NRDAX-T0280 - Spoofed Endpoint-Proof Bypass Amplification

mechanism

discv4 FINDNODE->NEIGHBORS reflection/amplification (NethermindEth/nethermind#12211): discv4 is Ethereum's connectionless-UDP node-discovery protocol. A ~170 B FINDNODE (packet-type 0x03) makes the node answer with a NEIGHBORS packet (type 0x04) of up to 16 node records (~8-13x larger). Pre-fix the node honoured FINDNODE without a PING/PONG endpoint proof bound to the exact UDP IP:port, so an attacker SPOOFING the victim's source IP reflects+amplifies the large NEIGHBORS replies onto the victim (DRDoS), and a FINDNODE burst starves the discovery response budget. #12211 requires endpoint-proof bonding (proof from endpoint A no longer authorizes requests to endpoint B) + splits the discovery rate-limit budget 50/50 between outbound requests and protocol responses. Wire framing is faithful (hash[32]||sig[65]||type||rlp; hash=keccak256(sig||type|| data)); a VALID secp256k1 signature is NOT required for the capture - the wire SHAPE + flood is the signature - so the 65-byte sig is synthetic. PUBLIC-FIX REPLICATION - loopback UDP mock plays the node (replies NEIGHBORS); no real Nethermind/geth discovery service stood up.

instances (3)

related (Response amplification)

cite

https://nrdax.com/techniques/NRDAX-T0280

@misc{nrdax_NRDAX_T0280,
  title = {Spoofed Endpoint-Proof Bypass Amplification (NRDAX-T0280)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0280},
}

{
  "id": "nrdax-NRDAX-T0280",
  "type": "dataset",
  "title": "Spoofed Endpoint-Proof Bypass Amplification (NRDAX-T0280)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0280",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0280 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0280.svg)](https://nrdax.com/techniques/NRDAX-T0280-spoofed-endpoint-proof-bypass-amplification)