Duplicate shares

[1towia]

Hello, I think there is a way to send duplicate shares to the pool that are accepted as valid:

By resending the "mining.submit" message with differents extraNonce2 (params[3]) in a way that it remain valid and don't alter the header.
To do this, It's possible to change the lasts characters of extraNonce2 by non hexadecimal characters.

I don't know if the pool pay for those invalid shares, I can't test right now.

https://github.com/z-classic/node-stratum-pool/blob/master/lib/stratum.js#L169
https://github.com/z-classic/node-stratum-pool/blob/master/lib/jobManager.js#L177-L187
https://github.com/z-classic/node-stratum-pool/blob/master/lib/blockTemplate.js#L116-L124
https://github.com/z-classic/node-stratum-pool/blob/master/lib/blockTemplate.js#L71

[WaveringAna]

Hmm, the fastest miners are closed source and most pools use TLS and that prevents MitM attacks, but this is an valid exploit

[wuhuaping]

47.93.44.197:5959 Who can help me
I started him but
pool
Not connected

[nimbosa]

need help to test and check vulnerability since this partial fix: #26