Cardano Blockchain Functions Amidst Major DDoS Attack

Around 8:00 PM tonight (CET Time) the Cardano blockchain was targeted by a massive Distributed Denial of Service (DDoS) attack. Despite this, the network has continued to function effectively.

The attacker used 194 smart contracts per transaction, aiming to overload the network’s validators by exploiting a feature where the size of reference scripts doesn’t impact transaction fees. Each of these transactions cost the attacker 0.9 ADA, intending to fill blocks and create network congestion.

Exact Procedure of the DDoS Attack and Community Counterattack

Let’s go a bit into detail how this attack was executed, and failed, also thanks to the Cardano community intervening.

The attack on the Cardano blockchain was executed by exploiting a feature where the size of reference scripts does not directly impact transaction fees. However, processing these large reference scripts increased the workload on validators because each script execution incurred a setup cost and increased transaction size. The attacker used “always succeeds” credentials, 194 in total, to flood the network with computationally expensive transactions for validators to process.

In response, the community encouraged users to deregister the stake credentials being used by the attacker. For each stake credential deregistered, users received 2 ADA, and since the attacker had 194 such credentials, this quickly became economically unsustainable for the attacker. Deregistering these credentials effectively stopped the DDoS attack, as it would cost the attacker another 400 ADA to restart the attack, which could then be immediately stolen through the same deregistration process.

Despite the attack, the Cardano network continued to operate as intended. The network’s liveliness, or its ability to keep functioning, was unaffected. The conservative settings for block size limit, transaction size limits, and block times ensured that any attack on liveliness was ineffective, leading to wasted funds for the attacker. Validators managed to handle the increased workload from deserializing the 194 junk scripts per transaction (around 200 times their usual workload) without any issues, demonstrating the robustness and capacity for scaling the network parameters.

Immediate Community Response and Mitigation

So that was the technical part, now we’ll have a look at what led to the counterattack as well. Users quickly shared a method to counteract the attack by deregistering the stake credentials used by the attacker, receiving 2 ADA per deregistration. This made the attack economically unsustainable for the attacker. The overall loss for the attacker is estimated to be 788 ADA.

On Block 10,487,530, an attack on the Cardano network began.

🐛 Each transaction executes 194 smart contracts.
🐛 The attacker is spending 0.9 ADA per transaction.
🐛 They are filling each block with many of these transactions.
🐛 The smart contracts used are of type REWARD.

In… pic.twitter.com/QUVm0pq0Q8

— elraulito (@ElRaulito_cnft) June 25, 2024

Intersect, a member-based organization within the Cardano ecosystem, also mobilized a technical task force in collaboration with Cardano Foundation, Input Output HK, and various Stake Pool Operators (SPOs) and developers. This task force quickly identified the source of the spam attack and worked on potential solutions to blunt such attacks in the future.

Update on the spam attack attempted today ⬇️

We want to thank the community for quickly mobilizing to help support us in identifying the source of today’s spam attack on the Cardano mainnet. To complement the community effort to resolve the issue, we have coordinated a technical…

— Intersect (@IntersectMBO) June 25, 2024

Despite the attack, Cardano’s network parameters (block size limit, transaction size limits, block times) remained unaffected. The validators successfully processed the increased workload without major disruptions, showing the system’s ability to handle such attacks. The network experienced higher load than usual, causing some block height battles and minor impacts on transaction timings and chain density, but overall functionality remained stable.

NFT Launched to Celebrate the Network’s Resilience

And this wouldn’t be the crypto community if it didn’t come up with some kind of extra… to mark the unsuccessful attack and celebrate the network’s resilience, NMKR created a special (now sold out) NFT, of which only a 1000 were available (and almost immediately sold out).

— NMKR (@nmkr_io) June 25, 2024

Successful DDoS Attacks on Other Blockchains

Distributed Denial of Service (DDoS) attacks have been a real threat to various blockchain networks, despite their decentralized nature. Here are some examples of successful DDoS attacks on blockchains:

1. Solana Network (September 14, 2021) :
   • Incident: Solana experienced a DDoS attack that caused the network to go offline for several hours. The attack was triggered by a surge in transactions from a newly launched project, with bots generating a peak of 400,000 transactions per second.
   • Impact: The overload led to validator processes running out of memory and crashing, causing significant network congestion. The network had to be hard forked to resolve the issue and restore normal operations.
2. Arbitrum One (September 14, 2021) :
   • Incident: Arbitrum One, a layer 2 protocol on Ethereum, was hit by a DDoS attack that overwhelmed its Sequencer. The Sequencer, responsible for ordering transactions, was knocked offline for about 45 minutes.
   • Impact: The outage prevented new transactions from being accepted and processed on the network, although users could still submit transactions directly to the Ethereum chain for delayed processing.
3. Solana Network (May 1, 2022) :
   • Incident: Solana faced another significant DDoS attack related to the NFT minting tool “Candy Machine”. Bots took over the tool, flooding the network with over 4 million transactions per second at its peak.
   • Impact: This massive transaction surge led to the network being down for seven hours, severely impacting its operations and credibility.

Cardano Survived a Real Stresstest

Despite the intense DDoS attack aimed at crippling the Cardano blockchain, the network not only survived but literally thrived, proving its robust and resilient design. The swift response from the community, combined with the collaborative efforts of the technical task force, ensured the attack was effectively mitigated.

This incident is also quite good publicity for Cardano’s strength as a blockchain.

Continue Reading