Read this on twitter: wonder what you guys think…
The most practical way to attack Cardano would be a Spam attack filling all blocks with 16kb spam-tx. This would be surprisingly cheap as one of such tx would just cost 1 ADA. 4 of these tx would fill a block leading to complete congestion for a price of roughly 20$/min.
[https://twitter.com/flubdubster/status/1463813468214202368]
(https://twitter.com/flubdubster/status/1463813468214202368)
Realize that the 51% attack doesn’t really fit this topic. would be nice to have a general “network attacks” tag or something.
The calulations seems plausible to me.
Network parameters
“txFeePerByte”: 44,
“txFeeFixed”: 155381,
Fixed Cost calculation for 1x 16kb TX:
Fixed Cost: 155381
FeePer Byte: 44 / Byte = 704 pro 16 Byte = 720896 / 16 KByte
Total TX Cost: 876277
Cost for one Block (64kb):
Four TX Cost: 3.5 ADA
Spam Attack Cost:
Per Minute: 10.5 ADA
Per Hour: 630 ADA
Per Day: 15120 ADA
Question: How much is the “invalid-hereafter” parameter allowed to be set into the future?
Maybe through a limitation, it still could be avoided that other transactions cannot be added.
On the other hand, an attacker would just add new TXs continuously with the max possible invalid-hereafter. Any transaction which would be added manually would have to wait until this slot is reached then.
Is there a limit of max TX which are accepted on the Mempool?
You can skip it completely and the transaction will never expire.
Mempool size limit is 125 KB now.
Ok, so this would mean that the is a chance that someone else is adding TX if he is submitting a TX right after a block and getting it in the queue within the next 2 blocks. Not optimal, but at least not completely blocking the queue.
To really solve the issue it then would be needed to block the node which is distributing those blocks which requires a combined effort from the SPO community. Or are there other mitigation strategies?
Generally speaking, this supposes that the attacker has an access to all mempools of the network equally and instantly. Practically speaking it is lilkely not the case. Still, this might be annoying but it won’t block normal transactions by other folks to be settled from time to time.
One mitigation strategy is to prioritize transactions from known peers and not from a single origin (which is likely the case during an attack). Some more informations about that here
This is not true. They are missing a big chunk of how fees are calculated.
So, this “practical” way (mentioned in that msg) would require you to spend around 12 ADA per slot so around 120k ADA just to slow the network down for couple of days during 5 day Epoch. All this assuming that no one notices your ongoing 5 day attack.
From recent examples $HOSKY token had 240k transactions in 1 hour. Their sending/minting slow down. The rest of the network barley noticed. I bought and sold CNFT and sent ADA to my wallet and it was there in seconds all during this $HOSKY massive sale.
However, this is just a forum chat (all theory 
). I suggest you ask that individual to go ahead and bring the network down with $20/min. Cardano is after all based on scientific principles and what’s more scientific then testing a theory with an experiment. 
This is exactly why minADA is 1000000 lovelace in addition to transaction fee based on byte size. For the sake of giggles here is a little table for reference:
| ADA / slot | ADA / epoch |
|---|---|
| 2 | 864,000 |
| 6 | 2,592,000 |
| 12 | 5,184,000 |
So if you know anyone willing to spend roughly $10,000,000 to maybe slow down the network for only one epoch it might help to have that data when they work on performance and scaling in the next era 
Couldnt it simpy be filled with metadata as well without the need to wait for anything.
This is good to know and it was my hope that in such a scenario it is still possible to add transactions which then will reduce the no of spam tx. Anywas Hosky was hopefully using some rate limit.
I dont understand. The minAda can be sent back to yourself. They are not lost. So its a budget needed to be able to add a big number of transactions but the budget is not lost.
No. The way Cardano is designed is that on-chain Tx meta data is NOT stored in the ledger state and doesn’t affect transaction validity, so it doesn’t affect ledger performance (which is what spam attack would try to disrupt).
If you are just creating an asset or sending assets to yourself this is a budget. If you are trying to spam then you have to hit as many nodes as possible so all your transactions are outgoing (as in tens of thousands of transactions) and none of the minAda would come back.
You can’t spam just by sending to another wallet that you own. If you do that then you have to wait for Tx to clear to send those assets back and that will be at the speed of block creation.
To spam you have to generate large amount of outgoing Tx in time that is less then block production continuously for prolonged period of time.
Otherwise you are just spamming yourself and your own node. <— Also experimentally testable. 
I think such an attack would try to just fill up the mempool of all nodes so that no other transactions are possible and therefore making the chain un-usable for the duration of the attack. In this scenario it’s not about the ledger performance. Cardano would not have any problem with handling the load of such a scenario as it’s design to run best at high TX load. The issue is just that no one would be able to submit a TX if mempools are constantly full.
As the mempool is limited to 2 blocks (8 TX with 16kb) the money could circle around. Would require some coding to identify incoming UTXO’s so maybe another 2 blocks needs to be prepared in advance to avoid delays in generating the next 8 spam TX.
Right, as mentioned above some blocks in advance are needed to avoid wait times in load generation
My understanding about that:
If you submit the TX to one node it’s immediately synced over to mempool’s of other nodes. This should be with a similar speed to block propagation. So within an average of ~750 ms the TXs are added to mempool’s of all other nodes as well. So even if you only generate the TX on one node the time until you filled up all mempool’s is “just”: The time you need to generate/submit the TX + propagation delay.
Let’s assume this takes 1s in total. This would mean that other network participants only have one 1s time to add a new TX right after the last block was generated before the mempool is full with SPAM again.
Of course I’m not confident about my statement here 
But if I’m right it would mean that the SPAM Attack could fill a maximum of 95% of the capacity (assuming a linear 20s block production, in reality i think it would be close but not exactly 95%)
Just read through the thread with @Psychomb linked above ([FR] - Increase network throughput · Issue #3247 · input-output-hk/cardano-node · GitHub)
The following aspect I think is also very relevant:
Q: Cardano-node uses a fixed-size mempool is currently only 2 blocks in size (~280 txs). If transactions are submitted when the mempool is full, they may be dropped (this is partially tool-dependent. The cardano-node just holds agency with txsubmit protocol until there is room)
A: No, they are not dropped. They are not accepted until there is room. This is the back pressure.
Backpressure would allow the Spammer to already have his backlog of next TXs prepared and added automatically to the mempool when free again.
But! Also the normal users can put something on the backpressure of the node they are connected to. That way this TX would immediately be added to the mempool there. So it depends on which node is making the next block and if this node is connected with a lower latency to the spammer or the normal user. Anyways this is making the attack far less effective. Normal user Tx should still be handled within a few blocks.
Hope this is now correct?
I think you are focusing on a wrong part of transaction process. This isn’t Solana or Nano. Block validation logic and mempool queue is a separate layer. Tx don’t just all rush into mempool first come first serve basis.
When you send a transaction from a wallet you go trough a node. Just a regular node, not a block producing node. This node is responsible for rate of Tx and amount of data arriving and amount of outstanding data.
Each node has protocol parameters that restricts amount of network resources that node can consume. If this node is changed to allow Tx beyond protocol parameters, then the network will drop that node and spam attack will stop.
Backpressure is just a term used for this type of data diffusion. When nodes send all the Tx info, if mempool is full, then Tx diffuse at entrance layer. This backpressure is not on mempool, but on separate network layer managed by nodes with direct peer connections.
So, it is not correct to think that mempool size is somehow total available Tx storage size for a whole Cardano network. Size of storage for Tx is the size of all memory available to ALL nodes and relays that network has connected (that’s of course theoretical maximum, since it’s not possible to max out all memory on all nodes and relays at once due to internet speed/capacity limitations).
This is why calculating cost of a spam attack just using Tx size vs mempool size is same as you trying to remove all cash from all ATM machines in a large city using just your bank card. However, feel free to try.
So, to be able to pull off spam attack that OP is describing you would have to:
However, similar type of attack such as OP suggested did happen on Nano network and another on Solana just recently. So, maybe they were just confusing blockchain protocols (or grouping anything that is not Bitcoin into same category 
)
@Markus-VITAL You are correct about network easily handling the load even if mempool was perpetually full. In their pressure test they went up to 44x max network capacity and aside from having to resubmit some transaction and some general network slowness Cardano network worked right trough it. 
@ADA_user Hope OP question is getting answers. (Feel like we are moving away from the topic of $20 spam attack 
)
Was this really possible? 
Network traffic and tiered pricing - IOHK Blog
Here is a summary of article you linked.
This article talks about future upgrade of transaction fee structure from fair system (currently in place) to tiered system.
It discuses how possible change of the current fee system to tiered pricing with out changing fair treatment of transactions may affect network security.
It uses example of DoS attack to illustrate the point that in a future when Cardano network, post Hydra, becomes so busy that there are constant excluded transactions on regular basis, then changing from current pricing model to tiered pricing model may be necessary, especially in a case of DoS attacks.
Then it offers potential solutions to fix that future problem in a case that network ever reaches that point.
So, I’m not sure how this article is relevant to this discussion.
Cardano is nowhere near the hypothetical network conditions used as an example in this article.
Even if those conditions were here now, the measures I outlined above would still prevent any $20 spam attack from cost and technical perspective. Here is a direct quote from that article:
" As the use of Cardano increases, there will, eventually, come a point when not all transactions will be able to be included in the blockchain, even with adjustments to the parameterization. Although increasing the capacity of the main chain and/or diverting transactions to Hydra or other layer 2 solutions can alleviate this concern, the core system must still work in an agile way in all possible cases and at all times.
This is especially relevant in the case of a denial of service (DoS) attack. With the system as is, an attacker could take advantage of the fair treatment and pass off their malicious spam as legitimate transactions, increasing waiting times for everyone else. There are measures in place (eg, relating to transaction propagation through the peer-to-peer network) that make such an attack technically challenging. However, for extra protection, we would like to be able to increase the costs of such attacks without jeopardizing the fairness and price efficiency of the whole system."
You can clearly see that sentence : “With the system as is, an attacker could take advantage of the fair treatment and pass off their malicious spam as legitimate transactions, increasing waiting times for everyone else.” read in a context of this article it clearly refers to future hypothetical network conditions in relation to transaction fee treatment and DoS attack.
No such conditions exist today and wont exist for a very long period of time.
This article is literally talking about the future time when even Hydra implementation will not be enough to alleviate amount of traffic on Cardano network.
To replicate such conditions today you would have to go through those 6 steps of spam attack I outlined in the post above.
If you would like to read an IOHK article that describes current (not hypothetical) conditions of Cardano network. Check this one out, especial section on Network Capacity and section on Streching the network:
Cardano: robust, resilient – and flexible - IOHK Blog
I recommend this read to anyone who wants a better understanding of current Cardano network. It will also show a glaring difference between Cardano and many of the current blockchains.
If that article peaks your curiosity then you can get more details on current network design of Shelly/ Ouroboros Praos implementation in this network design paper. It’s long and more technical, but very clear.
Shelly Network Design PDF.
Hope this clears up any confusion about what is possible today (vs hypothetical). 
Regarding the article I posted.
While discussing future optimizations it also gives an idea about what is possible today. The following sentence in there (which you also Quoted above) feels very important to me:
With the system as is, an attacker could take advantage of the fair treatment and pass off their malicious spam as legitimate transactions, increasing waiting times for everyone else.
Ok, so put pressure is possible but not cutting out legitime transactions
Regarding your linked article
Thanks @Neo_Spank for the link. Definitely a good read and recommendable for all. It brought me back to my original understanding of the mempool
By using a fixed-size mempool, we avoid the possibility of nodes being overloaded during high-demand periods, but this means that it may be necessary for a wallet or application to re-submit transactions. The mempool size is currently set to 128 KB: twice the current block size. This has been chosen based on queuing models.
With all the discussion we had so far I think my simple answer to someone who posts this would be:
Such a spam attack would bring a big load on the Cardano System. But it would not block other participants from submitting and also executing their transactions in time. So it would not be an effective attack in the end.
The reason for this: The attacker would only be able to push his transaction to a limited number of nodes that he controls. There they stay on the mempool. Other nodes would fill their mempool with TX which are added from legitime TX submitters. Those would have big chance to add his TX there before the according mempool gets filled with Spam messages, but might need some retries (which should be handled by the wallet).
Well, a simple answer would be:
$20 per minute attack would be a insignificant and ineffective It would barley affect the function of a single wallet node out of 1000s, and would have zero effect on a network as a whole.
Reasons are: