Solana Researchers Expose Clock Attack Against Legacy Proof-of-History Path

Researchers at USENIX Security on August 12 presented a clock attack against Solana's Proof-of-History, which they had privately disclosed to the development team in December 2025. The attack targets the legacy PoH and TowerBFT path, which is still active on mainnet despite Alpenglow being designed to replace it.

The researchers demonstrated that a malicious scheduled leader can stretch its effective block window and suppress honest leaders' proposals by withholding protocol-valid blocks and re-anchoring the PoH state. This creates a timing advantage for the attacker, allowing them to select fee-bearing transactions and increasing their chances of being included in the next block.

The attack is not new, but it appears to have fallen outside the scope of Solana's 50,000 SOL security contest, which closed on August 19. The rules excluded behavior reachable only when Alpenglow was inactive, and the researchers' findings suggest that the legacy PoH path will remain vulnerable until Alpenglow is activated.

The development team has acknowledged the issue and considered it a known problem, expecting Alpenglow to address it in the future. However, without a public paper-specific adjudication or implementation analysis, the transition remains uncertain.