The research paper here: https://eprint.iacr.org/2019/455 says Monero is prone to the FloodXMR attack.

  • What is it exactly and how can one execute it?
  • And how can one defend against it?

Abstract: Monero is one of the first and most popular cryptocurrencies to address privacy issues of other crypto coins such as Bitcoin. Monero has a market capitalization of over one billion US dollars, and is ranked the 12th most valuable cryptocurrency on CoinMarketCap (17 April 2019). This digital coin provides different mechanisms to protect its users, such as decoy keys or mixins to obfuscate transaction inputs. However, in spite of the efforts to protect Monero’s users privacy, transaction tracing attacks are still feasible. Our contribution is twofold. First, we propose and evaluate a new traceability attack, called transaction flooding attack (FloodXMR). Second, we present an analysis of thecosts required for an attacker to conduct FloodXMR. We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Moreover, we show also that more than 90% of the inputs are affected by our tracing algorithm.

  • 2
    This paper is rampant with inaccuracies, as can be seen here: reddit.com/r/Monero/comments/bn046q/… I am not certain a question about this inaccurate paper is even relevant for the Monero StackExchange. Besides, the attack was already covered in MRL-0001 and MRL-000.4
    – dEBRUYNE
    Nov 13, 2019 at 20:52
  • I likewise am not certain SE is the right platform to debate such flawed research.
    – jtgrassie
    Nov 14, 2019 at 3:07

1 Answer 1


The "paper" you cite is full of inaccuracies and has been debunked, at length in other channels, such as this reddit thread.

That should be the end of it.

What is it exactly and how can one execute it?

The general, and flawed, presumption is that an attacker can flood the network with cheap transactions. The aim of which being to track other users transactions due to a large percentage of decoys being owned by the attacker. Think about it like this: If a significant amount of the decoys being used in honest txs were owned by a single attacker, they're not very useful decoys are they! However, of the many inaccuracies in the paper, the cost analysis is fundamentally flawed. And as @ArticMine puts it so eloquently: "...this paper fails to account for significant anti-spam measures that are present in Monero.".

In short, it is simply not feasible to execute.

And how can one defend against it?

The "paper" doesn't present a feasible attack; the protocol already defends against such a proposed attack.

Lastly, and perhaps most relevant, @dEBRUYNE's quote: "...anyone can upload a paper to arXiv. They are not checked for factual correctness.".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.