EOS to nullify the blacklisted accounts as part of the temporary solution following the hack

The EOS Community Arbitration Forum [ECAF] is the forum in the EOS network that was created to handle disputes and blacklisting accounts involved in fraudulence. With just 21 nodes of Block Producers [BP] to validate transactions, the EOS blockchain is more efficient as compared to the other blockchains that have millions of miners on the network.

The feature includes freezing the transaction settlements of the illicit players on the network so that the coins do not land in their account. For this, the 21 Block Producers or BPs have to update or ‘configure’ the blacklist, failing to do which would make the entire EOS network susceptible to attacks.

The problem cropped up when an all-new rollout BP – games.eos failed to update the blacklist. EOS stated:

“On Feb 22, 2019 a new Active BP (games.eos) did not update the blacklist for EOS mainnet accounts. The blacklist is used to freeze accounts that were hacked. Due to the blacklist not updated, one of these frozen account’s attacker managed to transfer 2.09 million EOS.”

The apparent ‘hack’

A transaction of 2.09 million EOS that had been previously frozen took place from a blacklisted account, the account of a legitimate user which was hacked. Before the Block Producers could pull the plug, funds were transferred all over the network and the account was emptied. Luke Stoke’s a Puerto Rico-based Block Producer asserted that the incident happened a long time ago.

Highlighting the ‘loophole’ in the blacklist mechanism, EOS blog post stated:

“In the most benign form, a Block Producer can neglect to update the blacklist on their producing node, resulting in one BPs mistake overriding a decision that was made by 15/21.”

The blog further stated that a hacker could ‘corrupt’ any BP on the network by providing it with benefits such as ‘rewards’ for not configuring the blacklist. The blog also suggested that nulling the keys of the blacklisted accounts could resolve the issue temporarily as a short term mitigation procedure from further damage. However, for a long term fix, the community is yet to propound a solution.

The founding and top 21 Block Producer on the EOS Mainnet, EOS42, regarding the temporary solution, tweeted:

“We proposed a solution for a broken mechanism [blacklist] that is already in effect. Our solution would be temporary, only to help stop a repeat of the situation we witnessed last weekend.”

Lastly, the blog entailed that nulling does not equate to an account being lost forever. Retrieving will be possible, details of which have not been elucidated in the post.