# Crafted p2p spam can render nodes permanently unable to process L2 blocks

Replaying >100 recent valid L2 blocks evicts the 100-entry seen-block LRU, letting an attacker eclipse a node so it can no longer process new L2 blocks.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: usmannk
- Disclosed: 2023-01-19
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/177
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-6
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:go technique:race-window vuln:dos

**Target:** op-node p2p gossip BuildBlocksValidator
**Root cause:** The seen-block LRU cache holds only 100 block numbers, but more than 100 valid L2 blocks are produced per minute, so replayed blocks evict each other and pass the duplicate check.
**Steps:**
1. Observe >100 valid L2 blocks emitted within 60s (e.g. 253 blocks between 71404110 and 71404363)
2. Collect ~200 recent valid sequencer-signed blocks (71404110-71404310)
3. Replay them in order to a target node over 60 seconds; each passes size, snappy, signature, SSZ, timestamp, blockhash, and LRU checks
4. LRU evicts entries twice over, so all replays are accepted and re-gossiped
5. After 60s, block 71404311 is too old; node waits for it and discards all newer blocks
**How found:** Noticed the 100-entry LRU constraint versus observed L2 block production rate exceeding 100 blocks/minute, then reasoned that replaying more than 100 valid blocks would evict the seen-set and desync the node.
**Exploitation:** Attacker needs a set of recently valid sequencer-signed blocks and network access to gossip them repeatedly to a target node for 60 seconds, causing the node to stall on a missing block and propagate the spam to peers.
**Escalation:** Re-gossiped blocks spread the effect to peers and peers-of-peers, potentially cascading node halts.
**Insight:** When a dedup/seen cache size is smaller than the legitimate message rate over the validity window, replay of valid messages defeats it; compare cache capacity against real throughput.