Ravencoin (RVN) Consensus Exploit and Chain Restoration

This was essentially the most severe incident on any of our swimming pools this 12 months, so right here is the entire thing so as.

What broke

The flaw sits in Ravencoin’s KAWPOW block header validation. The nHeight discipline contained in the KAWPOW header was by no means checked towards the block’s precise place within the chain. An attacker who manipulates that discipline can get a susceptible node to just accept a provided combine hash with out ever doing the actual ProgPoW work – no DAG, no memory-hard hashing, no GPU. Forging a block that method is orders of magnitude cheaper than mining one truthfully.

The bug had two ugly negative effects past the solid blocks themselves. Affected nodes may crash on restart, and nodes attempting to sync bumped into damaged header sequences and stalled.

Timeline

• August 7, 15:44:01 UTC – the primary recognized invalid block is accepted at peak 4,487,776. A self-described safety researcher demonstrated the assault on mainnet, and a second attacker copied it.
• August 10 – 2Miners releases the emergency patch 4.6.1.1-hf1. It rejects any block whose declared header peak doesn’t match its precise place within the chain, and locks a checkpoint at block 4,487,775, the final clear block.
• August 10-12 – Upbit and Bitget droop RVN deposits and withdrawals as a precaution.
• August 11 – Ravencoin publicly discloses the vulnerability and advises node operators, exchanges, and explorers to improve instantly. Maintainer Hans Schmidt recommends operating the 2Miners code till a mixed upstream launch is prepared.
• August 19 – Ravencoin publishes v4.8.0, constructed on the identical code we launched, bundling the KAWPOW repair with the separate asset switch amount overflow patch.

How massive the injury was

Scanning a 2,089-block window from 4,489,527 to 4,491,615, we recognized 96 solid blocks. Every thing confirmed after 4,487,775 on the exploited department was in danger, which is roughly three days of chain historical past.

The restoration chain

2Miners and the opposite swimming pools began constructing a competing chain from block 4,487,776 that excludes the department carrying the invalid blocks. Collectively we maintain the vast majority of Ravencoin’s hash charge, so the clear chain grew sooner than the solid one and overtook it. It’s now 1000’s of blocks forward, friends have reconnected, and the break up is settled in favour of the trustworthy chain.

Each RVN mined earlier than August 7 was by no means in query. Our RVN pool and RVN SOLO have been operating on the clear chain all through.

What you might want to do

• Run v4.8.0 if you happen to function your individual node, pockets, explorer, or alternate integration. It supersedes our emergency hotfix 4.6.1.1-hf1.
• v4.7.0 doesn’t repair this. That launch solely patched the asset overflow bug and by no means activated on mainnet, as a result of BIP9 voting didn’t full earlier than v4.8.0 turned obligatory.
• Something older than 4.6.1.1-hf1 continues to be uncovered to the identical forged-block trick and should refuse to sync.

Should you mine RVN with us and don’t run your individual node, there’s nothing to alter in your aspect. KAWPOW mining and payouts proceed as regular.

Pearl (PRL) Salted Noise-Seed Exhausting Fork at Block 99,000

Pearl activated a tough fork at mainnet block 99,000 on August 11. The change salts the noise seed utilized by PearlHash, which suggests shares produced by pre-fork mining software program are merely invalid after the fork block.

Please concentrate! This failure mode is quiet. An outdated miner retains reporting a wholesome hashrate in your display whereas nothing it submits will get credited. In case your PRL earnings flatlined in mid-August, for this reason.

Mining software program with fork help:

• PeakMiner 2.9.0
• SRBMiner 3.5.3
• Krig 1.2.0
• ArcMiner 0.3.1
• Fl4shMiner 1.2.7
• ForgeMiner 1.5.10

On the node aspect the fork ships in Pearl 1.4.1, and that’s what our node runs. Earlier within the month we additionally took Pearl 1.3.1 (commit b6d7e5e), a follow-up to the 1.3.0 rank-penalty gentle fork launched on August 5. Our swimming pools have been prepared earlier than the fork block and saved producing. Mine on PRL POOL and PRL SOLO, and examine profitability on 2CryptoCalc.

Kaspa (KAS) Block Reward Discount

As outlined by the Kaspa Tokenomics, the Crescendo Exhausting Fork, and the official emission schedule, Kaspa underwent one other scheduled block reward discount in August.

• Earlier Reward: 2.449 KAS
• New Reward: 2.312 KAS

Please concentrate! Kaspa mining profitability has modified. We have now already up to date 2CryptoCalc to replicate the brand new reward values. Mining continues on the KAS pool and KAS SOLO.

Node Updates

Ergo – 6.0.4

Launched August 18. Most of this launch is API hardening and take a look at work, however three objects matter if you happen to run an Ergo node or care about block propagation:

• Block candidate era enhancements
• A repair for lastHeaders within the upcoming state context, so the miner not will get caught on divergence throughout block pre-validation and validation
• A caught-up repair, plus further index consistency preserved throughout chain switches

The remainder is housekeeping: duplicate IDs at the moment are prevented within the ordered transaction pool, a number of REST and pockets routes validate their parameters correctly, and the testnet model 2 activation peak was corrected. Autolykos mining is unchanged. Mine on the ERG pool and ERG SOLO.

Quai – v0.55.1

Tagged August 11. The headline for miners is that go-quai now carries a built-in stratum proxy for solo mining, and the discharge collects a future of labor on it:

• Variable issue (vardiff) for the stratum proxy
• Non-obligatory PROXY protocol help, so the stratum server works behind a load balancer
• A blockTemplateUpdates websocket subscription
• Bitcoin-style issue values as an alternative of uncooked issue in API submissions
• A well being examine service on port 8081 that compares node peak towards a public RPC
• Swish stratum shutdown, distinctive job IDs, monotonic session IDs, and a frequency parameter that solely updates ASICs on the requested charge
• KawPoW dealing with updates on Quai dad or mum hash change, and guarding of the epoch and lightweight cache DAG measurement

Nothing adjustments in your miner configuration on our aspect. Mine on QUAI KawPow, QUAI KawPow SOLO, QUAI SHA-256, and QUAI SHA-256 SOLO.

Keep Up to date

Comply with us on X (Twitter) and be a part of our Telegram chat to remain knowledgeable about new developments, miner alerts, and community upgrades.