# Update call, just return, 35M cycle consume!

**URL:** <https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008>\
**Category:** Developers\
**Created:** [July 20, 2021, 10:10am UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008 "2021-07-20T10:10:01Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![machenjie](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/machenjie/32/1523_2.png) [@machenjie](https://forum.dfinity.org/u/machenjie)\
**Post date:** [July 20, 2021, 10:10am UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/1 "2021-07-20T10:10:02Z")

</div>

How to avoid DDOS attack of cycle consume!

How to avoid cycle consume with no sense?

---

<div class="post-metadata">

**Author:** ![dpdp](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/dpdp/32/1143_2.png) [@dpdp](https://forum.dfinity.org/u/dpdp)\
**Post date:** [July 20, 2021, 11:45am UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/2 "2021-07-20T11:45:02Z")

</div>

As far as I understood; if you trap the execution of an update call ( `throw` it would not decrease the cycles;

Example:

```auto
public shared (msg) func updateSomething(): async () {
    if(msg.caller != admin) { // throw and won't spend }
    // update state and will spend
}

```

---

<div class="post-metadata">

**Author:** ![machenjie](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/machenjie/32/1523_2.png) [@machenjie](https://forum.dfinity.org/u/machenjie)\
**Post date:** [July 20, 2021, 12:00pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/3 "2021-07-20T12:00:26Z")

</div>

I just use assert and throw, not work, cycle will be used.

---

<div class="post-metadata">

**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\
**Post date:** [July 20, 2021, 12:26pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/4 "2021-07-20T12:26:40Z")

</div>

35M cycles is 0.000035 $, isn’t it? Someone needs to send a lot of requests to your canister to make that noticable.

For update calls (but not inter-canister calls), you can use the `canister_inspect_message` feature to prevent calls from event entering the Internet Computer. This way you would not be charged at all. This is not available in Motoko, though.

For inter-canister calls you can find solace in the fact that the call costs the caller much more than what you pay for a quick rejection. To plug even that I expect that the cycle accounting will charge the first few million cycles not to the canister (but rather consider them paid by the caller’s fee for sending a message). Then your swift rejection will be free.

---

<div class="post-metadata">

**Author:** ![machenjie](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/machenjie/32/1523_2.png) [@machenjie](https://forum.dfinity.org/u/machenjie)\
**Post date:** [July 20, 2021, 12:35pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/5 "2021-07-20T12:35:33Z")

</div>

> [@nomeata](#):
>
> `canister_inspect_message`

Thank you, `canister_inspect_message` is a good choose, but code is written by motoko, so sad!

---

<div class="post-metadata">

**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\
**Post date:** [July 20, 2021, 12:42pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/6 "2021-07-20T12:42:19Z")

</div>

It’s not as bad. Most canisters have _some_ public method that anyone can call (e.g. registration). Once you have a single such message, and attacker can make you spend cycles, and you just have to live with that (and can stop worrying about counter measures). So as long as rejecting quickly is cheap enough to make the attacks practically too expensive, it’s kinda fine.

---

<div class="post-metadata">

**Author:** ![machenjie](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/machenjie/32/1523_2.png) [@machenjie](https://forum.dfinity.org/u/machenjie)\
**Post date:** [July 20, 2021, 12:50pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/7 "2021-07-20T12:50:26Z")

</div>

Maybe so. just go ahead and look.

---

<div class="post-metadata">

**Author:** ![mparikh](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@mparikh](https://forum.dfinity.org/u/mparikh)\
**Post date:** [July 20, 2021, 7:31pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/8 "2021-07-20T19:31:14Z")

</div>

IMO It is bad. I think that when ANY amount of $ can be lost by serving malafide requests, it totally exposes up a surface vector for attack. This should be prevented at the IC level in partnership with canisters.

---

<div class="post-metadata">

**Author:** ![senior.joinu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/senior.joinu/32/9240_2.png) [@senior.joinu](https://forum.dfinity.org/u/senior.joinu)\
**Post date:** [July 21, 2021, 12:17am UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/9 "2021-07-21T00:17:56Z")

</div>

Every attack has a cost. It is not feasible for an attacker to drain any canister out of cycles if it will require more cycles to execute.

---

<div class="post-metadata">

**Author:** ![Siliev545](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Siliev545](https://forum.dfinity.org/u/Siliev545)\
**Post date:** [July 21, 2021, 4:15pm UTC](https://forum.dfinity.org/t/update-call-just-return-35m-cycle-consume/6008/10 "2021-07-21T16:15:08Z")

</div>

Are there any examples of how to use `canister_inspect_message`?