Feedback-ID: i525146e8:Fastmail
Date: Sun, 26 Jun 2022 20:43:35 -0400
From: Peter Todd <pete@petertodd.org>
To: alicexbt <alicexbt@protonmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <Yrj9N7k8osWsxhY4@petertodd.org>
References: <CALZpt+GOh-7weEypT9JrzcwthZJqHOfj7sf9FMuqi5_FZv0g7w@mail.gmail.com>
 <gmDNbfrrvaZL4akV2DFwCuKrls9SScQjqxeRoEorEiYlv24dPt1j583iOtcB2lFrxZc59N3kp7T9KIM4ycl4QOmGBfDOUmO-BVHsttvtvDc=@protonmail.com>
 <CALZpt+FJ-R9yCoMLP=Vcxk1U7n=-LKHUGctFZj0K-vTMsz==ew@mail.gmail.com>
 <RJEFmrnjbzKQCBr4L7ebwBLzg7QHGXlaE19zj6jfkxL6xjfodgbfssZBQSYxm783Y4X5awuhL9Gj8IaBc4npE2oh3d1xoudKTrSsJ-dk0VQ=@protonmail.com>
 <CALZpt+HXB=xh3qtxJFM7yUzRu1uj-pPtLQmT=5QV0dNfVuTpfQ@mail.gmail.com>
 <Pb8H4PbeS-RaNOKfekOPdY8gQo4_Syd3HoTK26AO872f7tCKyGnty56KtcvmvrXFOJdC7nQgNHoQ37M4MNXQ6vqQ9du6BFbvGLbY3BdYVpY=@protonmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="zwp7TnS3OpeDXg8r"
Content-Disposition: inline
In-Reply-To: <Pb8H4PbeS-RaNOKfekOPdY8gQo4_Syd3HoTK26AO872f7tCKyGnty56KtcvmvrXFOJdC7nQgNHoQ37M4MNXQ6vqQ9du6BFbvGLbY3BdYVpY=@protonmail.com>
Subject: Re: [bitcoin-dev] Playing with full-rbf peers for fun and L2s
 security
Precedence: list


--zwp7TnS3OpeDXg8r
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 26, 2022 at 04:40:24PM +0000, alicexbt via bitcoin-dev wrote:
> Hi Antoine,
>=20
> Thanks for sharing the DoS attack example with alternatives.
>=20
> > - Caroll broadcasts a double-spend of her own input C, the double-spend=
 is attached with a low-fee (1sat/vb) and it does _not_ signal opt-in RBF
> > - Alice broadcasts the multi-party transaction, it is rejected by the n=
etwork mempools because Alice double-spend is already present
>=20
> I think this affects almost all types of coinjoin transaction including c=
oordinator based implementations. I tried a few things and have already rep=
orted details for an example DoS attack to one of the team but there is no =
response yet.
>=20
> It was fun playing with RBF, DoS and Coinjoin. Affected projects should s=
hare their opinion about full-rbf as it seems it might improve things.
>=20
> Example:
>=20
> In Wasabi an attacker can broadcast a transaction spending input used in =
coinjoin after sending signature in the round. This would result in a coinj=
oin tx which never gets relayed: https://nitter.net/1440000bytes/status/154=
0727534093905920

Note that Wasabi already has a DoS attack vector in that a participant can =
stop
participating after the first phase of the round, with the result that the
coinjoin fails. Wasabi mitigates that by punishing participating in future
rounds. Double-spends only create additional types of DoS attack that need =
to
be detected and punished as well - they don't create a fundamentally new
vulerability.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--zwp7TnS3OpeDXg8r
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAmK4/TEACgkQJIFAPaXw
kfv+tggAgg0HaIpO+qVegWegMtPIqgTgcbLFYCd75YHOTMwD3co6loSMgApnHePH
Au/2S+XpWA8iZiLpiwOXlUafhw15uNEHBmCVCHwGw4f1tn4jY/iIFQC0/wm41vFZ
noG3mcrOcAV0hkiVC7RLrrr7nh5rSEm9y3LTGkwDPOTBae93P5WCtGEkrK/P4hvO
rTZHn0gavYiNdDtr4CgC7X9P5/nji1gx0xBaGyh7o6HAz5nLYaq6AvJR8gHfJgU3
RSO47Z74dUE7IS8WGXsD6N953p0tZjc2fVC3RGwWoi7KmDeqoy0p7Q7PFBJRd0Ta
eLPz6keWPxYqdIOwJtJY/PRm+M9o3Q==
=zG7+
-----END PGP SIGNATURE-----

--zwp7TnS3OpeDXg8r--