Mithril 2642.0, the vulnerability wave and a minimum margin

Our pools’ Mithril signers are now running 2642.0, the latest release. Mithril is what lets a wallet or a node start from a certified snapshot of the chain instead of replaying it from the beginning, and stake pools sign those certificates. This release reads its settings from the chain itself and supports the current node.

You may have seen talk of a vulnpocalypse, as researchers using AI tools find and publish vulnerabilities faster than before, and FIRST now expects around 66,000 to be published this year. Far fewer are used in attacks: VulnCheck counts 14 of 1,061 AI-discovered flaws exploited in the first half of the year.

We follow the advisories as they arrive, check whether each one can actually reach anything we run, and patch on a regular supervised cycle, sooner for anything critical that is exposed. That routine, and the way the pools are built, continue to keep this within our risk tolerance.

On fees, CIP-23 would set a minimum variable fee (margin) for every pool, and it looks set to come with the next hard fork, after which DReps would vote on its level. We are evaluating it carefully, and should a minimum above our 1% margin be approved we will do what we can to keep the cost to delegators as small as possible.