Security alert [consensus issue]

KenK

This is now fixed
Edited by @StephanTual Thursday 7pm GMT.

This issue only affected geth users (or geth users in combination with ethminer). If you are using Geth, please update now.

To update:

If using the PPA: sudo apt-get update then sudo apt-get upgrade
If using brew: brew update then brew reinstall ethereum
If using a windows binary: download the updated binary.
If you are building from source: git pull followed by make geth (you need to be on the Master branch)

The correct version for this update on Ubuntu AND OSX is Geth/v1.0.2-4591ae56 and v1.0.2-a0303f (both are fine)

On windows, the latest chocolatey package version is Geth Stable 1.0.1.2 and it's pulling from download/v1.0.1.2/Geth-Win64-20150820212541-1.0.1-f0c7af0.zip (this is normal)

Note, if you are getting:

I0820 19:00:53.368852    4539 chain_manager.go:776] Bad block #116522 (05bef30ef572270f654746da22639a7a0c97dd97a7050b9e252391996aaeb689)
I0820 19:00:53.368891    4539 chain_manager.go:777] Found known bad hash in chain 05bef30ef572270f654746da22639a7a0c97dd97a7050b9e

.. after updating this is NORMAL and will resolve itself once your peers have updated their clients, too.

UPDATE 10:52 BST: We have released a new update on the state of the network post consensus failure and expectations on chain reorganization depth (now 750 blocks) https://blog.ethereum.org/2015/08/20/security-alert-consensus-issue/



------------

This alert is related to a consensus issue that occurred on the Frontier network at block 116,522, mined on 2015-08-20 at 14:59:16+02:00

Impact: High

Issue description: Edge case in the Go implementation of the consensus protocol for contract suicides

Affected implementations: All implementations of Geth (Go). Eth (C++) and pyethereum (Python) are unaffected

Effects on expected chain reorganisation depth: Increase waiting time for eventual block confirmation to 12 hours

juttasteiner

We are distributing updates in all channels (blog, forum, twitter, IRC, etc.) asap. Earliest updates will be given on blog.ethereum.org.

Escalicha

I'm waiting for an update.

Thanks

acros

@Escalicha an update has been posted on the blog: https://blog.ethereum.org/2015/08/20/security-alert-consensus-issue/

evan

how likely is it that we will return to the bad block?

juttasteiner

All transactions mined by geth after block 116,522 should be considered unconfirmed.

juttasteiner

Issue description: Edge case in the Go implementation of the consensus protocol for contract suicides
Affected implementations: All implementations of Geth (Go). Eth (C++) and pyethereum (Python) are unaffected
For earliest updates: See blog.ethereum.org or https://blog.ethereum.org/2015/08/20/security-alert-consensus-issue/

Righteous

I'm assuming this is why my eth(c++) has been throwing "block hash bad" and "InvalidReceiptsStateRoot" errors?

acros

how many blocks are poloniex and kraken using for confirmation?

urwald

am I ok by mining with Geth-v1.0.3 ? I'm the node 'urwald'...

heaveancorner

what to do if we are not concerned? restart geth ? rebuilt the blockchain etc ???

acros

@urwald and @heaveancorner , I would avoid mining and potentially further confirming double-spent ether (provided there has been any)

urwald

ok ! I'm not mining now, just run as passive node... Somebody could publish the right version of Geth to use, when avalaible ?

juttasteiner

We will publish fixes for geth once they become available. The issue has been identified, but we are waiting for tests to confirm.
Meanwhile, all geth (Go) miners should either stop or better switch to eth (C++) or pyethereum (Python).

zono

acros said:

how many blocks are poloniex and kraken using for confirmation?

i believe poloniex needs 375 confirmations

StephanTual

I updated the thread top message with the fix and instructions on how to build.

acros

great, excellent response from the dev team! only one criticism: a more coordinated action involving exchanges would have been nice (unless it was the case and it was just a matter of communication!)

StephanTual

@acros : all exchanges are with us in a skype channel and were notified immediately.

heaveancorner

i'm getting : I0820 20:26:14.347048 2840 chain_manager.go:777] Found known bad hash in chai
n 05bef30ef572270f654746da22639a7a0c97dd97a7050b9e252391996aaeb689
I0820 20:26:14.347048 2840 downloader.go:254] Synchronisation failed: hash fe
tching canceled (requested)

Apparently i'm mining .

acros

I'm now at block 116721 (0x71bb687a72efb0904de5baa23f02d7552e60d3e002cd0e47c9421b45dc45506d), you guys?

Righteous

It seems like ethpool was/is mining on the correct chain, and is reporting a hash rate of 111 GH/s. etherchain.org is reporting a network hash rate on the correct chain of 130 GH/s. That's 85%

Seems like we really need to inform people not to pool mine at this stage of things.

zono

#116729
working fine

heaveancorner

acros said:

I'm now at block 116721 (0x71bb687a72efb0904de5baa23f02d7552e60d3e002cd0e47c9421b45dc45506d), you guys?

Working fine now ! 116734 for me.

StephanTual

https://etherchain.org/ is on the new chain, so feel free to refer to this going forward.

joshuad31

I don't have any healthy peers so I can't sync to the main chain even after making an update.

liondani

acros said:

how many blocks are poloniex and kraken using for confirmation?

it should be 3000 confirmations on poloniex at first but they have pending all transaction's before a couple of hours without giving updates about confirmations...... They said they will make an announcement on the NOTICES box (under the trollbox). Until now no more info....
And I will take the opportunity to desctibe my problem with poloniex...

I had sent a big sum of Ether's to poloniex before the security announcement and it made 333 confirmations... after that they freeze the transaction (pending) and disabled the wallet.... The strange thing is that they changed the confirmations to 204/3000 (instead of 333) and they changed the transaction time stamp for the same transaction with a difference of about 4 hours !!! The original transaction was made at 2015-08-20 14:53:58 and they changed the timestamp for the same transaction to 2015-08-20 18:40:12 (with the confirmation difference). Luckily I have screen-shot’s for what i am describing... has anybody a clue what could happen? Is there a possibility they want to hide something? I am really very frustrated with the situation.

liondani

joshuad31 said:

I don't have any healthy peers so I can't sync to the main chain even after making an update.

go to .ethereum directory and rename the chaindata to chaindata_old (for example)... this way it will create the directory from scratch and you will end-up on the right chain

Wil611

When will ETHDEV give the exchanges the go ahead to open transactions?

StephanTual

@Wil611 We'd never do such a thing - we simply flag issues when they come up, and provide them with an update on chain reorg depth expectation. We of course give them a heads up when a fix is available.

Then again none of the above is different to what we provide the community (either in content or timing). What they do with that information is up to them.

Wil611

Ok thanks Stephan

metbit

After I upgraded to geth-1.02, I'm getting these messages as follow,
> I0821 09:06:18.613480 5612 downloader.go:278] Block synchronisation started
I0821 09:06:20.660828 5612 chain_manager.go:660] imported 0 block(s) (0 queued 1 ignored) including 0 txs in 1.1637769s. #115299 [6c03d6ad / 6c03d6ad]
I0821 09:06:20.664831 5612 chain_manager.go:776] Bad block #115300 (30ef297811617a9f246592fa57f2af23f61cbb74e2b793054a64b58532713df4)
I0821 09:06:20.664831 5612 chain_manager.go:777] Transaction w/ invalid nonce. tx=5349 state=0)
I0821 09:06:20.664831 5612 downloader.go:254] Synchronisation failed: block downloading canceled (requested)
I0821 09:06:29.645939 5612 chain_manager.go:660] imported 0 block(s) (0 queued 1 ignored) including 0 txs in 5.012ms. #115299 [6c03d6ad / 6c03d6ad]
I0821 09:06:29.805415 5612 chain_manager.go:776] Bad block #115300 (30ef297811617a9f246592fa57f2af23f61cbb74e2b793054a64b58532713df4)
I0821 09:06:29.805415 5612 chain_manager.go:777] Transaction w/ invalid nonce. tx=5349 state=0)
I0821 09:06:29.806416 5612 downloader.go:254] Synchronisation failed: hash fetching canceled (requested)

Anybody help me?