Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!
Researchers present Nyx and Moros, the first eclipse attacks against Monero nodes behind NATs, requiring no inbound access and demonstrated on mainnet.
The paper presents the first eclipse attacks tailored to unreachable Monero nodes operating behind NATs, requiring no inbound access to the victim. The attacks poison the peerlists of reachable nodes, which relay contamination to unreachable nodes' whitelists, then exploit Monero's outbound connection refresh logic to evict benign neighbors and monopolize all outbound connections. Nyx achieves a complete, persistent eclipse of long-running unreachable nodes in large-scale SEED Emulator simulations, while Moros stealthily eclipses newly joined nodes during bootstrapping and was demonstrated on the Monero mainnet. Countermeasures are proposed.