The CertiK team discovered a series of denial of service vulnerabilities in the Sui blockchain. Among these vulnerabilities, a new and highly impactful vulnerability stands out. This vulnerability can cause Sui network nodes to be unable to process new transactions, which is equivalent to shutting down the entire network completely. Just last Monday, CertiK received a $500,000 bug bounty from SUI for discovering this major security vulnerability. CoinDesk, an authoritative media in the US industry, reported on the incident, and then major media followed its report and published related news. This security vulnerability is figuratively called the "hamster wheel": its unique attack method is different from currently known attacks. The attacker only needs to submit a payload of about 100 bytes to trigger an infinite loop in the Sui verification node, making it unable to respond to new transactions. In addition, the damage caused by the attack can continue after the network is restarted, and it can automatically propagate in the Sui network, making all nodes unable to process new transactions like hamsters running endlessly on a wheel. Therefore, we call this unique type of attack a "hamster wheel" attack.

After discovering the vulnerability, CertiK reported it to Sui through Sui’s bug bounty program. Sui responded immediately and effectively, confirming the severity of the vulnerability and taking proactive measures to fix the issue before the mainnet launch. In addition to fixing this specific vulnerability, Sui also implemented preventative mitigation measures to reduce the potential damage that the vulnerability could cause. To thank the CertiK team for their responsible disclosure, Sui awarded the CertiK team a $500,000 bounty.

The persistent harm of “hamster wheel” attack in Sui network

Sui's bug bounty program has strict rules for rating vulnerabilities, which are mainly based on the degree of harm to the entire network. Vulnerabilities that meet the "critical" rating must shut down the entire network and effectively block new transaction confirmations, and require a hard fork to fix the problem; if the vulnerability can only cause a denial of service for some network nodes, it will be rated as "medium" or "high" at most. The "hamster wheel" vulnerability discovered by the CertiK Skyfall team can shut down the entire Sui network and require an official new version to upgrade and fix it. Based on the degree of harm caused by the vulnerability, Sui was ultimately rated as "critical". In order to further understand the severity of the impact caused by the "hamster wheel" attack, it is necessary to understand the complex architecture of Sui's backend system, especially the entire process of on-chain transaction publishing or upgrading. Initially, user transactions are submitted through the front-end RPC and passed to the backend service after basic verification. The Sui backend service is responsible for further verifying the incoming transaction payload. After successfully verifying the user's signature, the transaction is converted into a transaction certificate (containing the transaction information and Sui's signature). These transaction certificates are a fundamental part of the Sui network operation and can be propagated between various verification nodes in the network. For contract creation/upgrade transactions, before they can be put on the chain, the verification node will call the Sui validator to check and verify the validity of the contract structure/semantics of these certificates. It is at this critical verification stage that the "dead loop" vulnerability can be triggered and exploited.

When the vulnerability is triggered, it causes the verification process to be interrupted indefinitely, effectively hindering the system's ability to process new transactions and causing the network to shut down completely. To make matters worse, the situation persists after the node is restarted, which means that traditional mitigation measures are far from enough. Once the vulnerability is triggered, there will be a "persistent damage" situation that will leave a lasting impact on the entire Sui network.

Sui's Solution

After CertiK's feedback, Sui promptly confirmed the vulnerability and released a fix to address the critical flaw. The fix ensures consistency between state changes and the flags after the change, eliminating the critical impact caused by the "hamster wheel" attack. To eliminate the above inconsistencies, Sui's fix includes a small but critical adjustment to the AbstractState::join function. This patch removes the logic of determining the state merge result before executing AbstractValue::join. Instead, it first executes the AbstractValue::join function to merge the state, and sets the flag whether the merge has changed by comparing the final update result with the original state value (old_value). In this way, the result of the state merge will be consistent with the result of the actual update, and no infinite loop will occur during the analysis process. #山寨币 #BTC