Independent peer-candidate discovery for unreachable Monero nodes

Determine how an unreachable Monero node can obtain a peer candidate set that is not fully determined by its current outbound peers when inbound connections are unavailable as an honest-signal channel.

Background

The paper argues that the proposed protocol-level modifications address particular peerlist-injection paths but do not provide an unreachable node with an honest reference independent of its local peerlist. Because an unreachable node cannot accept inbound connections, its peer-discovery process may remain entirely dependent on the peers it already controls or trusts.

The unresolved issue is presented as a fundamental design question for preventing Nyx- and Moros-style eclipse attacks: a robust mechanism must supply either a Sybil-resistant identity signal or an independently obtained external signal that can detect or prevent eclipse states. The paper does not resolve how such a peer-candidate acquisition mechanism should be designed.

References

Blocking our attack at its root requires answering a question Monero has not systematically addressed, namely how an unreachable node obtains a peer candidate set not fully determined by its current outbound peers, in the absence of inbound connections as an honest-signal channel.

— Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!  (2609.10260 - Shi et al., 9 Sep 2026) in Section 6, “Countermeasures,” subsection “A Structural Perspective”