NRDAX-T0006 - Async Runtime Blocking VM Execution

mechanism

The simulateTransaction RPC handler executes the BPF VM synchronously on the calling Tokio worker thread (no spawn_blocking interposed), and because sigVerify defaults off and simulation is gas-free, an attacker can submit CU-maximizing transactions against pre-loaded programs at no cost. Each concurrent request pins a shared executor thread for the full simulation duration, so per-worker throughput degrades proportionally to concurrent request count, exhausting the bounded async worker pool and starving all other RPC handlers sharing it. The fix-class is interposing async offload (spawn_blocking / dedicated thread pool with backpressure) plus request-side CU/cost accounting for simulate calls, not just on-chain compute budgets.

research

In-depth write-ups of this attack on nullrabbit.ai.

instances (3)

references

related (compute_amp)

cite

https://nrdax.com/techniques/NRDAX-T0006

@misc{nrdax_NRDAX_T0006,
  title = {Async Runtime Blocking VM Execution (NRDAX-T0006)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0006},
}

{
  "id": "nrdax-NRDAX-T0006",
  "type": "dataset",
  "title": "Async Runtime Blocking VM Execution (NRDAX-T0006)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0006",
  "publisher": "NRDAX Registry"
}