Share this article
Amberdata Discovers 'RPC Call' Bug in Parity Ethereum Client
A new code release of the Parity ethereum client was released on Thursday to patch a security vulnerability found by blockchain startup Amberdata.
Updated Sep 13, 2021, 11:23 a.m. Published Aug 29, 2019, 10:30 p.m.
Make us preferred on Google
A code vulnerability that could have forced computer shutdowns was found on Tuesday in the second most popular ethereum client.
Parity connects over 3,000 computer servers around the globe to the ethereum blockchain network.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
On Thursday, Parity Technologies, the startup responsible for building and maintaining the ethereum client, released updated code to fix the bug.
Only a small subset of Parity servers were vulnerable to crashing, according to Scott Bigelow, the VP of engineering at blockchain analytics startup Amberdata. Amberdata first discovered the vulnerability and disclosed it to the Parity Technologies team.
“There was a vulnerability that [if exploited] would cause an immediate crash of the Parity client for all its services,” said Bigelow. “There is no possibility to steal funds or do other malicious things but you could shut down some portion of ethereum nodes.”
In a blog post published Thursday, Parity Technologies wrote:
“Please update your nodes to the newest version ASAP, especially if you’re running a node that has enabled tracing or a node that has enabled publicly-facing RPC."
What's RPC?
A remote procedure call, or RPC, is a protocol for requesting data and information from a program running on a third-party computer server. It is used on blockchains to request information about on-chain activities such as account balances, block numbers and other data.
It can be used privately by a user or opened for the broader public to access. Infura, one of the most popular applications on ethereum today, leverages public RPC ports to make data about the blockchain network accessible to users who don’t themselves run ethereum clients.
For the vulnerability found by the Amberdata team to be exploited, the ethereum node running Parity software must have enabled a public RPC port and activated a special module to enable the tracing of transaction history, according to Bigelow.
“It’s really this venn diagram,” said Bigelow. “You need to find people who are running Parity nodes, who have a Parity [RPC] port exposed and who also have the tracing module enabled on their system. If you have those three things, you can say that server is gone.”
Parity was susceptible to a similar attack vector back in February. That vulnerability impacted the software's entire user base, not just a specific subset.
Low likelihood of attack
At the same time, this tracing module on Parity is a highly detailed and developer-oriented module that Bigelow suspects only a small fraction of Parity users to have actually enabled.
What’s more, while RPC calls do exist on other ethereum clients, such as Geth, it is highly unlikely for the same kind of vulnerability to exploited on other software – due to how RPC implementations differ across ethereum software clients.
“The RPC interfaces of ethereum clients are not standardized and each client has addition calls for their specific features,” said a Parity Technologies spokesperson. “So it's unlikely they have a similar bug for their analogous call.”
Whatever the probability for attack, Parity Technologies encourages all its users to upgrade immediately, saying in their blog post:
"By default, Parity Ethereum does not enable tracing or public-facing RPC, so the majority of nodes should be not be affected. Regardless, we recommend everyone running Parity Ethereum nodes to update to this latest version."
Parity Technologies founder Gavin Wood image via CoinDesk archives
More For You
KuCoin captured a record share of centralised exchange volume in 2025, with more than $1.25tn traded as its volumes grew faster than the wider crypto market.
What to know:
- KuCoin recorded over $1.25 trillion in total trading volume in 2025, equivalent to an average of roughly $114 billion per month, marking its strongest year on record.
- This performance translated into an all-time high share of centralised exchange volume, as KuCoin’s activity expanded faster than aggregate CEX volumes, which slowed during periods of lower market volatility.
- Spot and derivatives volumes were evenly split, each exceeding $500 billion for the year, signalling broad-based usage rather than reliance on a single product line.
- Altcoins accounted for the majority of trading activity, reinforcing KuCoin’s role as a primary liquidity venue beyond BTC and ETH at a time when majors saw more muted turnover.
- Even as overall crypto volumes softened mid-year, KuCoin maintained elevated baseline activity, indicating structurally higher user engagement rather than short-lived volume spikes.
More For You
Key bitcoin price levels to watch as downward pressure builds
As bitcoin remains in a downtrend, several technical and onchain levels stand out as critical areas of support.
What to know:
- The 100-week moving average at $87,145 remains the main line of defense.
- Below this, the cost basis of U.S. spot bitcoin ETF buyers at $84,099 has provided support during recent consolidation.
- A sustained break below $80,000 would likely open the door to a revisit of the April 2025 low near $76,000.
Top Stories
