bitcoin-dev

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

Original Postby Peter Todd

Posted on: July 20, 2024 15:03 UTC

In the realm of cryptocurrency and blockchain technology, discussions about securing the network against various types of attacks are paramount.

Among such dialogues, Peter Todd shares insights into the elimination of certain "free" relay attacks within the Bitcoin network, underscoring his direct involvement in identifying and rectifying these vulnerabilities. He highlights two significant issues that have been addressed: the acceptance of non-final transactions into the mempool that would not be valid for an extended period and the nSequence replacement issue that was resolved through the implementation of replace-by-fee (RBF) mechanisms. Despite these advancements, Todd points out the ongoing concerns and potential oversights by the Core development team, particularly regarding the slow response to enabling full-RBF, which could have mitigated these vulnerabilities sooner.

Further complicating the landscape is the introduction of TRUC/V3 transactions, which Todd fears may introduce new avenues for "free" relay attacks, a concern seemingly overlooked by the developers. Additionally, he references a past decision by the Core team to implement mempool expiration, a move that ironically introduced another form of "free" relay attack. This contradiction raises questions about the priorities and responsiveness of the Core team to security threats.

Todd also discusses his One-Shot Replace-By-Fee (RBFR) proposal, detailed at Peter Todd's website, which outlines a strategy to mitigate Denial of Service (DoS) attacks, including those involving the simultaneous broadcast of contradictory transactions. He challenges the community and the Core developers to recognize and address the reality of these DoS attacks as ongoing threats that require immediate attention.

The conversation touches on the topic of weak blocks, with Todd dismissing them as an ineffective solution for preventing "free" relay attacks. His critique extends to the broader discourse surrounding these attacks, suggesting a need for a unified understanding and approach to securing the network against such vulnerabilities. Todd's dialogue underscores a critical examination of current practices and calls for a more proactive stance on network security from the Bitcoin Core development team, urging them to prioritize security considerations over political debates.