Bitcoin Forum

Following is a summary of the Terracoin vulnerability I communicated to Gavin and Terracoin developer. It is now fixed in the latest Terracoin release.

Summary: Possible manipulation of difficulty by a miner collusion, or a direct 51% attack, to collapse the difficulty and block generation interval to almost 0.

Impact Level: Critical.

Description: because terracoin employed a very short adjustment interval of 30 blocks, while the target spacing is 2-minute, below is what I come up with as an experimental attack scenario (not tested yet but just for illustration purposes for now). The way the attack works is that a miner collusion attempts to artificially inflates the time span of each retarget section. When the collusion gains momentum theoretically for terracoin I think the difficulty will collapse and block spacing drops close to 0. This is because terracoin 1) didn't fix the time travel vulnerability 2) used a too short retarget interval.


diff --git a/src/main.cpp b/src/main.cpp
index 87b8abf..f28ea0b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -1238,6 +1238,15 @@ void CBlock::UpdateTime(const CBlockIndex* pindexPrev)
 {
     nTime = max(pindexPrev->GetMedianTimePast()+1, GetAdjustedTime());

+    // If the time-travel vulnerability is present  (nActualTimeSpan is
+    // computed between the first and last block of the retarget section)
+    // the following patch can gradually attract miners to join a 'collusion':
+    // inflate nActualTimeSpan on both ends of the retarget section
+    if ((pindexPrev->nHeight+1) % nInterval == 0)
+        nTime = max(GetBlockTime(), GetAdjustedTime()) + 105 * 60;
+    else if ((pindexPrev->nHeight+1) % nInterval == 1)
+        nTime = pindexPrev->GetMedianTimePast()+1;
+
     // Updating time can change work required on testnet:
     if (fTestNet)
         nBits = GetNextWorkRequired(pindexPrev, this);


Acknowledgement: this class of attack was first disclosed by ArtForz in 2011 I think. It's well known among bitcoin developers and old-time altcoin developers.

Edit: nm, same as time travel with original solidcoin I think.

Thank you SunnyKing for pointing this out to the TRC dev's!

No. Yours is a limited oscillation. This one would collapse it to 0.

Yeah, I realized it now, I haven't heard about that vulnerability for a while.

Best way to thank me is for the terracoin fans to stop trashtalking ppcoin just because we are in competition. I advocate competing fairly with positive spirit.

Thanks,

Deal.

Uninstall, reinstall previous stable build and check for this error message. If it turns out that the previous builds work, then someone screwed up the source files and compiled.

I just installed the new stable release. Why is it re-downloading all the transactions that I had already?

nevermind.

That's not a patch to fix anything.  Do not apply that.  It was a potential exploit that has already patched (again, not that code).  It's my understanding that that code won't get you anywhere with exploiting anything in the current branch.

Earnest agreement!  Thank you for your contribution, and I wish you and your coin's users the best.

(And even though I have coin preferences, I hope nobody ever reads what I say as trashing other coins or their users.)

Terracoin has an active dev?

SK you are the Best

I purchased PPC and TRC both are great!!!!

Yes it does. He will answer questions at the sourceforge page or the github page and lurks in the forums.

i don't consider any coin as competition to each other. every coin is different and every coin can be useful in its way.
btw, SK you are great!

Some is time-travel exploiting the new difficulty calculation right now. The generated coins are going to:

http://cryptocoinexplorer.com:3750/address/111exFkjLXP5mXmEfVqGd2r7bXQhVhux3

i guess he can do that because there are not enough miners on TRC, looking atblocks, i see he is able to mine multiple consecutive blocks at a diff between 2k and 14k

If he was unable to mine multiple consecutive blocks, i'm pretty sure the averaging thing would more or less ignore those

Watch the time stamps. He's generating the blocks ahead of time and then dropping them all on the network at once.

yes, saw that.

If there was enough miners ... he should not be able to mine so many consecutive blocks, that's what i was saying.

If people want to protect their coins ... mining is the only option
(supposing he's not the guy behind your favorite pool of course :p )

Yes, he does have some mining power, but he's leveraging the time-travel exploit to multiply his hashing power by 10x or more.

It doesn't help the coin any that the difficulty jumping basically broke pooled mining and coinotron isn't doing it as far as higher constant hashrates go

actually no : enable the in-place logging of averaged data and you'll see the block with future ntime/timestamp has no real effect, the problem is that he can mine consecutive blocks, finally leading to the averaging taking those into account...

Last block was at 18:31:35 at difficulty 27431. At 18:51:35 difficulty drops to 2743. He has been mining that block and the ones after it for the last 15 minutes. When 18:51 comes he'll drop a chain of blocks already pre-generated at the lower difficulty. Watch for it.

BTE currently experiences a similar problem : some big mining resources were pointed to their chain, long enough to make diff skyrocket, then the miner simple left.. someone really wants a few coins to disappear :(

And there they are. Blocks 103018 at 18:52 through 103036 at 19:11. Actual clock is only 18:57. He's generating blocks ahead of time, and into the future.

this is supported by the protocol, but indeed, the averaging function should proceed those in another way i guess.
I reported the first block with a future ntime to devs, asking how would this affect the diff (magically he first used +15 mins, that's how i saw hit while looking at how frequent blocks were mined).

The real problem here i guess, is that that guy is able to mine multiple blocks one after the other, obviously this finally alters the averaged data and triggers the diff increase.

Looks like (according to P2Pool) -- the blocks seem to all be coming from:
216.69.248.251,9323

Sorry wmikrut.  I was wrong in the other thread. 

if blocks were generated with p2pool we would see two distinct things:

- p2pool author pubkey / transaction in outputs

- multiple outputs, to addresses belonging to share owners

i doubt he uses p2pool (how would he alter remote existing p2pool installations by the way)

No need to apologize!
I appreciate the response.

what's kinda funny, is that those attacks could come from a pool where miners willing to help point theirs rigs :)

Sorry -- I didn't mean to imply they are using P2Pool.
I meant when I use explorer in P2Pool on these blocks -- they all appear to be coming from the same address.

I am mining for few hours no blocks found, with 20Ghash t should be.. at least some... dunno if something is wrong or just bad luck.

I really don't know at this point... I see the guy churning out blocks so fast -- it seems impossible to keep up.
The difficulty drops to 565... then in seconds shoots back up to 32,000+

In the mean time -- he's turning out blocks in the difficulty range of < 35 at the rate of 1 every couple minutes.
TBH... I am surprised the exchanges haven't suspended TRC trading yet.

so at this point in time trc is terribly broken and i would never mine it because someone is ripping me off?
that about sums it up?

Dev said on Github that he won't play cat and mouse game with the guy who's exploiting terracoin and if people don't mine the attacker will win.

So how much hash power are we talking here?
I will gladly put my 7Gh into solo mining if that will help... but what's the bigger picture needed to stop this guy?

i guess this is how an alt coin dies then.
seems like there is two too many right now anyway.

it takes 30 of me to equal one avalon. if the guy has 3. we are talking 100 of me just to out do him by a tiny bit.
i doubt that is going to happen.

That's reassuring...

Ok... I redirected my ~7Gh into TRC P2Pool:
http://www.wmikrut.com:9322/static/

That's all I have.

I read the description of OP at least 50 times, but I dun' get it.

I assume you mean that you need more than one node for this?

And this "group" of miners does this how? Inflation means to increase, increase means it will take longer than 2 minutes to create a block. Not sure how you'd do it. It's possible due to less nodes?

And again, how do you prevent people from finding blocks? Bear with me, I am thinking as I type, so basically miners will increase the difficulty, then stop till the retarget code decides it needs to go down? And when it goes down it gets exploited by the miners with the most hashpower again?

I've moved 6GH/s to TRC.  We need an "Altcoin Rapid Response Team"  (ARRT) to fight off jackasses like this.   

i personally moved my miners away from p2pool for now, it really looks broken, nearly every found block gets orphaned and stale rate is incredible, i gave a try to multipool.

I'd suggest you check your own p2pool stats (& graphs) page and maybe logs, it can still be coming from my setup.

i'll check my stats tomorrow and then decide if i try solomining or not.

I'm having a good bit of success solo mining.  Sure I'm getting some orphans, but that's to be expected. 

Yeah, things look a little messed up in P2Pool --- and tbh I don't know if I am contributing to a problem by using it.
I just wanted visibility that I was throwing what I had at it.

I'll switch out to straight solo mining.

The main problem is the code allows the difficulty to drop by 90%. This is highly exploitable. This isn't the first time an alt-coin made the mistake of asymmetric difficulty adjustment problems.

For now the temporary solution is for those of us who support this coin, to keep mining it regardless of difficulty or profitability.  Let the dev's work on a more permanent fix, but in the meantime we can protect it by consistently pushing high hash power onto it, to minimize ASIC jackassery. 

The way it seems, their solution is working very well given you don't have a stalled network like some other chains being borked with right now... with that said I only see a couple solutions to this kind of attack off the top of my head...

1) Implement merge mining and coordinate with a larger merge mine pool or two to pick you up right away to get a much higher base hash rate making this attack less profitable thus less desirable (but still not impossible and potentially not worth it given other attack vectors scummy players have taken by abusing the merge mining capability)

2) Change some mining parameter around so that ASICS are completely broken on this chain, I would think something even as simple as changing the hash algo to use SHA512 instead of 256 should do it no?  There are also the next gen hash algo's that could be looked at and there is a "fall back" to try scrypt or a scrypt merge mine.... asics are not very friendly to change given their nature so the change to break them would be easy.  Collude with any exchanges to halt trading and you could even 51% them back by breaking them and mining at a point before they started jacking with the chain and overwrite their blocks with newly fairly generated blocks.

Can the hash algorithm be changed without jacking up the current blockchain though?  Would that require a hard fork? 

Any change that would be meaningful would most likely require a hard fork, that is a bit more difficult with TRC. TRC is now on a major exchange and if the TRC developers decide to hard fork, there will need to be some communication between the developers and the exchange, to lessen the chance of the exchange dropping TRC.

I have been thinking about this particular problem with ASIC manipulating Alt-coins. I have been trying to think of a tweak of some sort short of the complete scrypt parameter difficulty I have already proposed.

How about this:

Keep difficulty adjustment the same or relativity the same, and run the SHA-256 block hash through scrypt a limited number of times. LTC/NVC use a scrypt 1024:1:1 tuning, roughly this means that the data is run through the scrypt algo 1024x.

What if any of the SHA-256 coins, put a completed SHA 256 hash through a scrypt algo 2x, 10x, or 100x , whatever it takes to cripple the ASICs' efficiency. With the final result, of course, having to meet the difficulty requirement to solve the block. This is subject to the reality of how many times it would take before the coin becomes another LTC like coin. We still want the coin to be GPU friendly, just ASIC hostile.

Downside: mining software developers would have to get involved, or a community patch to a miner to run the SHA-256 hash through the scrypt algo.

Just throwing the idea out there...good or bad  ;D

Basics are very very specialized so the change required to break them could be very simple.

Wouldn't that break FPGA's too?

people holding ASICs probably still have GPU-based farms, maybe not reaching 60+Gh/s but currently, 20Gh/s may just be enough to disrupt the chain ; those type of rigs aren't that rare :(

This is probably what some of them decided to use their non-ASIC rigs for ; messing around with altcoins (benefiting from market?)

Yes but if the change is not too extensive and only dealing with things FPGA's can adjust for (as they are less specialized) then they may be fine, possibly just needing a firmware update.  And remember FPGA difference of power vs. GPU is considerably less of an impact than ASICs who are many fold more powerful.  So if this style of solution is used consider that....

I updated my terracoin wallet to 0.1.3 version. Is everything ok now? Can I trade my coins safely?  :P

I do solo 16Ghash from last night, only orphans!
Yes, I have up-to-date wallet. This is bullshit. I will give up TRC and giveaway all of 10K TRC coins...

I would hate to lose the use of my FPGAs on the chain... but if it would secure the coin, so be it.
I still have plenty of GPUs  ;D

Regular vs orphan ratio is 1:10 currently for me.

Please, if you think to keep ppl on TRC do something in Gods sake.

I'll take some! Haha, I'm supporting TRC all the way so I would welcome it :) Now only if I could finally get my BFL ASIC I would keep that on the chain to increase our permanent network hashrate, but who knows if I'll even ever get it -.- But yea, even getting rid of ASIC miners would work for me since I have decent GPU power, and ASIC just lets those with more get more.

16daYGpJeUnvC9NDSEUPtj5P5SoafPJ2ri

Yeah i'm still mining and supporting so please if you giving away TRC then i'll have some please!!

addy in my signature

or this one here:   1FzdruHpffAeW2ZBctDLwR8P4APVpATu2j 

many thanks and lets keep TRC alive

If your looking to unload some TRC I will happily take them off your hands! And thanks :)

1Pk6LUrEYqi7b27MKzSqky6NaLww3W1oj4

Well, if you don't need them anymore, maybe I could play with them a little... ::)

18wPyaoYAAktDsnwhNjnMS19LueL2qHLKt

Don't give away your TRC, just move them over to one of the TRC exchanges and convert them into something you like.

NEW TERRACOIN TRC POOL:  i made primarily for my ANTMINER rigs but can be used with any sha256-asic  or gpu/cpu if your oldschool

www.nemospool.com

email:   nemospool@hotmail.com

Regards
NEMO