## 3 Security Threats
### Layer-Based Attack Classification  
In Figure 1, a layer-wise decomposition of the blockchain network and the primary vulnerabilities are shown on the respective sides. Later, Table 2 provides a summary of different kinds of attacks on different layers, and their countermeasures are shown. Figure 1: Layer-based classification of blockchain attacks, highlighting representative vulnerabilities at each layer (application, contract, consensus and incentive, network, and data). To systematically assign attacks to blockchain layers, we established explicit classification criteria based on each attack's primary mechanism and its point of impact within the blockchain architecture. This structured approach aligns vulnerabilities clearly with the specific blockchain layer they affect, enabling targeted and efficient mitigation strategies. By understanding attacks within this layered context, security researchers and blockchain developers can more effectively implement defense mechanisms that address the root architectural causes of vulnerabilities. Specifically, attacks targeting transaction structures, cryptographic integrity, or ledger consistency, such as the transaction malleability attack, where an adversary manipulates transaction IDs by altering digital signatures, are categorized within the **Data Layer**[36]. Attacks disrupting node-to-node communication, routing protocols, or network connectivity, such as the Sybil attack, which involves creating numerous fake identities to disproportionately influence network decisions, are classified under the **Network Layer**[37]. Vulnerabilities compromising consensus algorithms or incentive mechanisms designed to regulate miner or validator behavior are assigned to the **Consensus & Incentive Layer**, a prominent example includes the 51% attack, wherein an attacker seeks majority control over the network's mining resources to manipulate blockchain state. Smart contract-specific vulnerabilities arising from programming flaws or execution logic errors, such as the re-entrancy attack, involving repeated calls to vulnerable functions before completion of their initial execution, are classified into the **Contract Layer**[5]. Lastly, vulnerabilities exploiting end-user interfaces, wallet security weaknesses, or external software applications such as cryptojacking, where attackers illicitly utilize computing resources to mine cryptocurrencies, are grouped under the **Application Layer**. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Study** & **Taxonomy Type** & **Categories** & **Key Features/Limitations** \\ \hline [PERSON] et al. (2021) [27] & Threat-based & 4 & General classification of threats; lacks architecture-specific alignment. \\ \hline [PERSON] et al. (2019) [28] & Surface-based & 3 & Abstract attack surfaces; does not directly align with blockchain system layers. \\ \hline [PERSON] (2018) [29] & Impact-based & 5 & Categorizes by severity and consequences; limited structural insight. \\ \hline [PERSON] et al. (2019) [31] & Functional-based & 8 & Detailed, but mixes threat types and system components. \\ \hline [PERSON] et al. (2019) [32] & Type-based & 7 & Catalog of known attacks; lacks architectural grouping. \\ \hline [PERSON] (2019) [18] & System-component & 6 & Focuses on blockchain node internals; limited generalizability. \\ \hline [PERSON] \& [PERSON] (2023) [5] & Layer-based & 7 & Strong emphasis on smart contract centralization risks; contract layer focus. \\ \hline [PERSON] et al. (2022) [34] & Consensus-attack & 6 & Comprehensive categorization of consensus-specific threats; does not cover full system layers. \\ \hline [PERSON] et al. (2021) [35] & Threat-centric layered & 5 & Maps attacks to technical stack; lacks emphasis on adaptability across architectures. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of our layer-based taxonomy with existing classifications.