From 818abdb2ee07f74ff657c8c3d760629f3aa0ff68 Mon Sep 17 00:00:00 2001 From: "David A. Harding" Date: Sat, 4 Jul 2015 04:45:22 -0400 Subject: [PATCH] Alerts: SPV Mining more details --- _alerts/2015-07-04-spv-mining.html | 87 +++++++++++++++++++++++++++--- 1 file changed, 80 insertions(+), 7 deletions(-) diff --git a/_alerts/2015-07-04-spv-mining.html b/_alerts/2015-07-04-spv-mining.html index 1de5bb1a..e9edd929 100644 --- a/_alerts/2015-07-04-spv-mining.html +++ b/_alerts/2015-07-04-spv-mining.html @@ -5,13 +5,13 @@ active: true banner: "WARNING: many wallets currently vulnerable to double-spending of confirmed transactions (click here to read)" ---

This document is being updated as new information arrives. Last -update: 2015-07-04 08:15 UTC

+update: 2015-07-04 09:00 UTC

-{% assign confs="30" %} +{% assign confs="15" %}

Summary

-

Your bitcoins are safe if you received them in transactions confirmed before 2015-07-04 07:00 UTC.

+

Your bitcoins are safe if you received them in transactions confirmed before 2015-07-04 08:00 UTC.

After that time, confirmation scores are not as reliable as they usually are for users of certain software:

@@ -54,13 +54,86 @@ systems.

  • F2Pool
    • +

    When Will Things Go Back To Normal?

    + +The problem is miners creating invalid blocks. Some software can detect +that those blocks are invalid and reject them; other software can't +detect that blocks are invalid, so they show confirmations that aren't +real. + + +

    What's Happening

    -

    Some miners are currently generating invalid blocks. Almost all -software besides Bitcoin Core 0.9.5 and later will accept these invalid -blocks under certain conditions.

    +

    Summary: Some miners are currently generating invalid blocks. Almost + all software (besides Bitcoin Core 0.9.5 and later) will accept these + invalid blocks under certain conditions. The paragraphs that follow + explain the cause more throughly.

    -

    More information to follow.

    +

    For several months, an increasing amount of mining hash rate has been + signaling its intent to begin enforcing BIP66 + strict DER signatures. As part of the BIP66 rules, + once 950 of the last 1,000 blocks were version 3 (v3) blocks, all + upgraded miners would reject version 2 (v2) blocks.

    + +

    Early morning UTC on 4 July 2015, the 950/1000 (95%) threshold was + reached. Shortly thereafter, a small miner (part of the non-upgraded + 5%) mined an invalid block--as was an expected occurrence. + Unfortunately, it turned out that roughly half the network hash rate + was mining without fully validating blocks (called SPV mining), and + built new blocks on top of that invalid block.

    + +

    Note that the roughly 50% of the network that was SPV mining had + explicitly indicated that they would enforce the BIP66 rules. By not + doing so, several large miners have lost over $50,000 dollars worth + of mining income so far.

    + +

    All software that assumes blocks are valid (because invalid blocks + cost miners money) is at risk of showing transactions as confirmed + when they really aren't. This particularly affects lightweight (SPV) + wallets and software such as old versions of Bitcoin Core which have + been downgraded to SPV-level security by the new BIP66 consensus + rules.

    + +

    The immediate fix, which is well underway as of this writing, is to + get all miners off of SPV mining and back to full validation (at + least temporarily). As this progresses, we will reduce our + current recommendation of waiting {{confs}} extra confirmations to a + lower number.

    + +

    However, the BIP66 soft fork implementation method of waiting for + only 95% of miners to upgrade does leave miner-trusting software such + as lightweight wallets at increased risk of seeing invalid single + confirmations (10% risk), invalid double confirmations (1% risk), and + maybe even invalid triple confirmations (0.1% risk) until more of + the 5% non-upgraded miners do finally upgrade. So for the next + several weeks (maybe months), lightweight wallet users, web wallet + users, and users of old versions of Bitcoin Core should wait an extra + two to three confirmations.