The Constantinople hard fork on the Ethereum network is being postponed. The decision to postpone the hard fork was made by the Ethereum developers because of a critical vulnerability found in one of the upcoming upgrades. As the publication CoinDesk reports, the vulnerability was discovered in EIP 1283, which is intended to improve the pricing system when assessing data changes. Thanks to this vulnerability, identified by the audit company ChainSecurity, hackers could steal funds from user accounts.
Thus, during yesterday's video conference about the vulnerability, in which network creator Vitalik Buterin, developers Hudson Jameson, Nick Johnson and Evan Van Ness, as well as Parity release manager Afri Schoedon took part, it was decided to postpone the hard fork's activation date for some time. All the experts agreed that it would not be possible to fix the error by the appointed deadline (around 7:00 Moscow time on January 17).
The vulnerability, named the "reentrancy attack", would in essence have allowed an attacker to repeatedly enter the same function and withdraw funds from a user's account indefinitely. As Joan Espanyol, the technical director of the analytics company Amberdata, explained, the essence of this bug is that a contract, as it were, gains the function of calling another contract. Therefore a hacker can activate this function while the previous one is being executed, gaining the ability to withdraw funds. Such a scheme is similar to the vulnerability discovered in The DAO network in 2016.
It is worth noting that no Ethereum smart contracts are currently vulnerable. In fact, ChainSecurity's audit of the Ethereum blockchain did not find any contracts that would be vulnerable even if the upgrade had taken place, but the Ethereum developers nevertheless decided to reduce the risk by postponing the Ethereum Constantinople Hard Fork upgrade, which was supposed to begin on Thursday – January 16.
The new date for the hard fork is to be announced on January 18.
