가입 후 초대 링크를 공유하면 동영상 재생 및 초대 보상을 받을 수 있습니다.

Toni Wahrstätter ⟠
@nero_eth
serving ethereum at @ethereumfndn
가입 December 2021
643 팔로잉 중    10.1K 팬
Last week, core devs had to delay forking the Hoodi testnet to Glamsterdam to study a report by @chain_security which revealed some problems with how EIP-8037 interacts with a few contracts. Over the weekend, ppl tried to get a better picture of the impact and by now it's quite well understood. So here's what you need to know: What's been known is that contracts which hardcode forwarded gas are affected by repricings, e.g. making state writes (SSTORE) more expensive. What's new is that some coding patterns rely on specific invariant which were broken with EIP-8037. Gas already spent can come back mid-tx, so gasleft() can go up. This causes two problems: (1) a before / after gas counter underflows and reverts (2) a failed sub-call hands gas back, so a path that should've been unreachable runs, and the tx looks like it succeeded Related but different: (3) measuring the gas usage of a call using GAS - before and after the call - might undercount because the state gas reservoir is not visible during execution (e.g. gas_left). It's now about deciding how to proceed. Delaying hoodi bought time but won't resolve the issue. This week, we have to dig deep into contracts and make sure nothing is missed. Eventually, this might just need some coordination among the involved parties (dapps, core devs, auditors, people running nodes, etc.), or worst-case, spec changes. If you're an app dev or auditor, check your contracts for issues with EIP-8037/EIP-8038, and report them. Also, share this with your favorite app dev to spread awareness.
더 보기
⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: We already found 13 real-world examples and are in responsible disclosure with the affected projects. Please check your contracts as soon as possible, as the EF is determining how many contracts are impacted in which way. Feel free to reach out to us with questions via glamsterdam@chainsecurity.com.
더 보기