(HAL-06) NO GAS FEES FOR HIGH SEQUENCE NUMBER TRANSACTIONS ALLOWS RESOURCE ABUSE

[SA124]

(HAL-06) NO GAS FEES FOR HIGH SEQUENCE NUMBER TRANSACTIONS ALLOWS RESOURCE ABUSE

Auditor: Halborn
Severity: Critical

Description
Transactions with sequence numbers significantly higher than expected can be added to the mempool and processed by the nodes. These transactions go through the initial validation and queuing phases without incurring any gas fees, despite ultimately failing during block execution due to their unexpected sequence numbers. This behavior allows for the repeated submission of such transactions without cost.

The absence of gas charges for these transactions presents a potential attack vector where a malicious actor can submit thousands of these high sequence number transactions, causing nodes to process them without incurring any costs. This behavior can lead to resource exhaustion as nodes allocate CPU, memory, and I/O resources to handle these transactions. Over time, this can degrade node performance, disrupt normal transaction processing, and potentially lead to denial-of-service (DoS) conditions. The vulnerability undermines the economic incentives designed to prevent network abuse, as it allows attackers to exploit node resources without any financial deterrent.

Proof of Concept
SETUP:
The following macro, added to the the full node's code, prints a message when a transaction is validated:

BVSS
AO:A/AC:L/AX:L/R:N/S:C/C:N/A:H/I:N/D:N/Y:H (10.0)

Recommendation
It is recommended to enforce gas fee requirements not only during the block execution phase but also during the initial transaction validation and mempool inclusion phases. This approach ensures that every transaction, regardless of whether it is ultimately successful or not, incurs a cost to the sender.

Implementing such a requirement will deter malicious actors from submitting high sequence number transactions repeatedly, as they would need to pay gas fees for each transaction. Additionally, this would align the incentives for maintaining network stability, ensuring that only legitimate transactions that contribute to the network's functionality are processed. Moreover, implementing gas fees at earlier stages of transaction processing helps to maintain the economic balance of the network and protects against denial-of-service (DoS) attacks that exploit free transaction processing.

[mzabaluev]

Duplicate of #409.