Problem: currently used go-ethereum contains a known vulnerability #143

yihuang · 2021-10-06T03:03:17Z

Solution:

update to ethermint's recent main branch
add feemarket module, have to do this together.

👮🏻👮🏻👮🏻 !!!! REFERENCE THE PROBLEM YOUR ARE SOLVING IN THE PR TITLE AND DESCRIBE YOUR SOLUTION HERE !!!! DO NOT FORGET !!!! 👮🏻👮🏻👮🏻

PR Checklist:

Thank you for your code, it's appreciated! :)

tomtau

probably the more precise problem is: "Problem: currently used go-ethereum contains a known vulnerability" :)

I guess also a changelog entry can be added?

If the current testnet is to be upgraded via a state export -- I guess it'd also need genesis migrations to add the new module (or are there any other breaking changes?)?

tomtau · 2021-10-06T03:05:24Z

go.mod

@@ -40,6 +40,3 @@ replace github.com/cosmos/ibc-go => github.com/crypto-org-chain/ibc-go v1.0.1-ho
 replace github.com/peggyjv/gravity-bridge/module => github.com/crypto-org-chain/gravity-bridge/module v0.1.22-0.20211004080324-36ed315b3281

 replace github.com/cosmos/iavl => github.com/cosmos/iavl v0.17.1


is this IAVL line necessary? it should be by default in 0.44.1?

https://github.com/tendermint/tendermint/blob/v0.34.13/go.mod#L16

it seems still needed, tendermint still depends on the old iavl

submitted tendermint/tendermint#7089, I think it can be backported to v0.34.x.

thomas-nguy · 2021-10-06T03:19:41Z

Let's wait until we have a more stable version of ethermint before upgrading and adding a Changelog entry? (unless we are planning release soon)

It seems the bump to 1.10.9 is still work in progress and might take few more days to complete
evmos/ethermint#624

yihuang · 2021-10-06T03:47:42Z

Currently there's a panic here: https://github.com/tharsis/ethermint/blob/main/rpc/ethereum/backend/utils.go#L53, because the head.BaseFee is nil.

codecov · 2021-10-11T06:58:10Z

Codecov Report

Merging #143 (30ed5dc) into main (3ea70c5) will increase coverage by 4.82%.
The diff coverage is 48.17%.

@@            Coverage Diff             @@
##             main     #143      +/-   ##
==========================================
+ Coverage   21.51%   26.33%   +4.82%     
==========================================
  Files          27       33       +6     
  Lines        1729     2407     +678     
==========================================
+ Hits          372      634     +262     
- Misses       1324     1729     +405     
- Partials       33       44      +11

Impacted Files	Coverage Δ
app/prefix.go	`0.00% <0.00%> (ø)`
app/test_helpers.go	`0.00% <0.00%> (ø)`
x/cronos/keeper/gravity_hooks.go	`0.00% <0.00%> (ø)`
x/cronos/keeper/grpc_query.go	`0.00% <0.00%> (ø)`
x/cronos/keeper/msg_server.go	`5.00% <0.00%> (-1.46%)`	⬇️
x/cronos/module.go	`59.64% <0.00%> (-2.17%)`	⬇️
x/cronos/types/codec.go	`0.00% <0.00%> (ø)`
x/cronos/types/events.go	`0.00% <ø> (ø)`
x/cronos/types/messages.go	`20.22% <ø> (+20.22%)`	⬆️
x/cronos/types/params.go	`57.35% <ø> (+3.78%)`	⬆️
... and 19 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7ff1cb9...30ed5dc. Read the comment docs.

Closes: crypto-org-chain#142 crypto-org-chain#102 Solution: - update to ethermint's recent main branch - add feemarket module changelog

go.mod

thomas-nguy · 2021-10-12T03:32:02Z

CHANGELOG.md

@@ -9,6 +9,8 @@

 ### Improvements
 - [cronos#162](https://github.com/crypto-org-chain/cronos/pull/162) bump ibc-go to v1.2.1 with hooks support
+- [cronos#143](https://github.com/crypto-org-chain/cronos/pull/143) update go-ethereum to 1.10.9 and add fee market


maybe specify upgrade ethermint

scripts/cronos-devnet.yaml

tomtau · 2021-10-12T03:44:42Z

CHANGELOG.md

@@ -9,6 +9,8 @@



not sure if changelog should also comment on breaking changes?

copied some ethermint changelog.

thomas-nguy

on hold

yihuang · 2021-11-03T06:54:46Z

ethermint has upgraded, we just need to update to ethermint main branch later.

yihuang requested a review from a team as a code owner October 6, 2021 03:03

yihuang requested review from JayT106 and devashishdxt and removed request for a team October 6, 2021 03:03

yihuang mentioned this pull request Oct 6, 2021

Bump github.com/ethereum/go-ethereum from 1.10.3 to 1.10.8 #51

Closed

yihuang requested a review from thomas-nguy October 6, 2021 03:06

tomtau suggested changes Oct 6, 2021

View reviewed changes

yihuang changed the title ~~Problem: recent version of go-ethereum is not used~~ Problem: currently used go-ethereum contains a known vulnerability Oct 6, 2021

yihuang marked this pull request as draft October 6, 2021 03:47

JayT106 mentioned this pull request Oct 8, 2021

backport #6550 to v0.34.x tendermint/tendermint#7089

Closed

4 tasks

yihuang force-pushed the go-ethereum branch from e0648d9 to 3fb3c45 Compare October 11, 2021 06:54

yihuang added 3 commits October 11, 2021 19:42

Problem: recent version of go-ethereum is not used

09edb13

Closes: crypto-org-chain#142 crypto-org-chain#102 Solution: - update to ethermint's recent main branch - add feemarket module changelog

try again

90f64d4

disable london hardfork

a33391e

yihuang force-pushed the go-ethereum branch from 3fb3c45 to a33391e Compare October 11, 2021 12:05

yihuang added 2 commits October 11, 2021 21:13

increase gas price

f7a5edb

fix nil pointer panic

399fea6

yihuang commented Oct 12, 2021

View reviewed changes

go.mod Show resolved Hide resolved

yihuang marked this pull request as ready for review October 12, 2021 03:27

yihuang requested a review from tomtau October 12, 2021 03:27

Update go.mod

c1dd9f4

thomas-nguy approved these changes Oct 12, 2021

View reviewed changes

thomas-nguy reviewed Oct 12, 2021

View reviewed changes

scripts/cronos-devnet.yaml Show resolved Hide resolved

tomtau reviewed Oct 12, 2021

View reviewed changes

changelog

30ed5dc

yihuang enabled auto-merge (squash) October 12, 2021 05:19

yihuang disabled auto-merge October 12, 2021 09:34

thomas-nguy requested changes Oct 12, 2021

View reviewed changes

yihuang marked this pull request as draft October 13, 2021 08:18

yihuang closed this Nov 3, 2021

yihuang deleted the go-ethereum branch November 3, 2021 06:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Problem: currently used go-ethereum contains a known vulnerability #143

Problem: currently used go-ethereum contains a known vulnerability #143

yihuang commented Oct 6, 2021 •

edited

Loading

tomtau left a comment •

edited

Loading

tomtau Oct 6, 2021

yihuang Oct 6, 2021 •

edited

Loading

JayT106 Oct 8, 2021

thomas-nguy commented Oct 6, 2021 •

edited

Loading

yihuang commented Oct 6, 2021

codecov bot commented Oct 11, 2021 •

edited

Loading

thomas-nguy Oct 12, 2021

yihuang Oct 12, 2021

tomtau Oct 12, 2021

yihuang Oct 12, 2021

thomas-nguy left a comment

yihuang commented Nov 3, 2021

		@@ -40,6 +40,3 @@ replace github.com/cosmos/ibc-go => github.com/crypto-org-chain/ibc-go v1.0.1-ho
		replace github.com/peggyjv/gravity-bridge/module => github.com/crypto-org-chain/gravity-bridge/module v0.1.22-0.20211004080324-36ed315b3281

		replace github.com/cosmos/iavl => github.com/cosmos/iavl v0.17.1

Problem: currently used go-ethereum contains a known vulnerability #143

Problem: currently used go-ethereum contains a known vulnerability #143

Conversation

yihuang commented Oct 6, 2021 • edited Loading

PR Checklist:

tomtau left a comment • edited Loading

Choose a reason for hiding this comment

tomtau Oct 6, 2021

Choose a reason for hiding this comment

yihuang Oct 6, 2021 • edited Loading

Choose a reason for hiding this comment

JayT106 Oct 8, 2021

Choose a reason for hiding this comment

thomas-nguy commented Oct 6, 2021 • edited Loading

yihuang commented Oct 6, 2021

codecov bot commented Oct 11, 2021 • edited Loading

Codecov Report

thomas-nguy Oct 12, 2021

Choose a reason for hiding this comment

yihuang Oct 12, 2021

Choose a reason for hiding this comment

tomtau Oct 12, 2021

Choose a reason for hiding this comment

yihuang Oct 12, 2021

Choose a reason for hiding this comment

thomas-nguy left a comment

Choose a reason for hiding this comment

yihuang commented Nov 3, 2021

yihuang commented Oct 6, 2021 •

edited

Loading

tomtau left a comment •

edited

Loading

yihuang Oct 6, 2021 •

edited

Loading

thomas-nguy commented Oct 6, 2021 •

edited

Loading

codecov bot commented Oct 11, 2021 •

edited

Loading