The much anticipated upgrade to Ethereum network is set to be delayed yet again to a yet to be known date due to critical vulnerabilities discovered on the to be implemented upgrade, according to Coindesk.
Smart contract audit firm ChainSecurity flagged Tuesday that Ethereum Improvement Proposal (EIP) 1283, if implemented, could provide attackers a loophole in the code to steal user funds. Speaking on a call, ethereum developers, as well as developers of clients and other projects running the network, agreed to delay the hard fork – at least temporarily – while they assessed the issue.
Participants included ethereum creator Vitalik Buterin, developers Hudson Jameson, Nick Johnson and Evan Van Ness, and Parity release manager Afri Schoedon, among others. A new fork date will be decided during another ethereum dev call on Friday.
Discussing the vulnerability online, the project’s core developers reached the conclusion that it would take too long to fix the bug prior to the hard fork, which was expected to execute at around 04:00 UTC on Jan. 17.
Called a reentrancy attack, the vulnerability essentially allows an attacker to “reenter” the same function multiple times without updating the user about the state of affairs. Under this scenario, an attacker could essentially be “withdrawing funds forever,” said Joanes Espanol, CTO of blockchain analytics firm Amberdata in a previous interview with CoinDesk.
He explained:
“Imagine that my contract has a function which makes a call to another contract… If I’m a hacker and I’m able to trigger function a while the previous function was still executing, I might be able to withdraw funds.”
