Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!
Researchers present Nyx and Moros, the first eclipse attacks against Monero nodes behind NATs, requiring no inbound access and demonstrated on mainnet.
The paper presents the first eclipse attacks tailored to unreachable Monero nodes operating behind NATs, requiring no inbound access to the victim. The attacks poison the peerlists of reachable nodes, which relay contamination to unreachable nodes' whitelists, then exploit Monero's outbound connection refresh logic to evict benign neighbors and monopolize all outbound connections. Nyx achieves a complete, persistent eclipse of long-running unreachable nodes in large-scale SEED Emulator simulations, while Moros stealthily eclipses newly joined nodes during bootstrapping and was demonstrated on the Monero mainnet. Countermeasures are proposed.
- First eclipse attacks against NAT-unreachable Monero nodes without inbound access
- Attacks poison reachable nodes' peerlists to contaminate unreachable whitelists
- Nyx achieves persistent network-wide eclipse in emulation; Moros works on mainnet
- Countermeasures proposed for Monero's P2P network
From the original article
1 min read at arxiv.orgEclipse attacks isolate a blockchain node by monopolizing its network connections. Existing attacks on Monero (NDSS'25), Bitcoin (USENIX'15/21, S&P'20) and Ethereum (WWW'26) implicitly assume that the adversary can establish inbound connections, thereby excluding a large and practically dominant class of nodes: \textit{unreachable nodes} operating behind NATs.
By Ruisheng Shi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.