ChainCatcher news, Galaxy's Vice President of Research Christine Kim published a summary of the 165th Ethereum Core Developers Execution Call. First, EIP-6466 and 6406 are code changes that update the data encoding in the two block header fields "transactions_root" and "receipts_root" from RLP to SSZ. The blockchain security and auditing firm Dedaub's impact analysis of EIP-6466 and 6406 aims to determine how these code changes affect smart contracts that are already deployed and actively used on Ethereum. The analysis found that the SSZ update will impact three major projects: LayerZero, zkBridge (cross-chain bridge), and Telepathy (oracle).Despite the impact on these applications, Dedaub director Neville Grech stated that all three can be upgraded to accommodate the code changes implemented through EIP 6466 and 6406. Danny Ryan noted that there is no need to make decisions regarding the transition from RLP to SSZ implementation or timing during this call, and the information shared by the Dedaub team should be considered in future discussions.Regarding the Cancun/Deneb test, Ethereum Foundation DevOps engineer Parithosh Jayanthi stated that the upgrade was initiated on June 30, the test network is progressing smoothly, and some issues in client implementations have been discovered. Once the client issues are resolved, attempts will be made to send Blob transactions to the network over a longer period to understand how the network handles the load of 3 target blobs/block. Jayanthi emphasized that among these issues, one affects staked ETH deposits, and the Teku and Prysm consensus layer client teams should investigate further. Representatives from the Geth and Nethermind execution layer teams also shared the issues they are actively patching in preparation for the next phase of testing for Devnet #7.Regarding the Builder Override Flag, Teku (CL) developer Mikhail Kalinin asked the EL client teams if they would be willing to accept changes to the engine API in the Cancun upgrade. This change aims to create a boolean flag in the "get_payload" API command, which will return true if the EL client of an Ethereum validator node detects censorship behavior.Additionally, EIP-4788 introduces a new precompile, which is a cost-effective smart contract operation that will expose information about the CL on the EL to prevent excessive use of storage space through code changes. This feature will unlock many use cases for decentralized applications, such as staking pools and re-staking protocols, which will benefit from minimized trust access to CL state. Ethereum Foundation researcher Alex Stokes stated that this modification will be incorporated into the final EIP-4788 specification for implementation as soon as possible in Cancun. (source link)

ChainCatcher news, the smart contract security and auditing company Dedaub stated that the fundamental reason for the attack on the cross-chain interoperability protocol Poly Network is not a logical error in the smart contract, but most likely that three-quarters of the Poly Network administrators' private keys were stolen or misused.

ChainCatcher news, the security company Dedaub team discovered a vulnerability in the Ethereum programming language Solidity compiler, which causes dead code to be included in the bytecode of deployed contracts, significantly increasing the gas cost when deploying and operating smart contracts. Dedaub stated that the team found this error while evaluating the open-source binary decompiler Gigahorse. The vulnerability occurs when library methods are only called by the contract's constructor.Through the analysis with Gigahorse, Dedaub found that at least 35% of contracts contain some dead code, with 33% occupying most of their running bytecode. These results are predominantly seen in NFT proxies, but other proxy contracts also have the same issue. For large contracts, this problem can be overlooked, but most deployed contracts are small contracts. The Dedaub team had already discovered this error last November and alerted the Solidity team to confirm the issue. (source link)

ChainCatcher news, the security company Dedaub team announced that they received a security vulnerability report bounty from Uniswap Labs for disclosing a serious vulnerability in Uniswap that has the potential for reentrancy, which could deplete users' funds. However, the funds are safe, and the Uniswap team has resolved the vulnerability and redeployed the Universal Router smart contract across all chains.Uniswap released the Universal Router smart contract in November 2022, which consolidates ERC20 and NFT exchanges into a single swap router, allowing users to perform heterogeneous operations, such as swapping multiple tokens and NFTs in a single transaction.Dedaub stated that this router embeds a scripting language for various token operations, and such commands may include transfers to third parties (which may be untrusted) as recipients. If third-party code is called at any point during the transfer process, that code can re-enter the UniversalRouter and temporarily claim any tokens in the contract. Dedaub suggested that Uniswap add a reentrancy lock to the core execution of the new router and redeploy it.