ETC Chain Split Diagnosis

ETC Chain Split Diagnosis
Authors: Yaz Khoury, Sam Johnson, Austin Roberts

There was about 3000 block-insertion by a miner who was mining (either offline or there total difficulty could have exceeded current network difficulty while they were honestly mining) for about 12 hours on Core-Geth.

The block number where the approximately 3000 blocks were inserted was on block number 10904146.

The offending miner used the address 0x75d1e5477f1fdaad6e0e3d433ab69b08c482f14e

Timeline of Events
A timeline so far of the events that happened:

Offending Miner 0x75d1e5477f1fdaad6e0e3d433ab69b08c482f14e was mining about 3000 blocks that were introduced to the chain.
2Miners mining pool hashrate was going offline for maintenance purposes due to deprecation of MultiGeth (unrelated to current issue).
Because 2Miner wasn’t producing any blocks for the time being, and about 3000 block insertion around the same time, OpenRelay was notified that blocks weren’t coming in for a few minutes.
Soon afterwards OpenRelay realized there was a chain split between block explorers and started investigating.
All Ethereum Classic Parity/OpenEthereum nodes couldn’t handle about 3000 block reorg from the Core-Geth chain, so there was a chain split which made the network unstable. All Parity/OpenEthereum miners continued mining on the original chain. Core-Geth nodes were mining the about 3000 block-inserted chain.
Later, due to more work allocated to about 3000 block chain from the split, the “original chain” Parity miners started following about 3000 block chain header (due to Proof of Work and following the chain with the most amount of work).
Is It An Attack?
It could be that the offending miner has lost access to internet access for a while when mining, which led to a 12 hour mining period and about 3000 blocks inserted. On the first 2000 blocks, there was 1 miner and a total of 5 transactions. It also seems that the offending miner has uncled their own blocks by how fast they were mining. It doesn’t appear actively malicious. It might be a deliberate attack as well, but it doesn’t seem there was any major double-spend attack. More investigation of what happened is underway and more information will be released soon.

Possible impact
Any transactions during that time are possibly not mined in the order they were intended to have been mined in. The about 3000 blocks had a mean of 0 transactions mined, and any transactions that aren’t mined will be re-submitted to the mempool during a re-org.

What Can Miners Do?
Continue mining the chain as-is (chain is currently following the heaviest work which includes the about 3000 block inserted). This is the recommended option as the chain is following Proof of Work with the longest chain as intended.