Chain Partition Incident Analysis Working Group
Act as a place to gather information and insights on the fork incident, aiming to reconcile the data submitted to the orphaned chain.
Chain Partition Incident Analysis Working Group Charter - ratified
The goal of this working group is to ascertain the facts relating to the incident: its cause, timeline, effects, and consequences of decisions that have been taken. It is also to provide recommendations for improvements in software development, incident management and response, taking evidence from those directly involved in the incident. These findings are to be published as public reports. The goal is not to assign blame, create culpability or control information, but simply to establish a credible factual basis that allows the incident to be properly understood.
This group has spun out of the ‘War Room’ incidence response, but we welcome any representative who wishes to contribute.
Working under Intersect’s Technical Steering Committee and reporting to the Security Council.
26th November 2025
The group aligned that the immediate purpose of the Forensic WG is to define what exactly this inquiry will cover and establish a transparent, credible, and time-bounded process for analyzing the severity-1 incident from last Friday.
There was broad agreement that the work should be performed in phases, with early outputs delivered quickly to the community, followed by deeper analysis as needed.
Participants stressed that the inquiry must be:
Independent of vendors,
Transparent to the community,
Evidence-driven, and
Structured as a fact-finding process, not a blame exercise.
There was consensus that clarifying the remit is the first priority, and the group should produce a short charter defining:
the mission and boundaries,
the scope of analysis,
the expected outputs, and
the operating principles (transparency, independence, traceability, engagement with vendors).
The group identified the need to categorize the investigation into four major buckets, each representing a layer of questions that must be answered to reconstruct the incident deterministically.
A first pass at these “buckets” emerged through discussion:
Transaction-level / chain-state analysis
Operational timeline on the day of the incident
Historical/contextual factors leading to the conditions that made the incident possible
Ecosystem-level/systemic questions about how we ended up in a constrained decision-space and how future systems would behave
There is also recognition that some analysis work is already underway (e.g., Carlos & Kostas’ work, Edinburgh’s deeper mempool/business logic study), and the WG should integrate this instead of duplicating it.
The agreed next step is to produce a concise draft set of bullet-point questions + charter structure, which the entire WG can push against and refine in the next meeting.
1st December 2025
The meeting focused on defining the next steps for the Forensic Working Group, primarily concerning the production of a public report and appointing a chair.
Interim Report Deadline: The group voted and agreed to aim for a version of the report to be published by December 19th, before the holiday break.
Report Scope: The report should focus on the analysis of all available data and include preliminary conclusions on what went well and what did not, along with a clear message on future recommendations. It was emphasized to avoid rushing to final conclusions that could be overturned later.
Independent Chair: A significant discussion was held on the need to appoint an independent chair (someone not involved in the incident or employed by core entities) to avoid any appearance of cover-up and to adjudicate the report's contents.
Moving Forward Without a Chair: Given the tight deadline for the report, the group decided to start working on collecting facts (like the timeline) immediately, even before an independent chair is found and onboarded.
Naming: There was agreement that the current name, "Forensic Working Group," is misleading given the group's broader remit, with "Chain partition incident analysis group" suggested as an alternative.
3rd December 2025
Remit Ratification: The group discussed and essentially agreed to ratify the working group's remit, deciding to finalize the process on Slack to ensure all members, particularly Ryan, had time to review and raise any final objections.
Independent Chair: There was an extensive discussion on the need for an independent chair to ensure an unbiased final report. Key considerations included the required budget, the necessary secretariat/support, and the level of technical expertise versus external independence (e.g., from a major consulting firm). The decision was made to gather suggestions for candidates out of band.
Security Council Report Review: Christian Taylor presented the preliminary incident report from the Security Council, which focused on reviewing the internal process behind the incident, noting clear takeaways like improving incident response frameworks and clarifying post-incident governance.
Neutral Terminology: A consensus was reached to use neutral terms (like "desired" and "undesired" chain) when referring to the chain forks to avoid bias, moving away from terms like "minority" chain.
Fact-Finding Process: The group agreed to start collecting evidence immediately in a shared Google Drive folder and established the need for a template for a short, initial fact-finding document (to be produced by Kevin) that references all collected sources.
Postponed Topic: The agenda item on "Cardano Ignite" was postponed as Marcus, who was expected to present on it, was not present.
8th December 2025
Preliminary Report Scope: The report's primary goal is to present factual information and sources, avoiding speculation and hard conclusions, which will be reserved for the final report.
Defining the Incident: The group agreed to focus the report on the mainnet chain partition, with the response to the preview chain partition incident being a key part of the context, especially regarding how it contributed to a smoother response on mainnet.
Consequences and Double Spending: It was established that there was no on-chain double spending. A key discussion point was the need to systematically investigate potential off-chain double spending through exchanges.
Information Collection: A significant portion of the meeting was dedicated to reviewing the report structure (including sections on operational timeline, node upgrades, and consequences to DApps/exchanges) and assigning individuals to collect the necessary data for the Appendix of Sources.
10th December 2025
Preliminary Report Progress: The working group reviewed the progress on collecting background material for the preliminary fact-finding report on the chain partition incident.
Data Collection Update: Ryan Williams reported that the information collection for the first five assigned points is "more or less" complete (about 75% done) and committed to finalizing the source links immediately.
Incident Procedures and User Feedback: Discussion centered on linking Christian's security incident procedures evaluation report and the critical need to anonymize raw responses from the security council questionnaire before sharing them publicly.
Quality of Service Analysis: Markus Gufler confirmed he is handling the Quality of Service log/block production analysis. He reported that the combined density of both forks never exceeded 75% (where 90-97% is usual), indicating significant service degradation.
Report Drafting: Ryan Williams volunteered to immediately start writing the factual body of the preliminary report, focusing on sections like the mainnet chain partition and immediate incident context.
Timeline: The group agreed to aim for a draft report to be available early next week, with the goal of wrapping up source material collection by the end of the current week, acknowledging the need to publish before the holiday break.
15th December 2025
Preliminary Report Progress: The group reviewed the preliminary analysis report, identifying gaps in raw materials (Appendix 1) and progress on sections of the report body.
Source Material Gaps: The team agreed to close out several open items on the raw materials list, including "Record of decision making" (suggested to be derived from the timeline), "Quality of Service" (marked as not available for this iteration), and "Survey of infrastructure providers" (not available, but partially covered by a questionnaire).
Commit ID for Bug: Kevin Hammond confirmed he had identified the commit where the bug was introduced and linked it in the report for Ryan Williams to use.
Report Drafting Assignments:
Ryan Williams (with help from Kevin) is working on Section 1.
Ryan Williams and Kevin Hammond are collaborating on Section 2 (Historical Context).
Carlos Lopez de Lara will summarize and complete the incident timeline (Sections 3.1, 3.2, 3.3).
Marcus is responsible for a chart in Section 3.4.
Kevin Hammond and Ryan Williams will summarize Kostas's findings for Section 4.
Recommendations: The group decided against drawing formal conclusions or making formal recommendations at this stage, but will coordinate to highlight relevant recommendations from the Security Council report without formally adopting them.
Final Review: Members were asked to read through the report and provide comments.
17th December 2025
The primary focus was finalizing the preliminary "Chain Partition Incident Analysis" report for submission to the board and subsequent public release.
The group agreed that the report is "content wise essentially complete."
The plan is to send a clean, interim version of the report (without discussion comments) to the board this evening (Dec 17) or tomorrow, aiming for a public release on Friday.
Kevin Hammond clarified that the public version should be a separate copy with all comments simply removed, not necessarily resolved.
Editorial work remains, including checking for numerical and phrasing consistency throughout the document and ensuring all sources that shouldn't be public are marked.
The working group is tentatively scheduled to reconvene in the new year, likely on January 12th, 2026, to review and address any public feedback.
Attendees acknowledged the significant contributions from Carlos, Kevin, Ryan, Kostas, Markus, and Alex on various sections, including the timeline, transaction analysis, and block production analysis.
7th January 2026
The Chain Partition Working Group agreed to publish their final report by the end of the week (Friday)
The group agreed on several changes, including rephrasing the report to be a partial account based on available information, making technical adjustments regarding stake pool numbers and anti-DoS mechanisms, and adding a version history to document
Last updated