Update: REP migration is complete!
If you are a REP holder, there is nothing you need to do!
New REP contract : 0xE94327D07Fc17907b4DB788E5aDf2ed424adDff6
UPDATE: All EtherDelta and Oasis users have been refunded / paid back. Please let us know if you have any questions or problems.
Augur’s smart contracts are currently written in Serpent, a low-level programming language that pre-dates the widely-used, higher-level Solidity language. This past May, we hired Zeppelin Solutions to perform a formal security audit of the Serpent compiler. After two months of review, Zeppelin has published their audit results. [1]
The most hair-raising finding in Zeppelin’s audit report is a previously-unknown buffer overflow vulnerability in the Serpent compiler. This, combined with Serpent’s un-enforced types and a bug in Serpent’s computation of memory addresses, caused a non-loss-of-funds vulnerability in the REP token contract. The vulnerability allows someone to increase the token creation timestamp, indefinitely disabling transfers of the token. For a technical breakdown of the vulnerability, please read Zeppelin’s analysis.
Over the past two weeks, Augur and Zeppelin have been working around-the-clock on a strategy to migrate REP to a new, secure contract. The new REP contract is written in Solidity, and is derived from OpenZeppelin’s ERC20 token contracts, which have undergone extensive security audits. Today, at 10:01 AM PST, the Augur team intentionally triggered the vulnerability, increasing the creation timestamp by about 31 billion years. The old Serpent REP contract is now frozen: REP transfers can no longer be carried out using the old contract.
Right now, we are copying all REP balances to the new Solidity REP contract. If you are a REP holder, there is nothing you need to do! As soon as the REP migration is complete, your REP balance will be exactly as it was before the migration. The REP migration should only take a couple hours, if all goes well.
Serpent REP Token Link // Solidity REP Token Link
We notified exchanges, wallets, and block explorers on 2017 July 27 at 10:00am PST. The Augur and Zeppelin teams are currently working with them to update their software to use the new REP contract.
Confirmed: Poloniex, Kraken, Bittrex, Liqui, Bity, Gatecoin, BTER, Mr.Ripple, GateHub, HitBTC, BX.in.th, ShapeShift, Changelly, EtherScan, Exodus, Jaxx, Parity, MyEtherWallet, MetaMask, OASIS, EtherDelta and CryptoDerivatives.
Non-Confirmed: EtherCamp, Yunbi, Cryptopia, and BX Thailand.
Our technical team takes Augur’s security extremely seriously. This is why we paid to have the Serpent compiler audited, and why we are deeply concerned by the audit’s results. Whether or not to migrate Augur’s smart contracts to Solidity has been a topic of ongoing debate within our team for over a year now. However, after reading the Serpent audit report, our back-end team is now in unanimous agreement: we have to migrate to Solidity.
We estimate that migrating all of our smart contracts (about 4,400 lines of code total) to Solidity will take about 6 weeks. The migration will be a simple translation from one language to another. This is a straightforward process, similar to translating a document written in English into another language you’re fluent in, then running your translated text through a series of tests to ensure nothing was lost in translation.
Our team is focused on the REP migration today. Please join our Slack if you have any questions about either the new REP contract or the Solidity migration. We will post a follow-up as soon as the REP migration is
completed!
FOOTNOTES:
[1] We shared a draft of the compiler report with Vitalik, which prompted his tweet about Serpent: “PSA: I now consider Serpent outdated tech; not nearly enough safety protections by current standards.” https://twitter.com/VitalikButerin/status/886400133667201024
