CVE-2020-26240: 
Ethereum Geth vulnerability analysis and mitigation

Go Ethereum (Geth), the official Golang implementation of the Ethereum protocol, contained an ethash mining DAG generation flaw in versions before 1.9.24. The vulnerability, identified as CVE-2020-26240, was discovered in November 2020 and could cause miners to erroneously calculate Proof of Work (PoW) in an upcoming epoch, estimated to occur in early January 2021 (GitHub Advisory).

The vulnerability was related to a bit boundary issue in the DAG generation routine where index calculations needed to be converted to 64-bit operations to prevent overflow. This issue manifested when the DAG size exceeded the maximum 32-bit unsigned value, causing incorrect results during the generation process (GitHub PR).

The vulnerability only affected mining nodes, while non-mining nodes remained unaffected. When exploited, it could cause miners to generate incorrect Proof of Work calculations, potentially leading to invalid block generation. This issue had already manifested on the Ethereum Classic (ETC) chain on November 6, 2020 (GitHub Advisory).

The vulnerability was demonstrated to be exploitable, as evidenced by its occurrence on the Ethereum Classic chain. The issue would become relevant for Ethereum mainnet miners when reaching epoch 385, which was calculated to occur around January 1st, 2021 (GitHub PR).

The vulnerability was patched in Geth version 1.9.24. The fix involved converting all index calculations to 64-bit operations, which resolved the addressing overflow issue in the DAG generation process (GitHub Advisory).