Posts tagged json rpc.

Zebra's getaddresstxids RPC returns every transaction identifier for a queried transparent address without pagination, allowing a ~116-byte request to trigger a response that scales with the number of transactions at the address, measured at ~578× amplification in controlled testing.

Zebra's `getaddressutxos` RPC returns all UTXOs for a transparent address without pagination, allowing an attacker to amplify a ~116 B request into a ~236 KB response (≈2,033×) by seeding an address with dust UTXOs.