Warning: There’s a threat of relay assaults on particular person customers’ wallets if the ETHPoW ChainID will not be up to date as deliberate. Such assaults will trigger customers to lose $ETH equal to the ETHPoW offered.
Latest considerations over The Merge have been exacerbated after discovering that the Ethereum proof-of-work chain had not up to date its ChainID to a singular quantity. The group behind ETHPoW up to date its GitHub on Friday morning to state that it might use the ChainID ‘10001’ after the Merge.
Nevertheless, the group asserted that the ChainID would stay at ‘1’ (the identical as Ethereum Mainnet) till the day of The Merge in response to Coinbase requesting it’s up to date.
“The code you talked about within the above feedback has to maintain as a result of chainID 1 is required to validate chain knowledge for blocks earlier than the merge, and all chain knowledge after the merge will probably be chainID 10001.”
Ought to ETHPoW retain the identical ChainID and nonce as Mainnet, customers might threat dropping funds after they attempt to commerce any ETHPoW tokens they could obtain.
CryptoSlate spoke to Temoc Webber and Igor Mandrigin, CEO and CTO of Gateway.fm respectively concerning the potential for relay assaults by means of the ETHPoW chain. Gateway.fm is a web3 infrastructure firm targeted on constructing decentralized RPC options that don’t depend on centralized providers equivalent to AWS.
Through the dialog, Mandrigin acknowledged that there’s “no purpose” for the ETHPoW group to not replace the code earlier than The Merge. “They might fork it as we speak,” he asserted earlier than suggesting a easy answer:
“You might merely add some code that enables ETHPoW to make use of ChainID till the TTD of The Merge is reached after which mechanically revert to a ChainID of ‘10001.’”
Including a couple of easy traces of code would permit the Ethereum neighborhood to chill out, realizing that ETHPoW will not be making ready to create chaos on Mainnet post-merge. Nevertheless, the alternative seems to be confirmed as a core Ethereum developer, Lefteris Karapetsas, was blocked by EthereumPoW’s Twitter account after stating the problems with not altering the ChainID in good time.
Declaring that ETHPoW are incompetent and can trigger folks to lose funds will get you blocked.
All it’s worthwhile to learn about that chain. Use them at your peril. https://t.co/E1SBpSb5ux pic.twitter.com/CYUZL5Ye1Y
— Lefteris Karapetsas | Hiring for @rotkiapp (@LefterisJP) September 9, 2022
If the ChainID and nonce of ETHPoW should not up to date, then any trades that happen on the ETHPoW chain may very well be replicated on Mainnet. Right here is an instance of how this may very well be exploited.
- A malicious actor units up an empty upgradeable proxy sensible contract on Ethereum Mainnet previous to The Merge.
- After The Merge, the malicious actor upgrades the ETHPoW sensible contract to permit customers to promote their ETHPoW at a premium of $500 per ETHPoW.
- On Ethereum Mainnet, the malicious actor upgrades the sensible contract to ship any ETH it receives to Twister Money.
- The ETHPoW sensible contract is marketed as one of the best DEX to commerce ETHPoW, and customers promote their ETHPoW for USDT for $500 per ETHPoW.
- The commerce additionally goes by means of on the Ethereum Mainnet, provided that the identical ChainID, nonce, and personal keys are an identical. Nevertheless, the Mainnet contract has been up to date to ship the ETH to Twister Money and never return any USDT.
- The consumer now has USDT on ETHPoW and nothing of their Mainnet pockets. On condition that USDT doesn’t assist ETHPoW, the consumer has primarily been rugged of their ETHPoW and ETH.
A phrase of warning for anybody planning to dump any ETHPoW tokens they obtain after The Merge.
Take note of whether or not the ChainID of ETHPoW has been up to date earlier than you transact. The ChainID ought to NOT be ‘1’ however ‘10001.’ If the ChainID is ‘1’, you threat dropping funds out of your Mainnet Ethereum pockets.
