Delivery-date: Sat, 20 Jul 2024 07:12:29 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of pete@petertodd.org designates 103.168.172.159 as permitted sender) client-ip=103.168.172.159;
Feedback-ID: i525146e8:Fastmail
Date: Sat, 20 Jul 2024 14:10:49 +0000
From: Peter Todd <pete@petertodd.org>
To: Murch <murch@murch.one>
Cc: bitcoindev@googlegroups.com
Subject: Re: [bitcoindev] A "Free" Relay Attack Taking Advantage of The Lack
 of Full-RBF In Core
Message-ID: <ZpvFaRDoNbzSOgIq@petertodd.org>
References: <Zpk7EYgmlgPP3Y9D@petertodd.org>
 <6f6177b4-4fd3-4c22-ad13-97d430d7d0bc@murch.one>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Ktj3vlIIKXJ8qT/d"
Content-Disposition: inline
In-Reply-To: <6f6177b4-4fd3-4c22-ad13-97d430d7d0bc@murch.one>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--Ktj3vlIIKXJ8qT/d
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Fri, Jul 19, 2024 at 02:26:44PM -0400, Murch wrote:
> On 7/18/24 11:56, Peter Todd wrote:
> > # Summary
> > 
> > This is a public disclosure of a vulnerability that I previously disclosed to
> > the bitcoin-security mailing list.
> 
> It seems redundant to point out that some transactions are only relayed by a
> subset of a node population if there are multiple diverging mempool policies
> with significant adoption.

1) So you agree with me in general that this is just one of a large class of
"free" relay attacks?

2) You should re-read my analysis. You do _not_ need significant adoption of
the diverging mempool policy for this attack to work. Literally a single miner
is sufficient.

Indeed, as I pointed out one month ago on this mailing list, a "free" relay
"attack" was happening by accident due to good samaritans attemping to spend
Lightning anchor outputs to clean up the UTXO set, accidentally pinning
Lightning nodes in the process, and the fact that Libre Relay's RBFR was
already sufficent to get the intended transactions mined:

"Libre Relay v27.1 released with lower 1.25x replacement threshold" - Jun 20th 2024
https://groups.google.com/g/bitcoindev/c/n2GNmnz0btw/m/IemUVKBoAgAJ

> However, I concur that Bitcoin Core should match its default setting for
> `mempoolfullrbf` to the behavior of miners, and there appears to be palpable
> evidence that a supermajority of the hashrate has enabled `mempoolfullrbf`.

Thanks!

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZpvFaRDoNbzSOgIq%40petertodd.org.

--Ktj3vlIIKXJ8qT/d
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmabxVEACgkQLly11TVR
Lzcs+RAAnTcZ3xUepdr/ySzRzZS5987+PLRGt+AsDgJvVKxrMFiNSvDfRg+pB5D7
52yRMHsA0KzMFkvfj93Yi18p5fdJOWmbPV2UprQr53Lt1T8fFT9RzF98zhzDoXfm
1+IzxjWk/hY2r4mGTVm69tuHr5Ffz6Xz3IGD3ajZQ63Z5A9/iPCWqpnZElZzg8uH
9cpimJIqVNGdWjYq8++HOc737/lrjRuzTgBg++/2witU9HKkCEA+N6qqALipZ6/A
tLOUbmWeCJvKfFtSh/vto6QOax5Z790L4bPPuc3O9VKCBa/HZabVbUxvhsXXwNz+
b0XO8yyAT9G5N4l8eLn5yEXtS6zSyR0tmp36CZwlGtoMhrttNm9GKJEK89/+O6cV
4HVs7+y97PwjfbPihcT84PeMj9g7cgJ0RI+fTNDwRY0daGR6KoziQaeCLl/7ELha
nlBs5A7STI3c8CxfsQ/flpfElCFHAwHFW2bYWQKrmgUxwOqQApTuTjpXDhSZvVvq
mopNaMrx6VPj2kJ7hbN90hZr36sAzsqvODt3JeR5T8xAgE6Ay1zoFGtbDVDI2nsJ
BMJHXATJNv2bOqbLvhV23uAJMpMvbsFb1cR9iMxTpU4nydRdGmrrzr0Om7xpEN04
advag8CWAPSNekpH3QtHu1Wig4kaVqRRaFH3TWOWnEkIcrpkuNs=
=KGW7
-----END PGP SIGNATURE-----

--Ktj3vlIIKXJ8qT/d--