1/ The GoEthereum 1.10.8 "hot fix" patch just went out. This is a critical patch, seems like it is an EVM level exploit, so it affects the whole #Ethereum network.
What's the bug? This is the question of many billion dollars.
Keep reading
👇👇👇
What's the bug? This is the question of many billion dollars.
Keep reading
👇👇👇
2/ The bug was originally discovered during Telos EVM, an EVM as-a-smart contract implementation on the to of EOS, audit.
Never heard of Telos? It's your VC free grass root effort, based on the EOS codebase.
docs.telos.net/evm/comparing-…
Never heard of Telos? It's your VC free grass root effort, based on the EOS codebase.
docs.telos.net/evm/comparing-…
3/ The Telos press release itself here, see tweet from @Douglas_Horn, one of the leading Telos people:
https://twitter.com/Douglas_Horn/status/1430225342124355585
4/ The issue was found during fuzzing of Telos EVM implementation. Telos is slow to move, takes the security seriously.
The work was contracted to @sentnl_io and the issue was found by @GuidoVranken
The work was contracted to @sentnl_io and the issue was found by @GuidoVranken
5/ The @go_ethereum team has been unusually tight lipped about the security hot fix. It means everybody needs to update to keep Ethereum network secure. So unless you are geth insider developer, others are just speculating about the issue this point.
6/ But the new version with the source code is out now, so it should be just matter of hours until the black hats diff the source code, find the done code changes and start preparing their attack payloads.
7/ Because this was well announced beforehand, I am not worried about #Ethereum mainnet. Updates are rolling out steadily.
But the problem is that @go_ethereum has been forked left and right by semi co-operative and non-coperative teams.
But the problem is that @go_ethereum has been forked left and right by semi co-operative and non-coperative teams.
8/ Geth fork users include
@0xPolygon (good reputation)
@Binance Smart Chain (haha reputation)
@avalancheavax
And I assume Arbitrum and Optimism also run modified geth.
etc. etc.
@0xPolygon (good reputation)
@Binance Smart Chain (haha reputation)
@avalancheavax
And I assume Arbitrum and Optimism also run modified geth.
etc. etc.
9/ Some of these teams are not known not to have have a professional relationship with the upstream geth team, are unlikely to be priviledged for the patch content.
They are bad open source citizens.
They are bad open source citizens.
10/ Also geth team has zero incentives to let others know what the bug is, because if you are not a nice fork, the upstream project does not need to be nice either. Tit for a tat. Do your own security dammit.
11/ Now for the juicey part
👇👇👇
It sounds like the hotfixed @go_ethereum issue will affect the every geth fork out there, though I have no confirmation for this yet.
Based on @hellotelos press release, it sounds like an issue with the EVM itself.
👇👇👇
It sounds like the hotfixed @go_ethereum issue will affect the every geth fork out there, though I have no confirmation for this yet.
Based on @hellotelos press release, it sounds like an issue with the EVM itself.
12/ GoEthereum updates are rolling out nicely. But let's see how e.g. Binance Smart Chain people will get an update out, in timely and professional fashion.
13/ If the bug can be exploited on forked geth chains, then #Ethereum clones are going to have a nice exciting week ahead.
In a bad hair day sense.
In a bad hair day sense.
14/ That's is all this time. I updated my geth. Looking forward to see patches for Polygon and BSC.
But meanwhile, I am going to buy some popcorn. Might have good fire to make them pop.
But meanwhile, I am going to buy some popcorn. Might have good fire to make them pop.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
