Spamoor Dashboard

ID Name Scenario Status Actions
119 Slow block: KECCAK 32KiB case4: keccak256 over 32KiB per loop, 4M gas/tx gasburnertx Running
118 3631 attack C: random-alphabet JUMPDEST ring (n=16384) Zero-calldata full-block txs that walk the ring sequentially, persisting the ring index across transactions so consecutive blocks touch disjoint contracts (the LRU worst case). 3,163 gas per 64 KiB cold code load = 20.7 bytes/gas. Point contract_address at the ring driver whose n matches how much of the corpus has actually been deployed. calltx Paused
117 3631-C ring driver n=16384 Byte-exact live spamoor-108 driver, ring_count=16384. Deploys to 0xe8730e19b17d5312cf319f8af8a7f8eab5ba2f65. factorydeploytx Finished
116 3631-C ring driver n=8192 Byte-exact live spamoor-108 driver, ring_count=8192. Deploys to 0xfedf740ca9ca22a726078bad3508db931bdddc27. factorydeploytx Finished
115 3631-C ring driver n=4096 Byte-exact live spamoor-108 driver, ring_count=4096. Deploys to 0x88042870b7c888fee84a73b220b4d3b733389851. factorydeploytx Finished
114 3631-C corpus: 16384 x 64 KiB random-alphabet contracts (stop_jumpdest_push1) Each contract EXTCODECOPYs the shared blob and stamps its own ADDRESS at bytes 32..63, so all 16384 have distinct code hashes and no client can dedupe them. Verified: 130/130 unique hashes on geth Amsterdam. factorydeploytx Paused
113 3631 attack A: randomized jumpdest analysis, STOP tail (stop_jumpdest_push1) Each tx CREATEs 128 KiB of non-repeating random initcode ~820 times (measured); the initcode jumps to its last byte so the whole thing must be analysed, and the counter mixed in at offset 32 makes every analysis unique so no client cache can serve it. The child falls into an implicit STOP and the account IS created (as in the PR); the driver REVERTs at the end so the creations roll back and the pre-funded targets are reusable. 20,286 gas per 131,072 bytes = 6.46 bytes/gas. calltx Paused
112 3631 prep 3/3: pre-fund 900 CREATE targets One-shot. Sends 1 wei to CREATE(driver, nonce=1..900) so every CREATE in the attack skips NEW_ACCOUNT. The attack tx reverts, so these stay unused forever. calltx Finished
111 3631 prep 2/3: CREATE driver Deploys to 0x100dae30856f1b5b689b1a88c8ddf18fc83bfbcf. Arm-independent and tail-independent: the source blob and the tail word come from call data, so this one driver serves every alphabet and both scenarios A and B. (The funder is deployed by prep 3/3 itself; its address is irrelevant because the targets it funds come from call data.) factorydeploytx Finished
110 3631 prep 1/3: random-alphabet 64 KiB source (stop_jumpdest_push1) EXTCODECOPY source for the CREATE driver. Deploys to 0x3b47073bd0313c8e775e215cb80d85b7c6990e61. factorydeploytx Finished
109 TSTORE transient-storage exhaustion Repeatedly calls a 6-byte contract that loops PREVRANDAO/GAS/TSTORE with the current gas counter as the key, allocating a new transient slot every iteration until the tx runs out of gas at the EIP-7825 per-tx cap (2^24 gas). Every call fails (status 0), so nothing is committed - the whole cost is the EVM building and throwing away the transient-storage entries. calltx Paused
108 JUMPDEST CALL attack (indices 1-66678, target: 200 MGas) Deploys a JUMPDEST-contract caller that cycles through indices 4000..70678 only, then hits it with full-block zero-calldata txs that keeps loop-calling these contracts and saves where it ended up at, such that the next tx can pick that up. Targets contracts were created by spamoor ID 100. Signed off by Jochem. calltx Paused
107 Deposit-contract: 410 fresh deposits per tx (1 ETH each, valid BLS sig, ~10M gas, 200M total) Calls the deposit contract 410 times per tx with a 1 ETH deposit for a fresh validator. Calldata carries a BLS-signed DepositMessage (privkey 0x111...111, withdrawal_credentials 0x02...) that the consensus layer accepts as a new pending deposit. Sized to consume ~10M gas per tx. geastx Paused
106 Deposit-contract: 410 top-ups per tx (1 ETH each, ~10M gas, 200M total) Calls the deposit contract 415 times per tx with a 1 ETH top-up to validator geastx Paused
105 Heavy blob spam blobs Paused
104 mem-pressure-bomb Recursive nested-memory peak (~17MB) + identity-precompile churn (~90MB/tx, ~50ms) allocator stress geastx Paused
103 [CPU] BN254 pairing bomb BN254 alt-bn128 ECPAIRING (0x08) k=1 bomb. Targets ethrex (arkworks BN254, portable Rust) while gnark clients (geth/erigon/besu) stay ~95mgas/s. 64-pt non-cacheable G2 pool, ~211 pairings/16.77M-gas tx. runtime=8310B. geastx Paused
102 [CPU] ecrecover bomb Fills blocks with secp256k1 ecrecover (0x01) - ~31 mgas/s, ~2x worse than BLS pairing AND underpriced on every client (all do a full recovery for 3000 gas, no fast path). ~5590 recoveries/16.77M-gas tx, hash varied per call (r,s,v fixed-valid => full work, non-cacheable). Slows ALL clients, not just gnark. geastx Paused
101 [CPU] BLS pairing-check bomb BLS12-381 pairing-check (0x0f,k=1) worst CPU/gas. ~237 pairings/16.77M-gas tx, 64-pt non-cacheable pool. Slowest-client exec 3-6s. geastx Paused
100 Deploy CREATE2 unique max sized (64 KiB, EIP-7954) JUMPDEST contracts for theoretical max of 300 Mgas This deploys 100_000 unique, max-sized JUMPDEST contracts, which are the theoretical maximum accounts we can read under a gas limit of 300_000_000 (see EIP-8038, `COLD_ACCOUNT_ACCESS` of 3000). The JUMPDEST contract code is a PUSH x JUMP opcode. x is the size of the contract minus one (so 64*1024 - 1). The remainder of the contract is filled with JUMPDEST. At byte 32, the ADRESS is ORd in (after clearing the target 20 bytes by zeroing those), which means that each of these deployed contracts is unique (their codeHash is different). Executing this contract costs 7 gas, and will require the client to do the 64 KiB of JUMPDEST analysis. Depending on the client implementation and the database config, this might be costly (costing time). Used for an EEST benchmark which we want to test on a live testnet. (Signed off by Jochem, see EL-specs) factorydeploytx Paused
30 Fuzzing 3 members A mix of fuzzing scenarios - EVM execution fuzzing (random bytecode deployments) and transaction-layer fuzzing (randomized tx types, calldata, access lists, authorizations and blobs) - sharing a global budget of 10 tx/slot to surface consensus and validation bugs. shared 10 tx/slot Running
31 EVM Execution Fuzzing w:2 Deploys contracts with randomly generated, stack-aware bytecode exercising opcodes and precompiles. evm-fuzz Running
32 Transaction Layer Fuzzing w:2 Sends well-formed transactions across all types (legacy/2930/1559/4844/7702) with randomized calldata, access lists, authorizations, blobs and targets. tx-fuzz Running
33 Invalid Transaction Fuzzing w:1 Fires deliberately-invalid transactions (bad chainid/nonce/gas/fees, malformed RLP, empty 7702 auth, blobless blob tx) from a small reused pool of burner wallets, out-of-pool and fire-and-forget. A node accepting one is a potential validation gap. tx-fuzz-invalid Running
10 Regular Chain Load 13 members A balanced mix of everyday transaction types - EOA transfers, ERC-20/721/1155 tokens, ERC-4337 account abstraction, Safe multisig, Curve / Uniswap V2+V3 swaps, blobs, Aave V3 lending, ENS name registrations and Seaport NFT trades - sharing a global budget of 100 tx/slot to emulate organic chain activity. shared 50 tx/slot Running
11 EOA Transfers w:2 Plain ETH value transfers between externally-owned accounts. eoatx Running
12 ERC-20 Token Transfers w:1 Deploys an ERC-20 token and continuously transfers it between wallets. erc20tx Running
13 ERC-721 NFT Activity w:1 Mints and transfers ERC-721 non-fungible tokens. erc721tx Running
14 ERC-1155 Multi-Token Activity w:1 Mints and transfers ERC-1155 multi-tokens. erc1155tx Running
15 ERC-4337 Account Abstraction w:1 Submits ERC-4337 UserOperations through the EntryPoint via a bundler. erc4337 Running
16 Safe Multisig Executions w:1 Executes transactions through Safe (Gnosis) multisig wallets. safe-multisig Running
17 Curve StableSwap Swaps w:1 Performs token swaps on Curve StableSwap pools. curve-swaps Running
18 Uniswap V2 Swaps w:1 Swaps tokens across Uniswap V2 pairs. uniswap-swaps Running
19 Uniswap V3 Swaps w:1 Swaps tokens across Uniswap V3 pools (0.3% fee tier). uniswap-swaps Running
20 Blob Transactions w:1 Sends type-3 blob transactions as part of the shared chain load. blobs Running
21 Aave V3 Lending w:1 Deploys a full Aave V3 market and organically supplies, borrows, repays and withdraws two tokens, with oracle price moves and occasional liquidations. aave-lending Running
22 ENS Name Registrations w:1 Deploys the real ENS contract stack and organically registers, renews, updates and churns names, naming all spamoor wallets on the host. ens-names Running
23 Seaport NFT Trades w:1 Deploys Seaport 1.6 and fulfills signed NFT buy and sell orders against a market counterparty. seaport-trades Running
7 EVM Fuzz Spammer Opcode & Precompile fuzzer, 50tx/block, gas limit 1M, ~20M gas usage evm-fuzz Paused
6 Uniswap V2 Swap Spammer 200 type-2 swap transactions with uniswap v2 pools, gas limit 20 gwei, ~15M gas usage uniswap-swaps Paused
5 Gas Burner Spammer 20 gas-burner transactions per slot, burning 2M gas each, gas limit 20 gwei, up to 40M gas usage gasburnertx Paused
4 Big Block Spammer 200 type-2 eoa transactions per slot with 25k zero bytes calldata each eoatx Paused
3 Blob Average Spammer Maintains a steady average of ~3 blobs per block blob-average Paused
2 ERC20 Transaction Spammer 215 type-2 erc20 transactions per slot, gas limit 20 gwei, 8.4M gas usage erc20tx Paused
1 EOA Transaction Spammer 400 type-2 eoa transactions per slot, gas limit 20 gwei, 8.4M gas usage eoatx Paused