CVE-2022-37450

Vulnerability

Overview

CVE-2022-37450, also known as Riskless Uncle Making (RUM), affects Go Ethereum (geth) versions up to 1.10.21. The vulnerability arises from insufficient validation of block timestamps in the fork choice logic. By manipulating time-difference values, an attacker can cause the network to accept blocks that should be considered uncles (orphaned blocks) as part of the main chain, effectively replacing legitimate blocks [2]. This attack was exploited in the wild from 2020 through 2022.

Attack

Vector

An attacker must be a miner or control mining power to produce blocks. The exploit leverages specific code paths in geth's fork choice implementation, particularly in core/forkchoice.go [3]. By crafting blocks with carefully adjusted timestamps, the attacker can trigger a reorg that favors their blocks over honest ones, even when the honest chain has more accumulated proof-of-work. No special network position is required beyond standard mining capabilities.

Impact

Successful exploitation allows the attacker to replace main-chain blocks, thereby invalidating transactions in the original blocks and gaining block rewards for their own blocks. This enables reward inflation and potential double-spending attacks, undermining the security and consensus guarantees of the Ethereum network [2].

Mitigation

The vulnerability is patched in geth versions after 1.10.21. Users are strongly advised to upgrade to the latest version. The Ethereum Foundation has also released advisory information and recommended immediate updates to prevent ongoing exploitation [1]. There are no known workarounds for unpatched versions.