An Empirical Analysis of EOS Blockchain: Architecture, Contract, and Security

The gist: This study conducts a comprehensive investigation of the EOS blockchain from five key dimensions: system architecture, decentralization, performance, smart contracts, and behavioral security.

System Architecture Analysis

The architectural analysis focuses on six core components of the EOS system detailing their functionalities and operational workflows. The six major components analyzed are the P2P network communication component, the state management and data block component, the consensus algorithm component, the account management component, the transaction and contract component, and the smart contract execution environment component. The EOS program is built on Graphene which is a two-dimensional carbon nanomaterial composed of carbon atoms arranged in a hexagonal honeycomb lattice via sp-hybridized orbitals. The underlying Graphene software architecture of EOS determines its system architecture advantages. The code framework can be divided into four layers, as shown below: the library function layer, plugin layer, contract layer, and application layer.

Decentralization Evaluation

The decentralization and performance evaluations reveal several critical issues based on data from the XBlock data-sharing platform. Critical issues identified include low account activity, limited participation in the supernode election process, minimal variation in the set of block producers, and a substantial gap between actual throughput and claimed million-level performance. Account analysis shows that 63.67% of all accounts hold token assets, suggesting that these accounts are not active in the EOS ecosystem and will not participate in the election of block producers. The system account eosio ranks first among those with more than 10,000 accounts, but this account's number of created accounts only accounts for 8% of the total.

Performance Metrics

Performance evaluation examines EOS block production, transaction and action statistics, and resource utilization. The average transaction throughput of the EOS system is about 56.40 TPS based on the XBlock data. When the block height exceeded 87.7 million, the throughput peaked at around 126 TPS. This is still far from EOS’s originally claimed throughput of one million TPS. The sudden surge in transaction and action volume during this phase can be attributed to the EIDOS project, which launched a massive airdrop on EOS.

Smart Contract Vulnerabilities and Security

Five common types of vulnerabilities are identified in EOS smart contracts (such as integer overflow and fake EOS attacks). The paper compares four mainstream vulnerability detection platforms, including EVulHunter, EOSFuzzer, WANA, and EOSafe. Known typical vulnerabilities include Integer Overflow, Permission Validation, Fake EOS Attack, Fake Transfer Notification, and Non-Random Random Numbers. Behavioral security analysis summarizes four potential attacks targeting EOSIO and provides an analysis of real-world attack incidents. Real-world attack events include the EOS Fomo3D Werewolf Game and the EOSBet platform suffering from various attacks.

Behavioral Security Threats

Four possible attacks targeting EOSIO are introduced, including Block Delay Attack, CPU Exhaustion Attack, RAM Exhaustion Attack, and Ransomware Attack. A Block Delay attack occurs when a block producer transitions from the exhausted state back to the success state after producing a large number of blocks. CPU exhaustion attack refers to an attacker depleting the target’s CPU power to the extent that the smart contract can no longer be executed. RAM exhaustion attack involves sending a large amount of fake data to deplete the owner’s RAM. A Ransomware attack involves seizing all of the victim’s resources, including CPU, RAM, and EOS tokens. The analysis also covers DApp transfer processes and potential attacks on these transfers.

The study contributes to the ongoing development of the EOS blockchain and provides valuable insights for enhancing the security and regulatory mechanisms of blockchain ecosystems. This paper presents a comprehensive analysis of the EOS blockchain system architecture based on six core components—account management, consensus algorithm, P2P network communication, state management, transactions and contracts, and the smart contract execution environment. Based on data from the XBlock platform, this paper reveals several decentralization issues in the EOS blockchain such as low account activity and minimal changes in the set of block producers. In performance analysis, it shows a significant gap between EOS’s actual throughput and its theoretical goal of achieving millions of transactions per second (TPS). Finally, the paper summarizes five common types of vulnerabilities in EOS smart contracts along with corresponding defense strategies and analyzes four potential behavioral security attacks in EOS. The analysis underscores the importance of proper validation and security measures in the design of DApp transfer processes to prevent such vulnerabilities.

The references are as follows:

[1] Y. Zhong, H. Yang, Y. Li, B. Yang, X. Li, Q. Yue, J. Hu, and Y. Zhang “Sybil attack detection in vanets: An lstm-based bigan approach” in 2023 International Conference on Data Security and Privacy Protection (DSPP). IEEE 2023 pp 113–120

[2] Z. Liu and X. Li “Sok: Security analysis of blockchain-based cryptocurrency” arXiv preprint arXiv:2503.22156 2025

[3] W. Zheng, Z. Zheng, H.-N. Dai, X. Chen, and P. Zheng “Xblock-eos: Extracting and exploring blockchain data from eosio” Inf Process Manage., vol 58 2021

[4] B. Xu, D. Luthra, Z. Cole, and N. Blakely “Eos: An architectural, performance, and economic analysis” Retrieved June vol 11 p 41 2018

[5] A. E. Gencer, S. Basu, I. Eyal, R. Van Renesse, and E. G. Sirer “Decentralization in bitcoin and ethereum networks” in International conference on financial cryptography and data security Springer 2018 pp 439–457

[6] Y. Zhu, J. Zeng, F. Weng, D. Han, Y. Yang, X. Li, and Y. Zhang “Sybil attacks detection and traceability mechanism based on beacon packets in connected automobile vehicles” Sensors vol 24 no 7 p 2153 2024

[7] K.-k WU, B. PENG, H. XIE, Z. HUANG, and X. YAN “Quantitative evaluation method for degree of decentralization of blockchain network based on entropy theory” in Computer and Modernization vol 0 2019 pp 21–

[8] W. Ke-ke, P. Bo, and H. Duan “Coefficient of variation to measure the degree of decentralization of blockchain network” Computer and Digital Engineering vol 49 pp 143–147 2021

[9] J. Liu, W. Zheng, D. Lu et al “Understanding the decentralization of dpos: Perspectives from data-driven analysis on eosio” arXiv preprint arXiv:2201.06187 2022

[10] Y. Zhao, J. Liu, Q. Han et al “Exploring eosio via graph characterization” in International Conference on Blockchain and Trustworthy Systems Springer Singapore 2020 pp 475–488

[11] I. Dernayka and A. Chehab “Blockchain development platforms: Performance comparison” in 2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS) IEEE 2021 pp 1–6

[12] M. Suvitha and R. Subha “A survey on smart contract platforms and features” in 2021 7th International Conference on Advanced Computing and Communication Systems (ICACCS) vol 1 IEEE 2021 pp 1536–1539

[13] N. Kannengiesser, S. Lins, C. Sander et al “Challenges and common solutions in smart contract development” IEEE Transactions on Software Engineering 2021

[14] J. Xu, F. Dang, X. Ding et al “A survey on vulnerability detection tools of smart contract bytecode” in 2020 IEEE 3rd International Conference on Information Systems and Computer Aided Education IEEE 2020 pp 94–98

[15] D. Zhu, F. Yue, J. Pang et al “Bytecode similarity detection of smart contract across optimization options and compiler versions based on triplet network” Electronics vol 11 no 4 p 597 2022

[16] D. Wang, B. Jiang, and W.-K.

1. The improved system can incorporate an enhanced decentralized governance mechanism by integrating insights from EOS decentralization analysis to address a gap in the research on architectural design of the EOS blockchain and identify low account activity, limited participation in block producer elections, and minimal changes in the set of block producers.

2. The system can achieve superior performance optimization by implementing dynamic resource allocation based on token holdings, as suggested by EOS's tokenized resource allocation mechanism, which allows resources to be distributed based on the proportion of tokens held by users.

3. Smart contract security can be significantly strengthened by deploying a multi-layered defense strategy that combines multiple detection tools, such as using EOSFuzzer for fuzz testing and EOSSafe for static analysis, to detect vulnerabilities like fake EOS attacks, fake transfer notifications, rollback attacks, and permission control vulnerabilities.

4. The system's resilience against architectural exploits can be enhanced by implementing proactive monitoring against behavioral threats, specifically by defending against the identified Block Delay Attack and CPU Exhaustion Attack through mechanisms that manage block producer states (success and exhausted).