NRDAX-T0326 - Unbounded Peer-Slot Sybil
gossip_abuse · active · first seen 2026-07-09
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
Sybil (SlowMist Blockchain Common Vulnerability List): a flood of full RLPx+eth-handshake peers each with a DISTINCT node identity occupies the target's inbound peer slots and biases peer selection (e
instances (2)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| bitcoin | sybil_peer_identity_flood | lab | reverse-engineered-cve | sybil_peer_identity_flood | github.com ↗ |
| ethereum | geth_sybil_identity_flood | lab | reverse-engineered-cve | geth_sybil_identity_flood | github.com ↗ |
references
vendor-advisory: SLOWMIST-SYBIL
related (gossip_abuse)
NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active
cite
https://nrdax.com/techniques/NRDAX-T0326
plain
NRDAX Registry. Technique NRDAX-T0326.
bibtex
@misc{nrdax_NRDAX_T0326,
title = {Unbounded Peer-Slot Sybil (NRDAX-T0326)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0326},
} json (csl)
{
"id": "nrdax-NRDAX-T0326",
"type": "dataset",
"title": "Unbounded Peer-Slot Sybil (NRDAX-T0326)",
"URL": "https://nrdax.com/techniques/NRDAX-T0326",
"publisher": "NRDAX Registry"
}