When Is An Impactful Attack Downgraded To Griefing?

This article refers to bug reports with a High or Critical severity impact that the attacker does not profit from at all and may be costly to execute.

In general, if an attacker can only cause a small amount of damage per dollar they spend, then the attack’s impact is downgraded to Griefing.

The baseline ratio for Griefing is any attack where it costs $1 to deal $10 or less in damage on an attack for which the attacker does not profit from.

In contrast, any attack where it costs $1 to deal $100 or more in damage on an attack for which the attacker does not profit from is not Griefing because this is sufficiently impactful to motivate a malicious blackhat to exploit. For example, Immunefi considers it sufficient motivation for a malicious attacker to spend $1,000 of their own capital if they can then destroy $100,000. Same for if they can spend $100,000 to destroy $10 million.|

For any attack that falls between these ratios, does not directly put funds at risk, or is otherwise not covered in this article, Immunefi will evaluate on a case-by-case basis. That said, these are common questions Immunefi will investigate when evaluating risk:

1. Could the attacker indirectly profit from the attack?
2. How serious is the 2nd order damage from the attack?

Question: Can a denial of service attack on an asset in scope be considered the impact ‘Griefing’?

Answer: Yes it can.

For example, if deposits can be DOS'd by an attacker by frontrunning a tx, causing the user’s transaction to fail, and requiring the user to make a subsequent transaction.

In this example, damage is being caused to the user in the form of funds lost due to the reverting transaction. Even though the state may return back to normal, the contract is put in a not-optimal state which would block normal function execution for any user. When the state is back to normal, the user would be able to call the function once again to complete it. What the attacker achieved was damage to the user by requiring them to send another transaction. There's no profit for the attacker apart from damaging the users or the protocol.