Wave of attacks on altcoin networks

[bushstar]

I've had a number of people approach me about their coins getting attacked by having the blockchain replaced with a longer chain, the longer chain released by the attacker is without certain transactions. The coin may be attacked but the target is normally an exchange, coins are sent to the exchange, sold for Bitcoin and then withdrawn, at that points the longer chain is released, the coins disappear from the exchange and the attacker gets their coins back. Small coins with low hash power are easy targets for attackers. This has caused a few coin pairs to be frozen and people to be in a panic.

PoW coins are the typical target for this type of attack, PoS coins are harder to target due to PoS block generation but not impossible if PoS generation is still very low. There have been many proposals for solutions to protect coins from a blockchain replacement attacks but for small coins the one solution that works and is available now is to use live checkpointing. Checkpoints are defined in Bitcoin source code by defining a block hash and height, clients will only connect to a chain that has the corresponding blocks, it is to make sure that clients connect to the correct main chain. Altcoins inherit this checkpoint system.

Realtime checkpointing was devised by SunnyKing developer of PeerCoin to protect the chain before PoS was sufficient. It protects the history of the chain by use of a node that will broadcast checkpoints at a certain height set in the conf file. If your coin is being attacked, your coin pair is locked on the exchange and you face potential delisting you may want to consider implementing realtime checkpointing. For reference there is a commit for checkpointing below (Deepcoin linked below was commissioned and not a project that I ran personally), instructions on how to use it is in the checkpointsync.cpp file. If you decide to use this system add a Peercoin copyright notice on the About dialog and COPYING file.

https://github.com/Deepcoinbiz/Deepcoin/commit/43413fac89da1db064668e7e4dd5bd6c6036dfb4

[ChekaZ]

ACP is a great technologie for coins that don't have a massive hashingpower. Even if its a bit of centralization, it works fine and protects well from attacks. Sad that people these days still attack small coins and take advantage of their low hashingpower.

Past shows that sometimes it is necessary to implement such a ACP-System to help the coin grow protected by a proven system.

It did an awesome job for FTC in the past, and still protects the chain, even tho the attacks are decreased by far, as there is no point in attacking an ACP protected chain.

I vouch for Bushstar, if your coin is under attack or needs impelmentation, I guess he is able to lend a helping hand.

Kindly regards,
ChekaZ

[bathrobehero]

I feel like realtime checkpointing is just a duct tape solution against block withholding attacks.

Not that I can think of a better solution but having centralized supernodes is surely not the way to go.

[lavajumper]

If I'm reading this correctly, someone has to be awake and alert for this to work.

I'm here because Sexcoin recently suffered this type of attack. I like the concept, and can see it would be very handy as long as exchanges / master keyholders were hovering over their charts. The problem I'm mentally wrestling through right now is that if we left a master node broadcasting all the time, it would get targeted. If we waited to switch it on, we'd have to find some way to let everyone know to start up their enforcement policy. And by that time damage has been done. Granted, it can prevent worse damage.

How has this played out in the real world?

I feel like realtime checkpointing is just a duct tape solution against block withholding attacks.

Not that I can think of a better solution but having centralized supernodes is surely not the way to go.

Sometimes you are very grateful for a handy roll of duct tape.

[bathrobehero]

Sometimes you are very grateful for a handy roll of duct tape.

Sure, duct tape is one of my biggest friends, but then again I wouldn't use that for critical projects...