A metamorphic smart contract is a form of smart contract that stands out for its ability to transform and evolve over time. Let’s explore this notion in more detail, focusing on the example of the Ethereum blockchain. How do they work? What are the associated risks and how can you protect yourself against them?
What is a metamorphic smart contract?
Smart contracts have become an essential brick of the possibilities of interaction with the blockchainproviding a secure and decentralized way to automate contract execution. I‘immutability is one of the main characteristics of smart contractsmeaning their code cannot be tampered with once deployed.
The immutability of smart contracts has several advantages. First of all, it guarantees the code transparency and integrity. Since the code is visible to all blockchain users, any attempt to modify it would be immediately detected, thus preventing malicious tampering.
Next, immutability ensures that the terms of the contract remain fixed, which requires the consent of all parties to make changes.
Finally, immutability can contribute in a sense to preventing errors and bugs. Before a smart contract is deployed, it is carefully tested and audited to ensure that it works properly. If errors are discovered, a new version of the contract may be deployed with the corrections, but the original version of the contract remains unchanged.
However, this immutability has some disadvantages in terms of updating. For example, when vulnerabilities are discovered in a smart contract, it is difficult to react quickly to fix them. Likewise, projects wishing to add new functionality may encounter obstacles due to this immutability.
This debate sparks differing opinions, with some arguing that the immutability of smart contracts is an advantage, while others see its lack of scalability as a disadvantage.
👉 If you are not yet familiar with the concept of smart contract
Trade on the leading DEX
⛓️ A platform at the heart of DeFi
Since the introduction of EIP-1014the rules of the game have changed with the appearance of a new opcode (primitive allowing to program specific operations) called CREATE2. It offers developers greater control over the deployment of their smart contracts compared to the opcode CREATE of origin.
CREATE is used when deploying a new smart contract. It is notably one of the most expensive on the Ethereum Virtual Machine (EVM). Indeed, the CREATE opcode often causes problems for developers, because it is difficult for them to predict the destination address of a smart contract when it is deployed.
On the other hand, with CREATE2, developers can anticipate and control the specific address of a smart contract before deploying it on the blockchain. This ability to know the address in advance, combined with hints, allows developers to create metamorphic smart contracts.
Previously, the deployment of a smart contract was generally considered in three states: “not deployed”, “deployed” or “destroyed”. However, with the introduction of this update, a fourth state, “redeployed”, is now possible.
To deploy a metamorphic smart contract on the Ethereum blockchain, it is necessary to follow a specific architecture. This involves setting up 2 other smart contracts in addition to the main smart contract. These 2 smart contracts are responsible for deploying and storing the code for the metamorphic smart contract.
Anatomy of a metamorphic smart contract
Even if the use of metamorphic smart contracts makes it possible, for example, to correct bugs or flaws, this novelty opens the door to malicious uses. Malicious individuals could, for example, exploit this technique with a cryptocurrency staking smart contract to defraud users of the protocol.
Unfortunately, according to some experts, the majority of Ethereum users are unaware of this change. By ignoring this possibility, you could be at unanticipated risks. It is therefore essential to become familiar with the concepts and mechanisms of metamorphic smart contracts to better guard against possible manipulation.
Our service dedicated to cryptocurrency investors. Get real-time analytics and optimize your crypto portfolio.
Metamorphic smart contracts can be used legitimately to deploy updates to fix bugsbut they can also be exploited in scam attempts to steal your cryptocurrencies.
Before the Ethereum blockchain EIP-1014 update, the potential risk was mainly related to the destruction of the smart contract before your transaction is validated by the network.
After the update, the potential risk is misappropriation of all assets for which you have approved the smart contract. A malicious developer can destroy a smart contract and replace it with another that hijacks all your cryptocurrencies.
A recent example of an attack via this method concerns the Tornado Cash protocol, where the attacker managed to obtain 1.2 million votes from the multimillion-dollar Tornado Cash governance system using a malicious governance proposal smart contract. He managed to modify the smart contract code using metamorphic smart contracts and the Self Destruct statement.
👉 Learn more about the Tornado Cash hack
Fortunately, there are now tools to analyze different parameters of a smart contract to determine if it can be malicious or not, like the one created by Michael Blau, who works for the famous venture capital firm a16z. However, as its creator points out:
“It is important to note that this tool is not infallible. It will not be able to detect all problematic situations and there are cases where false positives can occur. Despite this, the tool provides valuable insights. It can arouse suspicion and be reason enough to take a closer look at a smart contract before committing to it”.
This tool analyzes six indicators of metamorphism in a smart contract:
- Was it deployed with metamorphic code?
- Can it call the Self-Destruct statement?
- Does it contain the DELEGATECALLs function?
- Was it deployed by another smart contract?
- Does the contract deployer contain CREATE2?
- Has the code changed?
👉 Are you interested in this prevention tool?
Graphic source: a16z Crypto
Receive a summary of crypto news every Monday by email 👌
What you need to know about affiliate links. This page presents assets, products or services relating to investments. Some links in this article are affiliated. This means that if you buy a product or register on a site from this article, our partner pays us a commission. This allows us to continue to offer you original and useful content. There is no impact on you and you can even get a bonus by using our links.
Investments in cryptocurrencies are risky. Cryptoast is not responsible for the quality of the products or services presented on this page and could not be held responsible, directly or indirectly, for any damage or loss caused following the use of a good or service highlighted in this article. Investments related to crypto-assets are risky by nature, readers should do their own research before taking any action and only invest within the limits of their financial capabilities. This article does not constitute investment advice.
AMF recommendations. There is no guaranteed high return, a product with high return potential involves high risk. This risk-taking must be in line with your project, your investment horizon and your ability to lose part of this savings. Do not invest if you are not ready to lose all or part of your capital.
To go further, read our Financial Situation, Media Transparency and Legal Notices pages.