--- title: "Blockchain Security — Reference · VORNAC Research" description: "Smart-contract, bridge, and consensus-layer threat classes — where the field's actual losses cluster, and the audit patterns that catch them." url: https://www.vornac.com/en/research/ai-emerging/blockchain-security-reference lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/ai-emerging/blockchain-security-reference --- [Research Index](https://www.vornac.com/en/research) / [7 · AI, Data & Emerging Risk](https://www.vornac.com/en/research/ai-emerging) / Blockchain Security — Reference Background · [7 AI, Data & Emerging Risk](https://www.vornac.com/en/research/ai-emerging) # Blockchain Security — Reference. Smart-contract, bridge, and consensus-layer threat classes — where the field's actual losses cluster, and the audit patterns that catch them. ## Smart-contract threat classes - **Reentrancy.** External call before state update lets callee call back into the contract in a state where invariants don't hold. Audit pattern: every external call (`.call`, ERC-20 transfer to unknown address, `safeTransferFrom` with hooks) followed by state mutation = reentrancy candidate. Mitigation: checks-effects-interactions ordering, reentrancy-guard modifier, pull-payment over push. - **Integer overflow/underflow.** Solidity ≥0.8 reverts on overflow; pre-0.8 used SafeMath. Audit pattern: explicit `unchecked { … }` blocks must be reviewed. Common bug: `unchecked` used for gas savings in subtraction without bounds check. - **Access control.** Missing `onlyOwner` on privileged function; `tx.origin` for auth (bypassable via intermediate contract); initializer callable twice; role-renounce paths that brick the contract. - **Oracle manipulation.** Price feed = on-chain DEX spot price. Attacker flash-loans, swaps to move price, calls liquidation. Mitigation: TWAP over >30 minutes; Chainlink-style off-chain aggregation; circuit breakers on price-delta. - **Time-dependence.** `block.timestamp` miner-manipulable by ~15 sec. Don't use for randomness, narrow window comparisons. - **Gas DoS.** Unbounded loop over user-controlled array; `send` to address that consumes more gas than 2300. Mitigation: paginate iteration; pull pattern. - **Front-running / MEV.** Mempool-visible transactions copied with higher gas to extract value. Mitigation: commit-reveal, private mempool (Flashbots), batch auctions. - **Signature replay.** EIP-712 signature missing chainId or nonce → replayable across chain or session. ## Bridge architecture — where the losses live - **Validator-set integrity.** Bridge security == validator set. Ronin (2022, $625M) compromised 5/9 validator keys. Wormhole (2022, $326M) — signature-verification bypass. Audit: how is the validator set rotated? key custody (HSM, threshold)? slashing on misbehavior? - **Message replay.** Withdrawal proof reusable across chains or twice on same chain. Nomad (2022, $190M) — uninitialized trusted root, every message valid by default. - **Asset accounting reconciliation.** Locked on chain A, minted on chain B. Drift = solvency bug. Audit: invariant that `locked == minted` at any block. Off-chain monitor that fires on drift. - **Upgradeability.** Proxy upgrades by admin = unilateral rug risk. Audit: timelock + multisig + on-chain visibility. Compare upgrade governance against actual TVL — TVL grows faster than governance maturity in nearly all projects. ## Consensus-layer threats - **Long-range attack (PoS).** Attacker buys old validator keys (worthless after they unstake), rewrites history from epoch where they had stake. Mitigation: weak subjectivity checkpoints. - **Nothing-at-stake.** Validator votes on every fork because no cost. Mitigation: slashing on conflicting votes. - **MEV at consensus.** Proposer-builder separation (PBS) tries to limit proposer rents; censorship and inclusion-list debates ongoing. - **51% attack on PoW.** Rent enough hash → reorg → double-spend. Economically rational on small chains; Bitcoin-Gold, Ethereum-Classic real-world examples. ## Audit-pattern checklist 1. External calls + state mutations — reentrancy review. 2. `unchecked` blocks — arithmetic review. 3. Every privileged function — access-control review (who can call, can be revoked, can be transferred). 4. Price-input source — TWAP or single-block? Manipulable via flash loan? 5. Loops — bounded by constant or by user input? 6. Upgrade path — admin, timelock, multisig configuration? 7. Signature verification — chainId, nonce, EIP-712 structure correct? 8. Initialization — initializer one-shot? Constructor sets all state? Proxy implementation initialized? **Rule of thumb**In smart-contract audits the most expensive bugs are not exotic — they're access control, oracle manipulation, and upgrade-path mistakes. Spend 70% of audit time on the boring questions: who can call this, what does it trust, and what happens on the unhappy path. Domain [7 · AI, Data & Emerging Risk](https://www.vornac.com/en/research/ai-emerging) Tier Background Engagement phases No specific phase Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Background ML & Cyber Analytics](https://www.vornac.com/en/research/ai-emerging/ml-and-analytics) - [Background NLP in Security — Reference](https://www.vornac.com/en/research/ai-emerging/nlp-in-security) - [Background Cryptographic Hashing — Reference](https://www.vornac.com/en/research/ai-emerging/cryptographic-hashing-reference) [Previous note NLP in Security — Reference](https://www.vornac.com/en/research/ai-emerging/nlp-in-security) [Back to domain](https://www.vornac.com/en/research/ai-emerging) [Next note Cryptographic Hashing — Reference](https://www.vornac.com/en/research/ai-emerging/cryptographic-hashing-reference) From reference to evidence ## Run this against your own environment.