Update threat model for Linear Leios #486
Conversation
This should characterize the latest protocol design (linear leios) sufficiently for the threat model.
ch1bo
force-pushed
the
update-threat-model
branch
from
93ea9e8 to
f4853a3
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR updates the threat model to align with the simplified "Linear Leios" design that eliminates Input Blocks (IBs) and couples Endorser Block (EB) and Ranking Block (RB) production by the same block producer. The update reflects significant architectural changes in the consensus mechanism and reassesses threat scenarios accordingly.
Key changes include:
- Updated system overview to reflect Linear Leios architecture with coupled RB/EB production
- Revised threat analysis with updated likelihood assessments and attack vectors
- Added new mitigation strategy (M11) for conflicting transactions and noted limitations of over-parameterization (M5)
ch1bo
force-pushed
the
update-threat-model
branch
from
f4853a3 to
6b0439e
Compare
| **Control type**: By design | ||
|
|
||
| **Implementation**: | ||
| - Protocol design inherently prevents conflicting transactions from reaching the chain |
There was a problem hiding this comment.
Not 100% true any more, because of the need for execution bitmaps.
| #### T?: Honey Pot Contract | ||
|
|
||
| **Description**: An attacker deliberately makes ADA available on-chain so anyone races to claim it with the goal of producing many conflicting transactions. This is very similar to T1, but uses cryptocurrency instead of network resources. | ||
| #### T8: Transaction Withholding |
There was a problem hiding this comment.
A more powerful related attack is to delay releasing transactions for several seconds. This will create a spike in fetches of those transactions so that some nodes do not have enough time to retrieve+validate them and then vote.
Updated scope to fit the latest design we have in the CIP draft. Updated several threats in there. I'm not 100% happy with the level of detail and its honestly a bit hard to maintain (also the diffs are horrible with re-ordering things). Especially as there are very good write-ups of attacks already.
Some key changes / observations:
M5)M11, but I'm not sure whether things avoided by design should be actual mitigations?@will-break-it Feel free to use it or leave it out for the CIP rationale/appendix.