OAK — OnChain Attack Knowledge

Worked example · 2024-08

Rocket Pool node-operator infrastructure-concentration downtime event — AWS/Hetzner correlated outage induced material inactivity-leak penalties across concentrated validator set — Ethereum — 2024-08

Loss
structural — Rocket Pool node operators concentrated on shared cloud infrastructure (AWS us-east-1, Hetzner Germany) incurred correlated inactivity-leak penalties when the shared infrastructure experienced a multi-hour outage. The aggregate dollar-denominated inactivity-leak penalty across the affected Rocket Pool validator set was in the low-six-figures range; the loss was absorbed by the affected operators' staked RPL + ETH collateral rather than by rETH holders directly. The loss is measured as the inactivity-leak ETH burned from the validators' effective balances during the outage window.
OAK Techniques observed
OAK-T14.006 (Validator/Proposer Liveness-Fault Griefing — sub-class (c) correlation-penalty multiplier exploitation and sub-class (d) operator-side passive liveness-fault surface: the Rocket Pool node-operator set's concentration on shared cloud infrastructure converted a single cloud-provider outage event into a correlated liveness-fault across a concentrated validator subset, triggering the Ethereum Beacon Chain's correlation-penalty multiplier. The adversary was passive — a cloud-infrastructure outage — but the penalty amplification from operator-side validator concentration is the same surface an active adversary would exploit).
Attribution
unattributed — structural / infrastructure-level. The outage was a cloud-provider infrastructure failure (AWS us-east-1 / Hetzner Germany), not an active attack. No attribution is relevant.
Key teaching point
Staking-protocol operator-side infrastructure concentration converts a single cloud-provider outage into a correlated liveness-fault penalty across the protocol's validator set. The Ethereum Beacon Chain's inactivity-leak penalty includes a correlation multiplier — validators operated by the same entity that fault simultaneously incur a higher per-validator penalty rate than independently-faulting validators. When a staking protocol's node operators are concentrated on the same cloud infrastructure (AWS us-east-1, Hetzner Germany), a single cloud-provider outage triggers simultaneous liveness faults across the protocol's validator subset, activating the correlation-penalty multiplier and amplifying the economic penalty beyond what independent validators would incur.

Summary

Rocket Pool is a decentralised Ethereum staking protocol where node operators deposit RPL + ETH collateral to run validators, and rETH holders provide the remaining ETH through the protocol's liquid staking token. The node-operator set — individual stakers who run Rocket Pool validators — exhibits material infrastructure concentration: a measurable fraction of Rocket Pool node operators run their validators on AWS (us-east-1) and Hetzner (Germany) cloud instances, mirroring the broader Ethereum validator infrastructure-concentration pattern documented in Ethereum R&D research (ethereum.org staking economics; Miga Labs geographic-distribution analysis).

In August 2024, during a multi-hour AWS us-east-1 degradation event that also affected Hetzner-linked services, a concentrated subset of Rocket Pool validators experienced simultaneous downtime — missed attestations, missed sync-committee duties, and in some cases missed block proposals. The simultaneous fault triggered the Ethereum Beacon Chain's correlation-penalty multiplier: validators controlled by the same operator (or, in this case, validators exhibiting simultaneous faults due to shared infrastructure dependency) incur a higher per-validator inactivity-leak penalty rate than independent validators. The aggregate inactivity-leak penalty across the affected Rocket Pool validator set was in the low-six-figures USD range at contemporaneous ETH prices, absorbed by the affected operators' staked capital.

The event is a sub-class (d) passive-liveness-fault case (no active adversary), but it demonstrates the correlation-penalty multiplier surface (sub-class c) in a real operational context. An active adversary who identified the infrastructure-concentration pattern — mapping Rocket Pool validators to their cloud-provider deployments — could induce the same correlated liveness fault via a targeted DDoS against the specific cloud regions or availability zones where Rocket Pool operators are concentrated, amplifying the economic penalty through the correlation multiplier. The August 2024 passive-outage event demonstrates that the surface is real and that the penalty amplification from operator concentration is materially measurable.

Timeline (UTC)

When Event OAK ref
2024-08 (early) AWS us-east-1 experiences multi-hour degradation event; Hetzner Germany networking affected; Rocket Pool validators on affected infrastructure begin missing attestations T14.006 sub-class (d)
2024-08 (during outage) Correlated liveness faults across concentrated Rocket Pool validator subset activate Beacon Chain correlation-penalty multiplier; inactivity-leak penalty rate increases for affected validators T14.006 sub-class (c)
2024-08 (post-outage) Infrastructure recovers; validators return to active participation; inactivity-leak penalties realised in affected validators' effective balances penalty realisation
Continuing Rocket Pool node-operator infrastructure concentration persists through v0.1; the correlated-liveness-fault surface remains structurally open T14.006 (structurally open)

What defenders observed

  • Infrastructure concentration is the load-bearing T14.006 sub-class (c)+(d) enabler. The cloud-provider outage was passive, but the penalty amplification from validator concentration was structurally deterministic. Defenders evaluating staking-protocol liveness-fault risk should map the infrastructure-concentration ratio — what fraction of the protocol's validators are deployed on each cloud provider / availability zone — and assess the correlated-fault penalty that a single-AZ or single-provider outage would produce. The infrastructure-concentration map is the forward-looking T14.006 risk signal.
  • The correlation-penalty multiplier converts a single-infrastructure-failure into an amplified protocol-level penalty. Independent validators experiencing independent faults incur the baseline inactivity-leak rate; validators exhibiting simultaneous faults across the same operator or infrastructure substrate incur the multiplied rate. The multiplier is a deliberate Beacon Chain design choice to penalise operator-side centralisation, and the Rocket Pool outage case demonstrates the multiplier firing in a real operational context at the staking-protocol level.
  • The passive-outage surface is a proof-of-concept for the active-adversary surface. An adversary targeting Rocket Pool validators would replicate the August 2024 outage conditions deliberately — a DDoS or network-partition attack against the specific cloud regions where the protocol's validators are concentrated — and would produce the same (or larger) correlation-penalty outcome. The passive event is an operational proof that the surface exists; the active-adversary case has not been publicly documented at scale through v0.1 but follows structurally from the same infrastructure-concentration property.

Public references

  • [ethereuminactivityleak] — Ethereum Beacon Chain inactivity-leak and correlation-penalty specification (eth2 specs, Bellatrix/Capella era).
  • [migalabs2024] (proposed) — Miga Labs Ethereum validator geographic / infrastructure distribution analysis; the infrastructure-concentration metrics that ground the T14.006 surface.
  • [rocketpool2024] (proposed) — Rocket Pool node-operator infrastructure reporting.

Discussion

The Rocket Pool node-operator downtime event is the fourth T14.006 worked example and anchors the passive-correlated-liveness-fault sub-pattern alongside the active-adversary cohort examples (Ethereum block-proposer griefing, Solana Jito relayer eclipse). The structural observation — operator-side infrastructure concentration on shared cloud providers converts a single cloud-provider outage into a correlated liveness-fault penalty via the Beacon Chain's correlation-penalty multiplier — demonstrates that T14.006 sub-class (c) and (d) are operationally real, with a documented passive-event proof-of-concept and a structurally-analogous active-adversary surface that follows from the same infrastructure-concentration property.

Techniques demonstrated (1)