Ethereum's Constantinople Upgrade Faces Delay Due to Security Vulnerability

Ethereum's major Constantinople upgrade was delayed after blockchain audit firm ChainSecurity discovered a security issue with one of the changes.

Jan 15, 2019 at 8:19 p.m. UTC
Updated Sep 13, 2021 at 8:48 a.m. UTC

Ethereum’s long-anticipated Constantinople upgrade has just been delayed after a critical vulnerability was discovered in one of the planned changes.

Smart contract audit firm ChainSecurity flagged Tuesday that Ethereum Improvement Proposal (EIP) 1283, if implemented, could provide attackers a loophole in the code to steal user funds. Speaking on a call, ethereum developers, as well as developers of clients and other projects running the network, agreed to delay the hard fork – at least temporarily – while they assessed the issue.

Participants included ethereum creator Vitalik Buterin, developers Hudson Jameson, Nick Johnson and Evan Van Ness, and Parity release manager Afri Schoedon, among others. A new fork date will be decided during another ethereum dev call on Friday.

Discussing the vulnerability online, the project's core developers reached the conclusion that it would take too long to fix the bug prior to the hard fork, which was expected to execute at around 04:00 UTC on Jan. 17.

Called a reentrancy attack, the vulnerability essentially allows an attacker to "reenter" the same function multiple times without updating the user about the state of affairs. Under this scenario, an attacker could essentially be “withdrawing funds forever,” said Joanes Espanol, CTO of blockchain analytics firm Amberdata in a previous interview with CoinDesk.

He explained:

"Imagine that my contract has a function which makes a call to another contract… If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds."

to one of the vulnerabilities found in the now-infamous DAO attack of 2016.

ChainSecurity's post explained that prior to Constantinople, storage operations on the network would cost 5,000 gas, exceeding the 2,300 gas usually sent when calling a contract using "transfer" or "send" functions.

However, if the upgrade was implemented, "dirty" storage operations would cost 200 gas. An "attacker contract can use the 2300 gas stipend to manipulate the vulnerable contract’s variable successfully."

Constantinople was previously expected to activate last year, but was delayed after issues were found while launching the upgrades on the Ropsten testnet.

Ethereum image via Shutterstock

The Festival for the Decentralized World
Thursday - Sunday, June 9-12, 2022
Austin, Texas
Save a Seat Now

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Trending

1
CoinDesk - Unknown
Circle Asks US Fed Not to Step on Its Toes by Launching a Digital Dollar

The public is already served well by private-sector tokens, the USDC stablecoin issuer said in a comment letter to the central bank.

The public is already served well by private-sector tokens, the USDC stablecoin issuer said in a comment letter to the central bank.

CoinDesk - Unknown
2
CoinDesk - Unknown
Crypto News Roundup for May 25, 2022

With bitcoin seemingly unable to break above the $30,000 threshold, plus a look at the suspects in the cast of the UST collapse, CoinDesk’s "Markets Daily" is back with the latest news roundup.

With bitcoin seemingly unable to break above the $30,000 threshold, plus a look at the suspects in the cast of the UST collapse, CoinDesk’s "Markets Daily" is back with the latest news roundup.

CoinDesk - Unknown
3
CoinDesk - Unknown
ApeCoin

CoinDesk - Unknown
4
CoinDesk - Unknown
Proof-of-Work vs. Proof-of-Stake: What Is the Difference?

Proof-of-work (PoW) and proof-of-stake (PoS) are two different methods to validate cryptocurrency transactions.

Proof-of-work (PoW) and proof-of-stake (PoS) are two different methods to validate cryptocurrency transactions.

CoinDesk - Unknown