Abstract

Blockchain technology forms the backbone of Web3, prized for its decentralized, trustless nature and high availability. Innovations in VM layers, such as WebAssembly and Move Lang, aim to provide more secure programming paradigms and ease developer efforts. However, these security enhancements place an additional burden on on-chain validators. The assumption that distributed nodes inherently enhance reliability is increasingly questioned, especially when security flaws in critical paths, such as publishing and executing untrusted smart contract payloads, are exposed.

At POC 2023, we demonstrated methods to compromise on-chain security verifiers in Move-based blockchains. Our presentation revealed how to bypass type-safety enforcement to fabricate arbitrary crypto tokens and circumvent gas meters to introduce infinite loops into the blockchain network.

For POC 2024, we aim to expand our focus to a broader attack surface. We will explore the resource usage of various VM’s on-chain validators, specifically targeting how a single transaction can exhaust the resources of validator nodes, thereby disrupting the entire blockchain network's ability to produce new blocks. Over the past years, we have responsibly disclosed variants of such attack vectors in different blockchain ecosystems, earning more than $1.2 million in bounties.

We will discuss the fundamental reasons why this attack surface is common across modern blockchain VMs. Our presentation will detail three variants of resource exhaustion attacks in 2 popular blockchain ecosystems, demonstrated with real bug bounty vulnerabilities.