TL;DR
- Ethereum Pectra upgrade on Sepolia suffered an exploit that allowed the mining of empty blocks due to an error in the deposit contract.
- An attacker exploited a vulnerability in the system to perform a zero-token transfer, causing continuous mining errors.
- The issue was limited to the Sepolia testnet and did not result in major losses or affect finalization, allowing developers to quickly implement a fix.
Ethereum’s Pectra upgrade encountered unexpected problems during its implementation on the Sepolia testnet, which led to an exploit that allowed the mining of empty blocks.
The upgrade, launched on March 5, encountered a setback on March 8 when developers began detecting errors in their nodes. The problem stemmed from the deposit contract, which generated a transfer event instead of a deposit event, leading to incorrect processing.
Shortly after identifying the issue, developers issued a fix. However, an attacker exploited a loophole in the system to generate the same error by making a zero-token transfer to the deposit contract. This caused the continuous mining of empty blocks, prompting developers to investigate the incident. Initially, they suspected the error came from a trusted validator, but soon discovered that the transaction originated from a new account funded by a faucet.
Ethereum Did Not Suffer Major Consequences Despite the Exploit
The exploit occurred because the ERC-20 standard does not prevent zero-token transfers, which allowed anyone—even those without tokens—to interact with the deposit contract. After identifying this vulnerability, developers implemented a fix on selected nodes to filter out problematic transactions. Since they suspected the attacker might be monitoring their communications, the fix was implemented privately without public disclosure, and was deployed on the nodes by 2 p.m., restoring normal block production.
The impact of this issue was limited. There were no finalization losses, and the incident only affected the Sepolia testnet, as it used a token-specific deposit contract, different from the one used on the mainnet.
Despite this setback, the Pectra upgrade is not the first to face difficulties. ETH faced a similar problem during its implementation on the Holesky network in February, which led developers to decide to postpone the upgrade to conduct further testing before its final release
