Panning for gold.eth: Understanding and Analyzing ENS Domain Dropcatching

Ethereum Name Service (ENS) domains allow users to map human-readable names (such as gold.eth) to their cryptocurrency addresses, simplifying cryptocurrency transactions. Like traditional DNS domains, ENS domains must be periodically renewed. Failure to renew leads to expiration, making them available for others to register (a phenomenon known as dropcatching). This presents a security risk where attackers can register expired domains to leverage the residual trust associated with them and, in the context of ENS, receive transactions intended for their previous owners. In this paper, we conduct the first large-scale study on dropcatching in ENS domains. We curate and analyze a dataset comprising 3.1M ENS domains and 9.7M Ethereum transactions, finding that 241K of these domains were re-registered by new owners after expiration. Our findings indicate a preference for domains linked to high-income wallets in re-registrations. We identify 2,633 transactions that were misdirected to new owners, averaging the equivalent of thousands of US dollars. Lastly, we highlight the lack of countermeasures by digital wallet providers, and suggest straightforward approaches that they can use to minimize financial losses due to ENS dropcatching.