fixed a duplicate share exploit for bitcoin. (#102)

fixed a tiny typo in ethereum_pool.json.
oliverw · Dec 4, 2017 · c0eb4da · c0eb4da
1 parent b4616aa
commit c0eb4da
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/examples/ethereum_pool.json b/examples/ethereum_pool.json
@@ -8,7 +8,7 @@
         "perPoolLogFile": false
     },
     "banning": {
-        "manager": "integrated"
+        "manager": "integrated",
         "banOnJunkReceive": true,
         "banOnInvalidShares": false
     },

diff --git a/src/MiningCore.Tests/Blockchain/Bitcoin/BitcoinJobTests.cs b/src/MiningCore.Tests/Blockchain/Bitcoin/BitcoinJobTests.cs
@@ -88,6 +88,10 @@ public void BitcoinJob_Should_Not_Accept_Invalid_Share()
             // invalid extra-nonce 2
             Assert.Throws<StratumException>(() => job.ProcessShare(worker, "02000000", "59ef86f2", "8d84ae6a"));
 
+            // make sure we don't accept case-sensitive duplicate shares as basically 0xdeadbeaf = 0xDEADBEAF.
+            var share = job.ProcessShare(worker, "01000000", "59ef86f2", "8d84ae6a");
+            Assert.Throws<StratumException>(() => job.ProcessShare(worker, "01000000", "59ef86f2", "8D84AE6A"));
+
             // invalid time
             Assert.Throws<StratumException>(() => job.ProcessShare(worker, "01000000", "69ef86f2", "8d84ae6a"));
 

diff --git a/src/MiningCore/Blockchain/Bitcoin/BitcoinJob.cs b/src/MiningCore/Blockchain/Bitcoin/BitcoinJob.cs
@@ -258,9 +258,9 @@ protected bool RegisterSubmit(string miner, string worker, string extraNonce1, s
                 .Append(miner)
                 .Append(worker)
                 .Append(extraNonce1)
-                .Append(extraNonce2)
+                .Append(extraNonce2.ToLower()) // lowercase as we don't want to accept case-sensitive values as valid.
                 .Append(nTime)
-                .Append(nonce)
+                .Append(nonce.ToLower()) // lowercase as we don't want to accept case-sensitive values as valid.
                 .ToString();
 
             lock (submissions)