Core-Geth v1.12.2x Security Audit

Background

How This Was Found

During Olympia upgrade preparation, the ETC core team needed Core-Geth as a reference client alongside Besu and Nethermind — both carrying ETC overlays for cross-client testing but not recommended for production. Core-Geth was the only existing ETC client at the time. That work confirmed what the commit history showed: the etclabscore/core-geth repository had not shipped a code release since v1.12.20 on June 10, 2024 — a 21-month gap. Multiple CVEs had accumulated unpatched, and the client was still shipping binaries built on Go 1.21, a runtime that reached end-of-life in August 2024.

Security disclosures sent to the upstream maintainer in February 2025 received no response. The last substantive upstream commit was the v1.12.20 release itself; the final commit of any kind was a GitHub Actions CI update on January 23, 2025. With Olympia requiring a reliable, patched client for network continuity, the ETC core development team brought Core-Geth forward under the ethereumclassic organization, applied all known patches, upgraded the Go toolchain to 1.26, and is preparing Core-Geth v1.13.0 for release ahead of the Olympia upgrade.

CVE Analysis

CVE Gap Analysis

The following vulnerabilities were present in etclabscore/core-geth at v1.12.20. All are patched in the ethereumclassic/core-geth codebase, pending release as v1.13.0.

Go Toolchain

Go Runtime End-of-Life

The upstream Core-Geth v1.12.20 release was built with Go 1.21, which reached end-of-life in August 2024. Go's release policy provides security patches only for the two most recent major versions. As of March 2026, Go 1.21 had been unsupported for 19 months, leaving the runtime's standard library (net/http, crypto/tls, encoding) unpatched across that window.

Core-Geth v1.13.0 at ethereumclassic/core-geth builds on Go 1.26 (current stable). The upgrade proceeded in two steps: Go 1.21 → 1.24 (removing the incompatible fjl/memsize dependency and fixing go vet format errors), then Go 1.24 → 1.26 (updating all golang.org/x/ dependencies for compatibility). The blst cryptography library was simultaneously upgraded from v0.3.11 to v0.3.16. Commit: 8385cf8e8.

Timeline

Release Timeline

Risk Assessment

Risk Assessment

March 2026

The March 2026 Attack

On 18 March 2026, CVE-2026-22862 was actively exploited against the ETC mainnet classic bootnodes ams3 and sfo3. Malicious P2P traffic sent crafted auth messages with undersized ECIES payloads, crashing each node on inbound handshake attempts. Because the crash occurred in listenLoop, the node process exited and restarted under the service manager — only to crash again on the next malicious connection, producing an automated crash-loop. Bootnode sfo3 accumulated 805+ restart cycles on v1.12.20 before the patch was deployed.

panic: runtime error: makeslice: len out of range

goroutine 42797 [running]:
github.com/ethereum/go-ethereum/crypto/ecies.symDecrypt(...)
        crypto/ecies/ecies.go:224
github.com/ethereum/go-ethereum/crypto/ecies.(*PrivateKey).Decrypt(...)
        crypto/ecies/ecies.go:322
github.com/ethereum/go-ethereum/p2p/rlpx.(*handshakeState).readMsg(...)
        p2p/rlpx/rlpx.go:612
github.com/ethereum/go-ethereum/p2p/rlpx.(*handshakeState).runRecipient(...)
        p2p/rlpx/rlpx.go:415
github.com/ethereum/go-ethereum/p2p/rlpx.(*Conn).Handshake(...)
        p2p/rlpx/rlpx.go:308
github.com/ethereum/go-ethereum/p2p.(*Server).listenLoop.func2()
        p2p/server.go:921

Stack trace from issue #692. PR #694 (v1.12.21) was opened and merged in 5 hours — the first code activity from the upstream maintainer in 14 months.

Evidence Trail

Postmortem: Public Evidence Trail

The following issues and PRs at etclabscore/core-geth form a linkable evidence trail. Each was a missed opportunity to prevent the March 2026 attack.

Root Cause

Structural Failures

Five independent structural failures — any one of which, if addressed, would have been sufficient to prevent the March 2026 attack.

Recommended Client

Why Fukuii Is the ETC Client

The Core-Geth security failure was not a one-off — it was the predictable outcome of a Go-based client built outside the Ethereum Classic ecosystem, maintained under a corporate structure that has since wound down. Fukuii is the ETC-native execution client built from the ground up for Ethereum Classic. It does not share the Go toolchain, the go-ethereum P2P stack, or any of the code paths that were vulnerable in Core-Geth. Protocol-funded maintenance via ECIP-1112 provides a path not dependent on any single corporate entity.

Attribution

Prior Maintainers

Core-Geth is a fork of multi-geth, originally created and maintained by Wei Tang (@sorpaas). Multi-geth was the first multi-network go-ethereum fork with first-class ETC support, and its chain configuration architecture is the direct ancestor of core-geth.

The core-geth fork was then developed by ETC Labs until they left the ETC ecosystem in 2022. ETC Cooperative-paid staff maintained the client through the Spiral hard fork up until announcing maintenance mode for the client in December 2024:

• Isaac Ardis (@meowsbits) — primary architect and long-term maintainer
• Diego López León (@diega) — release manager; cut the v1.12.20 release
• Chris Ziogas (@ziogaschr) — contributor and maintainer

Migration

Network Migration Path

Core-Geth v1.13.x is the final stable release series of this client. The ETC network is migrating to Fukuii (github) as the primary ETC-native execution client. Core-Geth will continue to be maintained through the Olympia upgrade cycle to ensure a stable transition, but operators should plan their migration to Fukuii beyond that point.

If you are running etclabscore/core-geth v1.12.20 or earlier, upgrade to v1.12.22 immediately. Track ethereumclassic/core-geth for v1.13.0, which includes the Go 1.26 toolchain upgrade and full Olympia support.

Recommendations

Recommendations

Methodology

Methodology

These findings emerged from Olympia upgrade preparation. Core-Geth was required as a reference client alongside Besu and Nethermind, both of which carry ETC overlays for cross-client testing and are not recommended for production use. Fukuii is the only ETC-native production client and is built on Scala 3 / Pekko — it does not share the Go toolchain. The etclabscore/core-geth codebase at v1.12.20 was assessed against the go-ethereum GitHub Security Advisory database and the Go vulnerability database (vuln.go.dev). Each advisory was verified for applicability to core-geth's shared codebase and manually ported or cherry-picked where upstream structural differences prevented a clean merge. All patches were validated through Mordor testnet deployment and automated test suites across the Olympia reference client set (Core-Geth, Besu, Nethermind).

References

References

• ethereumclassic/core-geth — patched v1.13.0
• etclabscore/core-geth — upstream (unmaintained since June 2024)
• Full audit report — docs/audits/2026-03-security-audit.md
• go-ethereum GitHub Security Advisories
• Go Vulnerability Database — vuln.go.dev
• ETC Node Clients
• Olympia Client Implementations
• ECIP-1112: Treasury Funding for Protocol Maintenance