Push and Pull: Manipulating a Production Schedule and Maximizing Rewards on the EOSIO Blockchain

EOSIO is a blockchain platform utilizing a byzantine-fault-tolerance delegated-proof-of-stake (BFT-DPOS) consensus protocol to guarantee scalability. In EOSIO, a group of representatives called block producers (BPs) is elected by voting through a certain period, and is scheduled in an order to produce blocks. And new tokens are given to BPs every time they produce a block as a notion of reward. In this paper, we show that an attacker can disturb fairness of compensation policy by manipulating the production schedule of EOSIO. Such manipulation is possible through an attacker who has enough tokens to abuse the election process. In order to demonstrate the feasibility and the capability of our attack, we created a tool following EOSIO's voting and irreversible block generation procedure. Our simulation shows that an attacker can provide additional rewards or loss up to 3 BPs. Finally, we discuss the applicability of our attack against the real EOSIO mainnet, and at the same time, propose some countermeasures to prevent it.