NRDAX-T0329 - Unbounded RPC Response Amplification

mechanism

The node's JSON-RPC handler for batched account-lookup calls (e.g. getMultipleAccounts) imposes no response-size accounting or cost weighting relative to request size, only a flat cap on key count. An attacker submits a small request (~4.8KB) listing well-known large program accounts (Token/BPFLoader2/BPFLoaderUpgradeable), whose ELF/program data stubs are echoed in full, driving a single request to a ~17.8MB response (3,708x amplification) and sustained ~830MB/s egress under parallel workers. The fix-class is response-size-aware rate limiting/cost accounting on batched read RPCs (weighting by bytes returned, not just item count), not a request-count cap.

research

In-depth write-ups of this attack on nullrabbit.ai.

instances (20)

references

related (Response amplification)

cite

https://nrdax.com/techniques/NRDAX-T0329

@misc{nrdax_NRDAX_T0329,
  title = {Unbounded RPC Response Amplification (NRDAX-T0329)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0329},
}

{
  "id": "nrdax-NRDAX-T0329",
  "type": "dataset",
  "title": "Unbounded RPC Response Amplification (NRDAX-T0329)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0329",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0329 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0329.svg)](https://nrdax.com/techniques/NRDAX-T0329-unbounded-rpc-response-amplification)