Staircase attack
Staircase attack is a recent attack on the attestation incentives. Staircase attack aims to make honest validators suffer from penalties even if they strictly follow the protocol in a...

<div><h2><a href="https://ethresear.ch#p-53730-staircase-attack-1" rel="nofollow"></a>Staircase attack</h2><a href="https://www.usenix.org/system/files/usenixsecurity24-zhang-mingfei.pdf" rel="nofollow">Staircase attack</a> is a recent attack on the attestation incentives. Staircase attack aims to make honest validators suffer from penalties even if they strictly follow the protocol in a synchronous network after Capella upgrade. In staircase attacks, Byzantine validators withhold their attestations to prevent the canonical chain from justifying the last checkpoint. As illustrated in Figure 1, in epoch ee, the Byzantine validators withhold their attestations to prevent the honest validators from justifying the checkpoint cp_0cp0. The attestations from Byzantine validators are included in a withheld block b_1b1, a block proposed by a Byzantine validator. Before the middle of epoch e+1e+1, all honest validators extend the chain led by block b_0b0. After the middle of epoch e+1e+1, the withheld block b_1b1 is released. The last justified checkpoint is updated as only the withheld chain includes two-thirds of attestations for checkpoint block cp_0cp0. The chain led by cp_1cp1 is filtered in HLMD-GHOST and the chain led by b_1b1 becomes the canonical chain. In this attack, the attestations from honest validators in the first half of epoch e+1e+1 are discarded, as the chain they vote for is not later finalized. These honest validators suffer from penalties according to the protocol. It was shown that by controlling 29.6% of the total stake, the attack can be conducted in every epoch so eventually all honest validators suffer from no incentive rewards. The attack was mitigated via the Deneb upgrade.<div><a href="https://ethresear.ch/uploads/default/original/3X/1/2/1248dd2290d23f8bb6388d2b70a24c44abb07d41.png" title="Figure 1. Staircase Attack" rel="nofollow"><img src="https://ethresear.ch/uploads/default/optimized/3X/1/2/1248dd2290d23f8bb6388d2b70a24c44abb07d41_2_690x392.png" alt="Figure 1. Staircase Attack"><div>Figure 1. Staircase Attack1156×658 72.2 KB</div></a></div><h2><a href="https://ethresear.ch#p-53730-staircase-attack-ii-2" rel="nofollow"></a>Staircase Attack-II</h2>We find a new variant of the staircase attack and we called it staircase attack-II, as shown in Figure 2. Similar to the staircase attack, Staircase Attack-II requires the proposer in the first slot of an epoch to be Byzantine. Additionally, staircase attack-II assumes that the proposer in the first slot of epoch 1 is also Byzantine.<div><a href="https://ethresear.ch/uploads/default/original/3X/4/7/47014757c4e592c562fb360fce1f552aa8a28348.png" title="Figure 2. Staircase Attack-II" rel="nofollow"><img src="https://ethresear.ch/uploads/default/optimized/3X/4/7/47014757c4e592c562fb360fce1f552aa8a28348_2_410x500.png" alt="Figure 2. Staircase Attack-II"><div>Figure 2. Staircase Attack-II628×764 77.3 KB</div></a></div>As shown in Figure 2, at the beginning of epoch 0, the adversary delays its block b_0b0 in slot 0 for four seconds. Therefore, the target of attestations from honest validators in slot 0, i.e., block bb, is different from the target of attestations in slots 1-31, i.e., block b_0b0. In addition, all attestations from the adversary are delayed forever. Accordingly, the number of attestations from honest validators with the same target and source can not reach 2n/32n/3. Block b_0b0, which is supposed to be justified in epoch 0, cannot be justified by the attestations from honest validators. In contrast, the adversary can justify the block in slot 0 by releasing its last block in epoch 0, i.e., block b_{31}b31. This block includes the attestations from the adversary, so the number of attestations exceeds two-thirds. The adversary delays the block for two epochs. As a result, the block in slot 0 can be justified at the end of epoch 2. In epoch 1, the adversary conducts the same strategies. Particularly, the adversary delays the block b_{32}b32 for four seconds and delays all attestations from the adversary. Therefore, the honest validators can not justify the block in epoch 1. After block b_{31}b31 is released in epoch 2, block b_0b0 is justified. As the chain from honest validators does not justify any new block, the chain led by b_{31}b31 is the new canonical chain. All attestations included in the chain from honest validators are discarded.<h2><a href="https://ethresear.ch#p-53730-analysis-3" rel="nofollow"></a>Analysis</h2>Our staircase attack-II shares the same feature as the staircase attack: Byzantine validators receive rewards but honest validators suffer from penalties, although honest validators strictly follow the specification of the protocol. Therefore, this attack falls into metric III in our criteria. The probability of launching the attack is 1/9, as we require the proposer in the first slot to be Byzantine. Unlike the staircase attack, staircase attack-II cannot be continuously launched. However, if the adversary controls 33% stake and launches the attack whenever the attack can be launched, \textit{all} honest validators will suffer from penalties for the corresponding epochs.<div> </div></div>

Staircase Attack-II in Ethereum PoS

樓梯攻擊
樓梯攻擊是針對見證激勵的一種最新攻擊方式。樓梯攻擊旨在使誠實的驗證者即使嚴格遵守協議也遭受懲罰，即使在一個...

<div><h2><a href="https://ethresear.ch#p-53730-staircase-attack-1" rel="nofollow"></a>樓梯式攻擊</h2><a href="https://www.usenix.org/system/files/usenixsecurity24-zhang-mingfei.pdf"�rellow��a對見證激勵的最新攻擊。樓梯式攻擊旨在使誠實驗證者即使在Capella升級後的同步網路中嚴格遵循協議也會遭受處罰。在樓梯式攻擊中，拜占庭驗證者扣留其見證，以阻止規範鏈對最後一個檢查點進行確認。如圖1所示，在紀元e中，拜占庭驗證者扣留其見證以阻止讀驗確認檢查點cp_0。拜占庭驗證者的見證在被扣留在塊b_1</中，這是由拜占庭驗證者提出的塊。在�span></紀元的中間之前，所有�誠實擴鏈由塊b_0引導在e+1�</�中，扣留的塊b_1</></釋放。最後為一個確認的檢查點被更新，因為只有扣留的鏈包含對對檢查點塊cp_0</三分之二見證。由cp_1引導的鏈在HLMD-GHOST中中被過濾，由b_1引導的鏈成為規範鏈。在這次攻擊中，誠實驗證者在e+1</>�第一元前半部分的見證被丟棄，因為�為們投票的持鏈沒有被最終確認。這些誠實驗證者根據協議�受議受到罰。研究表明，通，透過控制總權益的29.6%，攻擊可以在每個紀元中進行，最終所有誠實驗證者都將失去激勵獎勵。該攻擊透過Deneb升級得到緩解。<div><a href="https://ethresear.ch/uploads/default/original/3X/1/2/1248dd2290d23f8bb6388d2b70a24c44abb07d41.png"" title="="圖1. 樓梯式攻擊" rel="nono=""><img src="https://ethresear.ch/uploads/default/optimized/3_3/2248dd222d23f8bb6388d2b d2b70a24a c4407d41_2690x392.png" alt=""圖1�. 樓梯式攻擊"><div>圖1. 樓梯式攻擊<span156×658 72.2 KB</div></a></div><h2><a href="https://ethresear.ch#p-53730-staircase-attack-ii-2" rel="nofollow"></a>樓梯式攻擊-II</h2>我們發現了樓梯式攻擊的一個新變體，我們稱之為樓梯式攻擊-II，如圖2所示。與樓梯式攻擊類似，樓梯式攻擊-II要求第一個�個槽的提議者是拜�佔�證。此外，�還假設第一個紀元的第第一第一個個個�的的提議者�也是拜占庭的。<img="resear.ch/uploads///default/optimized X/3X/4/7/47014757c4e592c562fb360fce1f552aa8a28348_2_2_410x500.png" alt="圖2. 樓梯式攻擊-II"><div>圖2. 樓梯式攻擊-II764 77.3 KB</div></a></div>如圖2所示，在第0個紀元開始時，對手將其塊b_0在第0個延槽延延遲四�。因此，誠實驗證者在第0個槽的見證目標的，即塊<><</span與第1-31個槽的見證目標標，即塊b_0不同。此外，對手的所有見證都被永久延遲。因此，具有相同目標和源的誠實驗證者的見證數量無法達到2n/3。塊b_0，本應在第0個紀元被確認，無法被誠實驗證者的見證確認。相比之下，對手可以透過在第0個紀元釋放其其最後一個塊，即塊b_{31}來確認第個槽的塊。這個塊包含對手的的見證，因此見證數量超過三分之二。對手將塊延遲兩個紀元。因此，第0個槽的塊可在第2個�個被確認。在第1個�個，對手採用相同的策略。特別是，對手將塊b_{32延><>延��秒並延遲所遲的所有見證。因此，誠實驗證者無法確認認第1個�個紀元的塊。在第2個紀元釋放塊b_{31}後，塊b_0被確認。由於誠實驗證者的沒有確認任何新b_{31}引導的鏈成為新的規範鏈。包含在誠實驗證者鏈中的所有見證都被�丟棄。<h2><a href="https://ethresear.ch#p-53730-analysis-3" rel="nofollow"></a>分析</h2>我們的樓梯式攻擊-II與樓梯式攻擊具有相同的特徵：拜占庭驗證者獲得獎勵，而誠實驗�驗證者遭受處�，儘管誠實驗證者嚴嚴格遵遵協議議。。因此，這種攻擊屬於我們標準中的指標III�III起攻擊的機率為1/1/9，因為我們要求第一個槽的提議者是拜占庭的。與樓梯式攻擊不同，�們����擊--II無法連續發起。但是，如對手控制33%益並在可以發起攻擊時發起攻擊，所有�誠實驗證者都將在相應的紀元中遭受處罰。<div2> </div></div>

以太坊 PoS 中的階梯攻擊-II

原創 / Odaily 星球日報（@OdailyChina）
作者 / Wenser（@wenser2010）
加密市場持續震盪走低，然而即便行情冷淡，仍有少數代幣逆勢而行，保持著自己“大漲大跌”的獨立節奏。Odaily星球日報將於本文將對近期價格表現亮眼的“妖幣”進行梳理，嘗試總結共性，助力發現下一個有望暴漲的投資標的。
PIPPIN：AI Agent 熱潮的遺孤，“內幕盤”代表作
去年年底至今...

五大妖幣逆市暴漲，下一個潛力幣是誰？

美國勞工統計局（BLS）將於格林尼治標準時間週四下午 1:30 發佈 11 月份的關鍵消費者價格指數（CPI）數據。
次通脹報告將不包含……月份的消費者物價指數（CPI）數據。

投資者正在密切關注美國消費者物價指數（CPI），權衡美聯儲1月份的利率前景。

作者 / Wenser（@wenser2010）
原標題：五大妖幣逆市暴漲，下一個潛力幣是誰？
---------------------------------------------------------------
加密市場持續震盪走低，然而即便行情冷淡，仍有少數代幣逆勢而行，保持著自己“大漲大跌”的獨立節奏。Odaily星球日報將於本文將對近期價格表現亮眼的“妖幣”進行梳理，嘗試總結共性...