Delivery-date: Sun, 31 Mar 2024 11:31:39 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of pete@petertodd.org designates 103.168.172.154 as permitted sender) client-ip=103.168.172.154;
Feedback-ID: i525146e8:Fastmail
Date: Sun, 31 Mar 2024 17:31:47 +0000
From: Peter Todd <pete@petertodd.org>
To: bitcoindev@googlegroups.com
Subject: [bitcoindev] A Free-Relay Attack Exploiting Min-Relay-Fee Differences
Message-ID: <ZgmeAzZp8RS6uMdc@petertodd.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Qnvi3+pULi0x6xlS"
Content-Disposition: inline
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--Qnvi3+pULi0x6xlS
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

It's common for some nodes, especially miners, to have larger than default
mempools, leading to lower-than-normal minrelayfees. This can be exploited for
free-relay attacks as follows:

1. Publish tx A, with an unusually low fee-rate, below typical
   min-relay-fees, but with a sufficient size to have a reasonably large absolute
   fee. In my experience it is not difficult to get very low fee rate
   transactions mined if they're broadcast by well-connected nodes. Specific
   connections to miners is not required.

2. Publish B, double-spending A, with a fee-rate high enough to be accepted by
   most mempools. But with a total fee less than A.

3. Publish C, spending B, with a low fee rate and large size. Nodes with A will
   not accept C, as it spends a txout that they're not aware of.

4. To recover funds, double-spend A with A', with a sufficiently high fee-rate
   to get mined.

Since package replacement has not been implemented, the combination of C and B
will not replace A, and the total cost of the attack will be limited to the
cost of spending A.

As usual, C can in turn be double-spent at higher and higher fee-rates. C could
also be double-spent across multiple different nodes with different, almost
identical, variants of C.


# Mitigation

Package replacement. Though it is still economically irrational for miners to
"mitigate" this attack: they earn more money by simply mining the high fee-rate
A', with replace-by-fee-rate.


# Responsible Disclosure

You're reading it. Since this type of attack is public, other variants of
attacks along these lines should just be openly discussed. Better to have
plenty of people who understand the issue so there's lots of eyes on potential
fixes.

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZgmeAzZp8RS6uMdc%40petertodd.org.

--Qnvi3+pULi0x6xlS
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmYJngEACgkQLly11TVR
LzeuKw/9EUxUwen1W8vGDtFnwLBxfK7AEYih8h+BUKqnINWTmJE/NpTPdHLXA1IF
RwFcO2saVQAfceSTgXm1DrWWEYFJa9mnNb2xBOV5tkUWX2I6aaAtfIZ6L0RkB2BV
y9oaJUAh98+k+Mia3xf5Zm4+gLtET3eIIkgF7eK3Ge8cDCzFAqihoXsUV7XRYC5J
TOn5D4XbYHHz7pJumb69tAvNuaYCdBNjJrLtAIzLCMHEXNsbII26BpRQ2B6r1iAH
0As/qMxFZZPuekQohUA52TEZwvNXppX0wWI9mp4b4p4WPZ8exmDpUT6JGYVkdYCt
aimNK/V5vG9A2NfcxS1UIvxFVePuZcSzCg6fR9U4Uhbc7lAXVFSqj5UHPQGM5+n/
xDa8nR3SFsQEJl3nmJAVu4vsNVnR0NeoBT/FjeB7rrjSccjL6x/INyEoDxlVB+Kp
FHssEawqQktLYu+s6TNPfYEy2ih2eORnrcOBzuYLQm/h64jhN7Zv40VFjRXzdklY
Bxt5lBNVDVOk6IdFBjlHPiZ916MaGi5ACxQXqrXQetL0dxUlAIqPDq+kyxwT5wky
36pTwH20GNfgF77issQHQ6LtN+oUFahOqzHsfuylrgXqVYmN2e/WK7VFGZA93iVo
QLNiCkPWSktUmILpm71Y3h0T4JeZEE3xtgGGShBMy30ap90qEBg=
=Jibx
-----END PGP SIGNATURE-----

--Qnvi3+pULi0x6xlS--