Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!

1 Introduction

• Monero’s P2P integrity matters because eclipse attacks can enable follow-on attacks including deanonymization, network partitioning, and selfish-mining advantages.Prior Monero eclipse attacks required continuous active interference to maintain isolation, increasing cost and detectability.Source: §1 · p. 1
• Prior eclipse attacks generally require direct incoming connections, excluding nodes behind NATs or firewalls.Unreachable nodes are commonly believed to be more secure because they cannot accept unsolicited inbound connections.Source: §1 · p. 1
• The attacks poison reachable nodes’ peerlists so they relay malicious records to unreachable nodes, then exploit normal outbound-connection refresh to replace benign peers.The attack requires no direct interaction with the victim.Source: §1 · pp. 1–2
• Nyx gradually targets existing unreachable nodes through long-term peerlist infiltration, while Moros isolates newborn nodes during bootstrapping using poisoned seed nodes.Once their peerlists are fully compromised, unreachable nodes lack an independent path to rediscover the honest network.Source: §1 · p. 2
• Nyx achieved full takeover within 27 min in emulation, while Moros eclipsed newborn nodes within 8 s; both attacks were evaluated under controlled conditions.The emulation used a 1,200-node network calibrated against mainnet measurements; Moros was tested on the Monero mainnet.Source: §1 · p. 2
• The paper identifies weak peerlist propagation and connection management as structural vulnerabilities disproportionately affecting unreachable nodes.It proposes mitigation strategies alongside the attacks.Source: §1 · p. 2

2.1 Monero’s P2P Network (Sketch)

• Unreachable nodes behind NATs or firewalls accept no incoming connections and depend on outgoing peers for peer discovery, making full compromise of those peers self-reinforcing.Once all outgoing peers are attacker-controlled, no honest node reaches the target.Source: §2.1 · p. 2
• Monero maintains a whitelist of up to 1,000 verified peers and a graylist of up to 5,000 unverified candidates, with graylist records accepted without reachability verification.An attacker controlling an outgoing connection can inject up to 250 records per timed-sync round, displacing older benign entries.Source: §2.1 · p. 2
• Handshake and timed-sync responses carry up to 250 whitelist records, and unreachable nodes learn peer information only indirectly from upstream peers.A sent-address list prevents repeated transmissions and eventually bounds benign-record input from each honest outgoing peer.Source: §2.1 · p. 2
• Monero periodically releases an outgoing-connection slot and chooses a replacement from the local peerlist during normal protocol operation.The refresh releases one slot approximately every 101 s.Source: §2.1 · p. 2
• A newborn node with empty peerlists gets its initial candidates from a hardcoded seed node, so a poisoned seed whitelist can supply only attacker-controlled records.Those records populate the graylist used to select the node’s first 12 outgoing connections.Source: §2.1 · p. 2

2.2 What Do Unreachable Nodes Change?

• Because victims cannot be contacted directly, poisoning must propagate through reachable nodes and survive graylist deduplication; port diversity keeps injected records distinct.Connection takeover must use ordinary refresh logic rather than active resets.Source: §2.2 · pp. 2–3
• A newborn unreachable node can receive an attacker-dominated peer view from poisoned seed responses before it has an independent view of the network.The bootstrapping path gives the attack an early point of entry in the node lifecycle.Source: §2.2 · p. 3
• Nyx compromises reachable peer-information sources whose poisoned whitelists reach the target through timed sync, then uses connection refresh to replace benign peers.Moros instead enters through seed-node bootstrapping before a newborn node forms an independent peer view.Source: §2.2 · p. 3

3.1 Threat Model

• The threat model covers existing and newborn unreachable nodes; the attacker needs no target IP or direct connection, but seeks all 12 outgoing connections.The attacker uses 1,000 distinct /24 subnets for whitelist filling and 20 additional IPs for graylist filling.Source: §3.1 · p. 3

3.2.1 N-I: network-wide peerlist poisoning.

• Nyx poisons reachable nodes’ whitelists using port-diverse records, so a target’s outgoing peers can relay distinct malicious records during timed sync.At its stated upper bound, attacker records occupy 988 of 1,000 whitelist slots (about 98.8%); incomplete reachable-node coverage can lower the actual occupation rate.Source: §3.2.1 · pp. 3–4

3.2.2 N-II: peerlist infiltration.

• Nyx’s N-II phase fills the target’s graylist through timed-sync responses, leaving at most 144 benign records and a malicious fraction of at least 97.1%.Malicious records can then enter the whitelist through the protocol’s Gray→White promotion paths.Source: §3.2.2 · pp. 4–5

3.2.3 N-III: outgoing connection takeover.

• In N-III, normal outbound refresh drops and replaces peers; malicious connections inject records that shrink the benign candidate pool and reinforce takeover.The model’s convergence condition is P_k > q_k; at k = 11, the analysis bounds benign input against 2,750 malicious records per timed-sync round.Source: §3.2.3 · p. 5
• After Nyx’s takeover, all 12 outgoing connections are attacker-controlled, and no benign node can reconnect to the unreachable target.The target’s graylist and whitelist are also dominated by malicious records.Source: §3.2.3 · p. 5

3.3.1 M-I: seed peerlist poisoning.

• Moros eclipses newborn nodes through poisoned seed nodes, whose responses supply the newborn’s initial peerlist before it has independent peer interactions.The attack keeps seed poisoning active, while the newborn’s startup triggers the subsequent phases.Source: §3.3 · pp. 5–6, §3.3.1 · p. 6

3.3.2 M-II: bootstrapping-peerlist hijack.

• In M-II, the newborn writes the seed response’s 250 records to its graylist, making them the candidate pool for its first outgoing connections.The seed response consists almost entirely of malicious records.Source: §3.3.2 · p. 6

3.3.3 M-III: outgoing connection takeover.

• M-III uses malicious initial connections to keep adding records; during initial sync, 11 malicious peers can evict residual benign records before refresh resumes.After synchronization, the k = 11 boundary condition applies and the outgoing connections converge to 12 malicious peers.Source: §3.3.3 · pp. 6–7

4.1 Experiment Setup

• Nyx is evaluated on a 1,200-node Monero emulation, while Moros is tested on mainnet against a controlled newborn target; the target is made unreachable by blocking incoming connections or suppressing its listening port.The emulation uses 100 ASes; the mainnet design limits the attack footprint to six seed nodes and omits graylist poisoning.Source: §4 · p. 7, §4.1.1 · p. 7, §4.1.2 · p. 7

4.3.1 Evaluating N-I (peerlist poisoning).

• By 10 minutes, median reachable-node whitelist occupation reaches 98.5%; at 1,020 minutes it is 97.2%, while 99.5% of nodes remain at or above 95%.The early median matches the 98.8% theoretical upper bound; the later decline is attributed to benign records exchanged during timed sync.Source: Figure 4 · p. 8, §4.3.1 · p. 8

4.3.2 Evaluating N-II (peerlist infiltration).

• The target’s graylist saturates at minute 4, and only two benign records remain by minute 9, below the conservative bound of 144.Once full, the graylist displaces benign entries; the two remaining records are reintroduced by the target’s benign outgoing peers.Source: Figure 5 · p. 8, §4.3.2 · pp. 8–9

4.3.3 Evaluating N-III (outgoing connection takeover).

• Nyx reaches 12/12 outbound takeover in 27 minutes and maintains a stable eclipse; Moros reaches 12/12 in 8 seconds and remains eclipsed for over 650 minutes.Nyx has a 17 h 47 min steady-state window; Moros is monitored for about 10.8 hours after takeover.Source: Figure 6 · p. 8, §4.3.3 · p. 9, Figure 9 · p. 10
• After Nyx’s first malicious outbound connection, timed-sync responses raise the malicious graylist fraction and drive rapid takeover; convergence slows once nine of 12 connections are attacker-controlled.From that boundary, takeover advances when a benign connection is dropped and replaced by a malicious peer.Source: §4.3.3 · p. 9

4.4.1 Evaluating M-I (seed peerlist poisoning).

• Across six official seed nodes, Moros stabilizes at 934 malicious whitelist records on average, a 93.4% occupation rate that yields about 234 malicious records in a 250-record bootstrap response.Timed sync and frequent benign incoming requests cause fluctuations around the high occupation level.Source: Figure 7 · p. 9, §4.4.1 · pp. 9–10

4.4.2 Evaluating M-II (bootstrapping peerlist hijack).

• The newborn target receives 233 malicious records among its initial 250, and its graylist becomes fully malicious within six minutes, remaining so during 11 hours of monitoring.The initially poisoned records make malicious selection likely; established malicious outbounds then amplify the attack.Source: Figure 8 · p. 10, §4.4.2 · p. 10

4.4.3 Evaluating M-III (outgoing connection takeover).

• On mainnet, Moros takes over all 12 outgoing connections in eight seconds, and the newborn’s whitelist becomes dominated by malicious peers within the 1.5-hour attack window.A temporary benign outgoing connection appears at 63 seconds but is subsequently overcome by the peerlist dynamics.Source: Figure 9 · p. 10, §4.4.3 · p. 10

5.1 Attack Feasibility

• At least 12 distinct /24 subnets are needed to avoid filtering when taking over a node’s 12 outgoing peers.Source: §5.1 · p. 11
• With 1,000 IPs across distinct /24 subnets, malicious peers still dominate the candidate set, while concentration in a few subnets significantly reduces their share.The authors describe acquiring 1,000 IPs across distinct subnets as affordable and say a single workstation suffices to mount the attack at network scale.Source: §5.1 · p. 11
• An unpoisoned reachable node can ingest poisoned records from its outgoing peers and promote them from graylist to whitelist.Source: §5.1 · p. 11
• Effective poisoning coverage converges toward 1 even when direct coverage is below 1, provided it is sufficient to seed propagation.The authors do not empirically measure direct coverage or the convergence rate.Source: §5.1 · p. 11

5.2 Generalizability

• Nyx’s local N-II and N-III convergence mechanisms do not depend on global network size, provided N-I keeps poisoning the target’s current outgoing peers.The target’s whitelist and graylist capacities are fixed at 1,000 and 5,000 entries, respectively.Source: §5.2 · p. 11
• Selecting a malicious outgoing peer creates positive feedback: timed sync supplies fresh malicious records, increasing the chance of malicious selection in later replacement rounds.Source: §5.2 · p. 11
• Nyx’s mainnet deployment boundary is maintaining N-I coverage despite churn; the authors claim mechanism transferability, not full mainnet validation against arbitrary existing nodes.Source: §5.2 · p. 11
• Similar eclipse dynamics may affect outbound-only P2P systems with transitive peer discovery, bounded local peerlists, and refresh driven by local peer state rather than global diversity guarantees.Source: §5.2 · p. 11

6.1 Why Existing Defenses Fail

• Under the paper’s threat model, deployed defenses do not block the attacks: the anchor list, connection-retention patch, /24 filter, and increased outgoing connections each leave the relevant attack path open.The /24 filter raises cost by a constant factor under the assumed attacker coverage of more than 1,000 /24 subnets.Source: §6.1 · p. 11

6.2 Protocol-Level Modifications

• Discarding peerlists returned through inbound timed-sync responses would sever Nyx’s N-I-2 injection path, but would not address Moros’s direct whitelist insertion.Source: §6.2 · p. 12
• Deduplicating graylist entries by IP would stop port diversity from amplifying attacker records, but would exclude multiple Monero instances sharing one IP.Source: §6.2 · p. 12
• A per-/24 seed-node whitelist-insertion limit would slow Moros, with stricter limits trading attack speed against legitimate new-node registration delay.It does not block an attacker with persistent long-term Sybil capability.Source: §6.2 · p. 12

6.3 A Structural Perspective

• The three proposed modifications close individual protocol paths: the first two block Nyx, while the third slows Moros; none blocks the persistent-Sybil threat model.Source: §6.3 · p. 12
• The deeper problem is that unreachable nodes lack an honest peer signal independent of their local peerlist; proposed long-term directions are Sybil-resistant identity and eclipse detectability via an independent channel.Source: §6.3 · p. 12

• The attacks combine indirect peerlist poisoning with Monero’s built-in connection update mechanism to take over all outgoing connections and isolate unreachable nodes for extended periods.Source: §7 · p. 12
• Nyx reaches full connection takeover (CTR = 100%, 12/12) within ∼27 min in the 1,200-node emulation, persisting throughout an 18.2 h monitored window.Source: §7 · p. 12
• Moros demonstrates eclipse-at-birth against newborn unreachable nodes on the Monero mainnet using controlled targets and precautions against persistent network impact.Source: §7 · p. 12

• The authors share code, configurations, and a complete raw trace needed to construct the emulation environment and reproduce both attacks.Source: Open Science · p. 14
• Mainnet RPC traces and the specific 1,000 public IPs are withheld to protect third-party privacy and prevent reuse during responsible disclosure; equivalent IP lists remain usable with the released code.Source: Open Science · p. 14
• Released materials include SEED-Emulator scripts, a patched Monero client, attack and monitoring code, configurations, and a complete Nyx emulation trace.Source: Open Science · p. 14

Ethical Considerations

• Mainnet experiments avoid eclipsing uncontrolled nodes; the stated worst case is a small number of failed startup connections and retry overhead.Controlled peers do not provide usable peerlist responses to uncontrolled nodes, and /24 filtering limits the number of controlled outgoing peers they can select.Source: Ethical Considerations · p. 14

A Deferred Related Work

• Prior eclipse attacks commonly require direct incoming access or depend on restarts, while this work targets unreachable Monero nodes through indirect peerlist poisoning.Prior work also studied partitioning and deanonymization across Bitcoin, Ethereum, and Monero.Source: A Deferred Related Work · p. 15

B.1 P2P Communication

• Handshake responses and timed sync messages carry peer records, giving an attacker repeated opportunities to inject records into a target’s graylist.Handshake responses sample up to 250 whitelist records; timed sync occurs about every 60 seconds, and each connection’s new records are bounded by the sender’s whitelist.Source: §B.1 · pp. 15–16

B.2 Peerlist Management

• The whitelist verifies peers and ranks them by last_seen, while graylist records are unverified candidates inserted without reachability checks and evicted FIFO.Periodic probing and outgoing connections can promote graylist peers; active outgoing peers refresh their whitelist ranking, making them harder to evict.Source: §B.2.1 · p. 16, §B.2.2 · p. 16

B.2.3 Anchorlist.

• Monero maintains up to 12 outgoing connections, and a newborn node’s initial candidates come entirely from a seed-node peerlist.If seed-node records are attacker-controlled, the node can establish malicious outgoing connections from startup.Source: §B.2.4 · p. 16, §B.4 · p. 17

B.2.4 Outgoing Peer Selection.

• During steady operation, Monero selects from the whitelist below the threshold of 8 outgoing peers and from the graylist at or above it.After filtering duplicates and represented /24 subnets, graylist selection is approximately uniform; attackers therefore need peers across many subnets.Source: §B.2.4 · pp. 16–17

B.3 Connection Update Mechanism

• The periodic update drops an eligible outgoing connection and immediately replaces it through the selection logic, allowing polluted candidates to replace benign peers over repeated cycles.The trigger occurs when the node is synchronized, has its maximum outgoing connections, and has fewer than two synchronizing connections; the dropped eligible peer is effectively random.Source: §B.3 · p. 17

B.4 Seed Nodes and Newborn Nodes

• Seed nodes provide peer records at startup or after connection failures, so poisoning their whitelists can give newborn nodes attacker-dominated candidate pools.A newborn node starts with empty peer lists and uses its first seed response as its entire initial candidate pool.Source: §B.4 · p. 17

C Moros Whitelist Saturation

• Within 8 s, all 12 initial outgoing-connection slots are malicious; over the 650 min run, malicious whitelist entries grow while benign entries remain at zero after a transient at 63 s.The target briefly establishes a benign outgoing connection at 63 s; that entry is later evicted.Source: Figure 10 · p. 17, C Moros Whitelist Saturation · p. 17

D Detailed Convergence Analysis of N-III

• A malicious replacement returns about 500 fresh records and yields an expected net change of ΔB = −B/10 benign graylist records.The malicious pool is approximately 3,000,000 distinct peer pairs, roughly 600× the graylist capacity.Source: D Detailed Convergence Analysis of N-III · p. 17
• A benign replacement decreases B when B≥50 and can increase it only slightly when B<50.The analysis bounds the 500 returned records to at most about six benign records and estimates FIFO eviction of B/10 benign entries.Source: D Detailed Convergence Analysis of N-III · p. 17

E Whitelist Attack Progression

• By T0+18.5 h, all 1,000 whitelist slots are attacker-controlled, and the top 20 slots remain attacker-controlled for the rest of the run.The benign count starts at 483 and decreases monotonically as graylist promotion and outgoing replacement add malicious entries.Source: E Whitelist Attack Progression · p. 18, Figure 11 · p. 18, Figure 12 · p. 18

F Implementation Details (§4)

• The emulator runs whitelist poisoning across 1,000 /24 subnets and graylist poisoning through persistent connections to reachable nodes.Whitelist filling uses batches of 120 nodes with 1,000 concurrent handshake instances per batch; graylist sync responses inject 250 distinct trash records.Source: F Implementation Details (§4) · p. 18
• A host-side rule blocks new inbound TCP connections to the simulated target while preserving return traffic, and RPC polling records its peer lists and outbound connections every 30 seconds.This preserves the target’s outbound connectivity while monitoring whitelist, graylist, and outgoing-connection changes.Source: F Implementation Details (§4) · p. 18
• For Moros, the mainnet experiment targets the seed-node poisoning path and bootstrapping behavior of a controlled newborn unreachable node.The attacker uses 1,000 virtual nodes against six seed nodes and prepares 6,000 malicious peer records, exceeding the target’s combined whitelist and graylist capacity.Source: F Implementation Details (§4) · p. 18

G Reachable-Node Probing Infrastructure

• Recursive peerlist crawling expands node discovery, repeated checks exclude persistently unavailable nodes, and asynchronous handshakes reduce a full scan from hours to minutes.After the reachable-node inventory stabilizes, each confirmed node receives a dedicated port used in whitelist-filling handshakes.Source: G Reachable-Node Probing Infrastructure · pp. 18–19
• The tool discovers all 1,199 reachable emulation nodes in its first round; prior mainnet measurements report approximately 3,000 reachable nodes.The discovery count is consistent with the authors’ probing results on mainnet.Source: G Reachable-Node Probing Infrastructure · p. 19

H Network Impairment Calibration

• Mainnet measurements found a median RTT near 100 ms, which the emulation reproduces with calibrated delay, jitter, packet loss, and bandwidth settings.Measurements covered 1,312 reachable nodes: 98.9% had zero packet loss, mean loss was 0.43%, and mean jitter was 1.38 ms; the injected impairments were validated at a median RTT of approximately 100 ms.Source: H Network Impairment Calibration · p. 19, Table 2 · p. 19