arXiv subjects

Wanning Ding

Publications and source records attributed to Wanning Ding.

5 recordsLinked to original sources

arXiv2026

Position Paper: Denial-of-Service against Multi-Round Transaction Simulation

Transaction simulation is an important subsystem of block building, denial of whose service could lead to severe damage to the blockchain ecosystem and transaction delivery. Denial of block building has been studied, where the existing attack designs either target single-round builders, such as ConditionalExhaust (USENIX Security '24), or target two-round builders, by exploiting cross-round inconsistency, such as GhostTX (USENIX Security '24) and denial of sequencers (CCS '25). This work examines the denial-of-service security of multi-round transaction simulation under a new exploit: inter-transaction dependency that manifests in smart-contract state.

cs.CR↗

arXiv2024

Asymmetric Mempool DoS Security: Formal Definitions and Provable Secure Designs

The mempool plays a crucial role in blockchain systems as a buffer zone for pending transactions before they are executed and included in a block. However, existing works primarily focus on mitigating defenses against already identified real-world attacks. This paper introduces secure blockchain-mempool designs capable of defending against any form of asymmetric eviction DoS attacks. We establish formal security definitions for mempools under the eviction-based attack vector. Our proposed secure transaction admission algorithm, named \textsc{saferAd-CP}, ensures eviction-security by providing a provable lower bound on the cost of executing eviction DoS attacks. Through evaluation with real transaction trace replays, \textsc{saferAd-CP} demonstrates negligible latency and significantly high lower bounds against any eviction attack, highlighting its effectiveness and robustness in securing blockchain mempools.

cs.CR↗

arXiv2024

Understanding the Security Risks of Decentralized Exchanges by Uncovering Unfair Trades in the Wild

DEX, or decentralized exchange, is a prominent class of decentralized finance (DeFi) applications on blockchains, attracting a total locked value worth tens of billions of USD today. This paper presents the first large-scale empirical study that uncovers unfair trades on popular DEX services on Ethereum and Binance Smart Chain (BSC). By joining and analyzing 60 million transactions, we find 671,400 unfair trades on all six measured DEXes, including Uniswap, Balancer, and Curve. Out of these unfair trades, we attribute 55,000 instances, with high confidence, to token thefts that cause a value loss of more than 3.88 million USD. Furthermore, the measurement study uncovers previously unknown causes of extractable value and real-world adaptive strategies to these causes. Finally, we propose countermeasures to redesign secure DEX protocols and to harden deployed services against the discovered security risks.

cs.CR↗

arXiv2023

Towards Automated Discovery of Asymmetric Mempool DoS in Blockchains

In blockchains, mempool controls transaction flow before consensus, denial of whose service hurts the health and security of blockchain networks. This paper presents MPFUZZ, the first mempool fuzzer to find asymmetric DoS bugs by exploring the space of symbolized mempool states and optimistically estimating the promisingness of an intermediate state in reaching bug oracles. Compared to the baseline blockchain fuzzers, MPFUZZ achieves a > 100x speedup in finding known DETER exploits. Running MPFUZZ on major Ethereum clients leads to discovering new mempool vulnerabilities, which exhibit a wide variety of sophisticated patterns, including stealthy mempool eviction and mempool locking. Rule-based mitigation schemes are proposed against all newly discovered vulnerabilities.

cs.CR↗

arXiv2023

Defining and Preventing Asymmetric Mempool DoS in Ethereum with saferAd

This paper presents secure mempool designs under asymmetric DoS attacks. We formulate safety definitions under two abstract DoSes, namely eviction- and locking-based attacks. We propose a safe transaction admission framework for securing mempools, named saferAd, that achieves both eviction- and locking-safety. The proven security stems from an upper bound of the attack damage under locking DoSes and a lower bound of the attack cost under eviction DoSes. The evaluation by replaying real transaction traces shows saferAd incurs negligible latency or insignificant change of validator revenue.

cs.CR↗