Towards Automated Discovery of Asymmetric Mempool DoS in Blockchains
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2023
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910967902765056 |
|---|---|
| author | Wang, Yibo Tang, Yuzhe Li, Kai Ding, Wanning Yang, Zhihua |
| author_facet | Wang, Yibo Tang, Yuzhe Li, Kai Ding, Wanning Yang, Zhihua |
| contents | In blockchains, mempool controls transaction flow before consensus, denial of whose service hurts the health and security of blockchain networks. This paper presents MPFUZZ, the first mempool fuzzer to find asymmetric DoS bugs by exploring the space of symbolized mempool states and optimistically estimating the promisingness of an intermediate state in reaching bug oracles. Compared to the baseline blockchain fuzzers, MPFUZZ achieves a > 100x speedup in finding known DETER exploits. Running MPFUZZ on major Ethereum clients leads to discovering new mempool vulnerabilities, which exhibit a wide variety of sophisticated patterns, including stealthy mempool eviction and mempool locking. Rule-based mitigation schemes are proposed against all newly discovered vulnerabilities. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2312_02642 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | Towards Automated Discovery of Asymmetric Mempool DoS in Blockchains Wang, Yibo Tang, Yuzhe Li, Kai Ding, Wanning Yang, Zhihua Cryptography and Security In blockchains, mempool controls transaction flow before consensus, denial of whose service hurts the health and security of blockchain networks. This paper presents MPFUZZ, the first mempool fuzzer to find asymmetric DoS bugs by exploring the space of symbolized mempool states and optimistically estimating the promisingness of an intermediate state in reaching bug oracles. Compared to the baseline blockchain fuzzers, MPFUZZ achieves a > 100x speedup in finding known DETER exploits. Running MPFUZZ on major Ethereum clients leads to discovering new mempool vulnerabilities, which exhibit a wide variety of sophisticated patterns, including stealthy mempool eviction and mempool locking. Rule-based mitigation schemes are proposed against all newly discovered vulnerabilities. |
| title | Towards Automated Discovery of Asymmetric Mempool DoS in Blockchains |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2312.02642 |