Four Days of Ravencoin Transactions at Risk After Critical Blockchain Flaw

Ravencoin is at risk of losing several days of transaction history after two dominant mining pools began reconstructing the blockchain from the point immediately before Friday’s first invalid block. Since the pools account for most of the network’s hashpower, deposits, withdrawals and payments made after that point could be reversed if their rebuilt chain is ultimately accepted.

The Ravencoin project said Tuesday that a critical software vulnerability had been exploited, allowing attackers to create invalid blocks and potentially forcing the network to discard part of its recent history.

Ravencoin was launched in 2018 using Bitcoin’s codebase and was designed primarily for issuing and transferring digital assets. Its network also depends on miners to validate transactions and maintain a shared ledger. But because Ravencoin has a much smaller mining ecosystem than Bitcoin, a few large pools can exert considerable influence when the blockchain splits into competing versions.

That concentration has become crucial during the current incident. 2Miners and RavenMiner control most of Ravencoin’s computing power and are rebuilding the chain from block 4,487,775, which was mined just before the exploit began. Should enough miners adopt that chain, activity recorded after the block could be removed from the accepted ledger.

Blockchain networks maintain transaction histories by grouping transactions into blocks that miners add to the chain. Most miners operate through pools, combining their computing resources and sharing the rewards. When competing chains appear, the version backed by the greatest amount of hashpower generally becomes the network’s recognized history.

For users, the consequences of such a rollback could be immediate. A transaction that appeared settled could later disappear, potentially returning the RVN to the original sender and leaving the recipient without the payment.

Exchanges face a similar risk. A platform could receive an RVN deposit, credit the customer and permit a withdrawal before the transaction is ultimately removed. That could leave the exchange covering a shortfall, prompting several platforms to suspend Ravencoin services.

Bitvavo, an Amsterdam-based exchange, stopped RVN deposits and withdrawals after the vulnerability was exploited. South Korea’s Upbit also issued an investment warning covering RVN markets against the Korean won, Bitcoin and Tether and suspended deposits.

The exploit and chain reconstruction

The first invalid block appeared at height 4,487,776 at 15:44 UTC on Aug. 7. Once the vulnerability had been demonstrated on the live blockchain, additional invalid blocks were reportedly generated by others using the same weakness.

Ravencoin has released a software fix to close the vulnerability. However, installing the patch prevents further exploitation but does not automatically erase or restore blocks that have already been added to the chain.

The two major mining pools are therefore rebuilding the blockchain from block 4,487,775, the last valid block before the attack. Ravencoin said it asked them to restart from a later point to limit the amount of transaction history that could be affected, but both pools rejected the request.

RavenMiner said its nodes have been upgraded with an emergency patch and that it is now mining the chain it considers clean. According to the pool, blocks created during the exploit window are being discarded across the network, meaning mining rewards from that period would be reversed for all affected miners rather than only RavenMiner users.

RavenMiner has also paused payouts while the network determines which chain will prevail. The pool said it would cover any resulting shortfall and confirmed that rewards earned before 15:44 UTC on Aug. 7 are not subject to the rollback.

The incident marks another major security challenge for Ravencoin. In 2020, a separate vulnerability allowed attackers to create RVN beyond the amount permitted by the protocol, resulting in roughly 31 million additional tokens being minted before the flaw was patched.

RVN has also taken a significant hit in the market. The token declined about 17% in 24 hours to approximately $0.0029, leaving the project with a market capitalization of around $48 million. Trading volume was roughly $10 million, and RVN is down about 77% over the past 12 months.