Flooding with shares below the pool target (maxcoin branch)

[prydie]

We were seeing vast number of shares (100s per second) being submitted and validated by stratum that game from a single miner. These shares were always recorded at the pool target difficulty and the miner didn't respect vardiff.

The assumption I'm making especially after talking to @ahmedbodi on IRC is that stratum is not validating that shares actually match the target difficulty correctly.

If you give me some pointers I'm happy to do the leg work on this one.

[flound1129]

If you're not using quark algo, I'd check the vardiff code.

If you are using quark algo, turn on debug and verify that the difficulties reported for incoming shares match those in the miner. If not, then diff1 in diff_to_target in template_registry is wrong.

If they do match, then next place to look would be the vardiff code. The attacker probably needs to disconnect every time the pool's vardiff kicks in, resetting their connection's diff to POOL_TARGET.

[prydie]

@flound1129 I'm using the MaxCoin branch and it wouldn't be a problem if I believed the shares to actually be valid for the POOL_TARGET but I'm pretty sure given the rate at which they're being spammed the shares themselves aren't actually at that diff. If they were there would be no advantage to the miner in flooding with low diff shares (as the DB and stratum servers can more than handle it).

[prydie]

RocketPool will offer a bounty of 100 MAX for a fix for this bug with a unit test verifying the patches validity.

[flound1129]

I'm pretty sure it's got something to do with the vardiff code.
On Apr 11, 2014 4:57 AM, "Prydie" notifications@github.com wrote:

@flound1129 https://github.com/flound1129 I'm using the MaxCoin branch
and it wouldn't be a problem if I believed the shares to actually be valid
for the POOL_TARGET but I'm pretty sure given the rate at which they're
being spammed the shares themselves aren't actually at that diff. If they
were there would be no advantage to the miner in flooding with low diff
shares (as the DB and stratum servers can more than handle it).

Reply to this email directly or view it on GitHubhttps://github.com//issues/326#issuecomment-40195967
.