Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks. The patch, which affects consensus, transaction mixing, and network operations, is required for all users to avoid being forked from the network. Decred's release notes classified the consensus issue as a 'critical' security vulnerability, warning that users who fail to update could end up operating on a different network fork.
Patch details
The patch applies to dcrd, Decred's full-node software, while associated changes have also been released for dcrwallet. The software package contains 23 commits from three contributors, covering 20 files, with 795 lines of code added and 392 lines removed. Alongside the consensus fix, developers addressed several possible network-related denial-of-service attacks.
Wallet updates
A separate set of fixes in dcrwallet v2.1.6 deals directly with Decred's transaction mixing system, updating the mixclient protocol to prevent a deanonymization attack and raising the pairing version used to establish compatibility between participants in mixing sessions. The wallet release also fixes a problem involving blame assignment during mixing and the removal of messages from the mixpool after a mixing session expires.
Network security
The combination of the signature, peer-disconnection, and Merkle-root changes sits alongside the network-level DoS fixes included in dcrd v2.1.6. Decred's release notes do not state that the identified attack routes had been exploited in the wild before the patch was published. Users can verify the release files against SHA-256 hashes and associated signature files provided with the package.
