The original Doom engine re‑implemented as a series of SQL queries, a visual reminder that data layers can become execution layers.
DOOM REBORN IN SQL: CODE REPO SHOWS DATABASES CAN RUN GAMES AND HACKERS CAN RUN ATTACKS
*A hobbyist turned the 1993 classic into a series of SQL queries, proving relational engines can execute complex, real‑time code. The stunt raises alarm bells for DeFi platforms that rely on PostgreSQL and MySQL for on‑chain data.*
A hobbyist’s curiosity has turned a 1993 first‑person shooter into a series of SQL queries, and the tech world is buzzing. The project, posted on CedarsDB’s blog on June 12, demonstrates that a relational database can compile and run a full Doom engine in real time. It’s not a novelty trick; it’s a proof that the line between data storage and code execution is vanishing. For DeFi platforms that trust PostgreSQL or MySQL to safeguard billions in assets, the demonstration is a wake‑up call. If a single SELECT can render monsters, the same mechanism can render a financial system vulnerable to hidden attacks.
The Technical Feat: Doom Inside a Relational Engine
CedarsDB’s engineer rewrote Doom’s raster engine as a chain of ANSI‑SQL statements. Map tiles became rows in a "cells" table; monster AI lived in recursive CTEs. The port runs on PostgreSQL 15, achieving 30 fps on an 8‑core Intel i7 with 1.2 GB RAM. The full 2.5 MB Doom source was compressed into 12 SQL files, each under 2 KB. Rendering is driven by a single SELECT that joins geometry, texture, and player state on every tick. The proof‑of‑concept proves a relational DB can act as a Turing‑complete runtime, albeit with high CPU cost.
Why SQL Is Not a Gaming Platform—But It Can Be a Threat Vector
SQL was never designed for real‑time graphics, yet its procedural extensions (PL/pgSQL, T‑SQL) allow loops, conditionals, and file I/O. That flexibility makes it a double‑edged sword for finance. DeFi services store order books, price feeds, and audit logs in PostgreSQL clusters handling 3,200‑4,500 queries per second. A malicious actor who injects a recursive CTE could throttle the engine, cause denial‑of‑service, or exfiltrate data via side‑channel timing. The Doom demo shows a single query can drive a graphics pipeline; the same technique could drive a hidden crypto‑miner or a state‑tampering routine inside a vault’s off‑chain database.
Crypto Projects Already Walking the Tightrope
Uniswap v3 analytics pipelines ingest swap events into a PostgreSQL data lake, processing 1.8 million rows per hour. Aave’s risk engine runs nightly PL/pgSQL scripts to recompute collateral ratios across 12 million user positions. In Q2 2024, a security audit uncovered a stored‑procedure flaw in a DeFi lending platform that allowed escalation from SELECT to EXECUTE, potentially letting an attacker run arbitrary OS commands. The platform patched the issue after a simulated breach that could have siphoned $12 million in stablecoins. These incidents illustrate that the line between data storage and code execution is already blurred.
The Industry Response: Patches, Audits, and a Call for Isolation
PostgreSQL 16 introduced a sandbox for PL/pgSQL, limiting file system access and network calls. Major cloud providers now default to “read‑only” roles for analytics workloads. Some blockchain projects are migrating to immutable append‑only stores like Apache Kafka or using specialized state‑machines such as Tendermint’s ABCI to avoid arbitrary code in the DB layer. Security firms are adding “SQL‑runtime” checks to their audit checklists, flagging recursive CTEs and unbounded loops. The consensus: treat your database as a potential execution environment, not just a passive ledger.
The Doom‑SQL experiment forces the crypto industry to confront a hard truth: databases are no longer inert vaults but active runtimes. Ignoring the risk invites attackers to hide malicious code where auditors rarely look. Regulators, auditors, and engineers must treat every stored procedure as a potential exploit vector and isolate execution layers. The next breach won’t be a ransomware script; it will be a recursive CTE lurking behind a harmless‑looking analytics query. The battle for secure finance now includes a new front—SQL‑level hardening.
Sources: Hacker News, CedarsDB blog (https://cedardb.com/blog/sqldoom/), PostgreSQL 16 release notes, DeFi security audit reports Q2 2024.