Hours after Ethereum developers declaring the Constantinople upgrade to be an “uneventful even”, smart contract auditing firm ChainSecurity discovers a security vulnerability on the blockchain, According to the firm, it is susceptible to reentrancy attack.

Thanks to @chain_security for discovering the vulnerability in Constantinople before the upgrade went live.

If you're running a node, new Parity and Geth clients that contain a hotfix will be released shortly.

Discussions about a new upgrade date will be had on Friday.

— Anthony Sassano (@sassal0x) January 15, 2019

It is an attack that would allow a hacker to take over the control flow of Ethereum smart contract transactions and make changes to the data. The name reentrancy comes from the ability to repeatedly rerun the same transaction allowing for an attack to constantly withdraw funds until the wallet of the victim is run dry.

Joanes Espanol, chief technology officer of blockchain analytics firm Amberdata said:

“An attacker could essentially be ‘withdrawing funds forever.’ Imagine that my contract has a function which makes a call to another contract…. If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds.”

ChainSecurity says that before Constantinople storage operations on the network would cost 5,000 gas which is more than the 2,300 gas usually sent when calling a contract using “transfer” or “send” functions. After the hard fork, the same would be 200 gas. They say:

“An attacker contract can use the 2300 gas stipend to manipulate the vulnerable contract’s variable successfully.”

Ethereum founder Vitalik Buterin had a few words to say about the issue. On a Reddit post he said:

“All of the really nasty security issues that we had have been around the interactions between different components. The quadratic DoS attacks combined EVM memory and the call stack frame or reverts and the call stack frame, this potential threat arose because of interactions between the default gas in send, SSTORE gas costs and re-entrancy issues. So if you have N protocol features, there are N2 ways they could potentially break. I would say my personal takeaway from this is to be much more explicit about writing down invariants (properties guaranteed by the protocol) that we rely on so we can check against them when changing things.”

The jury is still out on when the developers will be ready for an upgrade. Although these events have led to the downturn in the price of ETH dropping by 6% since the release of the blog. Analysts say that the entire crypto ecosystem has been pushed to a short term bearish sentiments as a result of this.

Similar to Notcoin - TapSwap on Solana Airdrops In 2024

origin »

174 +