区块链生态共性安全风险分析综述

高昊昱; 曹春杰; 徐响; 裴庆祺; 芦翔; 雷虹

doi:10.11959/j.issn.2096-109x.2025015

您当前的位置：

首页 >

文章列表页 >

区块链生态共性安全风险分析综述

综述 | 更新时间：2025-05-14

- 区块链生态共性安全风险分析综述
- Survey on blockchain ecosystem common security risk analysis
- 网络与信息安全学报 2025年11卷第2期页码：1-25
- 作者机构：
  
  1.海南大学网络空间安全学院（密码学院），海南海口 570228
  2.西安电子科技大学网络与信息安全学院，陕西西安 710071
  3.中国科学院信息工程研究所，北京 100864
- 作者简介：
  
  [ "高昊昱（1994- ），男，山西太原人，海南大学博士生，主要研究方向为区块链、可信计算。" ]
  [ "曹春杰（1977- ），男，陕西西安人，博士，海南大学教授、博士生导师，主要研究方向为无线网络安全、区块链、人工智能安全。" ]
  [ "徐响（1999- ），男，湖北鄂州人，海南大学硕士生，主要研究方向为区块链、数字身份。" ]
  [ "裴庆祺（1975- ），男，广西百色人，博士，西安电子科技大学教授、博士生导师，主要研究方向为信息安全、电子商务/电子政务安全。" ]
  [ "芦翔（1982- ），男，山东烟台人，博士，中国科学院信息工程研究所副研究员，主要研究方向为区块链安全监管、物联网密码工程与应用。" ]
  [ "雷虹（1984- ），男，湖南常德人，博士，海南大学教授、博士生导师，主要研究方向为区块链、可信执行环境、隐私计算。" ]
- 基金信息：
  
  国家重点研发计划(2021YFB2700600);海南大学科研启动基金(KYQD(ZR)-21071)
- DOI：10.11959/j.issn.2096-109x.2025015
  中图分类号： TP309.2;TP39
- 收稿：2024-04-25，
  
  修回：2024-09-13，
  
  纸质出版：2025-04-25
- 稿件说明：
移动端阅览
高昊昱, 曹春杰, 徐响, 等. 区块链生态共性安全风险分析综述[J]. 网络与信息安全学报, 2025, 11(2): 1-25.

GAO H Y, CAO C J, XU X, et al. Survey on blockchain ecosystem common security risk analysis[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 1-25.
高昊昱, 曹春杰, 徐响, 等. 区块链生态共性安全风险分析综述[J]. 网络与信息安全学报, 2025, 11(2): 1-25. DOI： 10.11959/j.issn.2096-109x.2025015.

GAO H Y, CAO C J, XU X, et al. Survey on blockchain ecosystem common security risk analysis[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 1-25. DOI： 10.11959/j.issn.2096-109x.2025015.

摘要

区块链作为一种去信任化的分布式基础架构和新型计算范式，已经从最初的数字“加密货币”设计演进为广泛应用的技术基础设施，为数字经济发展和转型提供了新的动能。然而，这也为区块链技术与应用环境组成的生态带来了众多风险与挑战，包括区块链自身存在的技术安全风险及其融入现有系统所产生的安全问题。针对这些风险进行深入分析与研究，对于促进区块链技术与生态的良性发展具有重要意义。对这两类风险进行了全面系统的分析和评估，总结每种风险的成因、影响和缓解措施，为现有区块链项目的安全管理和风险控制提供了有力指导。提出了区块链生态安全发展的六大安全目标，并根据这六大安全目标构建了一个全面、多维度的区块链项目安全评估框架，旨在推动区块链生态的健康发展，为构建更加安全、稳定、高效的区块链应用环境提供有力支持。

Abstract

Blockchain has been evolved from the initial design of cryptocurrency to a widely applied technological foundation as a decentralized distributed infrastructure and novel computing paradigm

providing new impetus for the development and transformation of the digital economy. However

numerous risks and challenges have also been brought to the ecosystem composed of blockchain technology and application environments

including the technical security risks inherent in blockchain itself and those arising from its integration into existing systems. In-depth analysis and research on these risks have been of great significance for promoting the benign development of blockchain technology and ecology. Firstly

a comprehensive and systematic analysis and evaluation of these two types of risks were conducted

with the causes

impacts

and mitigation measures for each risk being summarized

thereby providing strong guidance for security management and risk control of existing blockchain projects. Subsequently

six security objectives for the development of blockchain ecology security were proposed

and based on these objectives

a comprehensive

multi-dimensional blockchain project security assessment framework was constructed

aiming to promote the healthy development of the blockchain ecosystem and provide robust support for building a more secure

stable

and efficient blockchain application environment.

关键词

Keywords

references

袁勇 , 王飞跃 . 区块链技术发展现状与展望 [J ] . 自动化学报 , 2016 , 42 ( 4 ): 481 - 494 .

YUAN Y , WANG F Y . Blockchain: the state of the art and future trends [J ] . Acta Automatica Sinica , 2016 , 42 ( 4 ): 481 - 494 .

DIFFIE W , HELLMAN M E . New directions in cryptography [M ] . Democratizing Cryptography : The Work of Whitfield Diffie and Martin Hellman . 2022 : 365 - 390 .

RIVEST R L , SHAMIR A , ADLEMAN L . A method for obtaining digital signatures and public-key cryptosystems [J ] . Communications of the ACM , 1978 , 21 ( 2 ): 120 - 126 .

KOBLITZ N . Elliptic curve cryptosystems [J ] . Mathematics of Computation , 1987 , 48 ( 177 ): 203 - 209 .

MERKLE R C . A digital signature based on a conventional encryption function [C ] // Conference on the Theory and Application of Cryptographic Techniques . Berlin Heidelberg : Springer , 1987 : 369 - 378 .

马永仁 . 区块链技术原理及应用 [M ] . 北京 : 中国铁道出版社 , 2019 : 24 .

MA Y R . Principles and applications of blockchain technology [M ] . Beijing : China Railway Press , 2019 : 24 .

BACK A . Hashcash-a denial of service counter-measure [R ] . 2002 .

DAI W . B-Money [EB ] .

SZABO N . Bitgold [EB ] .

WRIGHT C S . Bitcoin: a peer-to-peer electronic cash system [J ] . SSRN Electronic Journal , 2008 : 21260 .

VITALIK B . Ethereum white paper [J ] . GitHub Repository , 2013 , 1 : 22 - 23 .

ANDROULAKI E , BARGER A , BORTNIKOV V , et al . Hyperledger fabric: a distributed operating system for permissioned blockchains [EB ] . arxiv preprint arxiv: 1801.10228 , 2018 .

季乃礼 , 兰金奕 . 三元悖论视角下的区块链信任与社会治理研究 [J ] . 山东科技大学学报(社会科学版) , 2020 , 22 ( 5 ): 87 - 97 .

JI N L , LAN J Y . Research on blockchain trust and social governance from the perspective of trilemma [J ] . Journal of Shandong University of Science and Technology(Social Sciences) , 2020 , 22 ( 5 ): 87 - 97 .

REBELLOET AL . G. A. F. A survey on block-chain scalability: from hardware to layer-two protocols [J ] . IEEE Communications Surveys & Tutorials , 2024 , 26 ( 4 ): 2411 - 2458 .

ZHOU H , XU Y , DAI H B , et al . Recovery of ecosystem productivity in China due to the clean air action plan [J ] . Nature Geoscience , 2024 : 1 - 7 .

IQBAL M , MATULEVIČIUS R . Blockchain-based application security risks: a systematic literature review [M ] . Lecture Notes in Business Information Processing . Cham : Springer International Publishing , 2019 : 176 - 188 .

张滨 . 区块链安全风险研究 [J ] . 电信工程技术与标准化 , 2017 , 30 ( 11 ): 1 - 5 .

ZHANG B . Security risk study of blockchain [J ] . Telecom Engineering Technics and Standardization , 2017 , 30 ( 11 ): 1 - 5 .

LI X Q , JIANG P , CHEN T , et al . A survey on the security of blockchain systems [J ] . Future Generation Computer Systems , 2020 , 107 : 841 - 853 .

杨海红 , 邱惠丽 , 李正风 . 托马斯·休斯“技术-社会系统” 思想探微 [J ] . 自然辩证法研究 , 2020 , 36 ( 8 ): 26 - 30, 43 .

YANG H H , QIU H L , LI Z F . Exploration on Thomas P. Hughes' thought on “technical-social system ”[J ] . Studies in Dialectics of Nature , 2020 , 36 ( 8 ): 26 - 30, 43 .

COOPER R , FOSTER M . Sociotechnical systems [J ] . American Psychologist , 1971 , 26 ( 5 ): 467 .

SlowMist Hacked . SlowMist zone [EB ] .

刘敖迪 , 杜学绘 , 王娜 , 等 . 区块链系统安全防护技术研究进展 [J ] . 计算机学报 , 2024 , 47 ( 3 ): 608 - 646 .

LIU A D , DU X H , WANG N , et al . Research progress on blockchain system security technology [J ] . Chinese Journal of Computers , 2024 , 47 ( 3 ): 608 - 646 .

SULTAN N , MOHAMED N , MARTIN M , et al . Virtual currencies and money laundering: existing and prospects for jurisdictions that comprehensively prohibited virtual currencies like Pakistan [J ] . Journal of Money Laundering Control , 2024 , 27 ( 2 ): 395 - 412 .

刘海鸥 , 周颖玉 , 周鑫 , 等 . 区块链隐私威胁及保护机制研究综述 [J ] . 计算机集成制造系统 , 2023 , 29 ( 7 ): 2292 - 2312 .

LIU H O , ZHOU Y Y , ZHOU X , et al . Review on privacy threats and protection mechanisms for blockchain technology [J ] . Computer Integrated Manufacturing Systems , 2023 , 29 ( 7 ): 2292 - 2312 .

ZHANG R , XUE R , LIU L . Security and privacy on blockchain [J ] . ACM Computing Surveys , 2020 , 52 ( 3 ): 1 - 34 .

崔展齐 , 杨慧文 , 陈翔 , 等 . 智能合约安全漏洞检测研究进展 [J ] . 软件学报 , 2024 , 35 ( 5 ): 2235 - 2267 .

CUI Z Q , YANG H W , CHEN X , et al . Research progress of security vulnerability detection of smart contracts [J ] . Journal of Software , 2024 , 35 ( 5 ): 2235 - 2267 .

王永利 , 徐秋亮 . 量子计算与量子密码的原理及研究进展综述 [J ] . 计算机研究与发展 , 2020 , 57 ( 10 ): 2015 - 2026 .

WANG Y L , XU Q L . Principle and research progress of quantum computation and quantum cryptography [J ] . Journal of Computer Research and Development , 2020 , 57 ( 10 ): 2015 - 2026 .

沈传年 . 区块链安全问题研究综述 [J ] . 计算机工程与科学 , 2024 , 46 ( 1 ): 46 - 62 .

SHEN C N . Review on security issues of blockchains [J ] . Computer Engineering & Science , 2024 , 46 ( 1 ): 46 - 62 .

WANG X , FENG D , LAI X , et al . Collisions for hash functions MD4, MD5, HAVAL-128 and RIPEMD [J ] . Cryptology ePrint Archive , 2004 .

STEVENS M . New collision attacks on SHA-1 based on optimal joint local-collision analysis [M ] // Lecture Notes in Computer Science . Berlin Heidelberg : Springer , 2013 : 245 - 261 .

张伟 , 许海洋 , 周百顺 . 多进程共享的高效哈希表 [J ] . 计算机工程与设计 , 2017 , 38 ( 5 ): 1190 - 1195 .

ZHANG W , XU H Y , ZHOU B S . Efficient hash table supporting multi-process sharing [J ] . Computer Engineering and Design , 2017 , 38 ( 5 ): 1190 - 1195 .

倪雪莉 , 马卓 , 王群 . 区块链P2P网络及安全研究 [J ] . 计算机工程与应用 , 2024 , 60 ( 5 ): 17 - 29 .

NI X L , MA Z , WANG Q . Research on blockchain P2P network and its security [J ] . Computer Engineering and Applications , 2024 , 60 ( 5 ): 17 - 29 .

DUAN L , SUN Y Y , ZHANG K J , et al . Multiple-layer security threats on the ethereum blockchain and their countermeasures [J ] . Security and Communication Networks , 2022 , 2022 : 5307697 .

田国华 , 胡云瀚 , 陈晓峰 . 区块链系统攻击与防御技术研究进展 [J ] . 软件学报 , 2021 , 32 ( 5 ): 1495 - 1525 .

TIAN G H , HU Y H , CHEN X F . Research progress on attack and defense techniques in block-chain system [J ] . Journal of Software , 2021 , 32 ( 5 ): 1495 - 1525 .

OpenZeppelin . OpenZeppelin contracts [EB ] .

NAYAK K , KUMAR S , MILLER A , et al . Stubborn mining: generalizing selfish mining and combining with an eclipse attack [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 305 - 320 .

GRUNSPAN C , PÉREZ-MARCO R . On profitability of selfish mining [EB ] . arXiv preprint arXiv: 1805.08281 , 2018 .

BARWISE J . An introduction to first-order logic [M ] // Studies in Logic and the Foundations of Mathematics . Amsterdam : Elsevier , 1977 : 5 - 46 .

Optimism . Introducing the OVM [EB ] .

SUJATHA E , KUMAR G N , VIKAS N V , et al . Decentralized portfolio tracking application on A polygon layer 2 blockchain [C ] // Proceedings of the 2023 International Conference on Networking and Communications (ICNWC) . Piscataway : IEEE Press , 2023 : 1 - 5 .

KALODNER H , GOLDFEDER S , CHEN X , et al . Arbitrum: scalable, private smart contracts [C ] // Proceedings of the 27th USENIX Security Symposium (USENIX Security 18). 2018 : 1353 - 1370 .

YE Z , MISRA U , CHENG J J , et al . Specular: towards secure, trust-minimized optimistic blockchain execution [EB ] . arXiv preprint arXiv: 2212.05219 , 2022 .

KAUR G , GANDHI C . Scalability in blockchain: challenges and solutions [M ] . USA : Academic Press , 2020 : 373 - 406 .

THIBAULT L T , SARRY T , HAFID A S . Blockchain scaling using rollups: a comprehensive survey [J ] . IEEE Access , 2022 , 10 : 93039 - 93054 .

HARISHANKAR M , AKESTORIDIS D G , IYER S V , et al . Plasma go: a scalable sidechain protocol for flexible payment mechanisms in blockchain-based marketplaces [EB ] . arXiv preprint arXiv: 2003.06197 , 2020 .

LAVAUR T , DETCHART J , LACAN J , et al . Modular zk-rollup on-demand [J ] . Journal of Network and Computer Applications , 2023 , 217 : 103678 .

HE S L , TANG Q , WU C Q , et al . Decentralizing IoT management systems using blockchain for censorship resistance [J ] . IEEE Transactions on Industrial Informatics , 2020 , 16 ( 1 ): 715 - 727 .

AVERIN A , AVERINA O . Review of blockchain technology vulnerabilities and blockchain-system attacks [C ] // Proceedings of the 2019 International Multi-Conference on Industrial Engineering and Modern Technologies (FarEastCon) . Piscataway : IEEE Press , 2019 : 1 - 6 .

ČAPKO D , VUKMIROVIĆ S , NEDIĆ N . State of the art of zero-knowledge proofs in blockchain [C ] // Proceedings of the 2022 30th Telecommunications Forum (TELFOR) . Piscataway : IEEE Press , 2022 : 1 - 4 .

SIVARAMAN V , VENKATAKRISHNAN S B , RUAN K , et al . High throughput cryptocurrency routing in payment channel networks [C ] // Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20). 2020 : 777 - 796 .

Connext Network . What is connext [EB ] .

DONG M , LIANG Q , LI X , et al . Celer network: Bring internet scale to every blockchain [J ] . arXiv preprint arXiv: 1810.00037 , 2018 .

DZIEMBOWSKI S , ECKEY L , FAUST S , et al . Perun: Virtual payment hubs over cryptocurrencies [C ] // 2019 IEEE Symposium on Security and Privacy (SP) . IEEE , 2019 : 106 - 123 .

COUNTERFACTUAL . The Official Website of Counterfactual [EB ] .

THOMAS S , SCHWARTZ E . A protocol for interledger payments [EB ] .

SINGH A , CLICK K , PARIZI R M , et al . Sidechain technologies in blockchain networks: an examination and state-of-the-art review [J ] . Journal of Network and Computer Applications , 2020 , 149 : 102471 .

GNOSIS . Whitepaper [EB ] .

SKALE Network . The SKALE network: an ethereum interoperable elastic blockchain network [EB ] .

KOEGL A , MEGHJI Z , PELLEGRINO D , et al . Attacks on rollups [C ] // Proceedings of the 4th International Workshop on Distributed Infrastructure for the Common Good . New York : ACM , 2023 : 25 - 30 .

MAMAGEISHVILI A , FELTEN E W . Incentive schemes for rollup validators [M ] . Lecture Notes in Operations Research . Cham : Springer Nature Switzerland , 2023 : 48 - 61 .

DZIEMBOWSKI S , FABIAŃSKI G , FAUST S , et al . Lower bounds for off-chain protocols: exploring the limits of plasma [J ] . Cryptology ePrint Archive , 2020 .

Kyber Network . KyberNetwork: a trustless decentralized exchange and payment service [EB ] .

Loom Network . Loom network lightpaper [EB ] .

OMG Network . OmiseGO: decentralized exchange and payments [EB ] .

QIN K H , ZHOU L Y , GERVAIS A . Quantifying Blockchain Extractable Value: How dark is the forest? [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 198 - 214 .

YANG S , ZHANG F , HUANG K , et al . SoK: MEV countermeasures: theory and practice [EB ] . arXiv preprint arXiv: 2212.05111 , 2022 .

MILIONIS J , MOALLEMI C C , ROUGHGARDEN T , et al . Automated market making and loss-versus-rebalancing [EB ] . arxiv peprint arxiv: 2208.06046 , 2022 .

EigenPhi . Arbitrage transaction detail [EB ] .

PATRICK Z , NADAHALLI T , WATTENHOFER Y W R . Analyzing and preventing sandwich attacks in ethereum [J ] . ETH Zürich , 2021 : 1 - 29 .

XAVIER FERREIRA M V , PARKES D C . Credible decentralized exchange design via verifiable sequencing rules [C ] // Proceedings of the 55th Annual ACM Symposium on Theory of Computing . New York : ACM , 2023 : 723 - 736 .

HEIMBACH L , WATTENHOFER R . Eliminating sandwich attacks with the help of game theory [C ] // Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2022 : 153 - 167 .

CHEMAYA N , LIU D Y , MCLAUGHLIN R , et al . The power of default: measuring the effect of slippage tolerance in decentralized exchanges [J ] . SSRN Electronic Journal , 2023 .

ADAMS H , ZINSMEISTER N , SALEM M , et al . Uniswap v3 core [R ] . 2021 .

WHITE D , MCCARTHY D , ADAMS H . TWAMM [EB ] .

DAIAN P , GOLDFEDER S , KELL T , et al . Flash boys 2.0: frontrunning in decentralized exchanges, miner extractable value, and consensus instability [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 : 910 - 927 .

WANG D , WU S , LIN Z , et al . Towards a first step to understand flash loan and its applications in defi ecosystem [C ] // Proceedings of the 2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS) . IEEE , 2023 : 154 - 165 .

ROBERT S R . “ Engineering Error” Led to $34 Million DeFi Hack, Harvest Finance Says [EB ] .

QING X , HUANG Z R , DOU W S , et al . Detecting flash loan based attacks in ethereum [C ] // Proceedings of the 2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS) . Piscataway : IEEE Press , 2023 : 154 - 165 .

CAO Y X , ZOU C , CHENG X . Flashot: a snapshot of flash loan attack on DeFi ecosystem [EB ] . arXiv preprint arXiv: 2102.00626 , 2021 .

XU J H , FENG Y B . Reap the harvest on blockchain: a survey of yield farming protocols [J ] . IEEE Transactions on Network and Service Management , 2023 , 20 ( 1 ): 858 - 869 .

GUNDERMAN D . Suspected cryptocurrency “rug pull” nets actors $10 million [EB ] .

XIA P C , WANG H Y , GAO B Y , et al . Trade or trick? [C ] // Proceedings of the ACM on Measurement and Analysis of Computing Systems , 2021 , 5 ( 3 ): 1 - 26 .

XU J H , PARUCH K , COUSAERT S , et al . SoK: decentralized exchanges (DEX) with automated market maker (AMM) protocols [J ] . ACM Computing Surveys , 2023 , 55 ( 11 ): 1 - 50 .

DALE B . SushiSwap will withdraw up to $830M from uniswap today: why it matters for DeFi [EB ] .

REDSTONE ORACLES . Oracle attacks #1-inverse finance, $15M stolen [EB ] .

MACKINGA T , NADAHALLI T , WATTENHOFER R . TWAP oracle attacks: easier done than said [C ] // Proceedings of the 2022 IEEE International Conference on Blockchain and Cryptocurrency (ICBC) . Piscataway : IEEE Press , 2022 : 1 - 8 .

SMARTCONTENT . TWAP Oracles vs chainlink price feeds: a comparative analysis [EB ] .

WANG X Y , YU H B . How to break MD5 and other hash functions [M ] . Lecture Notes in Computer Science . Berlin Heidelberg : Springer , 2005 : 19 - 35 .

CORON J S , DODIS Y , MALINAUD C , et al . Merkle-damgård revisited: how to construct a hash function [M ] . Lecture Notes in Computer Science . Berlin Heidelberg : Springer , 2005 : 430 - 448 .

姚前 , 陈永伟 . Web 3 . 0 : 下一代互联网的变革与挑战 [M ] . 北京 : 中信出版社 , 2022.

YAO Q , CHEN Y W . Web 3 . 0 : the changes and challenges of the next generation Internet [M ] . Beijing : CITIC Press , 2022.

RABCAN J , RUSNAK P , ZAITSEVA E , et al . Analysis of aata reliability based on Importance analysis [C ] // Proceedings of the 2019 International Conference on Information and Digital Technologies (IDT) . Piscataway : IEEE Press , 2019 : 402 - 408 .

CAI X Q , DENG Y . The principle and core technology of blockchain [J ] . Chinese Journal of Computers , 2021 , 44 ( 1 ): 84 - 131 .

韩璇 , 袁勇 , 王飞跃 . 区块链安全问题:研究现状与展望 [J ] . 自动化学报 , 2019 , 45 ( 1 ): 206 - 225 .

HAN X , YUAN Y , WANG F Y . Security problems on blockchain: the state of the art and future trends [J ] . Acta Automatica Sinica , 2019 , 45 ( 1 ): 206 - 225 .

MAZUMDARU S . Facebook’s libra faces EU antitrust [EB ] .

Veritas . Navigating regulatory compliance [EB ] .

SERADA A . Why is cryptokitties (not) gambling [C ] // Proceedings of the 15th International Conference on the Foundations of Digital Games . Piscataway : IEEE Press , 2020 : 1 - 4 .

YU G , NIE T Z , LI X H , et al . The challenge and prospect of distributed data management techniques in blockchain systems [J ] . Chinese Journal of Computers , 2019 , 42 : 1 - 27 .

STALLINGS W , BROWN L . Computer security: Principles and practice [EB ] .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据