On December 16, we were made aware that someone had recently gained unauthorized access to a database from forum.ethereum.org. We immediately launched a thorough investigation to determine the origin, nature, and scope of this incident. He…
With the long awaited geth 1.5 ("let there bee light") release, Swarm made it into the official go-ethereum release as an experimental feature. The current version of the code is POC 0.2 RC5 -- "embrace your daemons" (roadmap), which is th…
This chapter describes the game theory and economic security modelling we were doing in the Fall of 2014. It recounts how the "bribing attacker model" led our research directly to a radical solution to the long range attack problem....
Vitalik suggested last week that I share my basic research and design philosophy in a blog post, I agreed but complained that it was still changing. My friend Jon West told me that everyone would really appreciate it if I told everyone abo…
The possibilities of zkSNARKs are impressive, you can verify the correctness of computations without having to execute them and you will not even learn what was executed - just that it was done correctly. Unfortunately, most explanations o…
This week marks the completion of our fourth hard fork, Spurious Dragon, and the subsequent state clearing process, the final steps in the two-hard-fork solution to the recent Ethereum denial of service attacks that slowed down the network…
Security Alert Affected configurations: Geth Severity: High Summary: An issue has been identified with Geth's journaling mechanism. This caused a network fork at block #2686351 (Nov-24-2016 14:12:07 UTC). The...
The Ethereum network will be undergoing a hard fork at block number 2,675,000, which will likely occur between 15:00 and 16:00 UTC on Tuesday, November 22, 2016. A countdown timer can be seen at https://fork.codetract.io/. The Morden test…
The Go Ethereum team is very proud to finally release Geth 1.5, which can almost be called a complete internal rewrite of the Go Ethereum (go-ethereum) codebase. We've packed a huge number of changes into this release, and simply listing t…
This blog post provides an update on our findings following the discovery of the storage corruption bug last week. In summary, the bug was much less severe than we initially thought. The small number of affected contracts we found is eithe…
Summary: In some situations, variables can overwrite other variables in storage. Affected Solidity compiler versions: 0.1.6 to 0.4.3 (including 0.4.4 pre-release versions) Detailed description: Storage variables that are smaller than 256 b…
One of the important indicators of how much load the Ethereum blockchain can safely handle is how the uncle rate responds to the gas usage of a transaction. In all blockchains of the Satoshian proof-of-work variety, any block that is publi…
Overview Introduction Aims Serialisation costs Rationale Future reductions Block validation costs Risk of introducing bugs Avoidance Mitigation Risks related to complexity and technical debt Avoidance Mitigation Risks related to soft-fork…
Mist leaks some low level APIs, which Dapps could use to gain access to the computer's file system and read/delete files. This would only affect you if you navigate to an untrusted Dapp that knows about these vulnerabilities and specifical…
Overview Detailed segwit benefits 1. Elimination of unwanted transaction malleability 2. Capacity increase 3. Weighting data based on how it affects node performance 4. Signature covers value 5. Linear scaling of sighash operations 6. Incr…
Overview Miners Upgrading Not upgrading Full node users Upgrading Not upgrading Wallet users Upgrading Not upgrading Bitcoin software developers Almost two years of iterative design, development, and testing has gone into the version of se…
The Ethereum network will be undergoing a hard fork at block number 2463000, which will likely occur between 12:00 and 13:00 UTC on Tuesday, October 18, 2016. A countdown timer can be seen at https://fork.codetract.io/....
During the last couple of weeks, the Ethereum network has been the target of a sustained attack. The attacker(s) have been very crafty in locating vulnerabilities in the client implementations as well as the protocol specification. While t…
Today the network was attacked by a transaction spam attack that repeatedly called the EXTCODESIZE opcode (see trace sample here), thereby creating blocks that take up to 20-60 seconds to validate due to the 50,000 disk fetches needed to p…