P2Pool-main has been attacked too, today at 00:02:46 UTC - see the log p2pool.io/p2pool_main_attack.log.xz All P2Pool miners, you must update to v4.16 immediately if you don't want to mine to the attacker's wallet! Update here: github.com/SChernykh/p2pool/releases/latest

<gaming-research-lab:matrix.org> sech1: instead of trying to get the few people that are probably just chillin at the beach without being chronically online and dont read the reddit/twatter/matrix/irc, would adding more hashrate could solve the issue? like, there's over 2Gh/s on supportxmr, 1.2Gh/s on nanopool while all the P2Pool combined are like 250Mh/s ri [... too long, see mrelay.p2pool.observer/e/-ebRxI0LYmpidS1f ]

More hashrate can allow non-upgraded miners to join back the original P2Pooll chain, but only until the next attack which can happen any moment, so it's futile

As long as 51% of hashrate or more updates, it will be an automatic process

<gaming-research-lab:matrix.org> oh dang ok, i thought it would have been like a "hardfork" type thing, that the attack would have been mitigated completely as long as majority of the nodes are updated

For P2Pool-main, it's already more than 60%, but for P2Pool-nano it's only around 30%

The attack inflates the calculated difficulty and "weight" of the affected chain, so honest miners have to mine for many hours to overcome it (if they have 51%)

<gaming-research-lab:matrix.org> oooh, so nano/mini does count torward main as well then? main cant be on its own being 60% updated and safe, it still also need mini/nano to update too?

no, they are separate chains

Main was attacked, but the aftermath is much easier in this case

Because a lot of hashrate was already on v4.16

<gaming-research-lab:matrix.org> ok so what's wrong with main right now then? if 60% have updated, how come the attack was possible? not enough time yet?

Attack affects only non-upgraded miners

It splits the chain in two

v4.16 keeps mining like nothing happened

v4.15.1 and older miners start mining to the attacker's wallet

Main lost around ~40 MH/s to the attacker

No, closer to 60 MH/s

08:23:28 <br-m> <gaming-research-lab:matrix.org> ok so what's wrong with main right now then? if 60% have updated, how come the attack was possible? not enough time yet?

due to the attack inflating shares they see the attacked chain as the majority of hashrate

<gaming-research-lab:matrix.org> oooh ok, thanks on those explanations

as sech1 once those shares go outside of the PPLNS weight window for sync they can re-merge

in fact... nano attacked side had more hashrate

Could a possible mitigation be to attack the chain too ? That'd dilute the attacker.

so once that became valid again (no attacked shares in window) P2Pool v4.16 switched back there

With the caveat that if the attacked miners can't even mine a single share (because of too many uncle shares there), they'll get stuck on that chain forever, I think

At least until they update

moneromooo: it was considered :)

for now we added changes to our seed nodes that make it easier for old nodes to re-join

or maybe they'll get stuck for a few days, I'm not sure

so with > 61 MH/s lost to the attacker, the attacker gets 80% of the block rewards mined by vulnerable miners, which is ~1400 USD/day now

that is for a sustained attack

<gaming-research-lab:matrix.org> still not as bad as qubic, and at least cant be as bad since P2Pool didnt get much adoption but yea, that's a phat stack of cash right there... hopefully it get sorted out, people chillin at the beach need to update already

for a single broadcast, that will be only 2-3 mine XMR blocks time 0.8 per block

*times

so around 500-800 USD

I did the math, and a single broadcast actually gives 0.96 XMR to the attacker (80% of 2 Monero blocks on average due to how PPLNS window is adjusted)

<eravsar:raubritter.org> isn't a "counter attack" that mines funds for monero ccs general fund or a burn address a good thing? there is no way to save the miners unless they update. at least reduce the profit of the attacker? he shouldn't get away with this.

<gaming-research-lab:matrix.org> @eravsar:raubritter.org: thought that too but then, they forked already to the attacker wallet, cant be hijacking it now, right?

<eravsar:raubritter.org> @gaming-research-lab:matrix.org: oh i didn't know that. then it would've been be better if devs ran the attack before a random guy i guess lol

<gaming-research-lab:matrix.org> guess so yea, well, maybe that's already the case but we cant know lol

<gaming-research-lab:matrix.org> and tbh, even if sech1 is the attacker, like, he found the vulnerability, fixed it, did all that could have been done so people would update, 3 days might have been short notice but if longer, someone else would prob have ran the llm on it to figure out the thing too eventually, like, he deserve those payouts ngl lol, people a [... too long, see mrelay.p2pool.observer/e/idzFxY0LQjR2SC0t ]

<eravsar:raubritter.org> @gaming-research-lab:matrix.org: yeah exactly. i wouldn't care if he exploited it for himself after doing everything he could do, p2pool is amazing, he deserves that. but there is certainly a need to better inform miners in cases like this. they should maybe subscribe to an email list for crucial updates. not everyone scrolls reddit everyday.

we posted on IRC channels for p2pool, Matrix channels for p2pool too at the same time

observer added a warning as well at the same time

these are places you can subscribe to.

releases on github you can subscribe as well, or security advisories

<gan:skhron.org> Contextually, Github have RSS feeds for releases

Discord and reddit too

main p2pool.io site

<gan:skhron.org> Sadly, saying that people should be better informed, not gonna make those people seek out such information, otherwise, there's already ample amount of channels

The announcement was everywhere

<eravsar:raubritter.org> i guess it is just unlucky then. this incident shows how valuable solo mining is. even though p2pool is amazing a small bug can cause this. so an open protocol doesn't make it entirely reliable

<gan:skhron.org> sech1: Thanks to ya!

<gaming-research-lab:matrix.org> inv.nadeko.net/watch?v=8xLbMQBkWhw

<gan:skhron.org> @eravsar:raubritter.org: Factually, there's almost no software - that's without bugs

<gaming-research-lab:matrix.org> @gan:skhron.org: right, like, could have been a monero protocol issue straight up, emergency fork and that would have been similar issue there tbh

<gaming-research-lab:matrix.org> @eravsar:raubritter.org: oh! or since sech did mentioned that adding more hashrate would allow them to join back the main chain, then maybe it would be doable? step 1: add more hashrate so they join back main chain, step 2: hijack the non-upgraded ones to a newer wallet thing, could be fun there i guess lol, until attacker #1 one gets the opportunity as well again to do step 1 to 2 lol

<gaming-research-lab:matrix.org> like, general fund could be used to rent temporary aws instances to bring the hashrate up until they join back, perform the attack, for 1 monero a day, would be fun if original attacker would do the same as well afterward

<eravsar:raubritter.org> @gaming-research-lab:matrix.org: lmao

<eravsar:raubritter.org> cat and mouse game

<gaming-research-lab:matrix.org> well, 1 monero a day was with mini/nano only, now with main the numbers are a bit more on that, 4 moneros or so as was being specified earlier, will be interesting to follow along regardless, how many will update, how much will be left on the old version for literally forever, and if that cat and mouse game thing will ever be [... too long, see mrelay.p2pool.observer/e/0bbzxo0Ld3poOERi ]

as more miners update, old version nodes will lose connectivity eventually, and thus won't be exploitable

they'll be essentially solo mining

<gaming-research-lab:matrix.org> oh right, duh! lol, and my bad being spammy a bit today, been legit trying to understand the thing, so thanks on the explanations and also for your work and taking the initiative on that sech1, cheers yall! keep up the good work! <3

Me and DataHoarder are currently running a counter-attack by mining malformed blocks ourselves - to hijack the payouts from the attacker and redistribute them to miners later. Currently doing it on p2pool-mini

We will ask for more hashrate later, once everything is set up properly

<gan:skhron.org> Damn, good luck comrades.

If anyone wants to participate in the defense, run XMRig and point it to this url: "xmrig -o stratum+tcp://p2pool-defense.p2pool.observer:3330" (for p2pool-main). For p2pool-mini, use port 3331, and for p2pool-nano use port 3332.

We are mining to this address: 42rWdYtoWxwYdDeasYiq1gRF21JKTHom3RsnqYKj1R4c643g4KBJ92qdUT3fhnDEcebcbGfmNpt2r7ufQjHWdwHdLgRxns6 - viewkey is 3500585bb0de52da0f330edb268417cef0fffd90d378bf294cd01f3a0909ccae

<albertlarsan68:albertlarsan.fr> Which one is more in need of help? (I can bring 100kh/s to a single one)

p2pool-main

so port 3330

Main. We can probably cover nano/mini ourselves. I'll make an automatic switcher in a few hours on port 3333 that will automatically send hashrate where needed

I am also archiving the received blocks/sidechains and afterwards attempting even distribution on non-cheated shares across all collected for people mining old versions (discounting any affected)

<albertlarsan68:albertlarsan.fr> You should keep the equivalent of the invested time and money out of the redistribution sum

server for this is $270/m or so hopefully people update quick

$270/minute? :D

month :)

<gaming-research-lab:matrix.org> mrelay.p2pool.observer/m/matrix.org/xMVXldrCvIWhnUZAPtmWlHfA.png (image.png)

<gaming-research-lab:matrix.org> idk why is not stable tho, like it crashing or somethin

<gaming-research-lab:matrix.org> oh wut and now just got an "stratum+tcp://p2pool-defense.p2pool.observer:3330 164.92.150.65 connect error: "connection refused"" but idk, shares literally got accepted earlier, idk, maybe is a rig issue tbh, havent mined the monero with that one yet

<albertlarsan68:albertlarsan.fr> Nah I have the same issue on my proxy (although I might DoS it a little with 100kH/s)

it's fine, I keep restarting it

<gaming-research-lab:matrix.org> aight, it got an other accepted share, thanks on the feedback as well @albertlarsan68:albertlarsan.fr, was worried was on my end

I keep making improvements to be more efficient against the attacker :)

<gaming-research-lab:matrix.org> you got this! <3

that will be stable for a while now. thanks for the collaboration!

<gaming-research-lab:matrix.org> 👍️

<gaming-research-lab:matrix.org> was 50kh/s all that you needed btw? or more hashrate is always good too? DataHoarder, and i guess rn u might be busy setting up the autoswitching thing on port 3333 so when that's ready please keep us updated on that too, so can do the switch when is ready too

more hashrate is good, allows higher rate of shares

specially for main

<gaming-research-lab:matrix.org> aight, so is like an mmorpg raid thing then, eryone doing the thing lol

more hashrate on the defense side is better

<albertlarsan68:albertlarsan.fr> But is defense (ie on the invalid chain) better than updated hashrate?

Updating to v4.16 is always preferred

We're defending only people who didn't update

Updated hashrate should be more than 51% to make sure updated miners don't switch to the old chain once the attack is over

It is for p2pool-main, but not for p2pool-mini for example

*nano

<gaming-research-lab:matrix.org> like in world of warcraft there that capture the flag thing (warsong gulch) and like, defending your base type thing, or the whole pve/pvm battleground "alterac valley" and is like, there's even a whole raid boss you defending too, this is the defending side rn lol

maybe mini too

<albertlarsan68:albertlarsan.fr> IIUC a single sidechain share can take up to 80% of the payout, for the PoW cost of a single sidechain share?

yes

more or less

<albertlarsan68:albertlarsan.fr> Correct me if I’m wrong, but my 100kH/s of updated hashrate is more useful on nano than on main defense?

main has 60+ MH/s needing defense

nano only 2-3 MH/s

<gaming-research-lab:matrix.org> would still need few megahashes on nano to get majority to be updated over there tho, from my understanding at least, still a bit confused on some of the maths there from earlier, but defense as was being talked in #monero-community earlier, it dont need that much hashrate to defend apparently, it's different

but more individual miners tbh

no, you just need to mine one share to hijack the rewards

we already did it for nano

currently working on mini and main

so focus your hashrate on p2pool-main

it will hijack more reward so we will be able to redistribute more to miners once it's all over

<albertlarsan68:albertlarsan.fr> but you said that updated hashrate (to have 51% updated) is better. I am confused.

updated hashrate protects only itself

yes, 51% of updated is good

but the rest is unprotected so we're protecting them by hijacking rewards and paying them later

insane statement but yep. We compete with the attacker to redirect further towards miners later

<albertlarsan68:albertlarsan.fr> Does the defense "pool" have tls support?

<albertlarsan68:albertlarsan.fr> for stratum

<gaming-research-lab:matrix.org> like, working overtime and paying electricity so the ones that are having a tan at the beach and enjoying the sun and all can come back to their mining rewards being given back to them instead of hijacked by idk, sech1 other persona type thing lol

we can't give back more than 80% though. Realistically no more than 30-40% because we're competing with the attacker.

<gaming-research-lab:matrix.org> DataHoarder: you said is stable btw but didnt get an accepted share in like 40mins now, is normal?

it's mining at the full sidechain difficulty

difficulty is difficulty of p2pool main

<albertlarsan68:albertlarsan.fr> That is why I say that sech1 and datahoarder should first remove the costs, both money for servers and time from the amount that will be redistributed

so you will only get accepted when it mines a sidechain share

<gaming-research-lab:matrix.org> oh ok, makes senses

<albertlarsan68:albertlarsan.fr> Is this an option in p2pool?

yes

this is go-p2pool :)

"--no-autodiff" in p2pool

DataHoarder will fix it

I'll put xmrig-proxy in front I guess

<albertlarsan68:albertlarsan.fr> xmrig-proxy doesn’t do "custom" diffs, it only relays/multiplexes the stratum messages.

but it can do autodiff

<albertlarsan68:albertlarsan.fr> ie if the proxy upstream asks for 2190973422 diff, then all the clients will get 2190973422 diff

xmrig-proxy can autodiff

ports 33330-33331-33332 for main/mini/nano using the proxy

<albertlarsan68:albertlarsan.fr> I have looked everywhere in the docs and no mention everywhere, except for the custom-diff-stats (which is not autodiff AFAICS).

it's indeed not autodiff :(

but it's setup at 1M difficulty in simple mode

is this any different than just having the pool difficulty for nicehash/rentals sech1? Given it ends up mapping it 1:1 when running in simple mode

it's mapping 1:1 in simple mode, it just set fixed diff

and you can track the hashrate this way

yeah, I am able to track it indeed

<nickaname:matrix.org> mrelay.p2pool.observer/m/matrix.org/lKAbvmVoMPQnqdhFRHMHVRKV.png (Free money hack lol)

<ofrnxmr:xmr.mx> Rates are just slow to update

<nickaname:matrix.org> @ofrnxmr:xmr.mx: Ahhh that makes sense yeah, i saw it and was like tf lol, and i look at the exchange rating in trocador and it was also B rated lol

<pw:xmr.mx> did you try execute it tho

<pw:xmr.mx> misread

<kiersten5821:matrix.org> how much hashrate/money is the p2pool guy making

<kiersten5821:matrix.org> @nickaname:matrix.org: b for bitcoin

q

<ofrnxmr:xmr.mx> preliminary PSA: if you run haveno, be cautious. there may be an ongoing attack

<ofrnxmr:xmr.mx> you may want to revoke you offers until its determined whats going on

<gaming-research-lab:matrix.org> @ofrnxmr:xmr.mx: where do you see that? what are the signs?

<ofrnxmr:xmr.mx> monero-orderbooks.com

<ofrnxmr:xmr.mx> all btc-xmr offers are gone

<ofrnxmr:xmr.mx> there were probably 150 of them

<hbs:matrix.org> hopefully because makers pulled them off

<gaming-research-lab:matrix.org> the btc-xmr side? not xmr-fiat side?

<gaming-research-lab:matrix.org> oh nvm, u did say that, so like, same as last time pretty much

<gaming-research-lab:matrix.org> haveno should be for xmr-fiat, my opinion on that is trading the cryptocoin for an other cryptocoin is just dumb anyways, thanks on the preliminary pre-PSA, if anyone wanna post about it somewhere else then feel free too, am too lazy for the whole crypto casino bs out here, well... maybe xmr-fiat also at risk there so... errr... alright jfc....

<ofrnxmr:xmr.mx> @hbs:matrix.org: they were reported as disappearing before anyone was notified

<ofrnxmr:xmr.mx> er, i mean, when someone notified, they did so by saying they had an offer go to arbitrition after 10 confs, and that the orderbook was getting wiped out at the same time

Hi

<gaming-research-lab:matrix.org> @ofrnxmr:xmr.mx: could it just be whale that bought the whole orderbook tho?

<ofrnxmr:xmr.mx> no

<gaming-research-lab:matrix.org> damn

<ofrnxmr:xmr.mx> Fed my logs to ai, here's its explanation:

<ofrnxmr:xmr.mx> "What the attacker did

<ofrnxmr:xmr.mx> Took the offer and completed normal multisig + deposit setup with the real arbitrator (7xktb2...).

<ofrnxmr:xmr.mx> Never sent payment (no PaymentSent in logs).

<ofrnxmr:xmr.mx> Skipped the arbitrator and sent dispute messages directly to the seller from their own onion (fg2lhfh...):[... more lines follow, see mrelay.p2pool.observer/e/j6iL2o0LZ3NLeHFP ]

<ofrnxmr:xmr.mx> fwd from haveno dev channel

<kiersten5821:matrix.org> again?

<kiersten5821:matrix.org> did the dev ask ai to review the codebase after the first incident

<plowsof:matrix.org> apparently "ai didnt find it" (the original)

<kiersten5821:matrix.org> ai could not find lack of input validation ? i dont have maximum context but that seems unlikely

"DisputeOpenedMessage sender not checked" - I can't even...

<kiersten5821:matrix.org> it's funny how everything in the monero ecosystem is burning to the ground and it has 0 impact on the price because 99.8% of people are just buying on cex

<kiersten5821:matrix.org> bisq, haveno, eigen, openmonero, p2pool, haveno again

<hbs:matrix.org> BasicswapDex is unaffected, so not everything

<gaming-research-lab:matrix.org> basicswapdex is cryptocasino bs tho, no offense lol, truth tho

<ofrnxmr:xmr.mx> tf u talking bout

<ofrnxmr:xmr.mx> its literally an atomic swap dex. theres not casino bs or frills. fuckin clown take

<gaming-research-lab:matrix.org> trading the cryptocoin for an other cryptocoin, that's gambling on the market bullshit, on/offramps like bisq and haveno does bring actual use and allow people to live off of monero

<ofrnxmr:xmr.mx> ok, so how is eigenewallet or retoswap better? retoswap exploits keep happening on crypto-crypto orderbooks

<ofrnxmr:xmr.mx> and 95% of the liquidity on it is crypto-crypto

<ofrnxmr:xmr.mx> on reto*

<gaming-research-lab:matrix.org> right, fiat trades havent been affected on haveno, maybe that's the design issue there... should have kept it fiat only and have something else for the gamblers

<ofrnxmr:xmr.mx> bisq too

<ofrnxmr:xmr.mx> they have been affected, just nobody cares to exploit the liquidity offered there

<gaming-research-lab:matrix.org> well, who knows what the issue is right now if fiat trades are affected, hopefully not, but last time they werent

<gaming-research-lab:matrix.org> oh... well still, that actually brings actually value to the space, gambling bullshit, not so much

<ofrnxmr:xmr.mx> they were. but they are limited to much smaller values, so not worth wasting time on when you can steal 500xmr

<ofrnxmr:xmr.mx> how do you figure?

<ofrnxmr:xmr.mx> you can buy ltc on a cex in europe or phillipines, but you cannot buy xmr

Maybe Haveno shouldnt be focusing too much on high-value offers

<ofrnxmr:xmr.mx> there are no damn offers on haveno for phillipines for xmr. so youd buy ltc and swap it into xmr on basicswapdex

<ofrnxmr:xmr.mx> assuming its casino bs in total retard take

<ofrnxmr:xmr.mx> and vice versa, if you need to cash out xmr, are you supposed to be the only person in the country using retoswap? if you dont care about kyc and all of that, you can still cash out using other coins

I really don't like how there are literally no way to cash out small quantities of XMR without KYC

<ofrnxmr:xmr.mx> using monero doesnt mean you have to be an someone who refuses to use a cex.

But so many ways to do so with very large quantities of XMR

Usually it would be the opposite

<ofrnxmr:xmr.mx> people in europe used kraken until they delisted eurupe

I was looking at the monero-wallet-cli documentation and tweeking some settings, and, as far as I understand, `print-ring-members` simply shows more information, but what about `store-tx-info` and `track-uses`? What do these two options entail? The first one relatively easy to understand -- it stores extra information, which would, I guess, be locally discarded otherwise, and probably shouldn't be

exposed -- except where the data is being stored. Is it in the wallet file or somewhere else?

<ofrnxmr:xmr.mx> you cant really use retoswap without some form of kyc, whether that be address, banking info (including real name and account numbers, obv)

<ofrnxmr:xmr.mx> youre not giving up ID, but you still VERY MUCH know who your customers are

<hbs:matrix.org> @ofrnxmr:xmr.mx: Especially if doing SEPA transfers since VoP came into effect last October

<kiersten5821:matrix.org> the thing that would fix 99% of monero's decentralized trading problems is a wrapped monero on eth

Also I find it dumb that nobody sees a problem with 500-1000 XMR offers anonymously

<kiersten5821:matrix.org> then you could just lp on uniswap

Tax authorities will find that really suspicious

<hbs:matrix.org> @kiersten5821:matrix.org: Heretic!

<hbs:matrix.org> @kiersten5821:matrix.org: Who would you trust with your XMR?

kiersten5821: Okay and who's gonna hold the XMR

The second one is somewhat vague (and I am not "in the know" about what does "owned outputs uses" mean), also.

<kiersten5821:matrix.org> @hbs:matrix.org: 🔥👨

<ofrnxmr:xmr.mx> @kiersten5821:matrix.org: so wagyu lol? wrapped protocols are custodial

<gaming-research-lab:matrix.org> @ofrnxmr:xmr.mx:

<gaming-research-lab:matrix.org> > youre not giving up ID, but you still VERY MUCH know who your customers are

<gaming-research-lab:matrix.org> that's why this thread over there: monero.forum/thread/burnt-out-trying-find-way-avoid-kyc-exchanges[... more lines follow, see mrelay.p2pool.observer/e/_L_p240LUUcxMG9T ]

<ofrnxmr:xmr.mx> Cindy__: perpetualcow of wagyu

<kiersten5821:matrix.org> @ofrnxmr:xmr.mx: yes, wrapped custody is bad, but one of those giant multisigs with stake based on a coin like tbtc is not THAT bad

<hbs:matrix.org> @ofrnxmr:xmr.mx: Hope he doesn't forget his ledger PIN

<kiersten5821:matrix.org> even serai will have its own coin

<kiersten5821:matrix.org> for the chain security

<kiersten5821:matrix.org> as i udnerstand

Why would anyone work on that when they could just do wrapped custody and bait everyone into falling for it

Then rugpull

<kiersten5821:matrix.org> why does anyone work on anything when they could just do that

How will you find the one good wrapped token in a sea of impostors and rugpullers

<sneedlewoods_xmr:matrix.org> alcedo: IIRC that's for tracking in which tx your outputs were used as decoys

Really? Does that happend locally, or are some special requests made towards the network?

The info is saved as your wallet scans txes. So it's done locally, from info that was pulled from the network, and saved to the wallet cache file.

Thanks!

moneromooo: Is the cache a seperate file or part of the large wallet file?

It's a large wallet file, called quux if your keys are in quux.keys.

moneromooo: Thanks for confirming it. I suspected as much, since there were seemingly no other files connected to monero except for the wallet file and the .keys (and an .old_cache file, but I guess it's vestigial).