7

I´m asking this because a possible attack would be to send an flooding number of orphan transactions, which will never be redeemed. Then clients would have to cache them, increasing storage requirements and reducing lookup time. This can lead to a resource-exhaustion attack.

If there is a limit on the size of the cache, then a DoS can be mounted to exhaust the limit. In both cases, a DoS attack can be mounted.

If there is no protection, adding a proof-of-work to each transaction would help to prevent such attack.

  • What cache are you referring to? – ripper234 Feb 10 '12 at 13:02
  • 1
    I went to the Bitcoin sourcecode for reference. See main.cpp: mapOrphanTransactions. Transactions are added by AddOrphanTx(). There is no limit on the number of orphan transactions that can be inserted in mapOrphanTransactions. The question is therefore: is a DoS attack possible? – SDL Feb 10 '12 at 13:25
  • Also mapOrphanTransactionsByPrev could be attacked, but the fact that c++ map lookup is O(N logN) may prevent the attack to be effective. – SDL Feb 10 '12 at 13:49
  • While it's O(N log N) but you could fill the machine's memory with a DDoS attack sending a significant number of trx. Am I missing something? – usr-local-ΕΨΗΕΛΩΝ Feb 10 '12 at 15:29
  • @SDL "c++ map lookup is O(N logN)". I find that hard to believe. A linear search through the elements would be O(N), which is cheaper than the o(N log N) you suggest. Perhaps you meant to write "is O(log N)". (See also en.cppreference.com/w/cpp/container/map where it says "Search, removal, and insertion operations have logarithmic complexity"). – Chris Moore Feb 10 '12 at 19:06
3

The 0.6 release includes fixes for a couple of denial-of-service vulnerabilities, including this one (see commit 142e6041).

Disconnecting peers that send "too many" orphans might be implemented in a future release.

In the future, if you find a DoS or security vulnerability in a Bitcoin implementation it is best to email the developer or developers so they know about the problem as soon as possible.

  • Sorry, I noticed a (possible) flaw was present in the code after writing the question. – SDL Mar 7 '12 at 13:44
  • I'd be delighted if you post a simple thanks line in the Bitcoin release log! – SDL Mar 7 '12 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.