blockchain-rpc-debug-exposure: Blockchain RPC Debug Trace Methods - Exposure

id: blockchain-rpc-debug-exposure

info:
  name: Blockchain RPC Debug Trace Methods - Exposure
  author: 0xBassia
  severity: medium
  description: |
    The blockchain RPC endpoint has debug-level tracing methods enabled (debug_traceTransaction, debug_traceBlockByNumber, trace_block, trace_filter). These methods return complete EVM execution traces including opcodes, stack values, and memory contents, enabling smart contract reverse engineering and targeted attacks.
  impact: |
    An attacker can reconstruct the logic of unverified smart contracts, analyze internal call flows, and simulate transactions. Combined with txpool access, this enables sophisticated MEV strategies. Heavy trace calls can also cause resource exhaustion on the RPC node.
  remediation: |
    Disable all debug_* and trace_* namespace methods on public RPC endpoints. If needed for developer tooling, expose them on a separate rate-limited endpoint requiring API key authentication.
  reference:
    - https://geth.ethereum.org/docs/developers/dapp-developer/native
    - https://github.com/ledgerwatch/erigon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
    cvss-score: 6.5
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: "jsonrpc"
  tags: misconfig,blockchain,rpc,debug,trace,web3

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"jsonrpc":"2.0","method":"debug_traceTransaction","params":[],"id":1}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"jsonrpc"'
          - '"error"'
          - "missing value for required argument"
        condition: and

      - type: word
        part: body
        words:
          - "does not exist"
          - "not available"
          - "not found"
          - "not supported"
        negative: true

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210088f0a2af8d5201bbf96337f6e2b7f6e3ac5f0643bba66b00467eadd2a31f18720221009e8055c49c838f2d567789dc4d3cc6c0124b720e3c121dcc7731bf3429dd4ea2:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.