Due to an incorrectly implemented software update last weekend, two forks have arisen in the blockchain that allow invalid bitcoin transactions to be carried out. Transactions executed after 2 AM on July 6 are less reliable with certain software.
Bitcoin.org warns about this. Users of Bitcoin Core software with version number 0.9.5 or higher have never been at risk. It was expected that a fork would occur after the upgrade. What was not foreseen, however, was that a large part of the miners would work with so-called Simplified Payment Verification nodes, or spv nodes. An spv node does not download the entire blockchain of almost 37GB in the meantime. The method is widely used with wallets for smartphones and tablets and embedded systems.
At the time of writing, nine invalid blocks have been mined. In the first six blocks mined between July 4 from 02:10 utc to 03:50, no duplicate transactions were posted. It is not yet known whether the three blocks that were mined between 21:50 utc and 23:40 on 5 July have led to double bookings.
The expected error occurred because a new version of the protocol was implemented that requires BIP66 rules. The rules of BIP66 state that once 950 out of 1000 blocks are based on version 3, all updated miners reject version 2 blocks. By the early morning of July 4, the tipping point of 95 percent had been reached: 950 of the 1000 blocks were v3 copies. Shortly after, a small miner, part of the not-yet-updated 5 percent, created an invalid block, as expected. However, it turned out that about half of the network’s hash rate was mining without fully confirming the blocks, so-called spv mining. So all those miners were building on that wrong block.
Bitcoin.org further reports that about 50 percent of spv miners have announced that they are enforcing the BIP66 rules. By failing to do so, some major miners lost more than $50,000 in income. Any software that assumes blocks are valid has a risk of showing transactions as valid when they are not. This applies to spv wallets and software and older versions of the bitcoin core that are at the security level of spv software due to the new BIP66 rules.
The recommended fix is that all miners temporarily do not do spv mining, but temporarily fully confirm all blocks. Normally there must be six confirmations in order to approve a transaction. Now Bitcoin.org recommends waiting at least 30 confirmations.