Eclipse Attack

The attacker floods the target node's connection slots with malicious or sybil nodes under their control. By monopolizing all peer connections, the attacker creates a false, isolated network view. This allows them to:

• Withhold new blocks or transactions from the victim.
• Feed the victim a fabricated, alternative chain.
• Enable follow-on attacks like double-spending or Selfish Mining against the eclipsed node.

An eclipse attack is typically a precursor to more damaging exploits, as controlling a node's view enables:

• Double-Spending: The attacker can convince a merchant node (e.g., an exchange) that a payment is confirmed while secretly mining a conflicting transaction on the real chain.
• Weakening Consensus: Isolating a significant portion of mining power can reduce the honest network's hash rate.
• Data Denial: Preventing a node from seeing legitimate transactions or blocks, degrading network service.

This attack exploits weaknesses in a node's peer discovery and management. Early Bitcoin and Ethereum clients were vulnerable. Key mitigations now include:

• Inbound/Outbound Connection Limits: Restricting the number of connections from a single IP or subnet.
• Structured Peer Tables: Using protocols like Kademlia DHT (in Ethereum) to make sybil attacks more difficult.
• Deterministic Node Selection: Algorithms that randomize peer selection based on specific criteria to prevent predictable isolation.

An Eclipse Attack often relies on or combines with other network threats:

• Sybil Attack: The attacker creates a large number of fake identities (nodes) to populate the victim's peer list. Eclipse attacks are a practical application of a Sybil attack.
• BGP Hijacking: At the internet routing level, an attacker could reroute a node's traffic to isolate it, a more powerful but higher-complexity method to achieve eclipsing.

The Kovan testnet suffered a sustained eclipse attack in 2016, providing a live case study. An attacker monopolized connections to the network's bootnodes, which are hardcoded entry points for new nodes. This caused the network to split into multiple partitions, disrupting consensus. The incident revealed critical flaws:

• Over-reliance on a small set of centralized bootnodes.
• The ease of sybil attacks to create malicious nodes.
• This event prompted Ethereum to implement more robust peer discovery and node identity management protocols.

In September 2020, the Monero network experienced a severe denial-of-service (DoS) attack that leveraged eclipse-like tactics. Attackers flooded the network with malicious nodes, overwhelming legitimate peers and isolating parts of the network. While not a pure eclipse attack, it shared the core mechanism of peer connection manipulation. The attack:

• Highlighted the vulnerability of cryptonote-based peer-to-peer stacks.
• Forced the Monero community to deploy emergency patches.
• Underlined that privacy-focused chains are not immune to network-layer attacks.

Beyond isolating a node for consensus attacks, researchers have explored eclipsing a node's mempool. By controlling all connections, an attacker can:

• Censor transactions from reaching the victim miner or merchant.
• Front-run transactions by seeing private order flow.
• Create a fake blockchain view by feeding the victim only specific, attacker-created blocks. This variant shows the attack's utility beyond double-spending, enabling financial surveillance and extraction of MEV (Miner Extractable Value).

Historical research converges on critical mitigation strategies now implemented in major protocols:

• Increased Maximum Inbound Connections: Raising from 8 to over 100 (Bitcoin).
• Anchor Connections: Persisting trusted peer addresses across sessions.
• Deterministic Node ID Selection: Using IP/Port hashing to prevent sybil attacks on slots.
• Outbound Connection Diversity: Ensuring connections span multiple network groups (/16 subnets).
• Regular Peer Rotation: Evicting old peers to prevent long-term infiltration. The attack remains a persistent threat, especially for new, bootstrapping nodes.

A Sybil Attack involves creating many fake identities (Sybil nodes) to gain disproportionate influence over a network. This is a prerequisite for an Eclipse Attack, as the attacker uses these fake nodes to monopolize the victim's peer connections. Key characteristics include:

• Low-cost identity creation in permissionless networks.
• Goal to subvert reputation systems or, in this case, network topology.
• Defenses often involve Proof-of-Work or Proof-of-Stake to raise the cost of creating identities.

Network Topology refers to the arrangement of nodes and connections (edges) in a peer-to-peer network. The resilience to Eclipse Attacks depends heavily on topology. Common structures include:

• Random Graphs: Default in many blockchains; vulnerable if peer selection is predictable.
• Structured Overlays (e.g., Kademlia DHT): Used by Ethereum; can be more resistant if properly implemented.
• Defensive designs include increasing the number of outgoing connections and using diverse, hardcoded bootnodes.

A 51% Attack is a consensus-layer attack where an entity controls the majority of a blockchain's hashing power or stake, allowing them to double-spend or censor transactions. Contrast with an Eclipse Attack:

• Eclipse: A network-layer attack targeting a single node's view.
• 51% Attack: A consensus-layer attack targeting the entire network's truth.
• An Eclipse Attack can be a stepping stone to enable a 51% Attack against a targeted miner by feeding them a fake blockchain.

Ethereum uses a Node Discovery Protocol based on a modified Kademlia Distributed Hash Table (DHT) to manage peer connections. Its design directly impacts Eclipse resistance:

• Kademlia ensures nodes connect to a diverse, geographically distributed set of peers.
• V5 (Discv5) introduces stricter cryptographic handshakes and topic-based advertising.
• Vulnerabilities historically included predictable node ID generation, which allowed attackers to position themselves in the victim's k-buckets (peer lists).

The Uncle Bandit Attack is a specific Eclipse Attack variant targeting Ethereum miners. The attacker eclipses a victim miner and withholds blocks, then releases them as uncles (stale blocks) to:

• Steal mining rewards by making the victim's blocks invalid.
• Reduce the network's security by increasing the uncle rate.
• This demonstrates how a network-level Eclipse can be weaponized for direct financial theft at the consensus layer.