With the promise of greater decentralization and sustainability, Ethereum transitioned from a Proof-of-Work (PoW) to a Proof-of-Stake (PoS) consensus mechanism. The new consensus protocol introduces novel vulnerabilities that warrant further investigation. The goal of this paper is to investigate the security of Ethereum's PoS system from an Internet routing perspective. To this end, this paper makes two contributions: First, we devise a novel framework for inferring the distribution of validators on the Internet without disturbing the real network. Second, we introduce a class of network-level attacks on Ethereum's PoS system that jointly exploit Internet routing vulnerabilities with the protocol's reward and penalty mechanisms. We describe two representative attacks: StakeBleed, where the attacker triggers an inactivity leak, halting block finality and causing financial losses for all validators; and KnockBlock, where the attacker increases her expected MEV gains by preventing targeted blocks from being included in the chain. We find that both attacks are practical and effective. An attacker executing StakeBleed can inflict losses of almost 300 ETH in just 2 hours by hijacking as few as 30 IP prefixes. An attacker implementing KnockBlock could increase their MEV expected gains by 44.5% while hijacking a single prefix for less than 2 minutes. Our paper serves as a call to action for validators to reinforce their Internet routing infrastructure and for the Ethereum P2P protocol to implement stronger mechanisms to conceal validator locations.

翻译：随着对更大程度去中心化和可持续性的承诺，以太坊从工作量证明（PoW）共识机制过渡到了权益证明（PoS）共识机制。新的共识协议引入了需要进一步研究的新型漏洞。本文旨在从互联网路由的角度研究以太坊PoS系统的安全性。为此，本文做出两项贡献：第一，我们设计了一种新颖的框架，无需干扰真实网络即可推断验证者在互联网上的分布情况。第二，我们介绍了一类针对以太坊PoS系统的网络级攻击，该类攻击联合利用了互联网路由漏洞与协议的奖惩机制。我们描述了两种代表性攻击：StakeBleed 攻击，攻击者触发不活跃泄漏，阻止区块最终确定性，并导致所有验证者遭受经济损失；以及 KnockBlock 攻击，攻击者通过阻止目标区块被纳入链中来增加其预期的MEV收益。我们发现这两种攻击都是可行且有效的。执行 StakeBleed 攻击的攻击者只需劫持30个IP前缀，就能在短短2小时内造成近300 ETH的损失。实施 KnockBlock 攻击的攻击者在劫持单个前缀不到2分钟的情况下，即可将其预期MEV收益提高44.5%。我们的论文旨在呼吁验证者加强其互联网路由基础设施，并呼吁以太坊P2P协议实现更强有力的机制来隐藏验证者位置。