Categories: Ethereum

Buterin-Proposed Constantinople Ethereum Feature Allegedly Introduces Attack Vector

Click here to view original web page at cointelegraph.com

Ethereum (ETH) co-founder Vitalik Buterin has proposed a new smart contract creation function dubbed “Create2.” This function reportedly introduces a new attack vector to the platform, according to a post on the Ethereum developers forum Ethereum Magicians published on Feb. 8.

According to a Medium post by software developer Tim Cotten, the original create function creates a new contract at an address that is calculated (through a hash function) with the creator’s address and a random number (nonce) associated with it. Create2, on the other hand, reportedly does the same, but with the difference that the contract is created at an address that can be determined beforehand by different parties.

In the GitHub page dedicated to this Ethereum Improvement Proposal (EIP), EIP-1014, the motivation for the new function is described as the ability to permit an interaction with a contract that does not exist on the blockchain yet.

More specifically, this EIP would allow for interactions “with addresses that do not exist on-chain yet but can be relied on to only possibly eventually contain code.” This EIP has been approved and is scheduled for mainnet deployment in the upcoming Constantinople hard fork, according to a ConsenSys blog post.

However, chief scientist at blockchain startup Indorse Rajeev Gopalakrishna has suggested that the Create2 implementation in Ethereum could have negative security implications for the platform. According to him, Create2 implies that smart contracts will be able to change their address after being deployed.

Gopalakrishna said that in some circumstances using this function, it is possible to replace a previously benign smart contract with a potentially malicious one. Jason Carver, senior staff engineer at the Ethereum Foundation, explained that he thinks that it will be possible to use Create2 to replace a self-destructed contract with a new one.

Gopalakrishna also pointed out:

“Doesn’t this change a major invariant assumed by users today and introduce a potentially serious attack vector with CREATE2 ? Doesn’t this mean that any contract post-Constantinople with a selfdestruct [function in its code] is now more suspect than before?”

Still, software developer Noel Maersk specified that the self-destruction function in and of itself isn’t suspect. According to him, what should be seen as suspect in contracts on a Create2-enabled blockchain is non-deterministic init code, since it renders foreseeing what code the newly generated contract would contain.

This way, a malicious contract could get hold of the pre-approved interactions with the address which could let the attacker, for instance, steal some tokens. Furthermore, Carver also points out that “it looks like a lot of contract devs aren’t aware that (new) contracts will be able to change in-place after” the implementation of this update.

As Cointelegraph recently reported, Ethereum (ETH) core developers have delayed the decision to implement application-specific integrated circuit (ASIC)-resistant proof-of-work (PoW) algorithm ProgPoW until a third party will have audited the algorithm.

Other than implementing Create2, the upcoming Constantinople hard fork is also meant to delay the so-called “difficulty bomb” and feature the so-called “thirdening”: a reduction of the reward for every miner block from 3 to 2 ETH.

cinerama

Illuminati, Mason, Anonymous I'll never tell. I can tell you this, global power is shifting and those who have the new intelligence are working to acquire this new force. You matter naught except to yourself, therefore prepare for the least expected and make your place in the new world order.

Disqus Comments Loading...
Share
Published by
cinerama

Recent Posts

Bitcoin Is Up Against An Extremely Important And Powerful Resistance Zone On The Monthly Chart: The Kijun-Sen (Base Line)

We can identify the price action causes of why price is finding it difficult to move higher by analyzing longer… Read More

41 mins ago

BTC ATM goes missing and no one notices

When you think of thieves stealing an ATM, the mind jumps to the idea of an exciting crime. Maybe there’s… Read More

41 mins ago

Major Swedish Bank Orders Negative Interest Rate on Euro Deposits

Sub-zero interest rates have become the norm in some countries, especially in Europe. Nordic nations such as Sweden and Denmark… Read More

41 mins ago

Researchers Concur Current Bitcoin Market Cycle is Only Just Beginning

Bitcoin price cycles can be influenced by a number of factors, FOMO and public sentiment is one, and mining profitability… Read More

41 mins ago

Hopes for Bitcoin as China’s Renminbi Drops to 11-Year Low

A recent plunge in the bitcoin price is looking to negate some of its losses as China’s currency weakens to… Read More

41 mins ago

Why Bitcoin Rules in the ‘Insane’ World of Negative Interest Rates

Central banks around the world are on a negative rate binge to further a compelling case for bitcoin.. | Source:… Read More

42 mins ago

This website uses cookies. We use these cookies to collect data about your interaction with our website for the purpose of continuously improving your experience with our site. For more information we encourage you to read our privacy policy.

Read More