Regarding ddos attack vector against the masternode network,

let's assume we have 1000 masternodes at some point (this is a low end safe estimate imo), and an adversary has accumulated 100 masternodes. Ok we know this itself is not nearly enough to spy on the network, but let's say the attacker decides to ddos the other 900 nodes. Most nodes don't have any ddos protection, and will be taken out. Some nodes will have protection, and/or will be quickly restarted on another IP. So let's say there are now 200 nodes of which the attacker controls 100.

Suggestion:

The wallet would keep track of the number of running masternodes, and if the number decreases rapidly (like the number is 50% less than last time the wallet was running), it would display a warning when trying to denominate and continue normally after the number of the running nodes has returned to normal. Usually ddos attacks don't last long, and this would prevent the adversary from directing all the traffic to his own nodes.


Thoughts?