1

I understand concepts about how consensus is important to record data into the blockchain such that it is accurate and not tampered with.

But, suppose a client queries the balance of an account, and a malicious node decides to return bogus data? In other words even though the blockchain is immutable what if the malicious node forks the codebase and modifies data after it reads the state of the blockchain? Then for the client requesting the data wouldn’t it see incorrect data in this case when checking an account balance?

I’m sure there is a means to prevent this...but I cant find the right literature.

Improve this question

1 Answer 1

Reset to default
1

The immutability stops at the blockchain. If you are calling foreign nodes which you don't control, or that you don't even know, then that is a huge design flaw in your application design. If you are pulling data from third-party nodes, then you have to trust that that third-party node won't tamper the data. Your options are to run your own node, or use a trusted third-party node provider. In the event that you can't trust your third party node provider, you will have to vet the data yourself.

More plausible attack:

There is some third-party service, whose fees are determined by your on-chain account balance of ethereum. You submit a request to process some data with the third party service, who then queries a non-trusted node for balance information about your ethereum account. The node pretends that your balance is higher than it is, subsequently causing the third party service to charge you a higher fee.

Obviously this "plausible attack" isn't a super well though out example, but I think it's suffice to demonstrate why you shouldn't rely on third-party nodes for state data about the blockchain.

Edit:

Keep in mind signing transactions to submit to a third-party provider like MEW, or metamask, or infura isn't subject to this kind of attack, since you aren't relying on them to do anything other than relay your signed transaction.

Improve this answer
2
  • Ok that makes perfect sense. But correct me if I’m wrong: even if you get tampered data back...say a balance of 1000 ether even if the accounts real balance is 500....it doesn’t do you any good because transactions on the blockchain prevent double spending anyway right?
    – Ralph Caraveo
    Commented May 28, 2018 at 19:34
  • 1
    I don't even think that would fall under double spending, since you are operating on completely invalid data. The blockchain would check the data, and determine that it is invalid, aborting transaction processing. A douple spend attack is slightly different, since it involves the ability to spend the same currency twice (essentially). However i'll edit my response with what I think is a more plausible attack
    – hextet
    Commented May 28, 2018 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.