On Fri, Jul 19, 2024 at 02:52:29PM +0100, Antoine Riard wrote: > Hi Peter, > > > I think you need to re-read the attack carefully before we discuss this > > further. The % of hash power mining full-rbf does not significantly > change the > > cost efficiency of the attack as long as the fee-rate of the B > transaction(s) > > is below the minimum economic fee-rate necessary for miners to mine a > > transaction. Above the minimum economic fee-rate, the cost efficiency is > an > > essentially linear function of % of full-rbf miners. > > This is not the % of hash power mining _full-rbf_ I was pointing to, just > the indistinct > total % of hash power mining. > > In my understanding, this is the scenario: > - Alice broadcasts small size, low-feerate transaction opt-in disabled A to > 99% of the miners+network nodes mempools > - Alice broadcasts a double-spend of A, a high-feerate transaction A2 to > Mark, a single miner > - Network nodes does not relay transaction A to Mark and vice-versa Mark > does not relay transaction A2 to network nodes Here I think you've misunderstood the attack. A is a low fee-rate transaction with opt-in disabled. When it is broadcast, it reaches 100% of nodes. A2 is a full-RBF double-spend of A. When it is broadcast, it reaches all nodes/miners with full-RBF enabled, replacing A. Full-RBF nodes do in fact relay A2 to non-full-rbf nodes they're peered with. But those nodes reject A2 as it is a full-RBF replacement. We are *not* trying to limit A2 to a single miner, or do any kind of simultaneous broadcast. We don't need to. > - Alice broadcasts a child B of transaction A to 99% of the miners+network > nodes mempools The % of miners/nodes that accept B isn't particularly relevant; this is an attack primarily against nodes that have full-RBF disabled (though those nodes will waste the bandwidth of their full-RBF peers). > - Mark, the single miner confirms in a block A2, rendering as a waste A+B > network bandwidth Again, the attack does not depend on a single miner receiving A2. Indeed, it works fine even if 100% of hash power is mining A2. Also, A2 isn't necessarily what gets mined. A2 can be broadcast with a fee-rate only slightly higher than A that is still below the minimum economic fee-rate, and then replaced later with an even higher fee-rate double-spend that is a high enough fee-rate to get mined. Remember that RBF Rule #6 prohibits a replacement if the fee-rate of the replacement is lower than the directly replaced transaction. > Correct if I'm wrong with this scenario and if it does not match the attack > vector you're describing. You're not far off. But I believe you are still misunderstanding details, as described above. > The child B can be extended with a full chain of useless children within > max mempool limits. Correct. Although it's probably simplest to just pick a B that is large enough to max out the mempool limits on its own. > The attack efficiency (i.e the total vB of bandwidth network waste) is > dependent on the delay > by which transaction A2 is included in Mark's block template and > subsequently mined. Back to > my observation, higher are Mark hashrate ressources, less there is latency > to let transaction B > spontaneously propagate on the network, or for Alice to (re)-broadcast in > cycle. Again, A2 does not need to pay a high enough fee-rate to be economical to mine. So there are no particular latency requirements between when A, B, and A2 are broadcast. All that is necessary for this class of attack is there be at least one miner willing to mine A2 (or a further double-spend), who rejects A. > All that said, I think my open question to you at the beginning of my > answer is still there, > i.e how much time has been left between the private report of this issue to > the sec mailing > list and the public disclosure of your email. This attack is simply a variant of attacks that were publicly disclosed months ago, that Core has chosen not to respond to at all, so the exact timeframe isn't very relevant. This is not actually a new class of attack; the whole point of my disclosure is to show that Core does not actually care about this class of attack by showing they won't even bother to fix the simplest possible version, even when the fix is trivial. But anyway, I disclosed on Jul 7th giving a 7 day deadline before I'd publish if I couldn't get any response. I publicly verified that achow (and others) had received my email on Jul 10th, with achow promising a response. On Jul 12th rather than replying, Core closed my full-RBF pull-req that fixes this issue. On Jul 15th I reached out again, and after someone else pointed out that failing to reply to me was degrading the value of the security mailing list, and finally got achow and glozow to respond in a perfunctory fashion (glozow recommended that I open a new full-RBF pull-req). So I published this on Jul 18th after my replies to achow and glozow didn't get any response. This whole time no-one has asked me to not publish this attack; asking me to keep this fact about mempools a secret would be rather duplicitous given that a key argument for TRUC/V3 relies on "free" relay attacks not being possible. Core could have *easily* responded by simply merging my pull-req to enable full-RBF by default, a trivial change that has had lots of ACKs from technical reviewers, which ~100% of hash power has adopted. No-one reasonable would have questioned merging that pull-req. They chose not to do so, proving my point that none of this has anything to do with a genuine technical concern. I was previously on the bitcoin-security mailing list for years, and almost every disclosed attack has gotten a response within 24 hours, with the longest about 72 hours (I just skimmed through my archives to double check). Failing to respond at all is very unusual. -- https://petertodd.org 'peter'[:-1]@petertodd.org -- You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/Zpp6U00Mp7Z/bOej%40petertodd.org.