Threat Landscape and Attack Vectors
What to Know
Organize attacks by target. Smart-contract attacks: reentrancy, integer issues, access-control gaps, oracle manipulation, flash-loan-assisted price distortion, front-running and MEV, and logic errors in upgradeable proxies. Consensus and network attacks: 51 percent, selfish mining, eclipse attacks, Sybil identities, and transaction-ordering manipulation. Key and endpoint attacks: phishing, malicious wallet approvals, supply-chain compromise of dependencies, and clipboard or address-swapping malware. Bridge and DeFi attacks: validator compromise, signature verification flaws, and liquidity-pool manipulation.
Know the kill chain for each: initial access, execution, persistence, exfiltration. For example, a phishing site obtains an approval, then a later transaction drains tokens through the allowance.
Traps
- Calling every price anomaly an "oracle hack"; often the oracle reported correctly and the protocol misused a spot price.
- Treating a 51 percent attack as theft of funds; it primarily enables double-spend and censorship.
- Confusing front-running with a consensus failure; ordering manipulation is economic.
- Assuming audits eliminate risk; audits are point-in-time.
Rule of Thumb
Name the attacker capability the exploit requires (capital, key, timing, code access) and the control that removes it. Worked example: an attacker borrows heavily, skews a pool's spot price, and liquidates positions. The capability is capital plus atomic ordering; the control is a time-weighted average price oracle with sanity bounds.
Study Focus
Build a table of attack, layer, capability, and control. Expect questions that describe symptoms and ask for the root cause, so practice separating the trigger from the underlying weakness.