Researchers say they discovered consensus level attack on Ethereum — miners cheating the system to earn more

A research paper published by The Hebrew University in Israel reports having discovered the “first evidence of a consensus-level attack on a major cryptocurrency.” The paper is currently awaiting peer review but utilizes publicly available on-chain data and Ethereum’s open source codebase to affirm its conclusions.

At its core, the paper highlights an issue where miners can change the timestamp related to a mined block to avoid increased difficulty on the network. On-chain data appears to support the claim as Aviv Yaish, one of the paper’s authors, highlighted F2Pool’s block timestamps being artificially altered to improve rewards.

(9/12) Whenever F2Pool’s block timestamps reach the point where mining difficulty is supposed to decrease, they artificially set them to be one second earlier. F2Pool has been executing this attack over the past two years, and the evidence has been hiding in plain sight! … pic.twitter.com/mDEG2UqXZh

— Aviv Yaish (@yaish_aviv) August 5, 2022

Uncle Maker

Ethereum is maintained through a proof-of-work consensus mechanism, which will be moved to proof-of-stake this September. However, to this point, the network appears to be susceptible to the attack identified in by The Hebrew University.

The consensus-level attack is referred to as an Uncle Maker attack within the paper in reference to the “uncle” blocks used in the exploit. Blocks within the Ethereum blockchain act as a set of records that are checked, distributed, and verified across the entire network. Uncle blocks are valid blocks that have been removed from the main chain but still receive rewards.

“The attack allows an attacker to replace competitors’ main-chain blocks after the fact with a block of its own, thus causing the replaced block’s miner to lose all transactions fees for the transactions contained within the block, which will be demoted from the main-chain.”

Miners can set a block’s timestamp within “a certain reasonable bound,” typically within a few seconds. One mining pool that was singled out in the research was F2Pool, which “in the past two years, F2Pool didn’t have even a single block with a timestamp” that matched the expected outcome. F2Pool is one of the largest Ethereum pools operating with a hashrate of 129 TH/s and generating roughly 1.5K ETH in daily rewards.

The paper also highlighted that F2Pool’s “founder has made a relatively well publicized condemnation of competing mining pools, blaming them for attacking his own mining pool” while, in reality, “F2Pool are attacking other mining pools.”

The monetary impact of the attack has not yet been officially identified, but CryptoSlate reached out Yaish who told us,

“For each successful instance of the attack, F2Pool earned 14% more from block rewards, and in addition earned all the transaction fees contained within.

We are currently attempting to give concrete estimations for both of your questions using real-world data, which will be published immediately when we have them!”

The Hebrew University has “concrete fixes for Ethereum’s protocol” and created a patch for consideration. Yaish stated in a blog post that the information was “responsibly disclosed to the Ethereum Foundation” before publication.