On Nov. 21, Cardano’s mainnet bifurcated into two competing histories after a single malformed staking-delegation transaction exploited a dormant bug in newer node software. For roughly 14 and a half hours, stake pool operators and infrastructure providers watched as blocks piled up on two separate chains: one “poisoned” branch that accepted the invalid transaction and one “healthy” branch that rejected it. Exchanges paused ADA flows, wallets showed conflicting balances, and developers raced to ship patched node versions that would reunify the ledger under a single canonical history. No funds vanished, and the network never fully halted. Still, for half a day, Cardano lived the scenario Ethereum’s client-diversity advocates warn about: a consensus split triggered by software disagreement rather than an intentional fork. Cardano co-founder Charles Hoskinson said he alerted the FBI and “relevant authorities” after a former stake-pool operator admitted broadcasting the malformed delegation transaction. Law enforcement’s role here is to investigate possible criminal interference with a protected computer network, under statutes like the U.S. Computer Fraud and Abuse Act, since deliberately (or recklessly) pushing an exploit to a live, interstate financial infrastructure can constitute unauthorized disruption, even if framed as “testing.” The incident offers a rare natural experiment in how layer-1 blockchains handle validation failures. Cardano preserved liveness, blocks kept coming, but sacrificed temporary uniqueness, creating two legitimate-looking chains that had to be merged back together. Solana, by contrast, has repeatedly chosen the opposite trade-off: when its single client hits a fatal bug, the network halts outright and restarts under coordinated human intervention. Ethereum aims to sit between those extremes by running multiple independent client implementations, betting that no single codebase can drag the entire validator set onto an invalid chain. Cardano’s split and the speed with which it resolved test whether a monolithic architecture with version skew can approximate the safety properties of genuine multi-client redundancy, or whether it simply got lucky. The bug and the partition Intersect, Cardano’s ecosystem governance body, traced the failure to a legacy deserialization bug in hash-handling code for delegation certificates. The flaw entered the codebase in 2022 but remained dormant until new execution paths exposed it in node versions 10.3.x through 10.5.1. When a malformed delegation transaction carrying an oversized hash hit the mempool around 08:00 UTC on Nov. 21, newer nodes accepted it as valid and built blocks on top of it. Older nodes and tooling that had not migrated to the affected code path correctly rejected the transaction as malformed. That single disagreement over validation split the network. Stake pool operators running buggy versions extended the poisoned chain, while operators on older software extended the healthy one. Ouroboros, Cardano’s proof-of-stake protocol, instructs each validator to follow the heaviest valid chain it observes, but “valid” had two different definitions depending on which node version processed the transaction. The result was a live partition: both branches continued producing blocks under normal consensus rules, but they diverged from a common ancestor and could not reconcile without manual intervention. The pattern had appeared on Cardano’s Preview testnet the day before, triggered by nearly identical delegation logic. That testnet incident alerted engineers to the bug in a low-stakes environment. Still, the fix had not yet propagated to mainnet when a former stake-pool operator, who later claimed he followed AI-generated instructions, submitted the same malformed transaction to the production network. Within hours, the chain had split, and infrastructure providers faced the question of which fork to treat as canonical. Safe failure without a kill switch Cardano’s partition resolved itself through voluntary upgrades rather than emergency coordination. Intersect and core developers shipped patched versions of node, 10.5.2 and 10.5.3, which correctly rejected the malformed transaction and rejoined the healthy chain. As stake pool operators and exchanges adopted the patches, the weight of consensus gradually tipped back toward a single ledger. By the end of Nov. 21, the network had converged, and the poisoned branch was abandoned. The incident exposed an uncomfortable gap: two canonical ledgers existed simultaneously, but several boundaries prevented it from cascading into a deep reorganization or permanent loss of finality. First, the bug lived in application-layer validation logic, not in Cardano’s cryptographic primitives or Ouroboros’ chain-selection rules. Signature checks and stake weighting continued to operate normally. The disagreement centered solely on whether the delegation transaction met ledger validity conditions. Second, the partition was asymmetric. Many critical actors, including older stake pool operators and some exchanges, ran software that rejected the bad transaction, ensuring substantial stake weight remained behind the healthy chain from the start. Third, Cardano had pre-positioned a disaster-recovery plan under CIP-135, which documented a process for coordinating around a canonical chain in more extreme scenarios. Intersect is prepared to invoke that plan as a fallback, but voluntary upgrades proved sufficient to restore consensus under normal Ouroboros rules. The narrow scope of the bug also mattered. The flaw affected a specific hash deserialization routine for delegation transactions, a bounded attack surface that could be patched and closed without requiring broader protocol changes. Once fixed, the exploit path disappeared, and no generalizable class of malformed transactions remained available to trigger future splits.

Un error de validación expuso vulnerabilidades críticas y obligó a la red a reunificarse tras 14 horas de cadenas paralelas

por Irene

noviembre 26, 2025

en Actualidad

Tiempo de lectura: 4 mins lectura

0