Skip to content

[Neo Core Memory Pool] fix flooding attack#3631

Closed
Jim8y wants to merge 1 commit intoneo-project:masterfrom
Jim8y:mempool-flooding
Closed

[Neo Core Memory Pool] fix flooding attack#3631
Jim8y wants to merge 1 commit intoneo-project:masterfrom
Jim8y:mempool-flooding

Conversation

@Jim8y
Copy link
Contributor

@Jim8y Jim8y commented Dec 17, 2024

Description

This one is to replace #3364, in 3364 i proposed a solution as smart throttler, which is not favored by core dev team, thus in this pr, i propose a much simpler solution that will set a minumum transaction fee barrier when the memory pool is over half filled. and the bar will by dynamicly updated based on the congestion factor.

When the memorypool is full, you have to pay 0.1 GAS to add a transaction.

Fixes # #2862

Type of change

  • Optimization (the change is only an optimization)
  • Style (the change is only a code style for better maintenance or standard purpose)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

@Jim8y
Copy link
Contributor Author

Jim8y commented Dec 17, 2024

@dusmart

@Hecate2
Copy link
Contributor

Hecate2 commented Dec 17, 2024

Can I still spam billions of txs and let them fail due to RateLimitExceeded, almost for free? In this case others cannot send any more tx, or have to send them at a high price.

@Jim8y
Copy link
Contributor Author

Jim8y commented Dec 17, 2024

Can I still spam billions of txs and let them fail due to RateLimitExceeded, almost for free? In this case others cannot send any more tx, or have to send them at a high price.

to that i think we can only fix in network level. like defend against DOS or DDOS in p2p network and rpc server.

@Hecate2
Copy link
Contributor

Hecate2 commented Dec 17, 2024

An attacker may send txs from different corners of the whole network, and we need to stop the attacker's txs, without dropping too many normal txs. Also we always have to let the consensus nodes communicate with others, because the attacker can always let the consensus nodes receive different txs.

We know the impossible CAP triangle among consistency, availability and partition tolerance. In dBFT we prioritize C, and then in a mempool flood it seems we want to keep A. Then we have to sacrifice P. In a robust blockchain system there should be enough nodes to sacrifice for P, and I do think the current methodology in this PR is good. But it is just dropping too many ordinary txs. And it is not saving the bandwidth among consensus nodes. The bandwidth among consensus nodes is the key to the quick availability for a new block.

We may additionally ban too many txs from a single signer, and too many txs from a single peer before a new block is generated. This forms bastions around the consensus nodes, before too many txs overflow the bandwidth of consensus network bandwidth.

Ordinary nodes should try to relay the txs in the PrepareRequest, after relaying the PrepareRequest, if they do know the contents of the txs. A node can forget the too many txs from a single peer or a single signer, unless it is included in a PrepareRequest in a coming block. Unfortunately current ordinary nodes are unable to decode PrepareRequest, and this may require a careful refactor.

The smart mempool throttler was almost the correct way to do this, but it was not handling the good txs well, and was not able to let the txs in the PrepareRequest to be spread in the whole network for the next block to be generated quickly.

{
_system = system;
Capacity = system.Settings.MemoryPoolMaxTransactions;
_metrics = new MempoolMetrics(Capacity) { BaseMinFee = 1_0000 }; // 0.0001 GAS
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be better to define BaseMinFee = 1_0000 with MaxFeeMultiplier and MetricsUpdateIntervalMs.

}
}

private class MempoolMetrics(int capacity)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file of MemPool has too many lines, so it's better for this part to be a separate file?

const double BaseMultiplier = 2.0;
const double ExponentScale = 10.0;

return Math.Pow(BaseMultiplier, CongestionLevel * ExponentScale);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it might be too tricky?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

normally this will not be triggered, just used for defending flooding attacks.

@Hecate2
Copy link
Contributor

Hecate2 commented Dec 17, 2024

Besides, a sender of good txs is unable to judge whether a tx marked RateLimitExceeded will be included in a future block. Other nodes may still possess the tx.

Copy link
Member

@vncoelho vncoelho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am still not in favor of this solution.
For that to be sucess, we would need to be more certain that these txs with more than 0,1 netfee gas will be processed and not replaced or dropped.

@Jim8y
Copy link
Contributor Author

Jim8y commented Dec 18, 2024

Besides, a sender of good txs is unable to judge whether a tx marked RateLimitExceeded will be included in a future block. Other nodes may still possess the tx.

Reality is, this problem may not be real to the core due to transaction numbers we have, but the core is under real threat, we may never find a perfect solution, any solution you can find some issue there, but the most important problem is can we mitigate the issue while bring minor influence to normal transactions.

@Jim8y
Copy link
Contributor Author

Jim8y commented Dec 18, 2024

it might better be defended in network level.

@Jim8y Jim8y closed this Dec 18, 2024
@Jim8y Jim8y deleted the mempool-flooding branch December 18, 2024 02:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants