Snapping Snap Sync: Practical Attacks on Go Ethereum Synchronising Nodes

Go Ethereum is by far the most used Ethereum client. It still supports the Proof-of-Work consensus mechanism despite Ethereum itself having switched to a Proof-of-Stake mechanism in 2022. We analyse the Go Ethereum implementation of chain synchronisation, the process through which a node first joining the network obtains the blockchain from its peers. We present three novel attacks that allow an adversary controlling a small fraction of the network mining power to induce synchronising nodes to deviate from consensus and eventually operate on an adversary-controlled version of the blockchain. We successfully implemented the attacks in a test network. We describe how the attacks can be leveraged to realise financial profits, through off-chain trading and via arbitrary code execution. Notably, the cheapest of our attacks can be mounted using a fraction of one GPU against both Ethereum Classic and EthereumPoW, two Ethereum forks still relying on the Proof-of-Work consensus mechanism and whose combined market capitalisation is more than 3.4 billion USD. Our attacks would have also applied to the pre-Merge Ethereum mainnet during the period 2017-2022.