search

Musicoin / go-musicoin

:link: Go-version of Musicoin blockchain wallet and consensus
GNU Lesser General Public License v3.0
161 stars 57 forks source link

Extremely malicious chain attack(s) in 51% double spending #98

Open immartian opened 5 years ago

immartian commented 5 years ago

During the last weeks of 2018. There's an increased risk of 51% attack around 200 GH/s. Some guys (maybe even early team member) stroked the chain with a series of attacks overtaking the mining hash rate and looted an amount of money from exchanges(like Bittrex) by using stealth mining strategy. Although early increasing of confirmation height has deterred this issue for a while, further attack took more fierce power and forged a bigger number of currency that cheated the exchanges. 

Amount    BlockHash    TxId    Address    Confirmations
31044323.16141530    0xd17795aef52653fb7a22e5d76edca90e6843b17f54ad49b7a22a3c1dc18e45bb    0x7adb0db9a9bc3d5c7bdae10ca4f5218cca2164b0d76a59b6d58f2823d3f3c28b    0x11e48413df8d1147b095c584d1cb50c029a8b8d1    173

the same times, plenty of orphaned transactions were made on the train which reveals the vulnerability of the chain algorithm, as well the of current weak states of the whole network in self-defense:

0xe4bc70111934ab0ddf6a9d6f1d541ee5b986f478    7925462.42564088    0x699b618bd8daf22756c1a8f273a9a81e02086498a29645ae1c966ac9b2c829b2    0xc9ee6de6acc7cfdb6f61216f7ea24b08c5f9f60b1e432fb7be9216be8b7eb070    2018-12-15 15:18:50.3570000
0xdee55f6e240697b74e73ded31c34ea39b152e227    3.56996376    0x9da71d9c4a8a6a71790d42d17e3951f2bd214be5d0ba32533c833707d64d6619    0x5a6e06e8bd9f097ab38d74fd32b80a159b762f84a3896c84b1d2b2523a36fa7b    2018-12-15 15:16:28.4600000
0xeb335873a609c7570fb99b0ec8319934466da455    8.11334479    0x9da71d9c4a8a6a71790d42d17e3951f2bd214be5d0ba32533c833707d64d6619    0x8fb9634f2099904cac145370ce7c148fecab3f27e5e6129b854b0ac4284fa336    2018-12-15 15:16:28.4430000
0xbc5033817d63732ee54814b3da817575c9d2be27    95.64662040    0x9da71d9c4a8a6a71790d42d17e3951f2bd214be5d0ba32533c833707d64d6619    0xf25c4e17e8e0202e0b816e098bbb9a91cbb15eac16f92d08c92dba45d951c05e    2018-12-15 15:16:28.4300000

The issue is serious and we have called industry experts to help and support. Currently a passive defensive measure has been investigation but eventually there' should be huge leap on the consensus to remove this vector totally.

immartian commented 5 years ago

we know how the attack works we can summarize it in a few key moments.

A) The attacker needs to mine his own version of the blockchain in private with hashrate greater than the one on the main network in order to be faster and create a longer chain. This is often a race for getting a chain with 10–20–50 blocks longer.

B) Once he is in possession of a longer blockchain he needs to broadcast it to the network. Then the network needs to recognize it as the longest chain and accept it.

C) A successful double spend would orphan the initial transactions making the coins available in the attacker wallet once again after the applied longer chain.

immartian commented 5 years ago

2nd 51% attack on $MUSIC blockchain