# JSON-RPC DoS through Websockets

ZetaChain's WebSocket JSON-RPC accepted 32MB messages and forwarded them to HTTP without rate limiting, letting an attacker crash the server with parallel oversized requests.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: MevSec
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/566
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:websocket technique:source-review vuln:dos

**Target:** WebSocket JSON-RPC endpoint
**Root cause:** WebSocket read limit set to 32MB (vs 10MB HTTP default) with no rate limiting; unknown methods are forwarded to the internal HTTP RPC server without size checks.
**Steps:**
1. Open WebSocket connection to ZetaChain RPC (e.g., ws://127.0.0.1:9546).
2. Send a message with an unknown method name `eth_XYZ` where XYZ is a random 14MB string, plus a 14MB non-ASCII payload.
3. Repeat in a loop with 30 parallel workers from a single machine.
4. Observe server crash due to resource exhaustion from processing and echoing back large payloads.
**How found:** Researcher noticed WebSocket message size limit (32MB) was 3x larger than HTTP default (10MB) and no rate limiting existed; traced code path showing unknown methods forwarded to HTTP without sanitation.
**Exploitation:** Attacker opens WebSocket connections and floods the server with 32MB messages containing unknown methods; the server forwards each to the HTTP RPC server and attempts to echo back the method name, consuming memory/CPU and causing a crash.
**Insight:** When reviewing WebSocket RPC handlers, compare message size limits and rate limiting against the HTTP endpoint; unknown method handling often forwards payloads internally without re-checking size, enabling amplification DoS.