# JSON RPC methods for debugging enabled by default allow DoS

Debug JSON-RPC methods evm_reset/evm_snapshot enabled by default on public RSK node let anyone reset EVM state, hanging the node and dropping it to block 0.

- Payout: hidden
- Severity: medium
- Program: Rootstock Labs
- Found by: teknogeek
- Disclosed: 2023-02-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/324021
- Library page: https://bugbountylibrary.com/r/h1%3A324021
- Tags: area:web3 domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:rest technique:recon technique:source-review vuln:dos vuln:misconfiguration

**Target:** Public RSK JSON-RPC node (bounty-node.rsk.co), RskJ 0.4.0
**Root cause:** Debug/EVM JSON-RPC methods (evm_reset, evm_snapshot) are exposed by default on the public RPC endpoint without authentication, and evm_reset tears down EVM state causing the node to hang and resync from block 0.
**Steps:**
1. Query block height: `curl -X POST -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1337}' https://bounty-node.rsk.co`
2. Confirm debug methods reachable: `evm_snapshot` returns incrementing snapshot ids
3. Send `{"jsonrpc":"2.0","method":"evm_reset","params":{},"id":666}` to the endpoint
4. Request hangs; subsequent calls return nginx `504 Gateway Time-out`
5. Re-query `eth_blockNumber` and observe `0x0` (node reset to block 0)
**How found:** Researcher read the rskj source to enumerate available JSON-RPC methods, then probed the public bounty node with each, noticing debug methods like evm_snapshot responded; sending evm_reset hung the server.
**Exploitation:** Unauthenticated attacker sends a single evm_reset JSON-RPC POST to the public node; the node's EVM state is reset, the RPC server hangs and begins returning 504s, and the node resyncs from block 0, denying service to all users.
**Insight:** Enumerate JSON-RPC/debug methods from the node's source (evm_*, debug_*, personal_*, admin_*) and probe public RPC endpoints for them—state-mutating debug methods like evm_reset/evm_snapshot are often left enabled on production nodes.