BunnyFinder: Finding Incentive Flaws for Ethereum Consensus

BunnyFinder: Finding Incentive Flaws for Ethereum Consensus

Speakers: Rujia Li

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=gD6-hRPsO4g

Overview

Ethereum's 2022 shift from Proof of Work to Proof of Stake (PoS) moved its security assumption from computational power to economic incentives -- validators are assumed to behave honestly because following the protocol should be economically beneficial. But what if the incentive mechanism itself is flawed? This talk introduces BunnyFinder, the first semi-automated framework for discovering incentive flaws in Ethereum's PoS consensus protocol. Instead of looking for code-level bugs, BunnyFinder injects adversarial strategies into protocol execution and uses reinforcement learning to adaptively explore which strategies become profitable over time.

Deployed against real Ethereum clients (Prysm and Teku), BunnyFinder ran over 9,000 attack simulations and found that over 3,000 revealed incentive flaws. The framework reproduced 5 known attacks and discovered 3 new ones, including the "Staircase-2" attack where honest validators suffer penalties while the attacker continues earning rewards. The findings were reported to the Ethereum Foundation, which has fixed one vulnerability and funded continued research through a grant.

Background

▶ Watch: Background: Ethereum PoS and the incentive security assumption (0:00)

Ethereum is the second-largest blockchain system. Its consensus protocol maintains two core security properties -- safety (agreement on chain state) and liveness (the chain continues to grow) -- under the assumption that at least two-thirds of stake is controlled by honest validators. The protocol enforces this assumption through incentive mechanisms: positive incentives (rewards for correctly proposing blocks and voting) and negative incentives (penalties for misbehavior like equivocation).

However, these mechanisms are not perfect. The previously known Staircase attack demonstrated that honest validators can suffer penalties even when strictly following the protocol, creating unfair reward distribution. More critically, if honest validators continuously lose rewards, adversary validators gradually accumulate a larger share of total stake. Once the adversary's share crosses the one-third security threshold, the entire system's safety and liveness guarantees break down.

Both academia and industry have begun examining incentive flaws, but existing approaches rely heavily on expert intuition -- each attack is manually crafted for a specific scenario. Traditional software testing tools (fuzzing, chaos testing) are designed for implementation-level bugs and cannot capture incentive flaws, which are not code-level bugs but rather emergent economic behaviors arising from protocol interactions.

Key Findings

▶ Watch: BunnyFinder design: strategy injection with reinforcement learning (4:00)

• Over 3,000 of 9,000 attack simulations revealed incentive flaws, suggesting the incentive landscape is far more fragile than the protocol designers assumed.
• 3 new attacks discovered, including:
• Staircase-2 attack: Requires one-third of stake and triggers with approximately 1-in-9 probability when the attacker controls the first proposer of two consecutive epochs. The adversary delays voting to break justification, triggers chain reorganization, and causes honest validators to receive penalties while the attacker continues earning high rewards.
• Periodical Vector attack: The attacker takes a small loss (~5%) to inflict a much larger loss (~20%) on honest validators, creating an asymmetric economic weapon.
• 5 known attacks reproduced, validating the framework's ability to rediscover established incentive flaws.
• Reinforcement learning significantly improves attack strategies: The RL component is critical because many attacks only emerge after fine-tuning parameters like voting delay timing -- delay too little and the attack fails, delay too long and votes are discarded.
• Ethereum Foundation acknowledgment: One finding has been fixed, and the Foundation awarded a grant for continued research.

Technical Deep Dive

▶ Watch: New attack: Staircase-2 with 1-in-9 trigger probability (7:00)

BunnyFinder's approach is inspired by failure injection testing but adapted for economic protocol analysis. Instead of injecting faults into code, BunnyFinder injects adversarial behaviors into protocol execution and observes economic outcomes. The framework consists of four components in a feedback loop:

Strategy Generator Module: Creates diverse attack strategies by varying parameters and timing. The strategy space for Ethereum PoS is enormous given the number of sub-protocols and timing-sensitive interactions, so systematic enumeration is infeasible.

Strategy Executor Module: Translates abstract strategies into concrete instructions and injects them into the network execution of real Ethereum clients (Prysm and Teku). This ensures findings are validated against production implementations, not simplified models.

Analyzer Module: Measures rewards, penalties, and consensus outcomes to determine whether a strategy exposes an incentive flaw. The key metric is whether an adversarial strategy produces better economic outcomes than honest behavior, or whether it causes disproportionate damage to honest validators.

Optimizer Module: Uses reinforcement learning to refine promising strategies. This is crucial because many incentive flaws only manifest with precisely tuned parameters. The Staircase-2 attack, for example, requires carefully calibrated voting delays -- the adversary must delay long enough to break justification but not so long that votes are discarded by the network. The RL optimizer learns these optimal parameter ranges through iterative experimentation.

The reinforcement learning component is particularly important because the Ethereum consensus protocol (Gasper) is a complex system with many interacting sub-protocols. The strategy space is too large for exhaustive search, and the relationship between timing parameters and economic outcomes is non-obvious. The RL reward signal is defined in terms of the economic advantage (or disproportionate damage) achieved by the adversarial strategy relative to honest behavior.

Demo / Proof of Concept

▶ Watch: Periodical Vector attack: 5% attacker loss for 20% honest loss (8:00)

BunnyFinder was deployed against real Ethereum clients (Prysm and Teku) in a controlled testnet environment, executing over 9,000 attack simulations. The framework successfully reproduced 5 known incentive attacks from the literature, validating its detection capability.

The Staircase-2 attack demonstrates a practical threat: when the adversary controls one-third of stake and happens to be the first proposer in two consecutive epochs (approximately 1-in-9 probability), they can delay voting to break checkpoint justification, trigger chain reorganization, and cause honest validators to receive penalties. The asymmetry is stark -- honest validators are penalized for failing to justify checkpoints that the adversary deliberately prevented.

The Periodical Vector attack represents an even more concerning pattern: an economic griefing attack where the attacker accepts a small 5% loss to inflict a 20% loss on honest validators. While the attacker also loses stake, the disproportionate damage to the honest majority can gradually shift the stake distribution toward the security threshold.

All code and documentation are open-sourced for community reproduction and extension.

Defensive Implications

▶ Watch: Q&A: Ethereum Foundation response and RL reward design (10:00)

BunnyFinder's findings have significant implications for blockchain protocol security:

• Incentive mechanism auditing: The framework provides a systematic approach to auditing economic incentive mechanisms rather than relying on ad-hoc expert analysis. This is essential as more protocols adopt PoS-style consensus.
• Stake concentration monitoring: The discovery of attacks that gradually shift stake distribution toward adversaries highlights the need for continuous monitoring of stake concentration as a security metric, not just at deployment but throughout the protocol's lifetime.
• Griefing attack resilience: The Periodical Vector attack's asymmetric damage ratio (5% attacker loss for 20% honest loss) demonstrates that pure economic rationality assumptions are insufficient -- attackers may accept losses to damage the system.
• Parameter sensitivity analysis: The RL optimizer's discovery of timing-critical attack windows suggests that small parameter changes in consensus protocols can have outsized security implications.
• Foundation response model: The Ethereum Foundation's constructive response -- fixing vulnerabilities, funding continued research -- provides a model for how protocol foundations should engage with adversarial security research.

Key Takeaways

• BunnyFinder is the first semi-automated framework for finding incentive flaws in Ethereum PoS, using adversarial strategy injection with reinforcement learning optimization
• Over 3,000 of 9,000 simulated attacks revealed incentive flaws, suggesting the incentive landscape is more fragile than assumed
• The Staircase-2 attack causes honest validators to be penalized while the attacker continues earning rewards
• The Periodical Vector attack creates asymmetric economic damage: 5% attacker loss for ~20% honest validator loss
• Reinforcement learning is critical for discovering timing-sensitive attacks that only emerge with precisely tuned parameters
• The Ethereum Foundation has acknowledged and fixed one finding and funded continued research

About the Speaker(s)

Rujia Li is a researcher at Tsinghua University. The research demonstrates deep understanding of both the formal properties of Ethereum's PoS consensus protocol and the practical economics of validator incentive structures. The Ethereum Foundation's grant and acknowledgment validate the work's significance to the blockchain security community.