Propose a reserved transaction slot scheme to mitigate XRP front‑running transaction risk
Concerns have been raised about the possibility of front running or transaction sandwich attacks on XRPL payments and offer crossing.
For the reasons I've explained, I'm not that concerned about this issue. But I have a proposal for a fairly simple scheme that would eliminate this attack. It's a transaction reservation scheme that can ensure that a transaction executes before any transaction that was formed after it was disclosed.
This is the scheme, and it eliminates concerns about front running or sandwich attacks.
Reserving Transaction Slots
A new ledger object is proposed, ReservedTxns. It contains a ledger sequence number and an array of transaction IDs. It is stored at an index that is formed from a hash of a fixed string and the ledger sequence number.
A new transaction is proposed, TxnReserve to reserve an execution slot for a transaction. It takes a ledger number and transaction ID as parameters.
It succeeds if:
1) It pays a fee of at least twice the normal transaction fee.
2) It meets all the normal transaction execution requirements.
3) The ledger sequence number specified in the transaction is greater than that current ledger sequence number and not more than 16 ledgers greater than the current ledger sequence number. The transaction TECs if this test fails.
4) The ReservedTxns object for the specified ledger sequence number either does not exist or if it exists it contains fewer than 32 transaction IDs and does not contain the specified transaction ID. The transaction TECs if any of these tests fail.
If it succeeds, it creates a ReservedTxns object for the specified ledger index if one does not exist. It then adds the specified transaction ID to the end of the array of transaction IDs in the object.
Broadcasting Reserved Transactions
If a transaction has a reserved slot in ledger X, the transaction should be broadcast as soon as it is known ledger X-1’s initial proposals are all received or the final consensus transaction set is known. The XRPL software should be modified to provide a feature to disclose when that occurs and, if desired, to hold a list of transactions to broadcast when, and only when, that happens.
The XRPL software should always broadcast a transaction with a reserved slot if that transaction has not been broadcast recently. This should apply even if the server thinks the transaction will not succeed. Its relaying has already been paid for by the doubled fee for the reservation transaction, so this is not an attack.
A transaction that is intended to execute as a reserved transaction should have its last valid ledger set to the ledger it is expected to execute in. This ensures that if it is somehow delayed, it still cannot be sandwiched or front run.
Execution Mechanics
As each ledger executes, the following steps are added prior to the execution of any transactions in the transaction set:
1) The ledger object containing the reserved transactions for this ledger sequence number is retrieved. If there is none, skip the rest of these steps and execute transactions normally.
2) For each transaction ID in the set of reserved transactions, that transaction is executed if it is in the consensus set and removed from the consensus set so it will not execute again.
3) The reserved transactions object for this ledger sequence number is removed from the ledger.
DoS Attack Resistance
There is a theoretical attack on this scheme where an attacker could fill up all reservation slots for many ledgers as a denial of service to others to prevent them from being able to use this scheme to protect their transactions. This is mitigated by the fact that they would have to pay continuously and others could simply wait the attack out. However, the cost is low enough that someone could theoretically do this indefinitely.
A simple fix is to ratchet up the fees for the reservation transaction as the object starts to get full. For example, when we hit 16 reserved slots, we could begin to raise the fee linearly up to the base reserve. By the time we hit 30, the fee could go up to three times the base reserve.
If needed, we could even raise the limit to 64 if people are willing to keep paying fees. It’s likely that this would never result in such fees being paid and simply make the attack impractical. An attacker would have to pay, every five seconds, several times the most anyone would be willing to pay to protect their transaction.