Double Stake Reward Proof-of-Stake Fix - 40+ VULNERABLE

So recently the DogeCash team posted about an issue we had to patch, in somewhat secrecy. Followed by a post about why with some information.

But here is what is going on, there's this bug that stems from 2 codebases. Any code base of PIVX 2.7 forks are vulnerable as well as any Trittium codebase to date, currently.

The following was commented out of main.cpp causing a double reward to not be checked.

// for any real tx this will be checked on AcceptToMemoryPool anyway
    //    if (Params().RequireStandard() && !IsStandardTx(tx, reason))
    //        return state.DoS(0,
    //                         error("AcceptableInputs : nonstandard transaction: %s", reason),
    //                         REJECT_NONSTANDARD, reason);

The problem here is now we are not checking for a standard TXID allowing for a duplicate.

if (pindex->nStatus & BLOCK_HAVE_DATA) {
        // TODO: deal better with duplicate blocks.
        // return state.DoS(20, error("AcceptBlock() : already have block %d %s", pindex->nHeight, pindex->GetBlockHash().ToString()), REJECT_DUPLICATE, "duplicate");
        return true;
    }

So as you can see that we were no longer checking if the block has data and then immediately returning true.
There comes blocks with junk data and someone reaping double rewards.

During the investigation, as we said any coins forked from PIVX 2.7 are vulnerable to the double reward.

Any Trittium codebase is vulnerable period. With the exploit currently on their chain now. It has been reported, but we will see what occurs as we hope most fix the problem as it's active.

The exploiter on our chain has been blocked and his coins are essentially burned. Simply by restoring checks on duplicate inputs by checking if the previous transaction exists and was not in the previous transaction. Now we are validating again the data in the block hash and checking transactions more closely.

By having to do a fork and activating Spork 14 for minimum protocol enforcement, we are able to check by block height for our block reward amount with the current mint and now expected mints. Since before there was no need, next we added a check for bad address actors, those bad addresses were checked by hashing the addresses and comparing the input for a transaction to those addresses. If matched they are unable to send coins. Effectively locking out the exploiter and shutting down the operation.

Our code for the mitigation can be found on our github rather than reposting it all here where you can see in total revisions. This way it may be easier for other groups to glean how to.

https://github.com/dogecash/dogecash/commit/75a7208d520573918618788ddf5548fad8767f31

We hope for this news to get out to other forks than the ones we have contacted. Since there are many forks of both the aforementioned codebases we have tried to reach out to them and some main forks.

As these should be monitored by the forked coins and will notice and update themselves accordingly.

In a bear market time such as this it's terrible to see someone subject so many to some intentional mistakes. While they reap profits and watch the groups suffer.

I hope this information is able to help others in their ventures with developing successful cryptocurrencies.

Vulnerable:
Abet
Pivx
ByteCoin
APR Coin
Vitae Token
BEE Coin
401k Coin
Venos
Dividend Cash
Divi
Quantis
Phore
ColossusXT
DRIP
Dash Green
Bulwark