Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DoS vector when creating transactions. #283

Open
kayabaNerve opened this issue Jan 22, 2021 · 0 comments
Open

DoS vector when creating transactions. #283

kayabaNerve opened this issue Jan 22, 2021 · 0 comments
Labels
bug Something isn't working

Comments

@kayabaNerve
Copy link
Member

This is possible due to a three-fold scenario:

  1. Lack of threading when generating work - which goes back to our lack of multithreading.

  2. Lack of a cap on how many proofs are attempted - when there likely shouldn't be one (4 byte proof for 2 byte difficulty means there should always be a solution; a check if we iterate over the entire solution field may be valuable).

  3. The fact that the initial difficulty is overridden the second a vote is passed. This means the first person to vote for the diff can nuke it.

So this is only possible at the start of the network. Pending an intelligent algorithm on deciding the difficulty, not to mention retargeting, the following fix would work:

When Merit is first gained, if the height < X (start of network), vote for the initial difficulty. Else, vote for the current difficulty. This throws Merit into the pool stopping abuse of a lack of votes. It also should stop poisoning at the start of the network as a malicious actor would need the majority of blocks before X to attack the network as such.

Of course, Merit Holders will be able to manually specify a difficulty, so even in the worst case at the start of the network, we can recover (though such a situation has much more worrying aspects). The relevant RPC calls will be part of #279.

@kayabaNerve kayabaNerve added the bug Something isn't working label Jan 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Development

No branches or pull requests

1 participant