bitcoin-dev

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

Original Postby Antoine Riard

Posted on: July 19, 2024 23:58 UTC

In the recent discussion on the Bitcoin Development Mailing List, Ava Chow and others delve into the intricacies of a particular type of DoS (Denial-of-Service) attack that exploits transaction relay policies in the Bitcoin network.

The conversation starts with an examination of how the attack operates by utilizing mempoolfullrbf=1 transaction-relay network paths to propagate transactions like A2. This method leverages the full replace-by-fee (RBF) policy settings adopted by a majority of miners, highlighting a scenario where an attacker could exploit network vulnerabilities without necessarily needing the transaction to be mined immediately for the attack to be effective.

The dialogue further explores the potential for this attack to capitalize on asymmetries in network fee-rate segments caused by divergences in transaction-relay policies. It's noted that this isn't a newly discovered class of attacks within Bitcoin development circles, citing historical discussions and pointing out similar concerns raised by developer Gregory Maxwell years ago. This context underscores the complexity and evolving nature of security challenges in the Bitcoin protocol and raises questions about the readiness and competency of those currently maintaining critical security infrastructure to address such issues effectively.

Moreover, the exchange touches upon broader concerns regarding the bitcoin-core security culture and the process for addressing vulnerabilities. There's a call for a reevaluation of how the community responds to and manages security threats, suggesting that a lack of experience or a gap in security knowledge could be factors contributing to inadequate handling of these issues. This point is further illustrated by personal anecdotes, reflecting on experiences with the bitcoin security mailing list and interactions with other security professionals, which seem to indicate a pattern of insufficient responsiveness or understanding when it comes to complex security problems.

Finally, there's a more personal dispute highlighted concerning the conduct of achow101, a maintainer involved in the discussion. The contention revolves around administrative communication practices and the ethical implications of withholding sensitive security information from certain maintainers based on perceived misconduct. This aspect of the conversation suggests deeper issues within the community related to trust, transparency, and the stewardship of critical security responsibilities.

Overall, the emails present a multi-faceted look at the challenges facing the Bitcoin development community, from technical vulnerabilities and their implications for network policy to broader cultural and procedural issues impacting the efficacy of security measures and community governance.