Network

Security Alert: Ethereum Constantinople Postponement

Infura

Jan 15, 2019 • 3 min read

** Infura will support the Constantinople Postponement and is actively working on updating its infrastructure to adjust to this new release. Read more about the Constantinople delay below or stay updated via twitter at @infura_io. **

UPDATE [Jan 16]: “We’ve been coordinating with others in the community over the last 24 hrs and we have completed updating our infrastructure to support delaying the Constantinople network upgrade.”

The Ethereum Core Developers and the Ethereum Security Community were made aware of the potential Constantinople-related issues identified by ChainSecurity on January 15, 2019. We are investigating any potential vulnerabilities and will follow with updates in this blog post and across social media channels.

Out of an abundance of caution, key stakeholders around the Ethereum community have determined that the best course of action will be to delay the planned Constantinople fork that would have occurred at block 7,080,000 on January 16, 2019.

This will require anyone running a node (node operators, exchanges, miners, wallet services, etc…) to update to a new version of Geth or Parity before block 7,080,000. Block 7,080,000 will occur in approximately 32 hours from the time of this publishing or at approximately January 16, 8:00pm PT / January 16, 11:00pm ET / January 17, 4:00am GMT.

What You Need To Do

If you are a person who simply interacts with Ethereum (you do not run a node), you do not need to do anything.

Miners, Exchanges, Node Operators:

Update your Geth and/or Parity instances when they are released.
These releases are not released yet. We will update this post when they are available.
Links and version numbers and instructions will be provided here when they are available.
We expect to have updated releases in 3–4 hours from the time this blog is published.

Geth

Upgrade to 1.8.21 , OR
Downgrade to Geth 1.8.19, OR
Remain on 1.8.20, but use the switch ‘–override.constantinople=9999999’ to postpone the Constantinople fork indefinitely.

Parity

Upgrade to Parity Ethereum 2.2.7-stable (recommended)
Upgrade to Parity Ethereum 2.3.0-beta
Downgrade to Parity Ethereum 2.2.4-beta (not recommended)

Everyone Else:

Ledger, Trezor, Safe-T, Parity Signer, WallEth, Paper Wallets, MyCrypto, MyEtherWallet and other users or token holders that do not participate in the network by syncing and running a node.

You do not have to do anything.

Contract owners

You do not have to do anything.
You may choose to examine the analysis of the potential vulnerability and check your contracts.
However, you do not have to do anything as the change that would introduce this potential vulnerability will not be enabled.

How was the decision to postpone the Constantinople fork was made

Security researchers like ChainSecurity and TrailOfBits ran (and are still running) analysis across the entire blockchain. They did not find any cases of this vulnerability in the wild. However, there is still a non-zero risk that some contracts could be affected.

Because the risk is non-zero and the amount of time required to determine the risk with confidence is longer the amount of time available before the planned Constantinople upgrade, a decision was reached to postpone the fork out of an abundance of caution.

This article was put together in a collaborative effort by EvanVanNess, Infura, MyCrypto, Parity, Status, The Ethereum Foundation, and the Ethereum Cat Herders.

For the full text and latest Geth/Parity versions, please read the Ethereum Foundation’s blog post here: https://blog.ethereum.org/2019/01/15/security-alert-ethereum-constantinople-postponement/