# A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses

arXiv: https://arxiv.org/abs/1908.04507 · HTML: https://mlsanity.com/paper/1908.04507/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Aug 2019.

## Built on by (most cited first, 25 of 25)

- [TTAGN: Temporal Transaction Aggregation Graph Network for Ethereum Phishing Scams Detection](https://mlsanity.com/paper/2204.13442/) (2022)
- [Smart-LLaMA: Two-Stage Post-Training of Large Language Models for Smart Contract Vulnerability Detection and Explanation](https://mlsanity.com/paper/2411.06221/) (2024)
- [Eth2Vec: Learning Contract-Wide Code Representations for Vulnerability Detection on Ethereum Smart Contracts](https://mlsanity.com/paper/2101.02377/) (2021)
- [Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2506.18245/) (2025)
- [MANDO: Multi-Level Heterogeneous Graph Embeddings for Fine-Grained Detection of Smart Contract Vulnerabilities](https://mlsanity.com/paper/2208.13252/) (2022)
- [Retrieval Augmented Generation Integrated Large Language Models in Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2407.14838/) (2024)
- [Detecting Malicious Accounts showing Adversarial Behavior in Permissionless Blockchains](https://mlsanity.com/paper/2101.11915/) (2021)
- [The Design Principle of Blockchain: An Initiative for the SoK of SoKs](https://mlsanity.com/paper/2301.00479/) (2023)
- [Vulnerability Detection in Ethereum Smart Contracts via Machine Learning: A Qualitative Analysis](https://mlsanity.com/paper/2407.18639/) (2024)
- [SAEL: Leveraging Large Language Models with Adaptive Mixture-of-Experts for Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2507.22371/) (2025)
- [From Asset Flow to Status, Action and Intention Discovery: Early Malice Detection in Cryptocurrency](https://mlsanity.com/paper/2309.15133/) (2023)
- [FTSmartAudit: A Knowledge Distillation-Enhanced Framework for Automated Smart Contract Auditing Using Fine-Tuned LLMs](https://mlsanity.com/paper/2410.13918/) (2024)
- [AI-Based Vulnerability Analysis of NFT Smart Contracts](https://mlsanity.com/paper/2504.16113/) (2025)
- [Toward Intention Discovery for Early Malice Detection in Bitcoin](https://mlsanity.com/paper/2209.12001/) (2022)
- [Building a Knowledge Graph of Distributed Ledger Technologies](https://mlsanity.com/paper/2303.16528/) (2023)
- [Tikuna: An Ethereum Blockchain Network Security Monitoring System](https://mlsanity.com/paper/2310.09193/) (2023)
- [Cybersecurity threats in FinTech: A systematic review](https://mlsanity.com/paper/2312.01752/) (2023)
- [RiskSEA : A Scalable Graph Embedding for Detecting On-chain Fraudulent Activities on the Ethereum Blockchain](https://mlsanity.com/paper/2410.02160/) (2024)
- [Unveiling Latent Information in Transaction Hashes: Hypergraph Learning for Ethereum Ponzi Scheme Detection](https://mlsanity.com/paper/2503.21463/) (2025)
- [Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions](https://mlsanity.com/paper/2504.17953/) (2025)
- [On-Chain Decentralized Learning and Cost-Effective Inference for DeFi Attack Mitigation](https://mlsanity.com/paper/2510.16024/) (2025)
- [DMind-3: A Sovereign Edge--Local--Cloud AI System with Controlled Deliberation and Correction-Based Tuning for Safe, Low-Latency Transaction Execution](https://mlsanity.com/paper/2602.11651/) (2026)
- [An end-to-end agentic pipeline for smart contract translation and quality evaluation](https://mlsanity.com/paper/2602.13808/) (2026)
- [SmartEval: A Benchmark for Evaluating LLM-Generated Smart Contracts from Natural Language Specifications](https://mlsanity.com/paper/2605.09610/) (2026)
- [Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts](https://mlsanity.com/paper/2607.15673/) (2026)

## Abstract (arXiv)

The blockchain technology is believed by many to be a game changer in many application domains, especially financial applications. While the first generation of blockchain technology (i.e., Blockchain 1.0) is almost exclusively used for cryptocurrency purposes, the second generation (i.e., Blockchain 2.0), as represented by Ethereum, is an open and decentralized platform enabling a new paradigm of computing --- Decentralized Applications (DApps) running on top of blockchains. The rich applications and semantics of DApps inevitably introduce many security vulnerabilities, which have no counterparts in pure cryptocurrency systems like Bitcoin. Since Ethereum is a new, yet complex, system, it is imperative to have a systematic and comprehensive understanding on its security from a holistic perspective, which is unavailable. To the best of our knowledge, the present survey, which can also be used as a tutorial, fills this void. In particular, we systematize three aspects of Ethereum systems security: vulnerabilities, attacks, and defenses. We draw insights into, among other things, vulnerability root causes, attack consequences, and defense capabilities, which shed light on future research directions.