Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request from Coinbase to clarify EthereumPoW fork code availability and activation #17

Closed
wants to merge 1 commit into from

Conversation

roberto-bayardo
Copy link

(Submitting as a PR since this repo has its issue tracker disabled)

On behalf of Coinbase and others preparing for the Ethereum merge, we request the team behind EthereumPoW clarify important but currently underspecified aspects of their fork chain and its activation. At the time of this writing, this EthereumPoW github repo leaves chainid unchanged. While a code comment suggests an intent to change chainid, we are unaware of any concrete communications around how the change will be implemented and ultimately activated. As the team must know, using the same chainid as the PoS Ethereum chain post-merge will allow transactions from one chain to be replayed on the other. These replay attacks place funds at serious risk, and many users will not have the time or expertise to protect themselves.

We have seen allusions from some EthereumPoW communication channels (Discord, Twitter, and Medium) that there is an intent to change the EthereumPoW chainid no later than the merge point. We strongly support this approach as it would prohibit any possibility of transaction replaying. But these same communication channels (and the code in this repo) indicate that no such fork implementation would be available let alone activate prior to it. Unless the intent is an effective EthereumPoW chain halt until the fork implementation is formally released, these statements appear contradictory.

In order to clear up this uncertainty and allow us to take appropriate actions to protect user funds, we request that the EthereumPoW team promptly and authoritatively communicate if and when an EthereumPoW chainid change is to take place, and how the change will be deployed and activated.

@Polandia94
Copy link

I think ETHPOW core lost access to this repo, they don't see to answer any pull request or do any commit in the last 14 days, so isn't probablly a good way of communications

@edocodi
Copy link

edocodi commented Sep 9, 2022

Coinbase team et al, feel free to reach out via twitter/telegram/discord for further communication.

@ethereumpow
Copy link
Owner

On behalf of Coinbase and others preparing for the Ethereum merge, we request the team behind EthereumPoW clarify important but currently underspecified aspects of their fork chain and its activation. At the time of this writing, this EthereumPoW github repo leaves chainid unchanged.

Thanks for your request. The chainid for ethw is 10001, which we will publish on our Twitter account. The code you mentioned in the above comments has to keep because chainID 1 is needed to validate chain data for blocks before the merge, and all chain data after the merge will be chainID 10001. To block any replay attack after the merge happening we have done the following work:

  1. chain ID change to 10001
  2. encore EIP-155, which means all transactions after the merge has to include the new chainID 10001.

The above two steps make ETHW the most safest chain, which means 1) ethpos will not replay to/from ETHW 2) all other forked chains can not replay to/from ETHW.

The final code will be released on the Merge day with the fork height.

@mrtestyboy781
Copy link

mrtestyboy781 commented Sep 9, 2022

Releasing code the day of merge does not give integrators much time to test the client. Any serious organization will need to regression test a lot before releasing to a prod environment

Is there any reason you can't add a function to switch chainID once TTD is hit, so that you can actually release a client that functions through the merge and can be released earlier

@LefterisJP
Copy link

Is there any reason you can't add a function to switch chainID once TTD is hit, so that you can actually release a client that functions through the merge and can be released earlier

That requires a developer intern with a high school understanding of if conditionals. Probably can't find one.

@ligi
Copy link

ligi commented Sep 9, 2022

chain ID change to 10001

be aware - you will never be listed on sites like chainlist.org then. I will refuse any PR to replace a chain with existing chainID to protect users from replay attacks.

The final code will be released on the Merge day with the fork height.

ROFL

@LefterisJP
Copy link

10001

Can you link the entry where this chain ID is used?

@tmoore22
Copy link

tmoore22 commented Sep 9, 2022

10001

Can you link the entry where this chain ID is used?

https://github.com/ethereum-lists/chains/blob/master/_data/chains/eip155-10001.json

I suggested chainID 12001 as this is not taken (and is sane):
https://github.com/ethereum-lists/chains/blob/master/_data/chains/eip155-12001.json

@ghost
Copy link

ghost commented Sep 10, 2022

@roberto-bayardo @ethereumpow @LefterisJP @ligi We now have a working solution to prevent replay attacks #20

be aware - you will never be listed on sites like chainlist.org then. I will refuse any PR to replace a chain with existing chainID to protect users from replay attacks.

I believe the community could make the changes for chainId before the merge. I think 999999 has not been used.

@gorgarp
Copy link

gorgarp commented Sep 10, 2022

Coinbase, I have a serious question @roberto-bayardo.

This project has a linktree as a main site. Their "geth" links to a Canadian shipping company. They obviously have no idea what in the hell they are doing.

My question to you.

WHY ARE YOU HERE AND TRYING TO EVEN LOOK AT THIS??!?!?!?!

@wschwab
Copy link

wschwab commented Sep 12, 2022

WHY ARE YOU HERE AND TRYING TO EVEN LOOK AT THIS??!?!?!?!

so that a number of innocent users of a less technical nature do not get cataclysmically and unceremoniously rekt by replay attacks (probably with a dash of social engineering) the second the merge happens, most likely

@KenTheWhaleGoddess
Copy link

wen update

@Lucienest
Copy link

ETHPOW is doomed!!

@edsonayllon
Copy link

The merge already happened. Last commit was 20 days ago

@KenTheWhaleGoddess
Copy link

Today ETH PoW team announced on Twitter that they are proceeding with Chain ID 10001, as pointed out previously this is used by a BTC Cash testnet which will definitely produce unexpected node behaviors, it also just seems like a stupid thing to miss, can @ethereumpow team go with 12001 or 13001 as discussed?

https://twitter.com/EthereumPoW/status/1570413723969552385

@Lucienest
Copy link

Today ETH PoW team announced on Twitter that they are proceeding with Chain ID 10001, as pointed out previously this is used by a BTC Cash testnet which will definitely produce unexpected node behaviors, it also just seems like a stupid thing to miss, can @ethereumpow team go with 12001 or 13001 as discussed?

https://twitter.com/EthereumPoW/status/1570413723969552385

proves their incompetency, re-using the same chainId of another blockchain is a violation of the harmonious relationship between blockchains.

@roberto-bayardo roberto-bayardo closed this by deleting the head repository Oct 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet