The Ethereum Constantinople fork, which was set to launch on Wednesday, has been postponed after a blockchain security firm found a vulnerability that could put users funds at risk.
According to Chain Security, a code change within the network upgrade to lower the cost of gas while transacting with Ether has caused an "unwanted side effect" that would allow a hacker to conduct a "reentrancy" attack.
The upcoming Constantinople Upgrade for the ethereum network introduces cheaper gas cost for certain SSTORE operations. As an unwanted side effect, this enables reentrancy attacks when using address.transfer(...) or address.send(...) in Solidity smart contracts. Previously these functions were considered reentrancy-safe, which they aren’t any longer. - ChainSecurity via Medium
This type of attack, according to Joanes Espanol, CTO of blockchain analytics firm Amberdata, allows an attacker to “reenter” the same function multiple times without updating the user about the state of affairs. Under this scenario, an attacker could essentially be “withdrawing funds forever.”
“Imagine that my contract has a function which makes a call to another contract ... If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds," Espanol told Coin Desk.
Ethereums core developers have decided that a new release date for the Constantinople fork will be decided on Friday.
A statement from Ethereum developer Hudson Jameson reads:
The Ethereum Core Developers and the Ethereum Security Community were made aware of the potential Constantinople-related issues identified by ChainSecurity on January 15, 2019. We are investigating any potential vulnerabilities and will follow with updates in this blog post and across social media channels.
Out of an abundance of caution, key stakeholders around the Ethereum community have determined that the best course of action will be to delay the planned Constantinople fork that would have occurred at block 7,080,000 on January 16, 2019.
This will require anyone running a node (node operators, exchanges, miners, wallet services, etc…) to update to a new version of Geth or Parity before block 7,080,000. Block 7,080,000 will occur in approximately 32 hours from the time of this publishing or at approximately January 16, 8:00pm PT / January 16, 11:00pm ET / January 17, 4:00am GMT.
The delay sent the price of Ether tumbling on Tuesday ...
.jpg)