I actually found out that gocoin doesn't verify the block's hash values, it just trusts whoever sends them. I think there are many more issues with gocoin i'm yet to find.
What do you mean?
Gocoin is a full node which means it should verify the blocks it receives (the hash alone is not verified, the entire block is) and a quick look at the code seems like it does have the block verification code
https://github.com/piotrnar/gocoin/blob/master/lib/chain/block_check.goAnd you can see it is verifying everything including but not limited to PoW, version, weight, transactions, etc.