9 nodes paralyzed and 700 ETH exhausted, in-depth analysis of Chainlink node attack events

This article comes fromTheBlock, original author: Yogita Khatri

Odaily Translator |

Content overview:

This article comes from

, original author: Yogita Khatri

Odaily Translator |

secondary title

Content overview:

1. At least 9 Chainlink node operators were attacked on August 30, causing about 700 ETH in their wallets to be depleted;

2. This attack exploits the node response query vulnerability, and also involves a token related to the network transaction cost and the way the token is used;

3. Chainlink has confirmed the attack and described it as a "failed attempt" to spam the network;

On August 30, nine Chainlink node operators were attacked, and the attackers took about 700 ETH (worth about $335,000 at the time) from their “hot wallets.” Chainlink plays a very important role in the field of decentralized finance, mainly providing price feeding services to decentralized exchanges, wallets, and DeFi protocol aggregation service providers.

According to a source with knowledge of the matter, the attackers sent valid price requests, causing node operators to have to pay a large amount of Ethereum transaction fees - known as gas fees. In addition, Chainlink node operator Certus One also provided more information about this attack. According to Hendrik Hofstadt, CEO of Certus One, this attack previously affected 9 Chainlink node operators, of which only Certus One lost 20 ETH, equivalent to about $7,500 at the current price.

Chainlink also confirmed the attack, but its officials have not disclosed how much ETH was lost and the number of node operators affected. The relevant spokesperson said:

“A brief spam attack did occur on August 30th, lasting about two hours, and while this spam attack did cost Chainlink nodes more ETH, once the network started handling spam properly, the impact of the attack was less Disappeared quickly. In the early stages of a spam request attack, it usually requires the network to consume 'slightly more' resources until the relevant request is identified as spam. This spam attack on Chainlink is actually a failed attempt, which is harmful to the entire blockchain. and the network had no material impact. This failed attempt to spam the Chainlink network is proof that the Chainlink network has become increasingly resilient."

However, the crypto community believes that this type of attack still poses a risk to node operators, because once the attack is carried out, it will sacrifice time for honest actors to make profits, and the network itself will therefore pay a huge price.

secondary title

attack analysis

However, malicious attackers could use the spare gas of node operators to mine the Chi gas token, which was created by decentralized exchange aggregation service provider 1inch.Exchange. Chi is a tokenized form of gas fees designed to hedge against elastically fluctuating gas fees. Chainlink CEO Hendrik Hofstadt said that Chi is currently the most liquid gas token in the market. The token has huge liquidity in the 1inch automated market maker protocol Mooniswap, and this may be the main reason why malicious attackers choose it.

In short, once an attacker sends a price request, node operators have to respond, which forces them to spend a certain amount of gas, and the attacker ends up exploiting some of that gas. The gas price on Ethereum is denominated in "gwei", and the attacker forced them to mint Chi tokens at a higher cost by driving up the gas fee price on these oracles. These tokens are usually used to pay the higher gas fee, But when the gas fee is raised, the attacker can sell Chi tokens in exchange for ETH and make a profit.

According to sources, the malicious actors ended up using Tornado Cash, an Ethereum-based transaction mixer, to mask the path of the illegally earned ETH.

Hendrik Hofstadt revealed that so far, the nine known affected Chainlink node operators are: T-Systems (a subsidiary of Deutsche Telekom), 01Node, Anyblock Analytics, B-Harvest, ChainLayer, Everstake, Figment Networks, LinkPool, and Chainlink itself.

Judging from the names of these node operators, the attackers are likely to carry out the attack in alphabetical order. Since the wallet balance of Chainlink node operators depends to a large extent on their respective internal policies, some operators have assets in their wallets More than 50 ETH, and some operators only have 2-3 ETH in their wallets, which means that if the attacker is lucky, it is very likely to grab more profits.

secondary title

The attack lasted for more than two hours, causing the above nine node operators to exhaust all the ETH in their wallets, and they were unable to respond and satisfy data requests during the attack. Hendrik Hofstadt explained that once node operators run out of ETH, they can no longer pay for transactions, respond to requests or provide data on-chain, essentially paralyzed.

Before Hendrik Hofstadt and his team realized that it was a malicious attack, most of the affected node operators were completely unaware that it was an attack. I chose to continue to recharge the wallet to make up for the gas "fuel", but all the newly injected funds were quickly depleted.

Hendrik Hofstadt explains:

“My team found the way Chi tokens were being minted to be very odd, so reported it to the Chainlink team immediately, their security team started patching, and after about half an hour to an hour, we came to the conclusion that it needed Check out the whitelist, that's the best solution."

In a whitelisting solution, node operators auction off the most valuable data requests from active DeFi protocols like Aave and Synthetix, and then only fulfill their requests while simultaneously blocking all other non-whitelisted requesters.

temporary solution

Hendrik Hofstadt admitted that the whitelist can only be regarded as a temporary solution. If it wants to obtain a permanent solution, Chainlink needs to find "common ground with actual data users" before node operators can change the system. Overall, the attack did not have any material impact on the Chainlink network, as unaffected node operators could still continue to boost price feeds. As an example, the official ETH/USD price feed needs about 25 or 28 data providers, so when 9 node operators have problems, the other node operators are still enough to update the price feed data.

Hendrik Hofstadt revealed that during the attack, some price feeds may be more biased towards the API used by node operators (such as CoinGecko). However, if this attack affects 50% of Chainlink node operators, the price feed data will be affected before there is enough backup.

However, a Chainlink spokesperson insisted that this attack will not affect its network, because the attack behavior is basically expected, and Chainlink's economic incentive model for node operators has also worked as expected. Node operators need to pay anyway. Fees will also continue to power Chainlink's price feed, ensuring that its market cap remains stable (Chainlink's market cap is around $3 billion at the time of this writing).

It is reported that Chainlink is cooperating with some official wallet operators who have been attacked and do not have enough ETH in the hot wallet. It is reported that the node operators who lost funds in the range of 10-20 ETH can obtain supplementary fund support because they use automatic fund replenishment scripts The resulting depletion of funds, but Hendrik Hofstadt said he was unsure if all node operators would be compensated, and a Chainlink spokesperson did not confirm the matter.

secondary title

Attack "Major Incentive": Gas Price Rise

The higher the gas fee, the more trouble it seems for Chainlink node operators.