The creation of a new type of smart contract intended to be made a part of Ethereum’s codebase in its Imminent Constantinople hard fork upgrade has become a source of concern for a lot of Ethereum (ETH) developers regarding its potential security vulnerability.
Vitalik Buterin, the co-founder of Ethereum, responding to the concerns on February 15 during a developers meeting, made it clear that the planned codebase modifications will not make the Ethereum blockchain vulnerable. Other Ethereum developers believe that the “Skinny CREATE2” feature will pose a security threat to the network.
With the “Skinny CREATE2,” users can interact with a smart contract that is yet to be issued on the Ethereum blockchain. According to the Ethereum developers, “Skinny CREATE2” allows interactions with “addresses that do not exist yet on-chain but can be relied on to only possibly eventually contain code.”
More Concerns From An Independent Blockchain Researcher
An independent researcher on cybersecurity and Ethereum by name Rajeev Gopalakrishna has expressed worry about the potential negative security implications the CREATE2 might have on the Ethereum network. The computer science PhD holder further explained that in some instances, the use of CREATE2 might give an attacker the opportunity to replace a previously non-threatening smart contract with a malicious one.
Earlier this month, Gopalakrishna asked the following questions:
“Doesn’t this change a major invariant assumed by users today and introduce a potentially serious attack vector with CREATE2? Doesn’t this mean that any contract post-Constantinople with a selfdestruct [function call] is now more suspect than before?”
Attacks Might Originate From Non-Deterministic Init Codes
Jeff Coleman, an Ethereum developer, went ahead to respond to the questions:
“One of the things that is counter-intuitive about CREATE2 is that theoretically redeployments can change the contract byte code, because the address is only a commitment to the init code. People need to be aware that init codes are part of auditing, […] that non-deterministic init codes are a problem.”
According to Noel Maersk, a blockchain developer, the self-destruct function may have zero negative security implications. Maersk also claimed that the addition of non-deterministic code to smart contracts distributed on a blockchain enabled with CREATE2 might introduce attack vectors.
Ethereum co-founder, Vitalik Buterin, also spoke about the implications of CREATE2 as well as Ethereum’s long-term goals:
“The one thing we need to keep in mind is more for the future, when thinking about rents and deletion; that’s a way that can lead to contracts being in a state to being not in a state without a self-destruct operation … It’s not something we need to figure out in the next few weeks, but it’s still useful to keep in mind when getting the ETH 2.0 sharding to a VM (virtual machine) spec very soon.”