Security Threats, Performance Trade-Offs, and Mitigation Strategies in Blockchain-Based Educational Credential Systems: A Comprehensive Review

2.1 Attacks on various layers of blockchain

As illustrated in Figure 2, various types of attacks can occur across different layers of the blockchain architecture.

2.png

Figure 2. Attacks on various layers of blockchain

2.1.1 Application layer attacks

(1) Smart Contract Vulnerabilities

Smart contract vulnerabilities originated as a result of contract code flaws and could be used to disrupt the operations of blockchains.

A reentrancy attack is a type of attack in which a malicious contract repeatedly invokes another contract before the original execution has been done, which can cause the state to be changed or the resource to be exhausted. In educational credential systems, such vulnerabilities could allow unauthorized modification or duplication of certificate records.

Reentrancy Analyzer (RA) that integrates symbolic execution and equivalence verification with a satisfiability modulo theories solver in order to examine Ethereum Virtual Machine (EVM) interactions at the level of the EVM bytecode language. Other prevention strategies are updating the user balances prior to making external calls, limiting the unreliable functions, and using mutex lock to avoid the occurrence of repetitive functions [15]. These measures counter the critical effects of reentrancy vulnerabilities of smart contracts.

Integer overflow happens when an arithmetic operation has surpassed the maximum value that it can represent, whereas integer underflow happens when the operation has an outcome that is below the minimum possible. In smart contracts with the data type being uint 256, overflow may happen where the values may surpass 2²⁵⁶-1 and underflow may happen where the values may fall below zero, yielding wrong computations. These vulnerabilities may undermine the logic of contracts, especially in balancing. To illustrate, an underflow can cause a balance to be reset to a big number so that it becomes possible to perform unauthorized transactions [16]. The most notable examples are the 2018 Beauty Chain attack, in which an overflow could be exploited to withdraw more tokens than usual, and the Proof of Weak Hands exploit, in which the underflow could steal 866 ETH. These cases highlight the risks of inadequate arithmetic checks in smart contracts.

Use solidity compiler versions 8.0 and higher to prevent these problems. As well, the problem of underflow and overflow can be prevented when the code of the smart contract is tested and audited before being deployed.

Denial-of-Service (DoS) attack on smart contracts is the condition when the attacker uses some vulnerabilities to disrupt the normal functioning of the contracts, making them inaccessible to their legal users [17]. In comparison with classic DoS attacks, which saturate servers, smart contract DoS attacks may affect excessive gas usage, logic errors, or locking of contract state, and no additional interaction should take place. Indicatively, recursive functions executed in loops over dynamic data structures may be used to create memory-space exhaustions, resulting in an outright crash. Likewise, operations that are intended to fail (e.g., absence of fallback() or receive() functions) can be blocking. These attacks can block money, limit legitimate transactions, and interfere with dApps. These weaknesses may be extremely harmful in case the developers do not solve them in the initial stages of development because of the immutability of smart contracts.

The mitigation measures are not to use unbounded loops and large dynamic data structures, but rather to perform batch processing or off-chain computing. Access control systems are used to restrain important operations, and the use of secure code patterns like the checks-effects-interactions pattern will minimize the risks associated with external calls. Other controls are circuit breakers, rate limiting, sound estimation of gas, input validation, and comprehensive testing with edge cases to establish weaknesses prior to deployment.

Smart contracts contain logic errors that cause unexpected or malicious behavior as a result of the implementation of business logic errors. Such problems are typically due to improper management of edge cases, misconceptions about how other contracts interact or do not update their contract states correctly. As an example, an error in logic can provide access to repeated withdrawals because of incorrect updating of the balance. As compared to low-level vulnerabilities, logic errors are more difficult to spot since the binaries run properly but result in unintentional actions. These imperfections may result in monetary losses, unauthorized access, or the loss of a contract, which is very dangerous with dApps.

Mitigation involves specification of contract logic clearly, extensive testing and formal verification of the contract logic. Early failure detection techniques include unit testing, fuzzing and Test-Driven Development (TDD). Require and assert functions are used to verify input to ensure proper state transitions, and secure design referents such as checks-effects-interactions minimize risks of external interactions. Also, formal verification (e.g., Certora, MythX, Slither) and security audit by an independent third party are essential to identify the subtle logic errors prior to deployment.

(2) Wallet Vulnerabilities

The vulnerabilities of the wallets are based on the vulnerabilities in software or hardware wallets that are used to store and handle the private keys and other digital assets. They can be either software (e.g. browser extensions or mobile apps) or hardware wallets, and be used either by malware injection, phishing, Man-In-The-Middle (MITM) attack, extraction of keys, or by compromising the supply chain. As an example, user credentials can be stolen by malicious browser extensions or by fraudulent interfaces on wallets, whereas hardware wallets could be exposed to physical access or via security bugs in firmware. Blockchain transactions are permanent, and in the case of lost private keys, one could lose all their assets.

Some of the mitigation measures include code signing, regular update, and sandboxed environments as far as the design of a secure wallet is concerned. Security is improved by using Multi-Factor Authentication (MFA), the integration of a hardware wallet, and transaction confirmation mechanisms. In the case of hardware wallets, the risks can be mitigated through updating the firmware and buying them in reputable platforms. It is also enhanced by the use of non-custodial and open-source wallets that enhance transparency and control. Moreover, the awareness of users about backup procedures and the safety of seed phrases is necessary to avoid wallet-related.

Exchange hacks are dedicated to cryptocurrency trading sites and are based on poor key management, lack of access control, software vulnerabilities, or insider threats. Attackers commonly seek to steal personal keys, account funds or sensitive account information. The high financial consequences of the attacks are indicated by the notable incidents, such as the Mt. Gox (2014) and Coincheck (2018) breaches. Centralized exchanges are most susceptible as they are one of the single points of failure [18].

The mitigation measures comprise saving the majority of funds in offline cold wallets, multi- signature (multisig) schemes, routine security audits, penetration tests, and bug bounties. Two-Factor Authentication (2FA), IP whitelisting, and anti-phishing measures are strong authentication tools that add to the security. Moreover, the possible losses can be minimized due to regulatory compliance and insurance systems. The users should only use trusted exchanges and do not leave huge amounts of money stored on centralized platforms (not your keys, not your coins) [19].

A front-running attack is an attack in which a malicious user notices a pending operation in the mempool and sends a competing operation at a higher fee in order to have priority of execution. This takes advantage of transaction ordering protocols in transparent blockchain solutions. Usually, with DeFi and NFT markets, front-running is a method of attackers to make a profit due to manipulation of transaction timing, providing unfair advantages, price manipulation, and creating less trust in users [20, 21].

The mitigation measures are aimed at decreasing the visibility of transactions and the manipulation of orders. Methods involve commit-reveal schemes to hide details of transaction, private transaction relays (e.g., Flashbots) to avoid public memorools as well as slippage limits to make such attacks less profitable. Furthermore, randomization of the sequence of network transactions, the use of fair transactions and security audits of Miner Extractable Value (MEVs) are aimed at enhancing the resilience of the system [22].

2.1.2 Consensus layer attacks

(1) Byzantine Fault Tolerance (BFT) attacks are an attack on the consensus mechanism of distributed blockchain systems, as well as faulty nodes or malicious nodes that can act dishonestly, collude, or relay conflicting messages. This may cause honest nodes to fail to agree on a consensus, resulting in a variety of problems: in permissioned systems that have less validators, including double-spending, chain forks and network failure. Overall, systems based on BFT are vulnerable in case more than a third of the nodes are compromised [23, 24].

Mitigation is achieved through strong consensus protocols like Practical Byzantine Fault Tolerance (PBFT) and variants thereof, capable of surviving a small number of bad nodes. Other techniques are: validator rotation, randomized leader choice, reputation system, secure protocol communication, and formal verification of the protocol to improve resilience [23, 24].

(2) Nothing-at-Stake attack is a problem that can take place in PoS systems, where validators can serve in two or more competing chains because the cost of computing is low, which increases the chances of forks, double-spending, and network instability [25, 26].

Reducing the conditions that punish fraudulent validators, finality like Ethereum Casper FFG, random selection of validators, and delayed incentive rewarding are some of the mitigation strategies. These strategies provide economic reasons against malice actions and ensure consensus integrity [26].

(3) Long-range attacks have an impact on PoS blockchains because attackers may utilize the past valid minor keys to generate an alternative past chain. It can cause misleading new or offline nodes and weaken chain finality, which may cause double-spending or network partitioning [27].

Countermeasures such as finality rules, which ensure that previously confirmed blocks cannot be rolled back, checkpointing, weak subjectivity assumptions with trusted snapshots, and key rotation are some of the notable countermeasures. Such mechanisms are implemented in protocols like Ethereum (Casper FFG) and Polkadot (GRANDPA) to provide integrity in the chain [27].

(4) A bribery attack happens when a malicious actor pays off the validators or miners to break the protocol rules, including transaction reordering, activity or malicious forks. Such attacks are easier in PoS and delegated consensus systems, where it is frequently less resource-demanding to influence the validators under these systems compared to PoW systems. This type of manipulation may allow for spending twice or make biasing governance choices, which is a threat to the integrity of the network [28].

The mitigation tactics involve the reduction of mechanisms to punish untruthful action, higher staking, and delayed rewards to deter the short-term incentive. Randomized validator selection and confidential ballot eliminate the chances of colluding specifically. Also, there are governance mechanisms and peer observation that led to the detection and prevention of bribery attempts and maintain equity in consensus [28].

2.1.3 Network layer attacks

(1) The routing attacks (e.g., BGP Hijacking) use the vulnerabilities of the internet routing protocols, including BGP to intercept, delay, or modify blockchain traffic. The attackers may divide the network, interrupt communications, or provide incoherent blockchain views, which may allow them to double-spend or stall consensus. As an example, a BGP hijack will be able to isolate a set of nodes to feed them with wrong or delayed data [29].

Encrypted communication (e.g., TLS), redundant network paths, and the selection of peers across both geographic and network boundaries are all mitigation measures. The analysis of BGP abnormalities and the implementation of safety improvements, such as RPKI mitigate the risks as well. The communication resilience is also enhanced by overlay and relay networks (e.g., FIBRE).

(2) An eclipse attack takes out a node by dominating both its in and out connections in such a way that attackers are able to disrupt its knowledge of the blockchain. This may result in twofold spending, rapacious mining or agreement manipulation. They may be in such a form of attacks that tend to utilize a bad peer selection in addition to flooding the nodes with bad IP addresses [30].

Randomized and diverse peer countermeasures were selected, such as blocking associations in the same IP range, using peer rotation, and trusted nodes. Other technologies as well as DNS seeding and whitelisting, will reduce the probability of node isolation [31, 32].

(3) The blockchain network is partitioned into network partitioning broken components, and node-to-node communication is blocked. This can create blockchain inconsistencies, forks, and two-spends attacks. BGP can occasion partitions hijacking, DNS attacks, or DDoS attacks.

Mitigation involves the economic implementation of geographically redundant connections, the distributed nodes, and the implementation of secure routing processes. Resilience of Relay networks enhance the partitioning attacks, encrypted communication, anomaly detection systems, and encrypted communication.

(4) Relay attacks occur in a situation where a hacker gets into and sends the messages between two parties again without their consciousness which makes them believe that they are communicating directly. This kind of attack is common when it comes to wallet transactions authentication protocols particularly in NFC or Bluetooth and may lead to attacks of unauthorized transactions and does not touch any personal key.

The mitigation techniques include mutual to prevent replay attacks nonces and timestamps to prevent replay attacks authentication, proximity verification and secure session control. Reduction of the threat of attack via relay still further is accomplished by making use of end-to-end encryption and other means authentication with biometrics authentication.

2.1.4. Data layer attacks

(1) An insider attack is a block withholding attack in PoW mining pools that a malicious miner does not provide valid blocks, and in its place sends partial proofs (shares) to one to seem valid. This reduces the overall rewards of the pool and can be used in undercutting competing pools, and results in an ultimate effect on trust and decentralization [33].

Mitigating is founded on statistical anomalies detection mining behavior, rewarding programs, Pay-Per-Last-NShare (PPLNS) and cryptographic evidence of truthful mining. These methods detract from the withholding and enhance equity in mining pools.

(2) Transaction malleability enables the attacker to alter the identifier (hash) of a transaction, but not its contents, which can interfere with the operation of other transactions (or also allow the attacker to spend the same money twice). In the Mt. Gox case, this weakness was taken advantage of (Decker and Wattenhofer) [34].

The Segregated Witness (SegWit) update alleviates this problem by splitting signature information into transaction hashes. Other initiatives involve recording transactions in the form of outputs rather than identification and the use of standardized transaction formats to promote integrity.

(3) Data corruption happens when someone makes changes to data before it is recorded on the blockchain or while it is being sent. The blockchain is very good at keeping data safe once it is confirmed. There are some weaknesses in the way data is put into the blockchain in smart contracts or with bad nodes that can cause problems with the data. To stop this from happening, we can use codes called cryptographic hashes, digital signatures and Merkle proofs. We also need to make sure the data we put in is good and valid. The data can also be kept authentic and reliable with the help of the so-called decentralized oracles such as Chainlink, and secure methods of reaching an agreement on data.

(4) Forking attacks refer to a situation as an individual creates another branch of the blockchain to alter transactions or use money twice. It is a frequent occurrence in systems consuming a large quantity of computer power, whereby the longest blockchain is victorious. In case a person possesses more computer power, he or she can cheat the system so that it picks his or her chain in the manner of Eyal and Sirer of 2014.

To discourage we may employ mechanisms that ensure that transactions are final and irreversible. Individuals can also be rewarded to be honest. Punish them in case they attempt to produce false blocks. Proofs of stake Systems which employ a mechanism of securing the blockchain are also safer as they possess regulations that deter malicious acts and make the creation of a counterfeit chain more difficult to an individual.

Hardware/Infrastructure Layer Attacks:

(1) A 51% attack (majority attack) occurs when an entity gains majority control of a network’s computational power (PoW) or stake (PoS), enabling manipulation of the blockchain. This allows double-spending, transaction censorship, and chain reorganization by overriding the honest chain. Such attacks undermine decentralization and trust, particularly in smaller networks with lower hash power, as seen in Ethereum Classic and Bitcoin Gold [35]. This could enable attackers to alter or invalidate issued academic credentials.

Mitigation focuses on increasing decentralization of mining or staking power. Systems like penalties reduction in PoS, block finality checkpointing and hybrid consensus mechanisms (e.g., PoW + PoS) make attacks less possible. Network surveillance and dynamically adjusted difficulty also assistance in the monitoring and reaction to abnormal conduct.

(2) Sybil attack represents a type of attack where a number of fake identities are formed to have disproportionate power in a blockchain network. This may interfere with consensus, corrupt governance or isolate honest nodes. Uncontrolled node creation can also be quite detrimental to permissionless systems [36]. Decentralized academic networks may be manipulated by fake identities.

Sybil-resistant consensus mechanisms like PoW and PoS are considered as the defense mechanisms, in which influence is potentially derived based on resources or stake. Others are reputation systems, identity checks, implementation of peer diversity and evidence-of-personhood. Permissioned blockchains also minimize the risk associated with blockchain as only trusted parties can participate.

(3) DoS/DDoS attacks will interfere with the availability of blockchains by flooding nodes, smart contracts, or network resources with excessive requests. Such attacks may either slow down transactions, block propagation or put nodes offline. A notable example is the Ethereum DoS attack of 2016, which took advantage of inefficient operations to waste a lot of resources. This can postpone or interrupt the certification verification provision to institutions and employers.

The strategies that can be employed to mitigate these issues are rate limiting, resource pricing schemes (e.g., gas fees), and request validation to make the abuse less appealing. Other protection features are DDoS protection services, redundancy of nodes and adaptive filtering. The protocols are also improved, like the EIP-150 in Ethereum, making it more resilient to resource-exhaustion attacks.

(4) Physical attacks are directed to blockchain nodes and focus on hardware access, i.e., full nodes, validator machines, or wallet devices. Attackers can steal private keys, cause havoc, or destroy hardware using such methods as hardware probing or side-channel analysis. Such threats are greater in unsecured setups, e.g., personal devices or insecure infrastructure. With PoS, a breached node can be used to sign blocks or even misuse staked funds.

Strong physical security measures that are part of mitigation are tamper-evident hardware, secure boots, and Hardware Security Modules (HSMs) to protect keys. Other security measures are biometric authentication and PIN protection, geo-redundancy, backups and cold/air-gapped storage of critical keys, minimizing the effects of physical compromise.

(5) In Malicious hardware attacks the device is compromised or there is a backdoor to steal sensitive data or interfere with the work of the blockchain. Hardware wallets, ASIC miners, and validator nodes are the threats that are especially applicable procured out of unreliable sources. As an example, an interfered device can leak private keys or permit unauthorized transactions without being noticed with secretive backdoors to the firmware.

Some of the risk mitigation measures are going to source the devices from reputable vendors, transparency with open-source firmware, and so on updating of firmware regularly. Other solutions, like cryptographic attestation, tampering, and air-gapped architectures, increase security. Trust in hardware components is also enhanced by certification standards (e.g., FIPS 140-2, Common Criteria), and third-party audits.

An overview of the attacks in various layers reveals that educational credential systems are affected the most by the application-layer vulnerabilities, such as smart contract and wallet attacks. These weaknesses may compromise the integrity of the certificate and the ownership of its users. Network-layer attacks, including routing and eclipse attacks, on the other hand, mostly affect the availability and communication reliability. Other systemic attacks, such as BFT attacks and 51% are less prevalent in well-established networks but have consensus-layer attacks such as the 51% and BFT attacks. Furthermore, priorities of mitigation are different. The problems of the application layer require secure coding and auditing, whereas the network and consensus threats rely more on the design of the protocols and infrastructure protection.