Researchers presenting at USENIX Security outlined a Solana Proof-of-History clock attack that was privately disclosed to Solana developers in December 2025. Anza's 50,000 SOL Alpenglow competition closed seven days after the presentation, with rules that appear to position the attack outside the scope of the event.
The academic paper describes a protocol-valid method for a scheduled leader to stretch its effective block window and suppress honest leaders' proposals using a fork-assisted mechanism. This path relies on Proof-of-History and TowerBFT, the legacy machinery that the Alpenglow upgrade is designed to replace, though it had not yet displaced TowerBFT on the mainnet in Agave 4.2.
Understanding the Clock Attack Mechanics
Proof-of-History uses a sequential hash chain to provide a logical clock for Solana. When a scheduled leader fails to immediately publish a block, validators continue advancing their local view of that clock. According to the researchers, a malicious scheduled leader can withhold a protocol-valid block while honest validators move ahead, and subsequently release the block anchored to an earlier point in logical time.
The researchers refer to this reset as "re-anchoring." Time Inflation (TI) repeats the maneuver to grant the attacker extended physical time for transaction selection while logical time moves more slowly, whereas Fork-Assisted Time Inflation (FTI) combines the reset with TowerBFT fork choice. Under modeled conditions, the attacker's branch can orphan an honest leader's block while Solana's one-block-per-slot rule prevents that leader from producing another block for the same slot.
The threat model presumes an adversary controlling less than 33% of the stake with no control over the network scheduler, operating under assumed partial synchrony and a known, stake-weighted leader schedule. The researchers implemented TI and FTI on a local Solana testnet and used simulations for full-epoch configurations, though they did not identify a specific affected Agave release.
Analysis of Mainnet Data and Contest Scope
The researchers also reviewed public mainnet data, identifying two validators that repeatedly appeared in the tail of the timestamp-interval distribution and paired longer intervals with higher transaction inclusion and low skip rates. While consistent with TI's incentive channel, the paper noted that hardware differences, local batching, configuration choices, or network conditions could produce similar timing patterns. The research did not identify a live exploit, theft, demonstrated mainnet manipulation, or a consensus-safety break.
Alpenglow competition submissions closed on August 19. The official rules covered the Alpenglow feature-active consensus surface, integration code affected by Alpenglow activation, and the migration path from TowerBFT to Alpenglow. Behaviors reachable only when Alpenglow was inactive belonged to the TowerBFT domain and were excluded, as were previously public issues.
The Transition Through Alpenglow
Anza's Alpenglow documentation indicates that the upgrade replaces TowerBFT and Proof-of-History as core consensus components with Votor, removing the prerequisites utilized by TI and FTI. Official SIMD-0326 proposals describe local timeouts that perform timing roles without synchronized time.
According to the paper, Solana developers responded within one day of the December 2025 disclosure, noting that the behavior was already known internally and expected to be addressed by a future protocol upgrade like Alpenglow. A Solana Foundation overview of Agave 4.2 noted that the client included Alpenglow code for community test clusters without activating it on the mainnet, with activation anticipated in Agave 4.3.
