SecurityReported
Arti reported to have proof-of-work queue bypass allowing zero-effort eviction
Published · Updated
A security report filed via HackerOne and published on GitLab describes a defect in Arti's rendezvous queue where a client sending no proof-of-work can evict a queued client that did. The report states this defeats the priority queue's purpose but notes it does not demonstrate a sustained denial of service. A maintainer commented that the issue is a bug but does not seem like a DoS issue, and a fix issue was created.
Why it matters
The report states that the defect defeats the purpose of the priority queue, allowing clients to bypass proof-of-work requirements for queue admission.
Event status Developing
Read the sources
- PoW bypass issue gitlab.torproject.org
- Public comment by @wesleyac gitlab.torproject.org
- Public comment by @wesleyac gitlab.torproject.org
This is an AI-assisted summary of the linked public sources. Consult the original reports for details and operator guidance.