Mining pool 2Miners executed an emergency rollback on four of its nodes from the Core Geth v1.13.0 client back to the stable Argos v1.12.23 release. The rollback came after an open warning was issued to all Ethereum Classic node operators and mining pools regarding the discovery of a rogue software release.
A security incident report from Classix revealed that the problematic update did not originate from official core developers. Instead of being released from the standard client repository, version v1.13.0 was published via a forked repository named ethereumclassic/core-geth, which injected massive code modifications.
Massive Code Changes Without Community Review
Data from the Classix investigation detailed an influx of 96 consecutive commits executed in rapid succession over just 56 hours. The code injection from the forked repository added 13,422 new lines of code while deleting 3,977 existing lines, completely bypassing any pull request or review process with the developer community.
This unilateral release bypassed the entire evaluation and review process that typically serves as a safeguard for blockchain client updates. The absence of communal testing for changes spanning tens of thousands of lines of code was the primary reason for the urgent warning issued to network infrastructure operators.
Verification from Official Client Maintainers
The team behind etclabscore/core-geth, the repository that has officially maintained the network’s client since 2020, confirmed they never released version v1.13.0. They emphasized that the rogue update is outside their responsibility and urged infrastructure operators to steer clear of it.
As a risk mitigation measure for mining operators, the official maintainers advised all parties to remain on the proven 1.12 series. 2Miners’ swift decision to roll back its four nodes in line with this guidance demonstrates how independent monitoring can prevent the adoption of unauthorized clients.
Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
