Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Header sync should check find split blocks for duplicate headers. #5816

Closed
SWvheerden opened this issue Sep 26, 2023 · 0 comments
Closed

Header sync should check find split blocks for duplicate headers. #5816

SWvheerden opened this issue Sep 26, 2023 · 0 comments
Labels
release-blocker Something that needs to be fixed before a release can be made

Comments

@SWvheerden
Copy link
Collaborator

A miner or attacker with a block with higher proof-of-work can lie about their
difficulty and height, forcing a peer to perform sync. This makes the victim not
accept new blocks and perform useless validations. The attacker is not penalized.
This issue is similar to TARI-013, but attackers need to provide a block with
higher proof of work. This makes the motivation similar to TARI-001: a miner
wants to delay other miners and gain advantage. In this case they can get up to 60
seconds advantage due to acquiring the add_block lock.
The attack leverages the fact that the initial header sync performed in
find_chain_split does not check for duplicated headers and makes requests to an
untrusted node.

All in all, an attacker has to:

  1. Have a block with at least a slightly higher difficulty than the victim
  2. Announce a much greater higher difficulty to the victim in order for them to
    believe they have FallenBehind.
  3. Wait 29s before responding to their find_chain_split request
  4. Answer not_found
  5. Victim will repeat request, wait 29s again
  6. Answer with 998 known blocks and the one new block

Local node should ban peers who lie about their difficulty and provide known blocks.

@SWvheerden SWvheerden added the release-blocker Something that needs to be fixed before a release can be made label Oct 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release-blocker Something that needs to be fixed before a release can be made
Projects
None yet
Development

No branches or pull requests

1 participant