NRDAX-T0435 - Fixed-Window Rate-Limit Boundary Bypass
Pending classification · active · first seen 2020-01-01
Producer label: rate_limiter_bypass. Not yet assigned a mechanism family.
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
The gasless rate limiter (both consensus and local counters) buckets requests using a fixed-window key derived from truncated timestamp (commit_timestamp_ms/1000), rather than a sliding-window or token-bucket scheme, and this gate sits on the tx-submission path before signature verification. An attacker bursts up to max_tps just before window rollover and again immediately after, so no single window is ever exceeded but ~2x the intended throughput is admitted across the boundary. This yields unauthenticated, consensus-tier admission of double the configured rate, enabling free execution-resource consumption up to the gasless computation-unit cap.
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| sui | sui_GR02_gasless_rate_bypass | lab | NullRabbit Labs | sui_GR02_gasless_rate_bypass | - |
cite
https://nrdax.com/techniques/NRDAX-T0435
NRDAX Registry. Technique NRDAX-T0435.
@misc{nrdax_NRDAX_T0435,
title = {Fixed-Window Rate-Limit Boundary Bypass (NRDAX-T0435)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0435},
} {
"id": "nrdax-NRDAX-T0435",
"type": "dataset",
"title": "Fixed-Window Rate-Limit Boundary Bypass (NRDAX-T0435)",
"URL": "https://nrdax.com/techniques/NRDAX-T0435",
"publisher": "NRDAX Registry"
} 
[](https://nrdax.com/techniques/NRDAX-T0435-fixed-window-rate-limit-boundary-bypass)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0435nrdax cite NRDAX-T0435 --format bibtex