Token Overflow Bug
On December 16th when updating safexcore we discovered some undesirable bug which exposed the blockchain to an integer overflow attack that caused 1.844 billion tokens to be generated.
244 million of these tokens have been used as mix ins and are indiscernible from other transactions on the blockchain. The remaining 1.6 billion we have been able to block as part of the patch.
Igor has also spent a good portion of his time going through the entire token stack to ensure there are no other exploitable bugs found in this code.
A detailed write up can be found as a separate post: Safex Token Overflow: January 6, 2020
Who needs to take action
If you are operating a full node, an exchange, or a mining pool you will need to be on the current version which is v6 or Hardfork 6.
This patch will cause some minor interruptions to ordinary wallet usage in the case that you are spending tokens that get mixed with the exploited transactions. You will receive an error message, you can retry the transaction with a smaller or 1 mix in count to ensure your transaction will go through.
We are urgently moving to update the wallet software to omit the problematic transactions from being included in the random selection of mix ins for the future.
Today is Christmas Eve for the Orthodox calendar, so until tomorrow will be the last days of holidays for most of our team. Despite the holidays we have been diligently sorting out this patch and getting it deployed.
Upon return we will be back to work on the marketplace on the last stretch to get it to the public for use.
Of course we must run additional testing networks, and ensure that we are comfortable with the deployment before turning it on live officially.
We have a clear roadmap that we’ve been keeping everyone up to date on and if you’ve been following along you would already be aware of our progress. Just a refresh:
Improved Purchase Flow
New wallet creation key formation bug
Synchronization balance correctness
Transaction broadcast to safexd network (testing)
Sanitize Sails Wallet codebase of development artifacts
The World Marketplace API:
Safex Offer Content Hosting
Getting back to the main course in this week with a clear list of objectives.
The Safex Development Community