CVE-2020-26265: 
Ethereum Geth vulnerability analysis and mitigation

Go Ethereum (Geth), the official Golang implementation of the Ethereum protocol, contained a consensus vulnerability in versions from 1.9.4 to 1.9.20. The vulnerability was discovered on August 11, 2020, by John Youngseok Yang from Software Platform Lab and was fixed in version 1.9.20 (Paragade release). The flaw could cause a chain split where vulnerable versions would refuse to accept the canonical chain (GitHub Advisory, NVD).

The vulnerability stemmed from a semantic change in the createObject function that caused it to return a non-nil object with deleted=true where it previously did not when an account had been destructed. This return value caused new objects to inherit old balances incorrectly. The issue manifested when executing specific transaction sequences involving self-destruct operations and subsequent calls. The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability could result in a consensus failure where affected nodes would maintain an incorrect state of the blockchain. In specific scenarios involving self-destruct operations, accounts could retain incorrect balances, leading to potential chain splits and network inconsistencies (GitHub Advisory).

The vulnerability could be triggered through a specific sequence of transactions: first, a transaction where a contract invokes a self-destruct-to-self operation followed by a call with a non-zero value, and second, a direct call to the affected address. This would result in incorrect balance calculations in vulnerable Geth versions (GitHub Advisory).

The vulnerability was patched in Geth version 1.9.20 (Paragade release) by modifying the createObject function to properly handle deleted objects. No individual workaround patches were provided, and all users were recommended to upgrade to the newer version. It's important to note that reverting to version 1.9.19 or prior after upgrading to 1.9.20 is not possible without a resync due to blockchain database layout changes (GitHub Release).