Blockchain is not as decentralized as you think: the Defense Agency’s report
Distributed ledger technology (DLT) and blockchains including Bitcoin and Ethereum may be more vulnerable to centralization risk than first thought, according to Trail of Bits.
On Tuesday, the security company released its report entitled “Are blockchains decentralized?” which was commissioned by the US Government’s Defense Advanced Research Projects Agency (DARPA).
The report aims to examine whether blockchains such as Bitcoin and Ethereum are truly decentralized, although the report appeared to focus mainly on Bitcoin.
Among its key findings, the security firm found that outdated Bitcoin nodes, unencrypted blockchain mining pools and a majority of unencrypted Bitcoin network traffic that spans only a limited number of ISPs could allow various players to gain excessive and centralized control over the network.
Bitcoin nodes
The report stated that a sub-network of Bitcoin nodes is largely responsible for reaching consensus and communicating with miners, and that “a large majority of nodes do not in a meaningful way contribute to the health of the network.”
It also found that 21% of Bitcoin nodes run an older version of the Bitcoin Core client, which is known to have vulnerability issues such as consensus errors. It states that “it is important that all DLT nodes operate on the same latest version of the software, otherwise consensus errors may occur and lead to a blockchain fork.”
A Bitcoin node is any computer that stores and verifies blocks in the blockchain. Nodes are used to monitor the health and security of the Bitcoin blockchain and validate the accuracy of transactions. The current version all nodes should run is Bitcoin Core 22.0.
Another takeaway from the report found that Bitcoin’s mining pool protocol Stratum is unencrypted and largely unauthenticated.
This means that malicious attacks can be made to “estimate the hash rate and payouts of a miner in the pool” and “manipulate Stratum messages to steal CPU cycles and payouts from participants in the mine pool.”
Funneling through ISPs
The authors also found vulnerabilities in the infrastructure, based on the fact that Bitcoin protocol traffic is unencrypted and 60% of network traffic goes through only three ISPs.
This is a problem because “ISPs and host providers have the ability to arbitrarily degrade or deny services to any node.”
Twenty-six pages of detailed information, data and infographics are contained in the report. DARPA started in 1958 and is responsible for the development of new technologies for use by the US Department of Defense and the US military. Trail of Bits is a research and consulting company for cybersecurity that was hired by DARPA to develop the report.
Related: Centralized vs. decentralized digital networks: Important differences
The report comes at an interesting time, after centralization concerns were highlighted at Solana.
On Sunday, the Solana-based lending protocol for decentralized finance (DeFi) Solend put together a requested management proposal with a view to taking over a whale wallet that was facing a liquidation that threatened to place a burden on Solend and its users.
The proposal, which was adopted by a whale, received an immediate backlash from Twitter and the creation of a new governing vote to invalidate the previously approved proposal. Observers argued that the move could damage the overall picture of DeFi, as taking control of one of Solend’s wallets means that the basic principles of DeFi are in doubt, and reversing a vote was not much better.
