Ethereum upgrade delayed over security vulnerability

Ethereum’s Constantinople upgrade, which was supposed to kick in on Thursday, Jan 16, is getting delayed. 

According to the official Ethereum blog, the delay is due to a potential security vulnerability identified by security audit company ChainSecurity on Jan. 15. 

The security bug could potentially make some smart contracts on Ethereum vulnerable to a so-called “re-entrancy attack,” enabling an attacker to steal other people’s ether. 

The bug is explained in detail in a blog post by ChainSecurity. The important bit is that, since Constantinople was delayed, no smart contracts are vulnerable at this point. In fact, a scan of Ethereum’s blockchain by ChainSecurity did not find any contracts that would be vulnerable even if the upgrade went through, but Ethereum’s developers still decided to mitigate the risk by delaying the upgrade.

“Because the risk is non-zero and the amount of time required to determine the risk with confidence is longer the amount of time available before the planned Constantinople upgrade, a decision was reached to postpone the fork out of an abundance of caution,” Ethereum developer Hudson Jameson wrote in a blog post Tuesday. 

For most end-users — i.e. owners of ether or users of dApps on the platform — there is no need to do anything following this news. Users who run nodes or mining operations should follow the instructions here. 

Constantinople was an important upgrade of Ethereum which was supposed to make the network a bit more efficient and pave the way for future upgrades, most importantly switching to a proof-of-stake consensus algorithm later this year. There’s no new date set for the Constantinople upgrade at this point. 

This is not the first time Constantinople has been delayed. The upgrade was originally scheduled to go live in November 2018, but was postponed due to bugs. 

Disclosure: The author of this text owns, or has recently owned, a number of cryptocurrencies, including BTC and ETH.