0

Geth does not ship with RPC support. By default Geth enables modules ["net", "web3", "eth", "shh"]. In case the RPC get compromised, what kind of bad things could happens?

Money lost will definitely be the first place

Assuming you have a wallet managed by Geth, people can freely sent any balance inside away.

Apart from money lost, is there any other things that may potential happens?

For example, if I just run the node as a block tracker and monitor if any money sent into my address. Does RPC has the ability to affect them as well?

  • Some functionality like complex filters can use lots of resources, if they are abused you can suffer a denial of service attack. – Ismael Mar 2 '18 at 6:16
1

Many bad things may happen, here is incomplete list of them:

  1. Anybody may sign transactions/messages with your private keys as long as you unlock them
  2. Anybody may use resources of your node to query blockchain state (some queries could be very CPU and HDD intensive)
  3. Anybody may use resources of your node to publish large amounts of transactions, i.e. when performing DDOS attacks on Ethereum network
  4. Anybody may exploit known RPC vulnerabilities in your node's software, especially in case your node's software is not up to date
  5. Anybody may make your node unresponsive or even crash it by spamming with expensive queries
0

Nothing bad is going to happen if you won't unlock any accounts on this node. The blockchain data is public information so running RPC with * in rpccorsdomain is not an issue. RPC does not have any private info , it is the personal module that contains it. do not call personal.unlockAccount() on your node and everything is going to be fine.

Neither store accounts info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.