On Slow and Fast Block Times

One of the largest sources of confusion in the question of blockchain security is the precise effect of the block time. If one blockchain has a block time of 10 minutes, and the other has an estimated block time of 17 seconds, then what exactly does that mean? What is the equivalent of six confirmations on the 10-minute blockchain on the 17-second blockchain? Is blockchain security simply a matter of time, is it a matter of blocks, or a combination... [Read More]

Security Alert – [Previous security patch can lead to invalid state root on Go clients with a specific transaction sequence – Fixed. Please update.]

  Summary: Implementation bug in the go client may lead to invalid state Affected client versions: Latest (unpatched) versions of Go client; v1.1.2, v1.0.4 tags and develop, master branches before September 9. Likelihood: Low Severity: High Impact: High Details: Go ethereum client does not correctly restore state of execution environment when a transaction goes out-of-gas if - within the same block - a contract was suicided. This would result in an invalid copy operation of the state object; flagging the... [Read More]

A message from Stephan Tual

To the wonderful Ethereum Community, You often heard me say at conferences that Ethereum was not a company, a foundation, an implementation, or an individual. Ethereum is both an idea and an ideal, encompassing the first censorship-resistant network build specifically to enable those who need it the most to safely trade, privately self-organise and freely communicate, rather than relying on the crippled walled garden handed out by the powers that be. Due to divergence in personal values, Eth/Dev and I... [Read More]

Security Alert – [Implementation bug in Go clients causing increase in difficulty – Fixed – Miners check and update Go clients]

Implementation bug in the go client leads to steady increase of difficulty independent of hashing power. Affected configurations: All Go client versions v1.0.x, v1.1.x, release and develop branches. The bug was introduced in a recent update and release through commit https://github.com/ethereum/go-ethereum/commit/7324176f702a77fc331bf16a968d2eb4bccce021 which went into the affected client versions. All miners running earlier mentioned versions are affected and are advised to update as soon as possible. Likelihood: High Severity: Medium Impact: Increase in block time will lead to an exponential increase... [Read More]

Security Advisory [Implementation bugs in Go and Python clients can cause DoS – Fixed – Please update clients]

State transition and consensus issue in geth client causes panic (crash) when processing a (valid) block with a specific combination of transactions, which may cause overall network instability if block is accepted and relayed by unaffected clients thus causing a DoS. This may happen in a block that contains transactions which suicide to the block reward address. Affected configurations: Issue reported for Geth.While investigating the issue, related issues were discovered and corrected in pyethereum, hence pyethapp is also affected. C++... [Read More]

devcon one postponed until further notice

Unfortunately we were not able to secure the venue for devcon one in London on the dates desired (October 5th-8th). As a consequence we are postponing the event until further notice.  Please do not make travel plans at this time. Updates will be forthcoming on the devcon one website . Please standby for further information.

Security Advisory [Insecurely configured geth can make funds remotely accessible]

Insecurely configured Ethereum clients with no firewall and unlocked accounts can lead to funds being accessed remotely by attackers. Affected configurations: Issue reported for Geth, though all implementations incl. C++ and Python can in principle display this behavior if used insecurely; only for nodes which leave the JSON-RPC port open to an attacker (this precludes most nodes on internal networks behind NAT), bind the interface to a public IP, and simultaneously leave accounts unlocked at startup. Likelihood: Low Severity: High... [Read More]

On Anti-Pre-Revelation Games

An increasing number of proposed applications on top of Ethereum rely on some kind of incentivized, multi-party data provision - whether voting, random number collection, or other use cases where getting information from multiple parties to increase decentralization is highly desirable, but also where there is a strong risk of collusion. A RANDAO can certainly provide random numbers with much higher cryptoeconomic security than simple block hashes - and certainly better than deterministic algorithms with publicly knowable seeds, but it... [Read More]

Olympic Rewards Announced

ETH DEV would like to thank everyone for their participation in the Olympic test network, which helped us greatly in stress testing, optimization, and finding bugs in the Ethereum clients, as well as determining what the limits of the current Ethereum system are. To that end, we are pleased to announce the Olympic reward recipients. On top of the rewards announced below, every miner who mined a block in the Olympic chain with block number in the range [310000, 589999]... [Read More]

Security alert [consensus issue]

This alert is related to a consensus issue that occurred on the Frontier network at block 116,522, mined on 2015-08-20 at 14:59:16+02:00 – Issue has been fixed, see “Fix” below. Impact: High Issue description: State database consensus issue in geth with deletion of account data, which could happen during SUICIDE instructions. Affected implementations: All geth implementations up to and including versions 1.0.1, 1.1.0 and develop (“unstable 1.1.0”) were affected. Eth (C++) and pyethereum (Python) are unaffected. Effects on expected chain reorganisation depth:... [Read More]