Author: Michael Johnson

Affected configurations: cpp-ethereum (eth, AlethZero, …) version 1.2.0 up to 1.2.5 (fixed in 1.2.6) Note: Neither “geth” nor “Mist” nor the “Ethereum Wallet” (unless explicitly used together with cpp-ethereum) are affected by this, they lock accounts correctly again.Severity: HighPossible Attacks:</stro… Source link

The Ethereum Virtual machine is kind of different than most other Virtual Machines out there. In my previous post I already explained how it’s used and described some of its characteristics. The Ethereum Virtual Machine (EVM) is a simple but powerful, Turing complete 256bit Virtual Machine that allows anyone to execute arbitrary EVM Byte Code. The go-ethereum project contains two implementations of the EVM. A simple and straightforward byte-code VM and a more sophisticated JIT-VM. In this post I’m going to explain some of the differences between the two implementations and describe some of the characteristics of the JIT EVM and why it can be so…

Affected configurations: cpp-ethereum (eth, AlethZero, …) version 1.2.0 up to 1.2.6 Note: Neither “geth” nor “Mist” nor the “Ethereum Wallet” (unless explicitly used together with cpp-ethereum) are affected by this, they lock accounts correctly again. This is just a quick head’s up that cpp-ethereum’s security issue around account security is not yet properly fixed. The fix that is part of cpp-ethereum version 1.2.6 did not decrease the security, but it also did not fix the bug completely. We will work towards another bugfix release and announce it once the fix is properly verified. A fix is now available: Release 1.2.7…

Solidity was started in October 2014 when neither the Ethereum network nor the virtual machine had any real-world testing, the gas costs at that time were even drastically different from what they are now. Furthermore, some of the early design decisions were taken over from Serpent. During the last couple of months, examples and patterns that were initially considered best-practice were exposed to reality and some of them actually turned out to be anti-patterns. Due to that, we recently updated some of the Solidity documentation, but as most people probably do not follow the stream of github commits to that…

London, United Kingdom, June 14, 2016 – The Ethereum Foundation is pleased to announce Microsoft as the Premiere Sponsor of Devcon2, the Ethereum developer conference in Shanghai, 19-21 September, 2016. Devcon2, which will showcase the most up-to-date research and development work supported by the Foundation, also represents the most comprehensive Ethereum-focused developer’s conference to date. The Ethereum Foundation’s Chief Scientist, Vitalik Buterin, notes that “We are very happy to have Microsoft’s sponsorship for Devcon2 and highly appreciate their continued support and collaboration with the Ethereum Foundation and the Ethereum ecosystem. We look forward to continuing to work together in the…

An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction. The leaked ether is in a child DAO at https://etherchain.org/account/0x304a554a310c7e546dfe434669c62820b7d83490; even if no action is taken, the attacker will not be able to withdraw any ether at least for another ~27 days (the creation window for…

Over the last day with the community’s help we have crowdsourced a list of all of the major bugs with smart contracts on Ethereum so far, including both the DAO as well as various smaller 100-10000 ETH thefts and losses in games and token contracts. This list (original source here) is as follows: We can categorize the list by categories of bugs: Variable/function naming mixups: FirePonzi, RubixiPublic data that should not have been public: the public RNG seed casino, cheatable RPSRe-entrancy (A calling B calling A): the DAO, Maker’s ETH-backed tokenSends failing due to 2300 gas limit: King of the EtherArrays/loops and…

Affected configurations: All smart contract wallets created using Ethereum Wallet  Frontier, version 0.4.0 (Beta 7) or earlier. Wallets created with Ethereum Wallet 0.5.0 and all later versions released after March 3, 2016, are not affected. Likelihood: Low Severity: High Summary: Do not use wallet contracts or owner accounts of those wallets that were created by the Ethereum Wallet 0.4.0 or earlier. If you send to (or interact with) a malicious contract it could take ownership of your wallet contract. Create a new wallet and move your funds. How to be super safe?? Don’t use the vulnerable wallet contracts, AND the owner accounts…

The last week was quite hectic for all of us in the Ethereum ecosystem. The DAO has shown us that it takes much more effort to write smart contracts than we originally anticipated; but also that it takes a surprising amount of debate to reach a consensus on issues of this scale. Everybody in our community was very vocal and forthcoming about how the problem should be fixed in his/her opinion, or whether there’s even a problem to fix in the first place. While many have suggested an immediate hard-fork, the implications of such action are yet to be fully understood. An alternative…

Affected configurations: geth 1.4.8 Likelihood: High Severity: High Details: An attack vector has been identified in the freshly released implementation of the DAO soft fork. The fork enactment code in geth (and other clients) allows execution of EVM code up to the block gas limit without paying for gas. This can slow down mining and prevent inclusion of legitimate transactions. The soft fork will not be enabled if the gas limit of block 1800000 is above 4000000 gas (i.e. if the community vote to activate the fork fails). The attack cannot be performed in this case. Effects on expected chain reorganisation depth: None Proposed temporary…