search

Crypto-Expert / stratum-mining

AIO Stratum mining server for various coins
Other
365 stars 348 forks source link

Flooding with shares below the pool target (maxcoin branch) #326

Closed prydie closed 7 years ago

prydie commented 10 years ago

We were seeing vast number of shares (100s per second) being submitted and validated by stratum that game from a single miner. These shares were always recorded at the pool target difficulty and the miner didn't respect vardiff.

The assumption I'm making especially after talking to @ahmedbodi on IRC is that stratum is not validating that shares actually match the target difficulty correctly.

If you give me some pointers I'm happy to do the leg work on this one.

flound1129 commented 10 years ago

If you're not using quark algo, I'd check the vardiff code.

If you are using quark algo, turn on debug and verify that the difficulties reported for incoming shares match those in the miner. If not, then diff1 in diff_to_target in template_registry is wrong.

If they do match, then next place to look would be the vardiff code. The attacker probably needs to disconnect every time the pool's vardiff kicks in, resetting their connection's diff to POOL_TARGET.

prydie commented 10 years ago

@flound1129 I'm using the MaxCoin branch and it wouldn't be a problem if I believed the shares to actually be valid for the POOL_TARGET but I'm pretty sure given the rate at which they're being spammed the shares themselves aren't actually at that diff. If they were there would be no advantage to the miner in flooding with low diff shares (as the DB and stratum servers can more than handle it).

prydie commented 10 years ago

RocketPool will offer a bounty of 100 MAX for a fix for this bug with a unit test verifying the patches validity.

flound1129 commented 10 years ago

I'm pretty sure it's got something to do with the vardiff code. On Apr 11, 2014 4:57 AM, "Prydie" notifications@github.com wrote:

@flound1129 https://github.com/flound1129 I'm using the MaxCoin branch and it wouldn't be a problem if I believed the shares to actually be valid for the POOL_TARGET but I'm pretty sure given the rate at which they're being spammed the shares themselves aren't actually at that diff. If they were there would be no advantage to the miner in flooding with low diff shares (as the DB and stratum servers can more than handle it).

Reply to this email directly or view it on GitHubhttps://github.com/Crypto-Expert/stratum-mining/issues/326#issuecomment-40195967 .