Read Time: 6 minutes
Ever visited a site that took a long loading time only to find that it can’t be opened at the moment? That is simply all about the effect of Denial of Service Attacks.
Denial of Service (DoS) Attacks are one of the many vulnerabilities that are majorly looked out for when auditing smart contracts. This blog aims to unwind the ins and outs of the DoS attack- what it is, its Impact, types and a lot more to add on.
Let’s quickly get in and explore all of them.
What Is A DoS Attack?
DoS attack intends to disrupt the processing capabilities of a network, server or application, restraining from taking up the requests from legitimate users. In this, the attacker overwhelms the network by sending more traffic that depletes the servers’ memory and bandwidth.
Because of the immense potential that blockchain holds, they are the primary target for DoS attacks to steal away the riches. The most famous cryptocurrencies, such as Bitcoin, Ethereum, etc., have also experienced DoS attacks.
Distributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) is a DoS attack involving the attacker controlling multiple devices to launch an attack on the target node.
The attacker observes the target node and channels the multiple devices under his control to send a large amount of information flooding the target node. This makes the target crash and unable to fulfil the specified task.
Targets Of DoS Attacks In The Blockchain Ecosystem
From the recordings of the past events of DoS attacks, every part of the blockchain ecosystem is vulnerable to DoS attacks. And to name a few,
Cryptocurrency wallets: As with any wallet, the cryptocurrency wallet is used to store, send or receive cryptocurrencies. And those online wallets use smart contracts, which are prone to DoS attacks that hinder their services and interaction with Dapps.
Cryptocurrency exchange services: The online platform wherein cryptocurrencies are traded, and the exchange occurs between users. They are prime targets for hackers to perform DoS attacks that cause the unavailability of the platform and its services.
Ex: Bitcoin exchange platform, Bifinex have suffered DDoS attacks several times.
Memory(transaction) pools: Transactions on the blockchain requires to be validated before they are added to the blocks. Until then, the transaction requests are stored in the mempool, which is like a repository of unconfirmed transactions awaiting to be picked by a miner.
The transaction with a high fee is most likely to be picked by the miner. So flooding the mempool with many transactions of small fees results in the user paying high fees to get their transaction processed. Thus the DoS attack has worked its magic in raising the processing fee.
Consensus participants: They are the players that solve the logic and decide the blocks to be added to the blockchain. Inflicting DoS attacks on the consensus leader stops the whole system.
Mixing services: It employs a protocol for the users to perform transactions anonymously. They suffer DoS attacks by various means, such as excessive participation requests to the mixing pool, inconsistent input for the shuffle, etc.
Smart contracts: Smart contract is the underlying protocol behind every transaction on the blockchain. DoS attacks on smart contracts can crash the node that stops the functioning of Dapps hosted by it.
DoS attacks are performed on them in several possible ways, elaborated in the following section.
Analysing Types Of Smart Contract DoS Attacks
The DoS vulnerability in smart contracts results in unlimited resource usage or manipulation of the contract. This leads to suspension in the execution of normal activities or interrupts and collapses the logic of the contract.
Below lies the classification of various DoS attacks in smart contracts
Unexpected Revert DoS
To study this DoS attack on smart contracts, let’s take an auction contract as an example. The auction contract gets updated with every highest bid received and returns the bid amount of the previous bidder as it is lower than the current bid.
contract Auction {
address frontRunner;
uint256 highestBid;
function bid() public payable {
require(msg.value > highestBid, "Need to be higher than highest bid");
// Refund the old leader, if it fails then revert
require(payable(frontRunner).send(highestBid), "Failed to send Ether");
frontRunner = msg.sender;
highestBid = msg.value;
}
}The attacker contract is initialized with the auction contract in the constructor, which gains access to the auction contract. In this, by calling the ‘attack()’ function, the attacker locks the amount and thereby, it fails to return the bid amount to the attacker even on receiving a higher bid than that.
import "./Auction.sol";
contract Attacker{
Auction auction;
constructor(Auction _auctionaddr){
auction = Auction(_auctionaddr);
}
function attack (){
auction.bid{value: msg.value}();
}
}
It is because the ‘attacker’ contract does not include any ‘receive()’ or fallback function to refund Ether, resulting in the unexpected revert. This makes the attacker contract to be the highest bidder always.
Block Gas Limit DoS
The block has a maximum limit of gas to be spent which is proportional to the amount of computational work to be done. In case of exceeding the gas limit, it lead to two types of DoS attacks.
Gas Limit DoS – Unbounded Contract Operation
There is a set gas limit, and if the transactions reach a higher gas limit than the set limit results in transaction failure.
It becomes even worse when the attacker manipulates the gas needed. That is when the attacker adds a few addresses for a very small refund. Each refund costs a gas fee; thus, the gas cost exceeds the limit that stops the refund transactions from happening.
struct Payee {
address addr;
uint256 value;
}
Payee[] payees;
uint256 nextPayeeIndex;
function payOut() {
uint256 i = nextPayeeIndex;
while (i < payees.length && msg.gas > 200000) {
payees[i].addr.send(payees[i].value);
i++;
}
nextPayeeIndex = i;
}
Therefore, necessary steps must be considered while implementing a loop over an array.
Block Stuffing
The attacker initiates this attack to detain transactions from adding to the blocks by sending computationally intensive transactions with high gas prices. Several transactions are issued in a similar way to consume the entire gas limit.
By paying the high gas fee, the attacker ensures that only the intended transactions are added to the blocks leaving out the rest of them.
Owner Action
Every contract has an owner address who has the authority to open or suspend transactions. The entire operation depends on the owner’s address, and so if it is lost, the user cannot send tokens at all, and the contract functioning will collapse.
Impact Of DoS Attack
Block stuffing is one of the many impacts that prevent legitimate transactions from getting added to the blocks. However, there are several other impacts of DoS attacks.
Bloated ledger: The blockchain ledger is where the transactions are recorded permanently. The blockchain nodes store a copy of the transactions to verify for double-spends. A DoS attack can bloat the ledger with spam transactions.
Network traffic: We know blockchain functions based on peer-to-peer mode. Every node in the blockchain receives a copy of the transaction. A DoS flooding may result in a large transaction volume, consuming the network bandwidth.
Node failures: Blockchain functions on the nodes that require the support of the software to handle large volumes of data. During transaction flooding, the nodes may run out of memory, halting the operations.
Software Crashdown: As we discussed, the mempool or blocks comes with certain limits on the memory allocated to them. The software receives, processes, and stores transactions within the set limit. When the incoming transactions overwhelm the built-in limits, the software crashes.
Restrain Smart Contracts From DoS Attacks
From the analysis of DoS attacks, the following ways can be employed to mitigate the attack.
Puzzles: The servers can generate puzzles such as memory puzzles, time-lock puzzles, CPU-bound puzzles, etc. For a user to gain access to a service, the puzzles have to be solved, which combats the spam attacks.
Fee-based approach: An extra fee can be imposed on the blockchain, such as mining fees for mining pools, transaction fees, etc. This makes the DoS hack costly for the attackers, thereby bringing down such attacks.
Concluding Note
A Smart contract auditing performed at QuillAudits looks out for the potential vulnerabilities that lie in the coding. Some of them include reentrancy vulnerability, storage collision, randomness attack, Denial of Service and so on.
This clearly means the smart contracts are thoroughly tested to be free of Denial of Service attack threats. This ensures your project is shielded from the possible vulnerabilities of the Web3 space.
Watch out for our Telegram channel to gather the latest insights on our services: https://t.me/quillaudits_official
The post Denial of Service Attacks On Smart Contracts: How to Fix and Avoid (An Expert Guide) appeared first on QuillAudits Blog.
