Decred Releases Inflation Vulnerability Post-Mortem: Approximately 2,078 DCR Minted, Emergency Patch Deployed

August 25 news: Decred has released a post-mortem report on a consensus vulnerability. Between August 16 and 17, the Decred mainnet was exploited via an inflation vulnerability, resulting in approximately 2,078 DCR being minted. The vulnerability was submitted through the bug bounty program on August 12 IA and exploited four days later, with roughly 72 hours from disclosure to mainnet exploitation. The flaw had existed in the consensus code since the network's launch in 2016, involving an unhandled edge case in the interaction between the regular transaction tree and the stake transaction tree. An emergency patch, version 2.1.6, was released on August 18, fixing the vulnerability without rolling back the chain, with most ecosystem participants completing the upgrade within approximately 24 hours. Decred stated it chose not to roll back the chain to minimize user impact, that the inflated amount does not affect the 21 million DCR hard cap, and that a double-spend monitoring service has been developed as an additional layer of protection.