  Blockchains, with intricate architectures, encompass various components,
e.g., consensus network, smart contracts, decentralized applications, and
auxiliary services. While offering numerous advantages, these components expose
various attack surfaces, leading to severe threats to blockchains. In this
study, we unveil a novel attack surface, i.e., the state storage, in
blockchains. The state storage, based on the Merkle Patricia Trie, plays a
crucial role in maintaining blockchain state. Besides, we design Nurgle, the
first Denial-of-Service attack targeting the state storage. By proliferating
intermediate nodes within the state storage, Nurgle forces blockchains to
expend additional resources on state maintenance and verification, impairing
their performance. We conduct a comprehensive and systematic evaluation of
Nurgle, including the factors affecting it, its impact on blockchains, its
financial cost, and practically demonstrating the resulting damage to
blockchains. The implications of Nurgle extend beyond the performance
degradation of blockchains, potentially reducing trust in them and the value of
their cryptocurrencies. Additionally, we further discuss three feasible
mitigations against Nurgle. At the time of writing, the vulnerability exploited
by Nurgle has been confirmed by six mainstream blockchains, and we received
thousands of USD bounty from them.
