Ethereum Developers Disclose Critical Vulnerability Fixed – Bits Media

Ethereum Foundation Releases Vulnerability Information, eliminated in the Berlin hard fork. The vulnerability was discovered back in 2019 year and could lead to a stop of the Ethereum blockchain.

According to the article on the Ethereum Foundation blog, Two years ago, vulnerability was discovered, which It was a “serious threat to the Ethereum” and was eliminated after the activation of the hardform Berlin
Last month. The threat was a "well -known secret", And the developers say, that one day she was publicly disclosed by mistake. After the deployment of the hardford, Berlin Ethereum Foundation appreciated the level of threat as a rather low, which allows you to publicly disclose information about it:

"Important, so that the community has the opportunity to understand the cause of the changes, which negatively affect the experience of using the network, Including gas prices ".

In the article, developers explain, that the state of Ethereum is formed in the tree of Patricia-Merchal, Conceptually comparing new accounts in the Ethereum network with new wood leaves. With the growth of the Ethereum network since October 2016 years have increased gas costs to protect against DDOS attacks, Including the controversial proposal EIP-1884.

IN 2019 year security researchers of Ethereum Gubert Ritzdorf (Hubert Ritzdorf), Matias Egli (Matthias Egli) And Daniel Perez (Daniel Perez) Combined, to test the possibilities of vulnerability. The attack launched random search queries in a tree, which can "lead to locks in a minute range". In the report
Researchers say, that the delay caused by the attack will increase as the state of the Ethereum grows, "Which allows you to conduct effective DOS attacks on the network".

After that, as various proposals of the developers were rejected during 2020 of the year, Vitalik Buterin united with Martin Svenda (Martin banging) To create EIP-2929 and EIP-2930. These updates raised gas prices “only for tools, to which there was no access yet ", To prevent the attack. EIP was deployed as part of Berlin update 15 april 2021 of the year. According to developers, The update reduced the effectiveness of vulnerability in 50 time.

Recall, that in April, the developer of Bitcoin Core revealed
Information about vulnerability in earlier versions of a software client. The error was eliminated in the Bitcoin Core release 0.19.