Ethereum has emerged as one of the leading blockchain networks globally, with a significant number of developers working on its platform. However, recent reports indicate that the Ethereum network is highly vulnerable to security exploits, leading to substantial financial losses for crypto investors. According to the “Global Web3 Security Report” by blockchain security firm Beosin, rug pulls alone accounted for a staggering $282.96 million in losses during the third quarter of this year. Additionally, phishing schemes resulted in $66.15 million in losses during the same period.
Chaals Neville, technical program director at the Enterprise Ethereum Alliance (EEA), acknowledges the presence of inherent problems within Ethereum that significantly impact its security. Neville points out that the Solidity compiler, responsible for deploying smart contracts, has known bugs that create vulnerabilities. Although the compiler is continually evolving and old bugs are being fixed, new ones also arise, posing a constant challenge.
The EthTrust Security Levels Framework
To tackle these security challenges, the EEA established the “EthTrust Security Levels Working Group” in November 2020. The group released the “EthTrust Security Levels Specification v1” in August 2022, serving as a framework for developers, organizations, and customers working with Solidity, Ethereum’s main programming language. However, as Ethereum continues to advance, Neville emphasizes the need for ongoing updates to address evolving security threats.
Recognizing this necessity, the EEA has now released Version 2.0 of the EthTrust Security Levels Specification. This updated version addresses newly discovered bugs in the Solidity compiler, offers more robust treatment of rounding errors, and provides better defense against read-only reentrancy attacks, among other improvements.
These updates are critical since the Ethereum ecosystem has experienced security exploits in the past due to these specific issues. The notorious “The DAO” hack in 2016, which resulted in a loss of $3.64 million in ETH, was a classic case of reentrancy. Michael Lewellen, head of solutions architecture at OpenZeppelin, a security firm specializing in securing smart contracts, highlights the importance of leveraging the EthTrust Security Levels framework to prevent such vulnerabilities from arising.
“We use this framework as a pre-audit assessment for many of our clients. This allows clients to know that we are checking for certain instances during the audit process.”
Michael Lewellen, Head of Solutions Architecture at OpenZeppelin
While the EthTrust standard has received positive feedback, Neville acknowledges the challenge of raising awareness among developers and organizations about the existence of such an open industry standard. He also notes that the framework is particularly beneficial for newer Ethereum projects.
The Future of EthTrust and Industry Standards
Looking ahead, the development of version 3 of the EthTrust specification is already underway, ensuring that the framework remains up-to-date and effective in combating emerging security threats. However, some experts express concerns about the ever-changing nature of industry standards. John Wingate, founder and CEO of BankSocial, suggests that repeatable, automated testing is crucial to ensure that decentralized applications adhere to best practices and mitigate security risks.
“Standards are always changing; languages are always depreciating methods, variables, data types, and object types.”
John Wingate, Founder and CEO of BankSocial
Nevertheless, the continuous improvements in the EthTrust security framework, coupled with robust testing methodologies, have the potential to enhance the overall security of the Ethereum network and protect the interests of investors and developers alike.
