Core-Geth
The client Ethereum Classic has run for years. It is a go-ethereum derivative, and it is now kept working rather than actively developed.
- Role
- Maintained through the upgrade
- Language
- Go
- Derived from
- go-ethereum
- Repository
- ethereumclassic/core-geth
What Core-Geth is
Core-Geth is a derivative of go-ethereum, the most widely deployed Ethereum client. It takes that codebase and adds the chain rules Ethereum Classic needs. Most Ethereum Classic infrastructure running today runs Core-Geth, and for years it has been the network's default answer to the question of what a node should run.
Being a derivative is the whole of both its strength and its limit. It inherits a large body of tested Ethereum work for free, and it inherits that work's assumptions, its dependencies and its release pace along with them, whether or not those suit this network.
Where it stands for Olympia
Core-Geth carries the Olympia parameters: the base-fee floor, the credit at block finalization, the destination address, the era gas targets and the MESS re-activation block.
Carrying the parameters is not the same as conforming to the specification, and ECIP-1122 is precise about the difference. It asks for the minimum-tip check at both points a transaction can enter a block, at pool admission and again at block production, and it asks for the era gas target to override rather than defer to an operator's own configuration.
What settles conformance is not a client's own account of itself. Cross-client state-transition equivalence is demonstrated on Mordor before a mainnet activation block is scheduled, which is the point at which a claim about any client stops being an assertion.
An operator already running Core-Geth does not have to change client in order to take the upgrade. That is deliberate: an upgrade is harder to land safely if it forces every operator on the network to migrate simultaneously.
Why it is described as maintenance
Maintenance is a real status here rather than a polite word for old. The upstream repository at etclabscore received no substantive code commit after June 2024, and the gap that followed ran 21 months, which is the longest in this network's history.
During it, six security vulnerabilities went unpatched. Two of them let a remote attacker crash a node, and one of those needs no authentication at all: a single crafted message during the opening handshake is enough. A third lets any connected peer exhaust a node's processor. The remaining three weaken the cryptography the peer-to-peer layer depends on, and one of those can leak bits of a node's own private key.
In March 2026 the gap stopped being theoretical. Ethereum Classic mainnet bootnodes came under active attack, and an emergency release followed within hours of the pull request that carried it.
All six are fixed. The client lives in the ethereumclassic organization, the patches were published there, and the Go toolchain it builds on was brought back to a supported version at the same time. The audit below lists each vulnerability, the commit that closed it, and the timeline of the signals that were available beforehand.
Read the Core-Geth security auditWhich repository to run
There are two Core-Geth repositories and the difference matters. The original at etclabscore is the one that carried the unpatched releases. The maintained client is at ethereumclassic, which is where the security work was published, and the distinction matters operationally.
Run the ethereumclassic build. An operator on an older etclabscore release is running a node with known remote-crash vulnerabilities in it, and rotating the node key afterward is a sensible precaution on any node that has been running for a long time.
Take a release that carries the Olympia changes. ECIP-1111 and ECIP-1121 are consensus changes, so a node without them leaves the canonical chain at the activation block instead of merely running in non-conformance.
- github.com/ethereumclassic/core-geth
- the maintained client, and the one to run
- github.com/etclabscore/core-geth
- the original repository, superseded
What to run for something new
Use Fukuii. Core-Geth exists in the Olympia era to carry the operators who are already on it, not to be the choice for a node that does not exist yet.
The reason is the one this page has just described. A single client that only one organization is positioned to maintain is a network-level risk, and Ethereum Classic has now watched that risk turn into an incident. More than one independent implementation is the structural answer to it.
Read about Fukuii