Monero Research Lab (Unofficial) on X: "Shi et al. (2026) “Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero’s P2P Network!” Paper: https://t.co/H0h0Cik9cz Proposed patch: https://t.co/2sH8uqpqWE rucknium presented preliminary 26-hour monerosim runs: https://t.co/O05sQq7ZQ5 1/10" / X

Shi et al. (2026) “Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero’s P2P Network!” Paper: arxiv.org/pdf/2609.10260 Proposed patch: gist.github.com/Rucknium/fd57f… rucknium presented preliminary 26-hour monerosim runs: libera.monerologs.net/monero-researc… 1/10

Monero Research Lab (Unofficial)

@MoneroResearchL

Sep 30

Replying to @MoneroResearchL

Shi et al. (2026) "Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero’s P2P Network!": arxiv.org/pdf/2609.10260 x.com/MoneroResearch…

3:47 AM · Oct 1, 2026

1,007

Views

Monero Research Lab (Unofficial)

@MoneroResearchL

Monero Research Lab (Unofficial)

@MoneroResearchL

Sep 30

Replying to @MoneroResearchL

Shi et al. (2026) "Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero’s P2P Network!": arxiv.org/pdf/2609.10260 x.com/MoneroResearch…

3:47 AM · Oct 1, 2026

1,007

Views

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

1,200 honest monerod nodes and 1,000 adversary lightweight py-levin processes; 14-hour burn-in then 12-hour attack; all honest nodes reachable except one target unreachable node. One run used unmodified v0.18.5.1-release; the other used that release plus the patch. 2/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

Result: on unmodified v0.18.5.1 the adversary nearly eclipsed the unreachable node (11 of 12 outbound connections). The patch defeated the attack. Attack path: poison reachable nodes’ 1,000-slot white lists (oldest-seen eviction), then those lists infect unreachable nodes. 3/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

Unreachable nodes still had a majority of honest white-list peers at the end, but connection-selection logic still produced eclipse; increasing white-list size alone is not enough. Status-quo selection: every 101 seconds drop one outbound and replace it; 4/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

usually from very recently seen white-list peers; first try gray list, then after 3 failures try white list up to three times. The patch’s three reforms: (1) raise white-list limit to 10,000; (2) draw from white list first instead of gray list; 5/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

(3) uniform random draw from the whole white list, removing the quadratic recent-peer distribution and the split logic around 8 outbound connections. Subsets of the reforms were insufficient; all three were needed. 6/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

White-list fill is slower because gray-list-to-white promotion on connection select is less common. plowsof confirmed IRC can see the images, reported ~3–4k reachable nodes recently, Peg Tech flooding gray lists (~800 IPs/many ports/~4k entries; proxy network tied to DDoS: 7/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

qurium.org/alerts/denial-…), and tracking at observer.monerodevs.org. jeffro256 supported dropping the quadratic recent distribution as centralizing even without attackers, and suggested setting the white-list limit near the real reachable-node count. 8/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

rbrunner noted the quadratic bias survived the last peer-selection update. rucknium said the attacker model was held constant (a weakness), some Shi et al. suggestions are in the defense, white-list expansion has been suggested by that team since at least early last year, 9/10

Monero Research Lab (Unofficial)

@MoneroResearchL

19h

next step is a PR plus this analysis, also removing dead logic. vtnerd: github.com/monero-project…, original logic attempted one white then gray each time; a later while-loop change may have been worse. rucknium would support putting this defense in the next monerod release. 10/10

Pruning · monero-project/monero@b750fb2

From github.com

Post

Post