Ethereum Classic node operators have been advised to refrain from using the disputed version Core Geth v1.13.0 and continue working with Argos v1.12.23. This step was initiated after several mining pool nodes temporarily switched to the new version before reverting to the previous client. According to a report by Classix, version v1.13.0 was released on September 14, prompting the migration of nodes as it was announced as a security update. However, doubts arose regarding its legitimacy, as the version was released without external review and contained changes that could affect consensus behavior. Classix emphasized that no economic losses were recorded, nor were any blocks lost.
The development of the disputed version accelerated just before its release: 96 commits were made 56 hours prior to the release, containing 13,422 added lines and 3,977 deleted lines. At the same time, four 2Miners nodes launched Core Geth v1.13.0 at 12:09 UTC on September 15. However, by 23:35 UTC, all these nodes reverted to Argos v1.12.23. Classix recommends operators avoid using Core Geth v1.13.0 and refer to the client from the supported repository, which has actively maintained Core Geth since 2020.
Classix further disputed the security of version v1.13.0, noting that seven security issues mentioned in the release had already been resolved in other versions of Core Geth. Classix reported that the incident did not lead to block losses and did not cause service disruptions. However, changes related to node discovery structure potentially threaten the security of the network. At the end of the report, Classix urged Ethereum Classic GitHub administrators to tighten access control to repositories to prevent similar situations in the future.
Related articles
