Change Details

This commit attempts to avoid the following attack: Attacker mines 10 blocks after the most recent checkpoint but not off of the current global chain tip. Attacker performs an eclipse attack against a node undergoing IBD, and supplies these 10 blocks. Attacker may or may not manipulate DAA to add more blocks on top with low difficulty. Attacker prevents other block headers from being seen during this time, causing the node in question to download those 10 blocks. Victim finalizes the first of those blocks. Victim is stuck until manual intervention is used. This code assumes that the eclipse attack cannot be maintained consistently for 2 hours, and that during that time at least some blocks from the true global best chain will filter through and displace the attacker's blocks, allowing the victim to escape the attack. That seems like a reasonable assumption to me.

This commit attempts to avoid the following attack: 1. Attacker mines 10 blocks after the most recent checkpoint but not off of the current global chain tip. 2. Attacker performs an eclipse attack against a node undergoing IBD, and supplies these 10 blocks. Attacker may or may not manipulate DAA to add more blocks on top with low difficulty. 3. Attacker prevents other block headers from being seen during this time, causing the node in question to download those 10 blocks. 4. Victim finalizes the first of those blocks. Victim is stuck until manual intervention is used. This code assumes that the eclipse attack cannot be maintained consistently for 2 hours, and that during that time at least some blocks from the true global best chain will filter through and displace the attacker's blocks, allowing the victim to escape the attack. That seems like a reasonable assumption to me.

This commit attempts to avoid the following attack: 1. Attacker mines 10 blocks after the most recent checkpoint but not off of the current global chain tip. 2. Attacker performs an eclipse attack against a node undergoing IBD, and supplies these 10 blocks. Attacker may or may not manipulate DAA to add more blocks on top with low difficulty. 3. Attacker prevents other block headers from being seen during this time, causing the node in question to download those 10 blocks. 4. Victim finalizes the first of those blocks. Victim is stuck until manual intervention is used. This code assumes that the eclipse attack cannot be maintained consistently for 2 hours, and that during that time at least some blocks from the true global best chain will filter through and displace the attacker's blocks, allowing the victim to escape the attack. That seems like a reasonable assumption to me.