Ethereum’s long-anticipated Ethereum Constantinople upgrade has just been delayed after a critical vulnerability was discovered in one of the planned changes.
Smart contract audit firm
Discussing the vulnerability online, the project’s core developers reached the conclusion that it would take too long to fix the bug prior to the hard fork, which was expected to execute at around 04:00 UTC on Jan. 17.
A new fork date will be decided during another ethereum dev call on Friday by Ethereum creator Vitalik Buterin, developers Hudson Jameson, Nick Johnson, Evan Van Ness, and Parity release manager Afri Schoedon, among others.
The possible vulnerability
Called a reentrancy attack, the vulnerability essentially allows an attacker to “reenter” the same function multiple times without updating the user about the state of affairs. Under this scenario, an attacker could essentially be “withdrawing funds forever,” said Joanes Espanol, CTO of blockchain analytics firm Amberdata.
“Imagine that my contract has a function which makes a call to another contract… If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds.”Joanes Espanol
This is similar to one of the vulnerabilities found in the now-infamous DAO attack of 2016.
ChainSecurity’s post explained that prior to Constantinople, storage operations on the network would cost 5,000 gas, exceeding the 2,300 gas usually sent when calling a contract using “transfer” or “send” functions.
However, if the upgrade was implemented, “dirty” storage operations would cost 200 gas. An “attacker contract can use the 2300 gas stipend to manipulate the vulnerable contract’s variable successfully.”
Enthereum Constantinople was previously expected to activate last year, but was delayed after issues were found while launching the upgrades on the Ropsten testnet.
Ethereum Clients Release New Software
Major Ethereum clients, Go-Ethereum (Geth) and Parity, have released software updates following an earlier decision to delay the planned system-wide upgrade dubbed Constantinople.
Geth released an emergency hotfix (version 1.8.21) designed to delay the upgrade, though developer Péter Szilágyi noted that users who do not wish to upgrade to the new version of the client can also downgrade their existing clients to version 1.8.19 or continue running the current version (1.8.20) with an override.
Parity clients can similarly either upgrade their existing clients to 2.2.7 (the stable release) or 2.3.0 (a beta release) or otherwise downgrade to 2.2.4 (beta).
Parity Technologies head of security Kirill Pimenov, speaking in an
“I want to restate — downgrading Parity to pre-Constantinople versions is a bad idea, we don’t recommend that to anyone. Theoretically, it should even work, but we don’t want to deal with that mess.”