Attacks show peer-to-peer gossip networks can lose message delivery
Attacking P2P Networks: Liveness Attacks on the GossipSub and DOG Gossip Protocols
Cryptography and Security
Summary
This paper finds security weaknesses in two popular peer-to-peer gossip protocols that help computers share messages in decentralized networks like Ethereum. The authors show that attackers can stop honest computers from getting new messages without changing or faking those messages. For GossipSub, attackers can disrupt groups of honest nodes using a few well-placed nodes. For the DOG protocol, even a single attacker node can block message forwarding, splitting the network. These attacks were tested in simulated environments and suggest ways to improve network resilience.
What this means in practice
- •For blockchain network administrators: Detect and mitigate liveness attacks on P2P gossip layers to maintain message delivery in decentralized blockchain systems.
- •For distributed system engineers: Design more robust gossip protocols that prevent network partitioning and maintain message propagation despite adversarial nodes.
Authors
Jiaheng Li, Anton Paramonov, Yann Vonlanthen
Abstract
Peer-to-peer (P2P) networks form the communication layer of large decentralized systems such as Ethereum, and the correctness of higher-level protocols depends on the gossip layer delivering messages to honest nodes. We study the robustness of two gossip protocols against adversaries whose only goal is to violate liveness, that is, to prevent honest nodes from receiving fresh messages, without forging, altering, or invalidating any message. For GossipSub, the publish-subscribe protocol used by Ethereum, we show that an adversary operating a constant number of geographically distributed nodes with a fixed latency advantage can take over the ``First Message Deliveries'' peer-scoring term and separate a constant fraction of nodes from the honest mesh. We analyze the attack under a geographical model, address the random-peer and outbound-connection mechanisms, and show that the separation can be maintained under realistic churn. For DOG, a transaction-dissemination protocol designed for CometBFT, we first give simple counterexamples in which route filtering disconnects the dissemination graph even without failures or Byzantine participants, and then present a practical attack that uses only a single physical node with a constant number of identities and legitimate actions to disable every forwarding route, separating the full network while allowing only direct publisher-to-neighbor delivery. We verify the attack in a simulated network and analyze its cost, assumptions, and possible mitigations.