- New NFT ‘Kid On The Block’ May Overtake OpenSea - January 13, 2022
- Ethereum Is Beyond DeFi - July 23, 2021
- El Salvador Declares Bitcoin as Legal Tender. What Does This Mean? - June 23, 2021
Ethereum’s long anticipated Constantinople update has quite recently been deferred after a critical vulnerability was found in one of the arranged changes that was to be made.
Smart contract audit firm ChainSecurity flagged Tuesday that Ethereum Improvement Proposal (EIP) 1283, if implemented, could provide attackers a loophole in the code to steal user funds. Speaking on a call, ethereum developers, as well as developers of clients and other projects running the network, agreed to delay the hard fork – at least temporarily – while they assessed the issue.
Participants included ethereum creator Vitalik Buterin, developers Hudson Jameson, Nick Johnson and Evan Van Ness, and Parity release manager Afri Schoedon, among others. A new fork date will be decided during another ethereum dev call on Friday.
Further Discussion
Discussing the vulnerability online, the project’s core developers reached the conclusion that it would take too long to fix the bug prior to the hard fork, which was expected to execute at around 04:00 UTC on Jan. 17.
Called a reentrancy attack, the vulnerability essentially allows an attacker to “reenter” the same function multiple times without updating the user about the state of affairs. Under this scenario, an attacker could essentially be “withdrawing funds forever,” said Joanes Espanol, CTO of blockchain analytics firm Amberdata in a previous interview with CoinDesk.
He explained:
“Imagine that my contract has a function which makes a call to another contract… If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds.”
This is similar to one of the vulnerabilities found in the now-infamous DAO attack of 2016.
ChainSecurity’s post explained that prior to Constantinople, storage operations on the network would cost 5,000 gas, exceeding the 2,300 gas usually sent when calling a contract using “transfer” or “send” functions.
However, if the upgrade was implemented, “dirty” storage operations would cost 200 gas. An “attacker contract can use the 2300 gas stipend to manipulate the vulnerable contract’s variable successfully.”
Constantinople was previously expected to activate last year, but was delayed after issues were found while launching the upgrades on the Ropsten testnet.
What’s your take on the new Constantinople update? Share your thoughts below.
While the blockchains themselves are secure, the applications running on the blockchain may not be. These applications interact with the blockchain through smart contracts, but just like any other software, bugs in the code can lead to security vulnerabilities. For this, we need to involve the auditors who conduct security audits on the smart contract. Smart Contract Audit helps you find hidden exploits and eventually reduce the risk and provides you an extra layer of security. Bug-free code is nice to have in other types of software, in blockchain applications, it is essential.