Ravencoin Faces Potential Four-Day Transaction Rollback After Block Bug

Two mining pools responsible for most of Ravencoin’s network hashpower are reconstructing the blockchain from a point before Friday’s first invalid block, raising the possibility that deposits, withdrawals and payments made afterward could be reversed.

Ravencoin said Tuesday that attackers exploited a critical software vulnerability, potentially forcing the network to discard several days of transaction history.

Launched in 2018 as a Bitcoin code fork, Ravencoin is a relatively small blockchain designed primarily for creating and transferring digital assets. Like Bitcoin, it depends on miners to produce blocks and maintain agreement over the network’s transaction history. However, Ravencoin’s smaller mining ecosystem means a limited number of pools can exert significant influence when competing versions of the blockchain emerge.

That concentration has become important following the exploit. Data shows that 2Miners and RavenMiner, which together account for most of Ravencoin’s computing power, are rebuilding the chain from shortly before the first invalid block. If the majority of miners ultimately adopt that version, transactions recorded after that point could be removed from the canonical chain.

A blockchain functions as a continuously updated ledger, with transactions grouped into blocks and added by miners competing to produce new records. Most miners operate through pools, combining computing resources and sharing the resulting rewards. In general, the chain supported by the greatest amount of computing power is recognized as the valid version of the network.

For users, the potential consequences are straightforward. A payment that appeared to have settled over the weekend could disappear if the affected blocks are discarded. The sender could regain the coins while the recipient loses the payment entirely.

Businesses that accepted RVN in exchange for goods, services or other assets could also be exposed. For example, an exchange that credited a customer’s account after receiving a deposit and then permitted a withdrawal could face a shortfall if the original deposit is later removed from the chain. That risk has prompted several platforms to halt RVN deposits and withdrawals.

Amsterdam-based crypto exchange Bitvavo suspended Ravencoin deposits and withdrawals as a precaution, citing the exploited vulnerability. South Korean exchange Upbit also issued an investment warning for RVN across its Korean won, Bitcoin and Tether markets and suspended deposits.

What happened

The first invalid block was recorded at height 4,487,776 at 15:44 UTC on Aug. 7. After the vulnerability was demonstrated on the live network, other participants began reproducing the exploit and generating additional invalid blocks.

Ravencoin has since issued a software patch to address the vulnerability. However, updating the software does not automatically remove transactions that have already been recorded on the blockchain.

2Miners and RavenMiner are rebuilding their version of the chain from block 4,487,775, the final block produced before the exploit. Ravencoin said it requested that the pools restart from a later block to reduce the amount of transaction history potentially affected, but the pools declined.

RavenMiner said its nodes are running an emergency software update and mining what it describes as the “clean chain.” The pool said blocks generated during the attack period are being removed across the network, meaning mining rewards earned during that period would be reversed rather than being invalidated only for RavenMiner participants.

The pool has temporarily suspended payouts while the network determines which chain will prevail. It also said it would absorb any resulting shortfall and confirmed that mining earnings generated before 15:44 UTC on Aug. 7 would remain unaffected.

The latest incident is not Ravencoin’s first major security problem. In 2020, attackers exploited another vulnerability that allowed RVN to be created in excess of the network’s prescribed issuance rules. Approximately 31 million additional tokens were generated before developers addressed the flaw.

RVN fell about 17% over a 24-hour period to roughly $0.0029, reducing the cryptocurrency’s market capitalization to approximately $48 million. Trading volume stood near $10 million, while the token has lost about 77% of its value over the past year.

About The Author

ctleditor

See author's posts