Home›Crypto›Market Structure›Solana security contest did not cover PoH clock attack…

Solana security contest did not cover PoH clock attack disclosed to developers

The USENIX Security paper said a malicious scheduled leader could use fork-assisted time inflation to suppress honest proposals, using less than 33% stake under stated assumptions.

Reported · Written up by our desk · Market Structure

Researchers presented at USENIX Security on Aug. 12 a Solana Proof-of-History clock attack they had privately disclosed to Solana developers in December 2025, according to CryptoSlate.

The researchers said a scheduled leader could withhold a protocol-valid block while validators advance their Proof-of-History clock, then release a block anchored to an earlier logical time, a reset they described as “re-anchoring.” They added that Fork-Assisted Time Inflation combines the reset with TowerBFT fork choice, and under modeled conditions the attacker’s branch could orphan an honest leader’s block.

CryptoSlate reported that Anza’s 50,000 SOL Alpenglow competition, which closed seven days after USENIX, appeared to exclude the behavior described because it was considered out of scope when Alpenglow was inactive. The paper’s threat path relies on Proof-of-History and TowerBFT, machinery the contest was intended to replace but that had not yet displaced on Solana mainnet at the time of Agave 4.2.

The researchers’ threat model assumed an adversary with less than 33% of stake and no control over the network scheduler, plus a known stake-weighted leader schedule, partial synchrony, and delivery of an honest block within one nominal slot after network stabilization, the outlet said. CryptoSlate noted that while public design documents suggest the legacy path should become unreachable after activation, neither Anza nor the Solana Foundation has published a paper-specific adjudication or implementation analysis.

Latest closeSolana $87.51 ▲2.5%

More like this

Sources