NRDAX-T0389 - Precompile Gas Underpricing CPU Burn

Compute amplification · Consensus ingest · mis-quantified bound · active · first seen 2026-07-14

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

The BLAKE2F precompile (0x09) exposes an attacker-controlled 'rounds' field that is charged at a flat 1-gas-per-round rate but executes synchronously on the node's RPC-serving thread; because gas cost scales linearly while wall-clock compute per round is effectively free to request, a small eth_call payload (~585 bytes) can force tens of millions of compression rounds. This yields a large asymmetry between request size/cost and CPU time consumed (~405ms vs ~1ms baseline), letting a single cheap call monopolize a worker thread and degrade node responsiveness. The fix-class is bounding/metering precompile-invoked loop primitives (rounds/iteration caps, tighter gas-to-wall-time calibration, or synchronous-call time budgets) at the eth_call/precompile-dispatch layer.

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

research

In-depth write-ups of this attack on nullrabbit.ai.

Burning go-ethereum RPC CPU with one eth_call to the BLAKE2F precompile ↗

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
ethereum	eth_call_blake2f_precompile_rounds_cpu_amp	lab	NullRabbit Labs	eth_call_blake2f_precompile_rounds_cpu_amp	-

related (Compute amplification)

NRDAX-T0006 - Async Runtime Blocking VM Execution active NRDAX-T0076 - Expensive Debug RPC Compute Amplification active NRDAX-T0088 - GetData Request Flood active NRDAX-T0100 - Handshake Crypto CPU Burn active NRDAX-T0139 - Legacy Sighash Quadratic CPU Blowup active NRDAX-T0143 - Malformed Field Gossip Before Validation active NRDAX-T0148 - Malformed KZG Proof Mismatch DoS active NRDAX-T0166 - Move Verifier Fixpoint CPU Exhaustion active

cite

https://nrdax.com/techniques/NRDAX-T0389

plain

NRDAX Registry. Technique NRDAX-T0389.

bibtex

@misc{nrdax_NRDAX_T0389,
  title = {Precompile Gas Underpricing CPU Burn (NRDAX-T0389)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0389},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0389",
  "type": "dataset",
  "title": "Precompile Gas Underpricing CPU Burn (NRDAX-T0389)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0389",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0389 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0389.svg)](https://nrdax.com/techniques/NRDAX-T0389-precompile-gas-underpricing-cpu-burn)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0389

Cite it (BibTeX)

nrdax cite NRDAX-T0389 --format bibtex

CLI guide → GitHub ↗