Executive brief
Go-Ethereum is the most widely deployed Ethereum node client, used to validate transactions and maintain the blockchain network. A design flaw allows an attacker to send a specially crafted message containing 5,120 high-value future transactions that floods and clears the pending transaction memory pool on a victim node, causing it to reject legitimate transactions and disrupting network participation for that node.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the transaction mempool management of Go-Ethereum versions 1.10.12 and earlier. An attacker-controlled Ethereum node can craft a network message containing up to 5,120 future-dated transactions with artificially high gas prices. When a victim node receives this message, the high-gas-price transactions are prioritized and added to the memory pool, displacing all existing pending transactions and effectively clearing the mempool. The attack requires only network connectivity to the victim node (no authentication or user interaction needed). The impact is denial of service—the victim node becomes unable to process legitimate pending transactions. As of the advisory publication date, no patched version was identified in the advisory, though the vulnerability likely prompted corrective measures in later releases.
Affected products
- Ethereum Go-Ethereum <= 1.10.12
Timeline
- 2022-03-04: disclosed: Published to National Vulnerability Database
- 2022-03-05: advisory: Published to GitHub Advisory Database
- 2022-03-09: other: GitHub security review completed