TTP-03-001 WP1: Snowflake broker vulnerability

Vulnerability type: TTP-03-001 WP1 Sybil attack on Snowflake broker
Threat level: _Medium_

While testing the Snowflake censorship circumvention broker, it was discovered that no rate-limit mechanism has been deployed in the client/proxy offer components. As a result, malicious actors could masquerade as Snowflake proxies to send large amounts of non- functional connection offers to the broker. Thus, the clients would be matched with non-functional proxies, which would artificially make it much more difficult to connect. Malicious actors could also send large amounts of client requests, which could artificially saturate the real proxies on the network. It is recommended to implement an IP-based rate-limit system, as well as possibly consider crafting a proof-of-work system to prevent these kinds of attacks.

We need a mitigation plan for this issue by the end of February.