A research paper revealed by The Hebrew University in Israel experiences having discovered the “first evidence of a consensus-level attack on a major cryptocurrency.” The paper is at the moment awaiting peer assessment however makes use of publicly accessible on-chain knowledge and Ethereum’s open supply codebase to affirm its conclusions.
At its core, the paper highlights a difficulty the place miners can change the timestamp associated to a mined block to keep away from elevated issue on the community. On-chain knowledge seems to assist the declare as Aviv Yaish, one in every of the paper’s authors, highlighted F2Pool’s block timestamps being artificially altered to enhance rewards.
(9/12) Whenever F2Pool’s block timestamps attain the level the place mining issue is meant to lower, they artificially set them to be one second earlier. F2Pool has been executing this attack over the previous two years, and the proof has been hiding in plain sight! … pic.twitter.com/mDEG2UqXZh
— Aviv Yaish (@yaish_aviv) August 5, 2022
Ethereum is maintained by way of a proof-of-work consensus mechanism, which might be moved to proof-of-stake this September. However, to this level, the community seems to be inclined to the attack recognized in by The Hebrew University.
The consensus-level attack is referred to as an Uncle Maker attack inside the paper in reference to the “uncle” blocks utilized in the exploit. Blocks inside the Ethereum blockchain act as a set of information which are checked, distributed, and verified throughout the total community. Uncle blocks are legitimate blocks which were faraway from the fundamental chain however nonetheless obtain rewards.
“The attack allows an attacker to replace competitors’ main-chain blocks after the fact with a block of its own, thus causing the replaced block’s miner to lose all transactions fees for the transactions contained within the block, which will be demoted from the main-chain.”
Miners can set a block’s timestamp inside “a certain reasonable bound,” usually inside a number of seconds. One mining pool that was singled out in the analysis was F2Pool, which “in the past two years, F2Pool didn’t have even a single block with a timestamp” that matched the anticipated consequence. F2Pool is one in every of the largest Ethereum swimming pools working with a hashrate of 129 TH/s and producing roughly 1.5K ETH in day by day rewards.
The paper additionally highlighted that F2Pool’s “founder has made a relatively well publicized condemnation of competing mining pools, blaming them for attacking his own mining pool” whereas, in actuality, “F2Pool are attacking other mining pools.”
The financial influence of the attack has not but been formally recognized, however CryptoSlate reached out Yaish who instructed us,
“For each successful instance of the attack, F2Pool earned 14% more from block rewards, and in addition earned all the transaction fees contained within.
We are currently attempting to give concrete estimations for both of your questions using real-world data, which will be published immediately when we have them!”
The Hebrew University has “concrete fixes for Ethereum’s protocol” and created a patch for consideration. Yaish said in a blog post that the data was “responsibly disclosed to the Ethereum Foundation” earlier than publication.