SoK: Root Cause of \$1 Billion Loss in Smart Contract Real-World Attacks via a Systematic Literature Review of Vulnerabilities (2507.20175v1)

Abstract: The Ethereum ecosystem, despite its maturity, continues to witness catastrophic attacks, with billions of dollars in assets lost annually. In response, a significant body of research has focused on identifying and mitigating smart contract vulnerabilities. However, these efforts predominantly focus on implementation-level bugs, leaving a critical gap between academic understanding of vulnerabilities and the root causes of real-world high-impact financial losses. We employ a two-pronged methodology: first, a systematic literature review of 71 academic papers to build a comprehensive and up-to-date catalog of 24 active and 5 deprecated vulnerabilities as understood by the research community. Second, we conduct an in-depth, empirical analysis of 50 of the most severe real-world exploits between 2022 and 2025, collectively incurring over \$1.09B in losses, to identify their true root causes. We introduce the concept of "exploit chains" by revealing that many incidents are not caused by isolated vulnerabilities but by combinations of human, operational, and economic design flaws that link with implementation bugs to enable an attack. Our analysis yields insights on how DApps are exploited in practice, leading to a novel, four-tier root-cause framework that moves beyond code-level vulnerabilities. We find that real-world successful attacks on Ethereum (and related networks) trace back to one of the four tiers of (1) protocol logic design, (2) lifecycle and governance, (3) external dependencies, and (4) traditional implementation bugs (classic smart contract vulnerabilities). We investigate the suitability of this multi-tier incident root-cause framework via a case study.