted transactions to exploit their effects.

BWC 5.1.3: Sandwich Attacks

Combining front-running and back-running to trap a victim's transaction and extract value.

BWC 5.2: Price & Liquidity Manipulation

BWC 5.2.1: Price Manipulation

Artificially influencing asset prices through market actions to exploit DApp mechanisms.

BWC 5.2.2: First Deposit / Inflation Attack

Exploiting initialization conditions in liquidity pools or staking systems to claim a disproportionate share of rewards.

BWC 5.2.3: Hardcoded Price

Using a fixed, hardcoded price for an asset instead of a dynamic feed, creating an easily exploitable arbitrage opportunity.

BWC 5.3: Transaction Execution Risks

BWC 5.3.1: Lack of Slippage Control

Missing or insufficient protection against price movement between the time a transaction is submitted and when it is executed.

BWC 6.0: Arithmetic & Numeric Vulnerabilities

Errors in mathematical calculations and data type handling.

BWC 6.1: Integer Overflow & Underflow

Exceeding the maximum or minimum value for an integer type, causing it to wrap around.

BWC 6.2: Precision Loss & Rounding Errors

Issues arising from integer division, order of operations (division before multiplication), or inconsistent decimal scaling.

BWC 6.3: Unsafe Type Casting

Improper or unchecked conversion between numeric types, potentially leading to overflow or precision loss.

BWC 6.4: Calculation Errors

General mathematical mistakes in contract logic, such as in liquidity or reward formulas.

BWC 6.5: Inconsistent Scaling Bugs

Errors in managing precision during unit conversion between different tokens or values.

BWC 7.0: Low-Level & EVM-Specific Vulnerabilities

Vulnerabilities related to the specifics of the Ethereum Virtual Machine (EVM), cryptographic primitives, and data handling.

BWC 7.1: Unchecked Return Values

Failing to verify the success status of external calls, leading the contract to incorrectly assume success.

BWC 7.2: Unsafe Storage & Memory Handling

BWC 7.2.1: Unsafe Storage Use

Improper handling of contract storage slots, leading to collisions or data corruption.

BWC 7.2.2: Deleting Dynamic Data in Structs

Memory corruption from improper deletion of complex data structures.

BWC 7.2.3: Broken EIP-1153 Transient Storage Use

Misuse of transient storage, which can enable reentrancy or state corruption due to improper clearing.

BWC 7.3: Weak Cryptographic Primitives

BWC 7.3.1: Weak Random Number Generation

Using predictable or manipulable sources of on-chain entropy (e.g., block.timestamp).

BWC 7.3.2: Malleable ecrecover

Vulnerabilities in signature recovery allowing for signature reuse or forgery.

BWC 7.3.3: Second Pre-image Attacks

Cryptographic vulnerabilities allowing for collisions in hash functions used by the contract.

BWC 7.3.4: Forgetting to Blind Polynomials in ZK Protocols

Weaknesses in zero-knowledge proof implementations that expose underlying data.

BWC 7.4: EVM Interpretation Issues

BWC 7.4.1: Incorrect VM Gas Charges

Logic that becomes vulnerable due to miscalculations of transaction execution costs.

BWC 7.4.2: Two-Parser Bugs

Inconsistencies between different parsers in the software stack, leading to unexpected execution.

BWC 8.0: Denial of Service (DoS) Vulnerabilities

Attacks designed to render a contract or system unusable, often by causing transactions to revert or consume excessive gas.

BWC 8.1: DoS via External Calls

Blocking contract functionality through external calls to malicious or non-functional contracts.

BWC 8.2: DoS via Malicious Receivers

A recipient contract designed to revert or consume excessive gas when receiving tokens or Ether.

BWC 8.3: DoS via Non-Reentrant Locks

Exploiting reentrancy guards to permanently or temporarily lock functions.

BWC 8.4: DoS via Numeric Calculation

Causing numeric underflows, overflows, or division-by-zero errors that block contract execution.

BWC 8.5: DoS via Block Gas Limit

Crafting operations that exceed the block gas limit, making certain state transitions impossible.

BWC 8.6: DoS via Hook Griefing

Exploitation of token standard callbacks (e.g., ERC777/721/1155) to cause denial of service.

BWC 8.7: DoS via Return Data Bomb

Exploitation of unbounded return data from an external call to cause an out-of-gas error.

BWC 8.8: DoS in Cross-Chain Messaging Protocols

Specific vulnerabilities in protocols like LayerZero or their integrations that can halt message passing.

BWC 9.0: Emerging Technology Vulnerabilities

BWC 9.1: Quantum Computing Threats

BWC 9.2: AI/ML Integration Attacks

BWC 9.2.1 Unrestricted Large Language Models (LLMs)

BWC 9.3: Hardware-Level Exploits

BWC 10.0: Network & Consensus Evolution Attacks

BWC 10.1: Advanced P2P Network Attacks

BWC 10.2: Novel Consensus Mechanism Exploits

BWC 10.3: Cross-Protocol Interoperability Attacks

BWC 10.4: Protocol Upgrade-Induced Vulnerabilities

Vulnerabilities that emerge in previously secure contracts when a network or protocol upgrade (like an EIP implementation) changes the behavior or security assumptions of the underlying platform. The contract code itself doesn't change, but its execution context does, rendering existing security patterns ineffective.

BWC 11.0: Privacy & Regulatory Attack Vectors

BWC 11.1: Privacy Protocol Compromises

BWC 11.2: Regulatory Weaponization