19

What protection does Bitcoin have against DoS attacks? Could you bring down a node by flooding it with data?

What happens if someone starts flooding the network with legitimate, yet nonsense, transactions? For example, sending bitcoins from A -> B -> C -> A -> B -> C -> A and so on in a rapid pace.

Improve this question
4
  • 1
    Well, technically, transaction fee is just a hurtle rather than a road blocker. If there are enough incentives for the attacker to sink the whole bitcoin network, he/she could invest enough cash in this. Consider one day, bitcoin currency plays a significant role of one country economy. Won't the opposite country invest a small amount (even millions, which is still a small portion comparing to the whole economy) to block all the trades based on bitcoin?
    – h0cked
    Dec 13, 2011 at 16:18
  • 3
    That's like trying to put Burger King out of business by sending so many people to their restaurants that the lines get too long.
    – David Schwartz
    Dec 13, 2011 at 20:43
  • @davidSchwartz: not really. Bitcoin does not win anything, if the are billions of extra transactions
    – rubo77
    Nov 14, 2017 at 11:55
  • @ DavidSchwartz: Great anology ... but bear in mind, that each of those customers that you flood Burger King with, only wants to buy a single chip. ... not that is where it becomes a problem isn't it?
    – z0mbi3
    Jan 29, 2021 at 19:37

1 Answer 1

Reset to default
12

The network has a moderate amount of protection against DoS attacks. If you flooded a single node with data from a single source, it would just drop you. You could reconnect, of course. You would need a lot of resources and effort to knock out a node, but it's possible to knock out a single node by overloading it.

The owner of an attacked node could simply stop accepting incoming connections and he could still operate. He still might, by sheer bad luck, make some outgoing connections to malicious nodes. But he'd quickly close all such connections and be left only with connections to non-malicious nodes.

Transaction flooding is perhaps the DoS attack for which the network is currently best defended. Trying to flood the network with legitimate, but nonsense transactions won't work very well. To form such a transaction, you have to claim some coins. The network will only maintain one transaction that claims a given output. And to claim newer output generally requires a transaction fee.

It's hard to imagine any scenario in which an attacker could maintain a significant number of concurrently valid transactions without paying large transaction fees. And even if he could, as soon as those were accepted, he'd need to be able to claim additional transaction outputs to keep up the flood. The outputs of the transaction from earlier in the flood would be too new to spend without fees.

In any event, the harm would be minimal. If this were working to cause harm, that would mean legitimate transactions wouldn't be going through. This means their coins would be getting older and older while the attack had to consist of newer and newer transaction outputs. Soon, the legitimate transactions would win.

Improve this answer
4
  • 3
    I would like to add that the vulnerable part of bitcoin isn't the nodes but the pools. They are fairly easily attacked, and are regularly, but it seems they are working at hardening themselves well.
    – Evil Spork
    Sep 3, 2011 at 17:58
  • Is this still a valid answer? Our did the problem change by now?
    – rubo77
    Nov 14, 2017 at 11:47
  • It's still correct in the basics. The fees have just risen, making such an attack even harder and more expensive.
    – David Schwartz
    Nov 14, 2017 at 12:18
  • So if you were a whale, could you perhaps expend maybe $10,000 in fees to cause an enormous DoS which will reach social media, resulting in a tiny market drop of BTC as an asset, which allows you to buy 100BTC again at far more than $1000 less, which still results in a surplus of $90,000?
    – z0mbi3
    Jan 29, 2021 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.