Research · July 7, 2026

Eighteen advisories, ten node implementations, one attack class

Simon Morley·1 min read

Since NR-2026-001 we have published eighteen advisories across ten independent node implementations. They are not unrelated bugs. They are recurring attack classes targeting the same structural weakness: unauthenticated ingress surfaces where a cheap request forces disproportionate cost.

Egress amplification

Short request, massive response. IOTA multiGetObjects: 41,636x. Aptos accounts/modules: ~10,000x. rippled batch: 25-32x.

Memory amplification

IOTA gRPC streams: 472 MB to 7.6 GB in seconds. Cardano submit-api: 444 MB persistent from a 500 MB POST. Sui wide-filter subscriptions: persistent pins until restart.

Pre-auth CPU exhaustion

Bitcoin Core BIP-324 handshake: 55-256x latency inflation. CometBFT SecretConnection: three cores at 56k probes/sec.

Connection exhaustion and crashes

IOTA gRPC subscriber-slot exhaustion. Cosmos-SDK gRPC: no MaxConcurrentStreams limit. reth transaction decode: unbounded Vec, fixed upstream (PR #23718). Agave snapshot bootstrap panic via oversized AppendVec data_len, before the hash gate.

One taxonomy

The mechanism is chain-agnostic. The taxonomy and public corpus (NullRabbit/nr-bundles-public) catalogue by class, not chain.

All measured on instrumented infrastructure. Full details and reproducers in the individual advisories.

security-research advisory validator-security dos amplification taxonomy

Publication policy:Why we publish these findings →

Twitter LinkedIn Reddit

Which chains fail the same way

Jul 30, 2026·4 min read

Twenty-eight of the 118 techniques we have reproduced appear on more than one chain. The registry could always report that number but never draw the line between the chains. The chain graph draws it, and most of the lines it draws are arithmetic rather than evidence, which is the part worth publishing.

nrdaxchain-graphregistry+5 more

NRDAX: browsable by chain and family, readable by machines

Jul 13, 2026·2 min read

NRDAX now holds 623 techniques across 64 chains, 103 reproduced with bundles. New per-chain and per-family landing pages, a pretty Atom feed, JSON and STIX 2.1 and knowledge-pack distributions surfaced for machines, and a fix for the first_seen date bug.

nrdaxsecurity-researchtaxonomy+3 more

NRDAX now includes known-but-not-reproduced techniques

Jul 11, 2026·1 min read

NRDAX v0.1-import now contains 368 techniques across 21 chains: 140 with reproduced instances and bundles, and 228 known from public disclosures (CVEs, GHSAs, vendor advisories) but not yet reproduced in the lab. A CVE maps to its technique even when no bundle exists yet.