Zcash Blockchain Hit by Spam Attack, Node Operators Severely Damaged

https://www.theblock.co/post/175259/someone-is-clogging-up-the-zcash-blockchain-with-a-spam-attack

Zcash, a privacy-focused proof-of-work blockchain, has been undergoing a spam attack.

Analysts say the blockchain has processed a large volume of transactions that aim to disrupt the network. To do this, the attacker misused Zcash’s “shielded transactions” meant for privacy.

Here, the attacker has been adding hundreds of output values within shielded transactions that are proving to be very data-intensive. As a result, the blockchain size has grown dramatically, going from 31 GB in mid-June to more than 100 GB currently, according to data from Blockchair.

The situation is placing high demands on the network. While Zcash has not had any downtime, the blockchain's rapidly growing size has led to troubles for nodes' ability to sync with the network. On-chain records indicate that while the situation has persisted for months, it has been brought to public attention only recently.

“At this point, there only seems to be two problems with the spam: it's bloating the chain size, and it's making it harder for wallets to sync,” Sean Bowe, an engineer at Zcash's core development firm Electric Coin Company said.

Others pointed out that Zcash doesn't have spam prevention systems in place. A transactor pays a small fee of 0.0001 ZEC (worth a few cents) for shielded transactions with hundreds of output values, Zcash's block explorer shows.

“It's sad to see. There was always a risk of DoS given Zcash’s deliberate lack of a fee market,” security researcher Ian Miers, who has previously worked at Zcash, noted in a tweet Wednesday. “The proofs are much larger and slower to verify, making the attack worse.”

The motive for this attack has not been determined, but industry commentators have offered varying theories.

Nick Bax, head of research at Convex Labs, speculated that someone is trying to profit off harming the network. He also floated a possible theory that the spam attack is an attempt to "make it harder for people to run nodes" as this can potentially allow them to surveil users' activity on the blockchain.

What are shielded transactions?

Across blockchains that use the UTXO model like Zcash, transactions are validated by linking the sender address, receiver address, and input and output values. But these values can be easily traced on a public blockchain. To enforce transactional privacy, Zcash uses cryptographic proofs called zk-SNARKs to obfuscate the input-output values of transactions.

Zcash transactions that make use of this technique are called shielded transactions and are meant for legitimate usage. However, the lack of a fee market can unintentionally let malicious actors spam the network if they use a large number of output variables. On this point, Solana Labs CEO Anatoly suggested that the project should increase the fees by 100 times for each output aiming to reduce spam.

In August, Zcash researchers proposed a new fee mechanism that aimed to incorporate fees based on transaction size. In such a scenario, fee rates would keep increasing when the network is under extreme usage.